Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9f241af9dae34bd12723b8e52c7db3437e656dc4)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9f241af9dae34bd12723b8e52c7db3437e656dc4)
  • Date: Sat, 19 Aug 2017 18:08:23 +0000

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

http/newsbeuter/DETAILS | 1 +
http/newsbeuter/HISTORY | 5 +++++
http/newsbeuter/PRE_BUILD | 2 ++
http/newsbeuter/escape.patch | 23 +++++++++++++++++++++++
4 files changed, 31 insertions(+)

New commits:
commit 9f241af9dae34bd12723b8e52c7db3437e656dc4
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

newsbeuter: security update

diff --git a/http/newsbeuter/DETAILS b/http/newsbeuter/DETAILS
index 458c5a8..6a1486a 100755
--- a/http/newsbeuter/DETAILS
+++ b/http/newsbeuter/DETAILS
@@ -1,5 +1,6 @@
SPELL=newsbeuter
VERSION=2.9
+ SECURITY_PATCH=1
SOURCE="${SPELL}-${VERSION}.tar.gz"
SOURCE_URL[0]=http://www.${SPELL}.org/downloads/${SOURCE}

SOURCE_HASH=sha512:b173008c8c8d3729f8ccef3ce62645a05c1803fb842d5c0afdf9ffd4ed3726030f9c359c20bc817402a6a0ea12af742d0ae7faf9b92d52c11f420f62b430b0aa
diff --git a/http/newsbeuter/HISTORY b/http/newsbeuter/HISTORY
index ff9b237..b12e4be 100644
--- a/http/newsbeuter/HISTORY
+++ b/http/newsbeuter/HISTORY
@@ -1,3 +1,8 @@
+2017-08-19 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH=1
+ * PRE_BUILD: apply the patch
+ * escape.patch: added, to fix CVE-2017-12904
+
2016-08-25 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 2.9
* PRE_BUILD: dropped sed hacks, fixed by upstream; added gcc 4.6
diff --git a/http/newsbeuter/PRE_BUILD b/http/newsbeuter/PRE_BUILD
index bc4ff40..6028796 100755
--- a/http/newsbeuter/PRE_BUILD
+++ b/http/newsbeuter/PRE_BUILD
@@ -1,6 +1,8 @@
default_pre_build &&
cd "${SOURCE_DIRECTORY}" &&

+patch -p1 < "${SPELL_DIRECTORY}/escape.patch" &&
+
if spell_ok gcc && is_version_less $(installed_version gcc) 4.8; then
sedit "s:-std=c++11:-std=c++0x:" Makefile
fi
diff --git a/http/newsbeuter/escape.patch b/http/newsbeuter/escape.patch
new file mode 100644
index 0000000..6a3fb66
--- /dev/null
+++ b/http/newsbeuter/escape.patch
@@ -0,0 +1,23 @@
+Description: Fix a RCE vulnerability in the bookmark command
+ Newsbeuter didn't properly escape the title and description fields before
+ passing them to the bookmarking program which could lead to remote code
+ execution using the shells command substitution functionality (e.g. "$()",
``,
+ etc)
+
+Origin: upstream,
https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
+Last-Update: 2017-08-18
+
+--- newsbeuter-2.9.orig/src/controller.cpp
++++ newsbeuter-2.9/src/controller.cpp
+@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s
+ std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
+ bool is_interactive =
cfg.get_configvalue_as_bool("bookmark-interactive");
+ if (bookmark_cmd.length() > 0) {
+- std::string cmdline = utils::strprintf("%s '%s' %s %s",
++ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
+ bookmark_cmd.c_str(),
utils::replace_all(url,"'", "%27").c_str(),
+-
stfl::quote(title).c_str(), stfl::quote(description).c_str());
++
utils::replace_all(title,"'", "%27").c_str(),
++
utils::replace_all(description,"'", "%27").c_str());
+
+ LOG(LOG_DEBUG, "controller::bookmark: cmd = %s",
cmdline.c_str());



  • [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (9f241af9dae34bd12723b8e52c7db3437e656dc4), Vlad Glagolev, 08/19/2017

Archive powered by MHonArc 2.6.24.

Top of Page