Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=4abb406e86a32c1aa9812bea02a32e218e030f34
commit 4abb406e86a32c1aa9812bea02a32e218e030f34 Author: Miklos Vajna <[EMAIL PROTECTED]> Date: Sat Apr 12 14:50:41 2008 +0200 emacs-22.2-2-i686 - added CVE-2008-1694.patch - closes #3006 diff --git a/source/xapps/emacs/CVE-2008-1694.patch b/source/xapps/emacs/CVE-2008-1694.patch new file mode 100644 index 0000000..7f59d6a --- /dev/null +++ b/source/xapps/emacs/CVE-2008-1694.patch @@ -0,0 +1,25 @@ +Steve Grubb of Red Hat discovered that vcdiff script as shipped with Emacs +(confirmed in versions 20.7 to 22.1.50) uses temporary files insecurely, +which makes it possible for local attacker to conduct a symlink attack and +make the victim overwrite arbitrary file. + +diff -ur emacs-21.4.orig/lib-src/vcdiff emacs-21.4/lib-src/vcdiff +--- emacs-21.4.orig/lib-src/vcdiff 2006-09-28 12:07:51.000000000 -0400 ++++ emacs-21.4/lib-src/vcdiff 2006-09-28 15:58:53.000000000 -0400 +@@ -86,14 +86,14 @@ + case $f in + s.* | */s.*) + if +- rev1=/tmp/geta$$ ++ rev1=`mktemp /tmp/geta.XXXXXXXX` + get -s -p -k $sid1 "$f" > $rev1 && + case $sid2 in + '') + workfile=`expr " /$f" : '.*/s.\(.*\)'` + ;; + *) +- rev2=/tmp/getb$$ ++ rev2=`mktemp /tmp/getb.XXXXXXXX` + get -s -p -k $sid2 "$f" > $rev2 + workfile=$rev2 + esac diff --git a/source/xapps/emacs/FrugalBuild b/source/xapps/emacs/FrugalBuild index b1ff73f..94cf8ab 100644 --- a/source/xapps/emacs/FrugalBuild +++ b/source/xapps/emacs/FrugalBuild @@ -5,7 +5,7 @@ pkgname=emacs pkgver=22.2 pkgextraver= -pkgrel=1 +pkgrel=2 pkgdesc="An extensible, customizable, self-documenting real-time display editor" url="http://www.gnu.org/software/emacs/"; Finclude texinfo @@ -14,14 +14,16 @@ depends=('xaw3d' 'libtiff' 'libjpeg' 'libpng' 'libungif' 'ncurses' 'libxcb') groups=('xapps') archs=('i686' 'x86_64') up2date="lynx -dump http://ftp.gnu.org/pub/gnu/emacs/ |Flasttar" -source=(ftp://ftp.gnu.org/gnu/emacs/$pkgname-$pkgver$pkgextraver.tar.gz emacs-21.4-amd64.patch) -signatures=($source.sig '') +source=(ftp://ftp.gnu.org/gnu/emacs/$pkgname-$pkgver$pkgextraver.tar.gz emacs-21.4-amd64.patch \ + CVE-2008-1694.patch) +signatures=($source.sig '' '') build() { # LDFLAGS="-Wl,--hash-style=both" does not compile LDFLAGS="" Fcd $pkgname-$pkgver [[ "$CARCH" == "x86_64" ]] && Fpatch emacs-21.4-amd64.patch + Fpatch CVE-2008-1694.patch Fmake --with-x11 --with-x-toolkit --with-pop Fmakeinstall [ -e $Fdestdir/usr/info/dir.old ] && Frm /usr/info/dir.old _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
