package/proftpd: security bump to version 1.3.6c
authorPeter Korsgaard <peter@korsgaard.com>
Thu, 27 Feb 2020 13:54:56 +0000 (14:54 +0100)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Thu, 27 Feb 2020 17:26:04 +0000 (18:26 +0100)
commita1859b6204e0deadec4377fe4e6813a97c8d3fa0
treede42f6917cf7aec9ff12955c9aff8df42281f306
parent128c57adb8f3a4e1af2b9e0fcfc612049cff6773
package/proftpd: security bump to version 1.3.6c

Fixes the following security issues:

- CVE-2020-9273: In ProFTPD 1.3.7, it is possible to corrupt the memory pool
  by interrupting the data transfer channel.  This triggers a use-after-free
  in alloc_pool in pool.c, and possible remote code execution.

And additionally, fixes a number of other issues.  For details, see the
release notes:

https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES

This also bumps the bundled libcap, so
0001-fix-kernel-header-capability-version.patch can be dropped.

While we are at it, adjust the white space in the .hash function to match
the new agreements.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/proftpd/0001-fix-kernel-header-capability-version.patch [deleted file]
package/proftpd/proftpd.hash
package/proftpd/proftpd.mk