210ccaef57
Upstream libid3tag is dead since 2004 so switch to debian to get two patches that fix the following CVEs: - CVE-2004-2779: id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). - CVE-2017-11550: The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. - CVE-2017-11551: The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. Moreover, drop patch (replaced by add-m4-directory.patch debian patch) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
8 lines
522 B
Plaintext
8 lines
522 B
Plaintext
# From http://snapshot.debian.org/archive/debian/20190310T213528Z/pool/main/libi/libid3tag/libid3tag_0.15.1b-14.dsc
|
|
sha256 63da4f6e7997278f8a3fef4c6a372d342f705051d1eeb6a46a86b03610e26151 libid3tag_0.15.1b.orig.tar.gz
|
|
sha256 f174cafe02bef25a9ad8cb7f9ce80119147297a7036f50878e85ac0d7ae09c62 libid3tag_0.15.1b-14.debian.tar.xz
|
|
|
|
# Hash for license files:
|
|
sha256 32b1062f7da84967e7019d01ab805935caa7ab7321a7ced0e30ebe75e5df1670 COPYING
|
|
sha256 7f12ad28dc075763e91b91bfa60fad04062380011ddad8f6bac21dd7b1f44367 COPYRIGHT
|