On 24 December 2015 at 02:59, Zhixiong Chi <zhixiong....@windriver.com> wrote:
> +++ b/meta/recipes-core/expat/expat-2.1.0/expat-CVE-2015-1283.patch > @@ -0,0 +1,58 @@ > +Multiple integer overflows in the XML_GetBuffer function in Expat > +through 2.1.0, allow remote attackers to cause a denial of service > +(heap-based buffer overflow) or possibly have unspecified other > +impact via crafted XML data. > + > +CVSSv2: (AV:N/AC:M/Au:N/C:P/I:P/A:P) > + > +Upstream-Status: Backport > + > +Index: expat-2.1.0/lib/xmlparse.c > No signed-off-by in the patch. Also can we experiment with a CVE tag in the patch alongside the upstream-status and s-o-b? "CVE: CVE-2015-1283". Thanks, Ross
-- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core
