Updates to avoid CVE-2021-34552, CVE-2021-25287, CVE-2021-25288, CVE-2020-10994 #1

jeremywestwood · 2021-07-28T09:36:03Z

Fixes # .

Changes proposed in this pull request:

Port of Use snprintf instead of sprintf python-pillow/Pillow#5567 to fix CVE-2021-34552
Set the --disable-jpeg2000 flag to avoid CVE-2021-25287, CVE-2021-25288, CVE-2020-10994
Fix up some routes for downloading dependencies
Turn off building of versions that we don't require.

(cherry picked from commit 5f4504b)

(cherry picked from commit 518ee37)

…l rather than sourceforge which seems to give some problems.

…it breaks

…e can be removed in future.

davidfraser

This all looks good - just the one change in the README

j5_build_instructions.txt

radarhere and others added 9 commits July 27, 2021 14:31

Limit sprintf modes to 10 characters

194c5dd

(cherry picked from commit 5f4504b)

Use snprintf instead of sprintf

59d1876

(cherry picked from commit 518ee37)

added brackets lost in the merge conflict

9bc68a1

add +j5 to the version

ef80420

update some of the package routes to fetch from the pillow depends ur…

27a9785

…l rather than sourceforge which seems to give some problems.

comment out the python versions we don't need to try and build

dde12fb

add the disable-jpeg2000 flag to fix related CVEs

c9da413

removed the 64 bit script from being created as we don't need it and …

8fdd5ba

…it breaks

Added some instructions for workarounds to build this, hopefully thes…

915b68f

…e can be removed in future.

jeremywestwood requested a review from davidfraser July 28, 2021 09:36

davidfraser approved these changes Jul 28, 2021

View reviewed changes

j5_build_instructions.txt Outdated Show resolved Hide resolved

correct version number for VC 10.0

fe71471

davidfraser merged commit c6864dd into j5int:6.2.x Jul 28, 2021

Provide feedback