From 8534a735a9483afc2218dedaa96b8052f411e910 Mon Sep 17 00:00:00 2001 From: maxice8 Date: Tue, 2 Oct 2018 15:52:07 -0300 Subject: [PATCH] libusbmuxd: fix CVE-2016-5104 --- .../libusbmuxd/patches/CVE-2016-5104.patch | 32 +++++++++++++++++++ srcpkgs/libusbmuxd/template | 3 +- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/libusbmuxd/patches/CVE-2016-5104.patch diff --git a/srcpkgs/libusbmuxd/patches/CVE-2016-5104.patch b/srcpkgs/libusbmuxd/patches/CVE-2016-5104.patch new file mode 100644 index 00000000000..c5c672374d5 --- /dev/null +++ b/srcpkgs/libusbmuxd/patches/CVE-2016-5104.patch @@ -0,0 +1,32 @@ +From 4397b3376dc4e4cb1c991d0aed61ce6482614196 Mon Sep 17 00:00:00 2001 +From: Joshua Hill +Date: Tue, 29 Dec 2015 23:09:37 +0100 +Subject: [PATCH] common: [security fix] Make sure sockets only listen locally + +--- + common/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/common/socket.c b/common/socket.c +index 27b93ba..4cdefd6 100644 +--- a/common/socket.c ++++ b/common/socket.c +@@ -203,7 +203,7 @@ int socket_create(uint16_t port) + + memset((void *) &saddr, 0, sizeof(saddr)); + saddr.sin_family = AF_INET; +- saddr.sin_addr.s_addr = htonl(INADDR_ANY); ++ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); + saddr.sin_port = htons(port); + + if (0 > bind(sfd, (struct sockaddr *) &saddr, sizeof(saddr))) { +@@ -368,7 +368,7 @@ int socket_accept(int fd, uint16_t port) + + memset(&addr, 0, sizeof(addr)); + addr.sin_family = AF_INET; +- addr.sin_addr.s_addr = htonl(INADDR_ANY); ++ addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); + addr.sin_port = htons(port); + + addr_len = sizeof(addr); + diff --git a/srcpkgs/libusbmuxd/template b/srcpkgs/libusbmuxd/template index 913c3b49d1f..637288d4b06 100644 --- a/srcpkgs/libusbmuxd/template +++ b/srcpkgs/libusbmuxd/template @@ -1,7 +1,8 @@ # Template file for 'libusbmuxd' pkgname=libusbmuxd version=1.0.10 -revision=1 +revision=2 +patch_args="-Np1" build_style=gnu-configure hostmakedepends="pkg-config" makedepends="libusb-devel libplist-devel"