Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (1f27fbab3d255ba0e22c2cbbe9eaec5586bc1806)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (1f27fbab3d255ba0e22c2cbbe9eaec5586bc1806)
  • Date: Sun, 22 Oct 2017 14:42:23 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

http/newsbeuter/DETAILS | 5 +++--
http/newsbeuter/HISTORY | 10 ++++++++++
http/newsbeuter/PRE_BUILD | 9 ++++++---
http/newsbeuter/escape.patch | 23 +++++++++++++++++++++++
4 files changed, 42 insertions(+), 5 deletions(-)

New commits:
commit 1f27fbab3d255ba0e22c2cbbe9eaec5586bc1806
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

newsbeuter: security update

(cherry picked from commit 9f241af9dae34bd12723b8e52c7db3437e656dc4)

commit 35800e5b7128c7adcfb99b4730ec3c750ca466f2
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

newsbeuter: => 2.9

(cherry picked from commit 79205aa3bf11041e3b484b9a105135232ee42082)

diff --git a/http/newsbeuter/DETAILS b/http/newsbeuter/DETAILS
index 0cbaeaa..6a1486a 100755
--- a/http/newsbeuter/DETAILS
+++ b/http/newsbeuter/DETAILS
@@ -1,8 +1,9 @@
SPELL=newsbeuter
- VERSION=2.7
+ VERSION=2.9
+ SECURITY_PATCH=1
SOURCE="${SPELL}-${VERSION}.tar.gz"
SOURCE_URL[0]=http://www.${SPELL}.org/downloads/${SOURCE}
-
SOURCE_HASH=sha512:487aaf2826a888680bf401542ac2f6703fe1694e8e06404ba0370cd623476f7d4f03104a88c6e612472cc0252db8e38687afe0ca16ca363ee6796cc33de1c287
+
SOURCE_HASH=sha512:b173008c8c8d3729f8ccef3ce62645a05c1803fb842d5c0afdf9ffd4ed3726030f9c359c20bc817402a6a0ea12af742d0ae7faf9b92d52c11f420f62b430b0aa
SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}"
WEB_SITE="http://www.newsbeuter.org/";
LICENSE[0]="MIT/X"
diff --git a/http/newsbeuter/HISTORY b/http/newsbeuter/HISTORY
index 2e944a3..b12e4be 100644
--- a/http/newsbeuter/HISTORY
+++ b/http/newsbeuter/HISTORY
@@ -1,3 +1,13 @@
+2017-08-19 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH=1
+ * PRE_BUILD: apply the patch
+ * escape.patch: added, to fix CVE-2017-12904
+
+2016-08-25 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 2.9
+ * PRE_BUILD: dropped sed hacks, fixed by upstream; added gcc 4.6
+ workaround
+
2013-08-28 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* DETAILS: version 2.7
* DEPENDS: add dep on json-c
diff --git a/http/newsbeuter/PRE_BUILD b/http/newsbeuter/PRE_BUILD
index ed5376d..6028796 100755
--- a/http/newsbeuter/PRE_BUILD
+++ b/http/newsbeuter/PRE_BUILD
@@ -1,5 +1,8 @@
default_pre_build &&
-cd $SOURCE_DIRECTORY &&
-sed -i -e "s:ncursesw/ncurses.h:ncurses.h:g" src/view.cpp
-sed -i -e "s:ncursesw/ncurses.h:ncurses.h:g" src/controller.cpp
+cd "${SOURCE_DIRECTORY}" &&

+patch -p1 < "${SPELL_DIRECTORY}/escape.patch" &&
+
+if spell_ok gcc && is_version_less $(installed_version gcc) 4.8; then
+ sedit "s:-std=c++11:-std=c++0x:" Makefile
+fi
diff --git a/http/newsbeuter/escape.patch b/http/newsbeuter/escape.patch
new file mode 100644
index 0000000..6a3fb66
--- /dev/null
+++ b/http/newsbeuter/escape.patch
@@ -0,0 +1,23 @@
+Description: Fix a RCE vulnerability in the bookmark command
+ Newsbeuter didn't properly escape the title and description fields before
+ passing them to the bookmarking program which could lead to remote code
+ execution using the shells command substitution functionality (e.g. "$()",
``,
+ etc)
+
+Origin: upstream,
https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
+Last-Update: 2017-08-18
+
+--- newsbeuter-2.9.orig/src/controller.cpp
++++ newsbeuter-2.9/src/controller.cpp
+@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s
+ std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
+ bool is_interactive =
cfg.get_configvalue_as_bool("bookmark-interactive");
+ if (bookmark_cmd.length() > 0) {
+- std::string cmdline = utils::strprintf("%s '%s' %s %s",
++ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'",
+ bookmark_cmd.c_str(),
utils::replace_all(url,"'", "%27").c_str(),
+-
stfl::quote(title).c_str(), stfl::quote(description).c_str());
++
utils::replace_all(title,"'", "%27").c_str(),
++
utils::replace_all(description,"'", "%27").c_str());
+
+ LOG(LOG_DEBUG, "controller::bookmark: cmd = %s",
cmdline.c_str());



  • [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (1f27fbab3d255ba0e22c2cbbe9eaec5586bc1806), Vlad Glagolev, 10/22/2017

Archive powered by MHonArc 2.6.24.

Top of Page