diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2019-06-17 11:35:30 +0200 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2019-06-17 11:35:30 +0200 |
| commit | 300c17172f28b6d0bd024111bc74805dc28de56a (patch) | |
| tree | 4bae6e440e1612bdb5950a169a151f653ff0cb1b | |
| parent | 4d6ca10f8ba57b07211d97a693e2c289bd1a9587 (diff) | |
| download | aports-300c17172f28b6d0bd024111bc74805dc28de56a.tar.bz2 aports-300c17172f28b6d0bd024111bc74805dc28de56a.tar.xz | |
main/glib: security fix for CVE-2019-12450
fixes #10576
| -rw-r--r-- | main/glib/APKBUILD | 10 | ||||
| -rw-r--r-- | main/glib/CVE-2019-12450.patch | 53 |
2 files changed, 61 insertions, 2 deletions
diff --git a/main/glib/APKBUILD b/main/glib/APKBUILD index 78721be6f4..65e0610563 100644 --- a/main/glib/APKBUILD +++ b/main/glib/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=glib pkgver=2.58.1 -pkgrel=2 +pkgrel=3 pkgdesc="Common C routines used by Gtk+ and other libs" url="https://developer.gnome.org/glib/" arch="all" @@ -14,10 +14,15 @@ depends_dev="python3 gettext-dev zlib-dev bzip2-dev libffi-dev makedepends="$depends_dev pcre-dev autoconf automake libtool" source="https://download.gnome.org/sources/$pkgname/${pkgver%.*}/$pkgname-$pkgver.tar.xz 0001-gquark-fix-initialization-with-c-constructors.patch + CVE-2019-12450.patch " subpackages="$pkgname-dbg $pkgname-doc $pkgname-static $pkgname-dev $pkgname-lang $pkgname-bash-completion:bashcomp:noarch" builddir="$srcdir"/$pkgname-$pkgver +# secfixes: +# 2.58.1-r3: +# - CVE-2019-12450 + prepare() { default_prepare cd "$builddir" @@ -79,4 +84,5 @@ bashcomp() { } sha512sums="115b74fcd43241e3c4b4babfb8170453b2a002ff02d5996f3c097876199cadccc1cf67b017c10c14c0d2a1bb4228027b743f4926bda0ef7d74012ed712ccd155 glib-2.58.1.tar.xz -32e5aca9a315fb985fafa0b4355e4498c1f877fc1f0b58ad4ac261fb9fbced9f026c7756a5f2af7d61ce756b55c8cd02811bb08df397040e93510056f073756b 0001-gquark-fix-initialization-with-c-constructors.patch" +32e5aca9a315fb985fafa0b4355e4498c1f877fc1f0b58ad4ac261fb9fbced9f026c7756a5f2af7d61ce756b55c8cd02811bb08df397040e93510056f073756b 0001-gquark-fix-initialization-with-c-constructors.patch +18f33b4902d1ec2595e17f6d686871445aaba3988c1f257a28892f5efcfdc79d6009d0bcf997791ab4f4f0eac9667a89cedca24261592b60b91627dd2d5ed79d CVE-2019-12450.patch" diff --git a/main/glib/CVE-2019-12450.patch b/main/glib/CVE-2019-12450.patch new file mode 100644 index 0000000000..6c514e1f8e --- /dev/null +++ b/main/glib/CVE-2019-12450.patch @@ -0,0 +1,53 @@ +From d8f8f4d637ce43f8699ba94c9b7648beda0ca174 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy <oholy@redhat.com> +Date: Thu, 23 May 2019 10:41:53 +0200 +Subject: [PATCH] gfile: Limit access to files when copying + +file_copy_fallback creates new files with default permissions and +set the correct permissions after the operation is finished. This +might cause that the files can be accessible by more users during +the operation than expected. Use G_FILE_CREATE_PRIVATE for the new +files to limit access to those files. +--- + gio/gfile.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/gio/gfile.c b/gio/gfile.c +index 24b136d80..74b58047c 100644 +--- a/gio/gfile.c ++++ b/gio/gfile.c +@@ -3284,12 +3284,12 @@ file_copy_fallback (GFile *source, + out = (GOutputStream*)_g_local_file_output_stream_replace (_g_local_file_get_filename (G_LOCAL_FILE (destination)), + FALSE, NULL, + flags & G_FILE_COPY_BACKUP, +- G_FILE_CREATE_REPLACE_DESTINATION, +- info, ++ G_FILE_CREATE_REPLACE_DESTINATION | ++ G_FILE_CREATE_PRIVATE, info, + cancellable, error); + else + out = (GOutputStream*)_g_local_file_output_stream_create (_g_local_file_get_filename (G_LOCAL_FILE (destination)), +- FALSE, 0, info, ++ FALSE, G_FILE_CREATE_PRIVATE, info, + cancellable, error); + } + else if (flags & G_FILE_COPY_OVERWRITE) +@@ -3297,12 +3297,13 @@ file_copy_fallback (GFile *source, + out = (GOutputStream *)g_file_replace (destination, + NULL, + flags & G_FILE_COPY_BACKUP, +- G_FILE_CREATE_REPLACE_DESTINATION, ++ G_FILE_CREATE_REPLACE_DESTINATION | ++ G_FILE_CREATE_PRIVATE, + cancellable, error); + } + else + { +- out = (GOutputStream *)g_file_create (destination, 0, cancellable, error); ++ out = (GOutputStream *)g_file_create (destination, G_FILE_CREATE_PRIVATE, cancellable, error); + } + + if (!out) +-- +2.21.0 + |