CVE-2011-3201

.gitignore

@@ -9,3 +9,11 @@ evolution-2.31.5.tar.bz2
 /evolution-2.91.5.tar.bz2
 /evolution-2.91.6.tar.bz2
 /evolution-2.91.6.1.tar.bz2
+/evolution-2.91.6.2.tar.bz2
+/evolution-2.91.90.tar.bz2
+/evolution-2.91.91.tar.bz2
+/evolution-2.91.92.tar.bz2
+/evolution-3.0.0.tar.bz2
+/evolution-3.0.1.tar.bz2
+/evolution-3.0.2.tar.bz2
+/evolution-3.0.3.tar.bz2

evolution-3.0.3-CVE-2011-3201.patch

@@ -0,0 +1,56 @@
+diff -up evolution-3.0.3/composer/e-msg-composer.c.CVE-2011-3201 evolution-3.0.3/composer/e-msg-composer.c
+--- evolution-3.0.3/composer/e-msg-composer.c.CVE-2011-3201	2011-07-15 02:42:06.000000000 -0500
++++ evolution-3.0.3/composer/e-msg-composer.c	2011-11-30 07:32:33.485560137 -0600
+@@ -3893,6 +3893,35 @@ add_recipients (GList *list, const gchar
+ 	return list;
+ }
+ 
++static const gchar *blacklist[] = { ".", "etc", ".." };
++
++static gboolean
++file_is_blacklisted (const gchar *filename)
++{
++	gboolean blacklisted = FALSE;
++	guint ii, jj, n_parts;
++	gchar **parts;
++
++	parts = g_strsplit (filename, G_DIR_SEPARATOR_S, -1);
++	n_parts = g_strv_length (parts);
++
++	for (ii = 0; ii < G_N_ELEMENTS (blacklist); ii++) {
++		for (jj = 0; jj < n_parts; jj++) {
++			if (g_str_has_prefix (parts[jj], blacklist[ii])) {
++				blacklisted = TRUE;
++				break;
++			}
++		}
++	}
++
++	g_strfreev (parts);
++
++	if (blacklisted)
++		g_message ("Skipping suspicious attachment: %s", filename);
++
++	return blacklisted;
++}
++
+ static void
+ handle_mailto (EMsgComposer *composer, const gchar *mailto)
+ {
+@@ -3985,6 +4014,8 @@ handle_mailto (EMsgComposer *composer, c
+ 				EAttachment *attachment;
+ 
+ 				camel_url_decode (content);
++				if (file_is_blacklisted (content))
++					goto next;
+ 				if (g_ascii_strncasecmp (content, "file:", 5) == 0)
+ 					attachment = e_attachment_new_for_uri (content);
+ 				else
+@@ -4004,6 +4035,7 @@ handle_mailto (EMsgComposer *composer, c
+ 				e_msg_composer_add_header (composer, header, content);
+ 			}
+ 
++next:
+ 			g_free (content);
+ 
+ 			p += clen;

evolution-help-gl.patch

@@ -0,0 +1,12 @@
+diff -up evolution-2.91.6.1/help/Makefile.in.gl evolution-2.91.6.1/help/Makefile.in
+--- evolution-2.91.6.1/help/Makefile.in.gl	2011-02-11 10:34:44.753102344 -0500
++++ evolution-2.91.6.1/help/Makefile.in	2011-02-11 10:35:07.402819183 -0500
+@@ -590,7 +590,7 @@ DOC_FIGURES = \
+ 	figures/stock_search.png 		\
+ 	figures/ver_view_a.png
+ 
+-DOC_LINGUAS = cs de el en_GB es eu fr gl oc ru sl sv mk zh_CN
++DOC_LINGUAS = cs de el en_GB es eu fr oc ru sl sv mk zh_CN
+ all: all-recursive
+ 
+ .SUFFIXES:

evolution.spec

@@ -3,15 +3,15 @@
 %define gnome_desktop_version 2.91.3
 %define gnome_doc_utils_version 0.8.0
 %define gnome_icon_theme_version 2.30.2.1
-%define gtk3_version 2.99.2
-%define gtkhtml_version 3.91.6
+%define gtk3_version 3.0.0
+%define gtkhtml_version 4.0.0
 %define intltool_version 0.35.5
 %define libgdata_version 0.7.0
 %define libgweather_version 2.91.0
 %define clutter_gtk_version 0.10
 %define soup_version 2.4.0
 
-%define evo_base_version 2.92
+%define evo_base_version 3.0
 
 %define last_anjal_version 0.3.2-3
 %define last_libgal2_version 2:2.5.3-2
@@ -21,21 +21,20 @@
 %define libnotify_support 1
 %define libpst_support 1
 %define krb5_support 1
-%define nm_support 1
 
 %define evo_plugin_dir %{_libdir}/evolution/%{evo_base_version}/plugins
 
 ### Abstract ###
 
 Name: evolution
-Version: 2.91.6.1
-Release: 3%{?dist}
+Version: 3.0.3
+Release: 2%{?dist}
 Group: Applications/Productivity
 Summary: Mail and calendar client for GNOME
 License: GPLv2+ and GFDL
 URL: http://projects.gnome.org/evolution/
 BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
-Source: http://download.gnome.org/sources/%{name}/2.91/%{name}-%{version}.tar.bz2
+Source: http://download.gnome.org/sources/%{name}/3.0/%{name}-%{version}.tar.bz2
 
 Obsoletes: anjal <= %{last_anjal_version}
 Obsoletes: libgal2 <= %{last_libgal2_version}
@@ -48,22 +47,25 @@ Patch10: evolution-1.4.4-ldap-x86_64-hack.patch
 # RH bug #589555
 Patch13: evolution-2.30.1-help-contents.patch
 
+Patch14: evolution-help-gl.patch
+
+# CVE-2011-3201
+Patch15: evolution-3.0.3-CVE-2011-3201.patch
+
 ## Dependencies ###
 
 Requires(pre): GConf2
 Requires(post): GConf2
 Requires(preun): GConf2
 
-# Don't trust evolution-data-server to maintain accurate sonames.
-# Requires: evolution-data-server >= %{version}
-Requires: evolution-data-server >= 2.91.6
-
+Requires: evolution-data-server >= %{version}
 Requires: gnome-icon-theme >= %{gnome_icon_theme_version}
 Requires: gvfs
 
 ### Build Dependencies ###
 
 BuildRequires: GConf2-devel
+BuildRequires: NetworkManager-devel
 BuildRequires: atk-devel
 BuildRequires: autoconf >= 2.59
 BuildRequires: automake >= 1.9
@@ -72,8 +74,7 @@ BuildRequires: cairo-gobject-devel
 BuildRequires: clutter-gtk-devel >= %{clutter_gtk_version}
 BuildRequires: dbus-devel >= %{dbus_version}
 BuildRequires: desktop-file-utils
-#BuildRequires: evolution-data-server-devel >= %{version}
-BuildRequires: evolution-data-server-devel >= 2.91.6
+BuildRequires: evolution-data-server-devel >= %{version}
 BuildRequires: gettext
 BuildRequires: glib2-devel >= %{glib2_version}
 BuildRequires: gnome-common
@@ -83,10 +84,8 @@ BuildRequires: gnutls-devel
 BuildRequires: gtk-doc
 BuildRequires: gtk3-devel >= %{gtk3_version}
 BuildRequires: gtkhtml3-devel >= %{gtkhtml_version}
-BuildRequires: gtkimageview-devel
 BuildRequires: intltool >= %{intltool_version}
 BuildRequires: libcanberra-devel
-BuildRequires: libgnomecanvas-devel >= 2.0
 BuildRequires: libgdata-devel >= %{libgdata_version}
 BuildRequires: libgweather-devel >= %{libgweather_version}
 BuildRequires: libpst-devel
@@ -115,10 +114,6 @@ BuildRequires: krb5-devel
 #define krb5dir `pwd`/krb5-fakeprefix
 %endif
 
-%if %{nm_support}
-BuildRequires: NetworkManager-glib-devel
-%endif
-
 %if %{libnotify_support}
 BuildRequires: libnotify-devel
 %endif
@@ -138,8 +133,7 @@ personal information-management tool.
 Group: Development/Libraries
 Summary: Development files for building against %{name}
 Requires: %{name} = %{version}-%{release}
-#Requires: evolution-data-server-devel >= %{version}
-Requires: evolution-data-server-devel >= 2.91.6
+Requires: evolution-data-server-devel >= %{version}
 Requires: gtk3-devel >= %{gtk3_version}
 Requires: gtkhtml3-devel >= %{gtkhtml_version}
 Requires: libgdata-devel >= %{libgdata_version}
@@ -170,6 +164,16 @@ Requires: bogofilter
 %description bogofilter
 This package contains the plugin to filter junk mail using Bogofilter.
 
+%package NetworkManager
+Group: Applications/Productivity
+Summary: NetworkManager plugin for Evolution
+Requires: %{name} = %{version}-%{release}
+Requires: NetworkManager
+
+%description NetworkManager
+This package contains the plugin to monitor network availability using
+NetworkManager.
+
 %package spamassassin
 Group: Applications/Productivity
 Summary: SpamAssassin plugin for Evolution
@@ -203,6 +207,8 @@ This package contains the plugin to import Microsoft Personal Storage Table
 %setup -q -n evolution-%{version}
 %patch10 -p1 -b .ldaphack
 %patch13 -p1 -b .help-contents
+%patch14 -p1 -b .help-gl
+%patch15 -p1 -b .CVE-2011-3201
 
 mkdir -p krb5-fakeprefix/include
 mkdir -p krb5-fakeprefix/lib
@@ -247,39 +253,8 @@ CFLAGS="$RPM_OPT_FLAGS -fPIC -DLDAP_DEPRECATED -I%{_includedir}/et -Wno-sign-com
 export tagname=CC
 make %{?_smp_mflags} LIBTOOL=/usr/bin/libtool CFLAGS="$CFLAGS -fno-strict-aliasing"
 
-# Strip unneeded translations from .mo files.
-# This reduces the RPM size by several megabytes.
-#disabled since 2.31.91 because of a msgmerge floating point exception (see RH bug 628073)
-#cd po
-#grep -v ".*[.]desktop[.]in[.]in$" POTFILES.in > POTFILES.keep
-#mv POTFILES.keep POTFILES.in
-#intltool-update --gettext-package=%{name}-%{evo_base_version} --pot
-#for p in *.po; do
-#	msgmerge $p %{name}-%{evo_base_version}.pot > $p.out
-#	msgfmt -o `basename $p .po`.gmo $p.out
-#done
-#cd -
-
-# Replace identical images in the help by links.
-# This reduces the RPM size by several megabytes.
-helpdir=$RPM_BUILD_ROOT%{_datadir}/gnome/help/%{name}
-for f in $helpdir/C/figures/*.png; do
-  b="$(basename $f)"
-  for d in $helpdir/*; do
-    if [ -d "$d" -a "$d" != "$helpdir/C" ]; then
-      g="$d/figures/$b"
-      if [ -f "$g" ]; then
-        if cmp -s $f $g; then
-          rm "$g"; ln -s "../../C/figures/$b" "$g"
-        fi
-      fi
-    fi
-  done
-done
-
 
 %install
-rm -rf $RPM_BUILD_ROOT
 export GCONF_DISABLE_MAKEFILE_SCHEMA_INSTALL=1
 export tagname=CC
 make LIBTOOL=/usr/bin/libtool DESTDIR=$RPM_BUILD_ROOT install
@@ -313,6 +288,7 @@ gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolutio
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_addressbook.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolution-attachment-reminder.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_calendar.schemas > /dev/null || :
+gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_eplugin_face.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_shell.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolution-template-placeholders.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_email_custom_header.schemas > /dev/null || :
@@ -333,6 +309,7 @@ gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps-evolution-
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps_evolution_addressbook.schemas > /dev/null || :
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps-evolution-attachment-reminder.schemas > /dev/null || :
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps_evolution_calendar.schemas > /dev/null || :
+gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps_evolution_eplugin_face.schemas > /dev/null || :
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps_evolution_shell.schemas > /dev/null || :
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps-evolution-template-placeholders.schemas > /dev/null || :
 gconftool-2 --makefile-install-rule %{_sysconfdir}/gconf/schemas/apps_evolution_email_custom_header.schemas > /dev/null || :
@@ -350,6 +327,7 @@ gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolutio
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_addressbook.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolution-attachment-reminder.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_calendar.schemas > /dev/null || :
+gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_eplugin_face.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_shell.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps-evolution-template-placeholders.schemas > /dev/null || :
 gconftool-2 --makefile-uninstall-rule %{_sysconfdir}/gconf/schemas/apps_evolution_email_custom_header.schemas > /dev/null || :
@@ -372,15 +350,13 @@ fi
 %posttrans
 gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 
-%clean
-rm -rf $RPM_BUILD_ROOT
-
 %files -f translations.lang
 %defattr(-, root, root)
 %doc AUTHORS COPYING ChangeLog NEWS README
 
 # GConf schemas:
 %{_sysconfdir}/gconf/schemas/apps-evolution-attachment-reminder.schemas
+%{_sysconfdir}/gconf/schemas/apps_evolution_eplugin_face.schemas
 %{_sysconfdir}/gconf/schemas/apps-evolution-mail-notification.schemas
 %{_sysconfdir}/gconf/schemas/apps-evolution-mail-prompts-checkdefault.schemas 
 %{_sysconfdir}/gconf/schemas/apps_evolution_addressbook.schemas
@@ -406,7 +382,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/icons/hicolor/24x24/apps/*
 %{_datadir}/icons/hicolor/32x32/apps/*
 %{_datadir}/icons/hicolor/48x48/apps/*
-%{_datadir}/icons/hicolor/scalable/apps/*
+%{_datadir}/icons/hicolor/256x256/apps/*
 
 # The main data directory
 # (have not attempted to split this up into an explicit list)
@@ -414,9 +390,20 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/evolution/%{evo_base_version}
 
 # Modules:
+# These must be listed individually because the NetworkManager
+# module is split off into a separate NetworkManager subpackage.
 %dir %{_libdir}/evolution
 %dir %{_libdir}/evolution/%{evo_base_version}
-%{_libdir}/evolution/%{evo_base_version}/modules
+%dir %{_libdir}/evolution/%{evo_base_version}/modules
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-addressbook.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-calendar.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-composer-autosave.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-mail.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-mailto-handler.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-offline-alert.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-plugin-lib.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-plugin-manager.so
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-startup-wizard.so
 
 # Shared libraries:
 %{_libdir}/evolution/%{evo_base_version}/libcomposer.so.*
@@ -497,6 +484,9 @@ rm -rf $RPM_BUILD_ROOT
 %{evo_plugin_dir}/org-gnome-evolution-google.eplug
 %{evo_plugin_dir}/liborg-gnome-evolution-google.so
 
+%{evo_plugin_dir}/org-gnome-face.eplug
+%{evo_plugin_dir}/liborg-gnome-face.so
+
 %{evo_plugin_dir}/org-gnome-groupwise-features.eplug
 %{evo_plugin_dir}/liborg-gnome-groupwise-features.so
 %{evo_plugin_dir}/org-gnome-compose-send-options.xml
@@ -586,6 +576,10 @@ rm -rf $RPM_BUILD_ROOT
 %{evo_plugin_dir}/liborg-gnome-bogo-junk-plugin.so
 %{_sysconfdir}/gconf/schemas/bogo-junk-plugin.schemas
 
+%files NetworkManager
+%defattr(-, root, root)
+%{_libdir}/evolution/%{evo_base_version}/modules/libevolution-module-network-manager.so
+
 %files spamassassin
 %defattr(-, root, root)
 %{evo_plugin_dir}/org-gnome-sa-junk-plugin.eplug
@@ -604,6 +598,57 @@ rm -rf $RPM_BUILD_ROOT
 %endif
 
 %changelog
+* Wed Nov 30 2011 Matthew Barnes <mbarnes@redhat.com> - 3.0.3-2
+- Add patch for RH bug #757164 (CVE-2011-3201).
+
+* Wed Aug 31 2011 Milan Crha <mcrha@redhat.com> - 3.0.3-1
+- Update to 3.0.3
+- Remove patch for Red Hat bug #707578 (fixed upstream)
+- Remove patch for Red Hat bug #714793 (fixed upstream)
+
+* Wed Jun 22 2011 Milan Crha <mcrha@redhat.com> - 3.0.2-3
+- Add patch for Red Hat bug #714793 (pop3 receives messages twice)
+
+* Thu Jun 02 2011 Milan Crha <mcrha@redhat.com> - 3.0.2-2
+- Add patch for Red Hat bug #707578 (crash on message fetching)
+
+* Mon May 23 2011 Milan Crha <mcrha@redhat.com> - 3.0.2-1
+- Update to 3.0.2
+
+* Tue Apr 26 2011 Milan Crha <mcrha@redhat.com> - 3.0.1-1
+- Update to 3.0.1
+
+* Mon Apr 04 2011 Milan Crha <mcrha@redhat.com> - 3.0.0-1
+- Update to 3.0.0
+
+* Fri Mar 25 2011 Matthew Barnes <mbarnes@redhat.com> - 2.91.92-2
+- Rebuild against NetworkManager 0.9.
+
+* Mon Mar 21 2011 Milan Crha <mcrha@redhat.com> - 2.91.92-1
+- Update to 2.91.92
+
+* Mon Mar 14 2011 Matthew Barnes <mbarnes@redhat.com> - 2.91.91-3
+- Remove some unnecessary BuildRequires:
+  gtkimageview-devel: No release available for gtk3.
+  libgnomecanvas-devel: Evolution bundles its own libgnomecanvas now.
+
+* Fri Mar 11 2011 Matthew Barnes <mbarnes@redhat.com> - 2.91.91-2
+- Split off an evolution-NetworkManager subpackage containing the NM
+  integration module.  Users that choose to bypass NetworkManager can
+  uninstall this subpackage so Evolution doesn't insist it's offline.
+
+* Mon Mar 07 2011 Milan Crha <mcrha@redhat.com> - 2.91.91-1
+- Update to 2.91.91
+
+* Mon Feb 21 2011 Milan Crha <mcrha@redhat.com> - 2.91.90-1
+- Update to 2.91.90
+
+* Fri Feb 11 2011 Matthias Clasen <mclasen@redhat.com> - 2.91.6.1-4
+- Rebuild against newer gtk
+- Fix a problem with gl help translations
+- Upstream fix for build against gtk3
+- Drop %%clean
+
 * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.91.6.1-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 

sources

@@ -1 +1 @@
-d394f7b4cfe5c7634827020097e3763a  evolution-2.91.6.1.tar.bz2
+49f2617445dc552a1527e5a33a7ad8b9  evolution-3.0.3.tar.bz2