rpms/evolution
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

- Add patch for CVE-2008-0072 (format string vulnerability).

Browse source
This commit is contained in:
Matthew Barnes 2008-03-05 15:09:49 +00:00
commit 3fa449c978
2 changed files with 56 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

48
evolution-2.10.3-CVE-2008-0072.patch Normal file
View file

@ -0,0 +1,48 @@
diff -up evolution-2.10.3/mail/em-format.c.CVE-2008-0072 evolution-2.10.3/mail/em-format.c
--- evolution-2.10.3/mail/em-format.c.CVE-2008-0072 2008-03-04 15:44:32.000000000 -0500
+++ evolution-2.10.3/mail/em-format.c 2008-03-04 15:45:23.000000000 -0500
@@ -1155,7 +1155,7 @@ emf_application_xpkcs7mime(EMFormat *emf
opart = camel_mime_part_new();
valid = camel_cipher_decrypt(context, part, opart, ex);
if (valid == NULL) {
- em_format_format_error(emf, stream, ex->desc?ex->desc:_("Could not parse S/MIME message: Unknown error"));
+ em_format_format_error(emf, stream, "%s", ex->desc?ex->desc:_("Could not parse S/MIME message: Unknown error"));
em_format_part_as(emf, stream, part, NULL);
} else {
if (emfc == NULL)
@@ -1305,7 +1305,7 @@ emf_multipart_encrypted(EMFormat *emf, C
if (valid == NULL) {
em_format_format_error(emf, stream, ex->desc?("Could not parse S/MIME message"):_("Could not parse S/MIME message: Unknown error"));
if (ex->desc)
- em_format_format_error(emf, stream, ex->desc);
+ em_format_format_error(emf, stream, "%s", ex->desc);
em_format_part_as(emf, stream, part, "multipart/mixed");
} else {
if (emfc == NULL)
@@ -1470,7 +1470,7 @@ emf_multipart_signed(EMFormat *emf, Came
if (valid == NULL) {
em_format_format_error(emf, stream, ex->desc?_("Error verifying signature"):_("Unknown error verifying signature"));
if (ex->desc)
- em_format_format_error(emf, stream, ex->desc);
+ em_format_format_error(emf, stream, "%s", ex->desc);
em_format_part_as(emf, stream, part, "multipart/mixed");
} else {
if (emfc == NULL)
@@ -1536,7 +1536,7 @@ emf_inlinepgp_signed(EMFormat *emf, Came
if (!valid) {
em_format_format_error(emf, stream, ex->desc?_("Error verifying signature"):_("Unknown error verifying signature"));
if (ex->desc)
- em_format_format_error(emf, stream, ex->desc);
+ em_format_format_error(emf, stream, "%s", ex->desc);
em_format_format_source(emf, stream, ipart);
/* I think this will loop: em_format_part_as(emf, stream, part, "text/plain"); */
camel_exception_free(ex);
@@ -1607,7 +1607,7 @@ emf_inlinepgp_encrypted(EMFormat *emf, C
if (!valid) {
em_format_format_error(emf, stream, ex->desc?("Could not parse S/MIME message"):_("Could not parse S/MIME message: Unknown error"));
if (ex->desc)
- em_format_format_error(emf, stream, ex->desc);
+ em_format_format_error(emf, stream, "%s", ex->desc);
em_format_format_source(emf, stream, ipart);
/* I think this will loop: em_format_part_as(emf, stream, part, "text/plain"); */
camel_exception_free(ex);

9
evolution.spec
View file

@ -47,7 +47,7 @@
Name: evolution
Version: 2.10.3
Release: 7%{?dist}
Release: 8%{?dist}
License: GPL
Group: Applications/Productivity
Summary: GNOME's next-generation groupware suite
@ -179,6 +179,9 @@ Patch56: evolution-2.10.3-fix-ETreeTableAdapter-crash.patch
# RH bug #249640 / GNOME bug #442329
Patch57: evolution-2.10.3-todo-conduit.patch
# CVE-2008-0072
Patch58: evolution-2.10.3-CVE-2008-0072.patch
## Dependencies ###
Requires(post): GConf2
@ -338,6 +341,7 @@ Development files needed for building things which link against evolution.
%patch55 -p1 -b .version-checks
%patch56 -p1 -b .ETreeTableAdapter-idle-crash
%patch57 -p1 -b .todo-conduit
%patch58 -p1 -b .CVE-2008-0072
mkdir -p krb5-fakeprefix/include
mkdir -p krb5-fakeprefix/lib
@ -759,6 +763,9 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/evolution/%{evo_major}/libmenus.so
%changelog
* Tue Mar 04 2008 Matthew Barnes <mbarnes@redhat.com> - 2.10.3-8.fc7
- Add patch for CVE-2008-0072 (format string vulnerability).
* Sat Nov 03 2007 Matthew Barnes <mbarnes@redhat.com> - 2.10.3-7.fc7
- Add patch for RH bug #249640 (todo conduit crash).