Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=ce32b9442b9b5a8f931ee61b4c3f8c10af695d54
commit ce32b9442b9b5a8f931ee61b4c3f8c10af695d54 Author: kikadf <[email protected]> Date: Fri Apr 25 08:26:08 2014 +0200 cups-1.6.1-3arcturus2-x86_64 * Fix CVE-2014-2856 diff --git a/source/xapps/cups/CVE-2014-2856.patch b/source/xapps/cups/CVE-2014-2856.patch new file mode 100644 index 0000000..a8e08a5 --- /dev/null +++ b/source/xapps/cups/CVE-2014-2856.patch @@ -0,0 +1,28 @@ +commit 1216300668307015a88efc6267a521eeab51e8e8 +Author: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be> +Date: Wed Feb 19 19:56:56 2014 +0000 + + Protect against HTML in the URL (STR #4356) + + + git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@11620 a1ca3aef-8c08-0410-bb20-df032aa958be + +Index: cups-1.6.1/scheduler/client.c +=================================================================== +--- cups-1.6.1.orig/scheduler/client.c 2014-04-18 11:56:43.232938047 -0400 ++++ cups-1.6.1/scheduler/client.c 2014-04-18 11:56:43.228938047 -0400 +@@ -3549,6 +3549,14 @@ + return (0); + + /* ++ * Check for "<" or quotes in the path and reject since this is probably ++ * someone trying to inject HTML... ++ */ ++ ++ if (strchr(path, '<') != NULL || strchr(path, '\"') != NULL || strchr(path, '\'') != NULL) ++ return (0); ++ ++ /* + * Check for "/.." in the path... + */ + diff --git a/source/xapps/cups/FrugalBuild b/source/xapps/cups/FrugalBuild index 3989bed..2d379ca 100644 --- a/source/xapps/cups/FrugalBuild +++ b/source/xapps/cups/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=cups pkgver=1.6.1 -pkgrel=3arcturus1 +pkgrel=3arcturus2 pkgdesc="The CUPS Printing System" url="http://www.cups.org/"; depends=('libtiff' 'libpng>=1.4.1' 'libjpeg>=8a' 'systemd' 'poppler-pdftools>=0.18.0' 'xdg-utils') @@ -35,8 +35,9 @@ subgroups=('lib') subarchs=('i686 x86_64 arm') # FSA fix *** -source=(${source[@]} CVE-2013-6891.patch) -sha1sums=(${sha1sums[@]} '0d58375b7d7ec99766dc9df27bc82e64f4c4e550') +source=(${source[@]} CVE-2013-6891.patch CVE-2014-2856.patch) +sha1sums=(${sha1sums[@]} '0d58375b7d7ec99766dc9df27bc82e64f4c4e550' \ + '3a6640d65eb8a1f77165352801f81dda7918d609') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
