Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=e0b644f4d4a684593ecabd62911a007916ce82c0
commit e0b644f4d4a684593ecabd62911a007916ce82c0 Author: kikadf <[email protected]> Date: Thu Apr 10 12:19:52 2014 +0200 a2ps-4.14-5arcturus1-x86_64 * Fix CVE-2001-1953, CVE-2014-0466 diff --git a/source/apps/a2ps/CVE-2001-1593.patch b/source/apps/a2ps/CVE-2001-1593.patch new file mode 100644 index 0000000..5a5fe18 --- /dev/null +++ b/source/apps/a2ps/CVE-2001-1593.patch @@ -0,0 +1,76 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 09_2001-1593.patch.dpatch by Salvatore Bonaccorso <[email protected]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix CVE-2001-1593: insecure use of /tmp +## DP: Bug-Debian: https://bugs.debian.org/737385 +## DP: Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1060630 + +@DPATCH@ +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/lib/routines.c a2ps/lib/routines.c +--- a2ps~/lib/routines.c 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/lib/routines.c 2014-03-30 12:31:55.206102405 +0200 +@@ -242,3 +242,50 @@ + /* Don't complain if you can't unlink. Who cares of a tmp file? */ + unlink (filename); + } ++ ++/* ++ * Securely generate a temp file, and make sure it gets ++ * deleted upon exit. ++ */ ++static char ** tempfiles; ++static unsigned ntempfiles; ++ ++static void ++cleanup_tempfiles() ++{ ++ while (ntempfiles--) ++ unlink(tempfiles[ntempfiles]); ++} ++ ++char * ++safe_tempnam(const char *pfx) ++{ ++ char *dirname, *filename; ++ int fd; ++ ++ if (!(dirname = getenv("TMPDIR"))) ++ dirname = "/tmp"; ++ ++ tempfiles = (char **) realloc(tempfiles, ++ (ntempfiles+1) * sizeof(char *)); ++ if (tempfiles == NULL) ++ return NULL; ++ ++ filename = malloc(strlen(dirname) + strlen(pfx) + sizeof("/XXXXXX")); ++ if (!filename) ++ return NULL; ++ ++ sprintf(filename, "%s/%sXXXXXX", dirname, pfx); ++ ++ if ((fd = mkstemp(filename)) < 0) { ++ free(filename); ++ return NULL; ++ } ++ close(fd); ++ ++ if (ntempfiles == 0) ++ atexit(cleanup_tempfiles); ++ tempfiles[ntempfiles++] = filename; ++ ++ return filename; ++} +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/lib/routines.h a2ps/lib/routines.h +--- a2ps~/lib/routines.h 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/lib/routines.h 2014-03-30 12:31:55.206102405 +0200 +@@ -255,7 +255,8 @@ + /* If _STR_ is not defined, give it a tempname in _TMPDIR_ */ + #define tempname_ensure(Str) \ + do { \ +- (Str) = (Str) ? (Str) : tempnam (NULL, "a2_"); \ ++ (Str) = (Str) ? (Str) : safe_tempnam("a2_"); \ + } while (0) ++char * safe_tempnam(const char *); + + #endif diff --git a/source/apps/a2ps/CVE-2014-0466.patch b/source/apps/a2ps/CVE-2014-0466.patch new file mode 100644 index 0000000..7be0bb5 --- /dev/null +++ b/source/apps/a2ps/CVE-2014-0466.patch @@ -0,0 +1,34 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 10_CVE-2014-0466.dpatch by Salvatore Bonaccorso <[email protected]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Description: CVE-2014-0466: fixps does not invoke gs with -dSAFER +## DP: A malicious PostScript file could delete files with the privileges of +## DP: the invoking user. +## DP: Bug-Debian: http://bugs.debian.org/742902 + +@DPATCH@ +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/contrib/fixps.in a2ps/contrib/fixps.in +--- a2ps~/contrib/fixps.in 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/contrib/fixps.in 2014-03-30 12:40:36.763249218 +0200 +@@ -389,7 +389,7 @@ + eval "$command" ;; + gs) + $verbose "$program: making a full rewrite of the file ($gs)." >&2 +- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; ++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; + esac + ) + fi +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/contrib/fixps.m4 a2ps/contrib/fixps.m4 +--- a2ps~/contrib/fixps.m4 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/contrib/fixps.m4 2014-03-30 12:40:36.767249254 +0200 +@@ -307,7 +307,7 @@ + eval "$command" ;; + gs) + $verbose "$program: making a full rewrite of the file ($gs)." >&2 +- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; ++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; + esac + ) + fi diff --git a/source/apps/a2ps/FrugalBuild b/source/apps/a2ps/FrugalBuild index ba5e7ff..24ef768 100644 --- a/source/apps/a2ps/FrugalBuild +++ b/source/apps/a2ps/FrugalBuild @@ -6,7 +6,7 @@ pkgname=a2ps pkgver=4.14 pkgextraver= -pkgrel=4 +pkgrel=5arcturus1 pkgdesc="An Any to PostScript filter" url="http://www.inf.enst.fr/~demaille/a2ps"; depends=('glibc' 'urw-fonts' 'psutils' 'texinfo') @@ -26,18 +26,23 @@ sha1sums=('365abbbe4b7128bf70dad16d06e23c5701874852' \ '6aed29c1399e79f3914b408059610f9e7c0fc38e') Finclude texinfo + +# FSA fix *** +source=(${source[@]} CVE-2001-1593.patch CVE-2014-0466.patch) +sha1sums=(${sha1sums[@]} 'b3d1199d47ac17e2456d23d39f11ad0eeff6ed28' \ + 'a9d109775ec4d190b3aa68019977514ee5e62f3f') +# *********** + + build() { - Fpatchall - Fsed "YFLAGS" "AM_YFLAGS" lib/Makefile.am - Fsed "YFLAGS" "AM_YFLAGS" src/Makefile.am - Fsed "AM_C_PROTOTYPES" "" configure.in Fsed "AUTOMAKE_OPTIONS = \$(top_builddir)/lib/ansi2knr" "" contrib/sample/Makefile.am Fsed "AUTOMAKE_OPTIONS = \$(top_builddir)/lib/ansi2knr" "" lib/Makefile.am Fsed "AUTOMAKE_OPTIONS = \$(top_builddir)/lib/ansi2knr" "" src/Makefile.am - Fautoreconf - Fmake --sysconfdir=/etc - Fmakeinstall || return 1 + Fsed "AM_C_PROTOTYPES" "" configure.in + Fsed 'AM_CONFIG_HEADER' 'AC_CONFIG_HEADERS' configure.in + Fsed 'AM_PROG_CC_STDC' 'AC_PROG_CC' configure.in + Fbuild } # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
