diff --git a/mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch b/mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch new file mode 100644 index 0000000..7ae15fe --- /dev/null +++ b/mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch @@ -0,0 +1,100 @@ +From 3d9028fec8f4d08db2251096307c0bbbebce669a Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Fri, 13 Jul 2018 14:25:28 -0700 +Subject: [PATCH] Check outbuf length in mutt_from_base64() + +The obuf can be overflowed in auth_cram.c, and possibly auth_gss.c. + +Thanks to Jeriko One for the bug report. +--- + base64.c | 8 +++++++- + imap/auth_cram.c | 2 +- + imap/auth_gss.c | 4 ++-- + protos.h | 2 +- + 4 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/base64.c b/base64.c +index fd3ffb88..120d4baa 100644 +--- a/base64.c ++++ b/base64.c +@@ -81,7 +81,7 @@ void mutt_to_base64 (unsigned char *out, const unsigned char *in, size_t len, + + /* Convert '\0'-terminated base 64 string to raw bytes. + * Returns length of returned buffer, or -1 on error */ +-int mutt_from_base64 (char *out, const char *in) ++int mutt_from_base64 (char *out, const char *in, size_t olen) + { + int len = 0; + register unsigned char digit1, digit2, digit3, digit4; +@@ -103,14 +103,20 @@ int mutt_from_base64 (char *out, const char *in) + in += 4; + + /* digits are already sanity-checked */ ++ if (len == olen) ++ return len; + *out++ = (base64val(digit1) << 2) | (base64val(digit2) >> 4); + len++; + if (digit3 != '=') + { ++ if (len == olen) ++ return len; + *out++ = ((base64val(digit2) << 4) & 0xf0) | (base64val(digit3) >> 2); + len++; + if (digit4 != '=') + { ++ if (len == olen) ++ return len; + *out++ = ((base64val(digit3) << 6) & 0xc0) | base64val(digit4); + len++; + } +diff --git a/imap/auth_cram.c b/imap/auth_cram.c +index 9b6db9af..87617215 100644 +--- a/imap/auth_cram.c ++++ b/imap/auth_cram.c +@@ -71,7 +71,7 @@ imap_auth_res_t imap_auth_cram_md5 (IMAP_DATA* idata, const char* method) + goto bail; + } + +- if ((len = mutt_from_base64 (obuf, idata->buf + 2)) == -1) ++ if ((len = mutt_from_base64 (obuf, idata->buf + 2, sizeof(obuf) - 1)) == -1) + { + dprint (1, (debugfile, "Error decoding base64 response.\n")); + goto bail; +diff --git a/imap/auth_gss.c b/imap/auth_gss.c +index a08e7c20..e14f4aac 100644 +--- a/imap/auth_gss.c ++++ b/imap/auth_gss.c +@@ -197,7 +197,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method) + goto bail; + } + +- request_buf.length = mutt_from_base64 (buf2, idata->buf + 2); ++ request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2)); + request_buf.value = buf2; + sec_token = &request_buf; + +@@ -233,7 +233,7 @@ imap_auth_res_t imap_auth_gss (IMAP_DATA* idata, const char* method) + dprint (1, (debugfile, "Error receiving server response.\n")); + goto bail; + } +- request_buf.length = mutt_from_base64 (buf2, idata->buf + 2); ++ request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2)); + request_buf.value = buf2; + + maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token, +diff --git a/protos.h b/protos.h +index 8bcda67f..f933e925 100644 +--- a/protos.h ++++ b/protos.h +@@ -397,7 +397,7 @@ ADDRESS *alias_reverse_lookup (ADDRESS *); + + /* base64.c */ + void mutt_to_base64 (unsigned char*, const unsigned char*, size_t, size_t); +-int mutt_from_base64 (char*, const char*); ++int mutt_from_base64 (char*, const char*, size_t); + + /* utf8.c */ + int mutt_wctoutf8 (char *s, unsigned int c, size_t buflen); +-- +2.13.6 + diff --git a/mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch b/mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch new file mode 100644 index 0000000..27cb377 --- /dev/null +++ b/mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch @@ -0,0 +1,56 @@ +From 3287534daa3beac68e2e83ca4b4fe8a3148ff870 Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Fri, 13 Jul 2018 12:15:00 -0700 +Subject: [PATCH] Don't overflow tmp in msg_parse_fetch. + +Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer. + +Thanks to Jeriko One for the bug report and patch, which this patch is +based upon. +--- + imap/message.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/imap/message.c b/imap/message.c +index 9ebfeb8e..e6056555 100644 +--- a/imap/message.c ++++ b/imap/message.c +@@ -1345,6 +1345,7 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s) + { + char tmp[SHORT_STRING]; + char *ptmp; ++ size_t dlen; + + if (!s) + return -1; +@@ -1378,8 +1379,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s) + } + s++; + ptmp = tmp; +- while (*s && *s != '\"') ++ dlen = sizeof(tmp) - 1; ++ while (*s && *s != '\"' && dlen) ++ { + *ptmp++ = *s++; ++ dlen--; ++ } + if (*s != '\"') + return -1; + s++; /* skip past the trailing " */ +@@ -1391,8 +1396,12 @@ static int msg_parse_fetch (IMAP_HEADER *h, char *s) + s += 11; + SKIPWS (s); + ptmp = tmp; +- while (isdigit ((unsigned char) *s)) ++ dlen = sizeof(tmp) - 1; ++ while (isdigit ((unsigned char) *s) && dlen) ++ { + *ptmp++ = *s++; ++ dlen--; ++ } + *ptmp = 0; + h->content_length = atoi (tmp); + } +-- +2.13.6 + diff --git a/mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch b/mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch new file mode 100644 index 0000000..bf86064 --- /dev/null +++ b/mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch @@ -0,0 +1,27 @@ +From e154cba1b3fc52bb8cb8aa846353c0db79b5d9c6 Mon Sep 17 00:00:00 2001 +From: JerikoOne +Date: Fri, 13 Jul 2018 10:47:11 -0700 +Subject: [PATCH] Ensure UID in fetch_uidl. + +--- + pop.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/pop.c b/pop.c +index ecfd8d7c..d9d95fbe 100644 +--- a/pop.c ++++ b/pop.c +@@ -152,6 +152,10 @@ static int fetch_uidl (char *line, void *data) + endp++; + memmove(line, endp, strlen(endp) + 1); + ++ /* uid must be at least be 1 byte */ ++ if (strlen(line) == 0) ++ return -1; ++ + for (i = 0; i < ctx->msgcount; i++) + if (!mutt_strcmp (line, ctx->hdrs[i]->data)) + break; +-- +2.13.6 + diff --git a/mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch b/mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch new file mode 100644 index 0000000..bc32d5d --- /dev/null +++ b/mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch @@ -0,0 +1,55 @@ +From e0131852c6059107939893016c8ff56b6e42865d Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Thu, 12 Jul 2018 20:46:37 -0700 +Subject: [PATCH] Fix imap_quote_string() length check errors. + +The function wasn't properly checking for dlen<2 before quoting, and +wasn't properly pre-adjusting dlen to include the initial quote. + +Thanks to Jeriko One for reporting these issues. +--- + imap/util.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/imap/util.c b/imap/util.c +index 3274a70c..27792944 100644 +--- a/imap/util.c ++++ b/imap/util.c +@@ -614,20 +614,29 @@ static void _imap_quote_string (char *dest, size_t dlen, const char *src, + char *pt; + const char *s; + ++ if (!(dest && dlen && src && to_quote)) ++ return; ++ ++ if (dlen < 3) ++ { ++ *dest = 0; ++ return; ++ } ++ + pt = dest; + s = src; + +- *pt++ = '"'; +- /* save room for trailing quote-char */ +- dlen -= 2; ++ /* save room for pre/post quote-char and trailing null */ ++ dlen -= 3; + ++ *pt++ = '"'; + for (; *s && dlen; s++) + { + if (strchr (to_quote, *s)) + { ++ if (dlen < 2) ++ break; + dlen -= 2; +- if (!dlen) +- break; + *pt++ = '\\'; + *pt++ = *s; + } +-- +2.13.6 + diff --git a/mutt-1.9.2-Handle_NO_response_without_message_properly.patch b/mutt-1.9.2-Handle_NO_response_without_message_properly.patch new file mode 100644 index 0000000..560ef18 --- /dev/null +++ b/mutt-1.9.2-Handle_NO_response_without_message_properly.patch @@ -0,0 +1,25 @@ +From 9347b5c01dc52682cb6be11539d9b7ebceae4416 Mon Sep 17 00:00:00 2001 +From: JerikoOne +Date: Fri, 13 Jul 2018 12:24:58 -0700 +Subject: [PATCH] Handle NO response without message properly + +--- + imap/command.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/imap/command.c b/imap/command.c +index 82bf54c4..bb267f62 100644 +--- a/imap/command.c ++++ b/imap/command.c +@@ -586,7 +586,7 @@ static int cmd_handle_untagged (IMAP_DATA* idata) + dprint (2, (debugfile, "Handling untagged NO\n")); + + /* Display the warning message from the server */ +- mutt_error ("%s", s+3); ++ mutt_error ("%s", s+2); + mutt_sleep (2); + } + +-- +2.13.6 + diff --git a/mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch b/mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch new file mode 100644 index 0000000..d289340 --- /dev/null +++ b/mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch @@ -0,0 +1,34 @@ +From e57a8602b45f58edf7b3ffb61bb17525d75dfcb1 Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Fri, 13 Jul 2018 12:35:50 -0700 +Subject: [PATCH] Verify IMAP status mailbox literal count size. + +Ensure the length isn't bigger than the idata->buf. + +Thanks to Jeriko One fo the bug report and patch, which this commit is +based upon. +--- + imap/command.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/imap/command.c b/imap/command.c +index bb267f62..6abd759d 100644 +--- a/imap/command.c ++++ b/imap/command.c +@@ -969,6 +969,13 @@ static void cmd_parse_status (IMAP_DATA* idata, char* s) + idata->status = IMAP_FATAL; + return; + } ++ ++ if (strlen(idata->buf) < litlen) ++ { ++ dprint (1, (debugfile, "Error parsing STATUS mailbox\n")); ++ return; ++ } ++ + mailbox = idata->buf; + s = mailbox + litlen; + *s = '\0'; +-- +2.13.6 + diff --git a/mutt-1.9.2-quote_mbox_names.patch b/mutt-1.9.2-quote_mbox_names.patch new file mode 100644 index 0000000..1ee65d5 --- /dev/null +++ b/mutt-1.9.2-quote_mbox_names.patch @@ -0,0 +1,127 @@ +From 185152818541f5cdc059cbff3f3e8b654fc27c1d Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Sat, 7 Jul 2018 19:03:44 -0700 +Subject: [PATCH] Properly quote IMAP mailbox names when (un)subscribing. + +When handling automatic subscription (via $imap_check_subscribed), or +manual subscribe/unsubscribe commands, mutt generating a "mailboxes" +command but failed to properly escape backquotes. + +Thanks to Jeriko One for the detailed bug report and patch, which this +commit is based upon. +--- + imap/command.c | 5 +++-- + imap/imap.c | 7 +++++-- + imap/imap_private.h | 3 ++- + imap/util.c | 25 ++++++++++++++++++++----- + 4 files changed, 30 insertions(+), 10 deletions(-) + +diff --git a/imap/command.c b/imap/command.c +index c8825981..c79d4f28 100644 +--- a/imap/command.c ++++ b/imap/command.c +@@ -842,8 +842,9 @@ static void cmd_parse_lsub (IMAP_DATA* idata, char* s) + + strfcpy (buf, "mailboxes \"", sizeof (buf)); + mutt_account_tourl (&idata->conn->account, &url); +- /* escape \ and " */ +- imap_quote_string(errstr, sizeof (errstr), list.name); ++ /* escape \ and ". Also escape ` because the resulting ++ * string will be passed to mutt_parse_rc_line. */ ++ imap_quote_string_and_backquotes (errstr, sizeof (errstr), list.name); + url.path = errstr + 1; + url.path[strlen(url.path) - 1] = '\0'; + if (!mutt_strcmp (url.user, ImapUser)) +diff --git a/imap/imap.c b/imap/imap.c +index 668203b8..c3a8ffd0 100644 +--- a/imap/imap.c ++++ b/imap/imap.c +@@ -1930,6 +1930,7 @@ int imap_subscribe (char *path, int subscribe) + char buf[LONG_STRING]; + char mbox[LONG_STRING]; + char errstr[STRING]; ++ int mblen; + BUFFER err, token; + IMAP_MBOX mx; + +@@ -1951,8 +1952,10 @@ int imap_subscribe (char *path, int subscribe) + mutt_buffer_init (&err); + err.data = errstr; + err.dsize = sizeof (errstr); +- snprintf (mbox, sizeof (mbox), "%smailboxes \"%s\"", +- subscribe ? "" : "un", path); ++ mblen = snprintf (mbox, sizeof (mbox), "%smailboxes ", ++ subscribe ? "" : "un"); ++ imap_quote_string_and_backquotes (mbox + mblen, sizeof(mbox) - mblen, ++ path); + if (mutt_parse_rc_line (mbox, &token, &err)) + dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", errstr)); + FREE (&token.data); +diff --git a/imap/imap_private.h b/imap/imap_private.h +index 312fbfe4..349c5a49 100644 +--- a/imap/imap_private.h ++++ b/imap/imap_private.h +@@ -301,7 +301,8 @@ char* imap_next_word (char* s); + time_t imap_parse_date (char* s); + void imap_make_date (char* buf, time_t timestamp); + void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path); +-void imap_quote_string (char* dest, size_t slen, const char* src); ++void imap_quote_string (char* dest, size_t dlen, const char* src); ++void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src); + void imap_unquote_string (char* s); + void imap_munge_mbox_name (IMAP_DATA *idata, char *dest, size_t dlen, const char *src); + void imap_unmunge_mbox_name (IMAP_DATA *idata, char *s); +diff --git a/imap/util.c b/imap/util.c +index 914c93c3..3274a70c 100644 +--- a/imap/util.c ++++ b/imap/util.c +@@ -608,11 +608,9 @@ void imap_qualify_path (char *dest, size_t len, IMAP_MBOX *mx, char* path) + } + + +-/* imap_quote_string: quote string according to IMAP rules: +- * surround string with quotes, escape " and \ with \ */ +-void imap_quote_string (char *dest, size_t dlen, const char *src) ++static void _imap_quote_string (char *dest, size_t dlen, const char *src, ++ const char *to_quote) + { +- static const char quote[] = "\"\\"; + char *pt; + const char *s; + +@@ -625,7 +623,7 @@ void imap_quote_string (char *dest, size_t dlen, const char *src) + + for (; *s && dlen; s++) + { +- if (strchr (quote, *s)) ++ if (strchr (to_quote, *s)) + { + dlen -= 2; + if (!dlen) +@@ -643,6 +641,23 @@ void imap_quote_string (char *dest, size_t dlen, const char *src) + *pt = 0; + } + ++/* imap_quote_string: quote string according to IMAP rules: ++ * surround string with quotes, escape " and \ with \ */ ++void imap_quote_string (char *dest, size_t dlen, const char *src) ++{ ++ _imap_quote_string (dest, dlen, src, "\"\\"); ++} ++ ++/* imap_quote_string_and_backquotes: quote string according to IMAP rules: ++ * surround string with quotes, escape " and \ with \. ++ * Additionally, escape backquotes with \ to protect against code injection ++ * when using the resulting string in mutt_parse_rc_line(). ++ */ ++void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src) ++{ ++ _imap_quote_string (dest, dlen, src, "\"\\`"); ++} ++ + /* imap_unquote_string: equally stupid unquoting routine */ + void imap_unquote_string (char *s) + { +-- +2.18.0 + diff --git a/mutt-1.9.2-sanitize_pop_paths.patch b/mutt-1.9.2-sanitize_pop_paths.patch new file mode 100644 index 0000000..9c72401 --- /dev/null +++ b/mutt-1.9.2-sanitize_pop_paths.patch @@ -0,0 +1,100 @@ +From 6aed28b40a0410ec47d40c8c7296d8d10bae7576 Mon Sep 17 00:00:00 2001 +From: Kevin McCarthy +Date: Fri, 13 Jul 2018 11:16:33 -0700 +Subject: [PATCH] Sanitize POP bcache paths. + +Protect against bcache directory path traversal for UID values. + +Thanks for Jeriko One for the bug report and patch, which this commit +is based upon. +--- + pop.c | 31 +++++++++++++++++++++++++------ + 1 file changed, 25 insertions(+), 6 deletions(-) + +diff --git a/pop.c b/pop.c +index d9d95fbe..288166de 100644 +--- a/pop.c ++++ b/pop.c +@@ -40,6 +40,25 @@ + #define HC_FEXT "hcache" /* extension for hcache as POP lacks paths */ + #endif + ++/** ++ * cache_id - Make a message-cache-compatible id ++ * @param id POP message id ++ * @retval ptr Sanitised string ++ * ++ * The POP message id may contain '/' and other awkward characters. ++ * ++ * @note This function returns a pointer to a static buffer. ++ */ ++static const char *cache_id(const char *id) ++{ ++ static char clean[SHORT_STRING]; ++ ++ strfcpy (clean, id, sizeof(clean)); ++ mutt_sanitize_filename (clean, 1); ++ ++ return clean; ++} ++ + /* write line to file */ + static int fetch_message (char *line, void *file) + { +@@ -205,7 +224,7 @@ static int msg_cache_check (const char *id, body_cache_t *bcache, void *data) + /* message not found in context -> remove it from cache + * return the result of bcache, so we stop upon its first error + */ +- return mutt_bcache_del (bcache, id); ++ return mutt_bcache_del (bcache, cache_id (id)); + } + + #ifdef USE_HCACHE +@@ -355,7 +374,7 @@ static int pop_fetch_headers (CONTEXT *ctx) + * - if we also have a body: read + * - if we don't have a body: new + */ +- bcached = mutt_bcache_exists (pop_data->bcache, ctx->hdrs[i]->data) == 0; ++ bcached = mutt_bcache_exists (pop_data->bcache, cache_id (ctx->hdrs[i]->data)) == 0; + ctx->hdrs[i]->old = 0; + ctx->hdrs[i]->read = 0; + if (hcached) +@@ -531,7 +550,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno) + unsigned short bcache = 1; + + /* see if we already have the message in body cache */ +- if ((msg->fp = mutt_bcache_get (pop_data->bcache, h->data))) ++ if ((msg->fp = mutt_bcache_get (pop_data->bcache, cache_id (h->data)))) + return 0; + + /* +@@ -578,7 +597,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno) + MUTT_PROGRESS_SIZE, NetInc, h->content->length + h->content->offset - 1); + + /* see if we can put in body cache; use our cache as fallback */ +- if (!(msg->fp = mutt_bcache_put (pop_data->bcache, h->data, 1))) ++ if (!(msg->fp = mutt_bcache_put (pop_data->bcache, cache_id (h->data), 1))) + { + /* no */ + bcache = 0; +@@ -624,7 +643,7 @@ static int pop_fetch_message (CONTEXT* ctx, MESSAGE* msg, int msgno) + * portion of the headers, those required for the main display. + */ + if (bcache) +- mutt_bcache_commit (pop_data->bcache, h->data); ++ mutt_bcache_commit (pop_data->bcache, cache_id (h->data)); + else + { + cache->index = h->index; +@@ -704,7 +723,7 @@ static int pop_sync_mailbox (CONTEXT *ctx, int *index_hint) + snprintf (buf, sizeof (buf), "DELE %d\r\n", ctx->hdrs[i]->refno); + if ((ret = pop_query (pop_data, buf, sizeof (buf))) == 0) + { +- mutt_bcache_del (pop_data->bcache, ctx->hdrs[i]->data); ++ mutt_bcache_del (pop_data->bcache, cache_id (ctx->hdrs[i]->data)); + #if USE_HCACHE + mutt_hcache_delete (hc, ctx->hdrs[i]->data, strlen); + #endif +-- +2.18.0 + diff --git a/mutt-1.9.2-selectively_cache_headers.patch b/mutt-1.9.2-selectively_cache_headers.patch new file mode 100644 index 0000000..ba705a0 --- /dev/null +++ b/mutt-1.9.2-selectively_cache_headers.patch @@ -0,0 +1,39 @@ +From 31eef6c766f47df8281942d19f76e35f475c781d Mon Sep 17 00:00:00 2001 +From: Richard Russon +Date: Fri, 13 Jul 2018 11:33:16 -0700 +Subject: [PATCH] Selectively cache headers. + +Thanks to NeoMutt and Jeriko One for the patch, which was slightly +modified to apply to the Mutt code. +--- + imap/util.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/imap/util.c b/imap/util.c +index 27792944..d4cc2742 100644 +--- a/imap/util.c ++++ b/imap/util.c +@@ -84,6 +84,7 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path) + ciss_url_t url; + char cachepath[LONG_STRING]; + char mbox[LONG_STRING]; ++ size_t len; + + if (path) + imap_cachepath (idata, path, mbox, sizeof (mbox)); +@@ -96,6 +97,12 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path) + FREE (&mx.mbox); + } + ++ if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0)) ++ return NULL; ++ len = strlen(mbox); ++ if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0)) ++ return NULL; ++ + mutt_account_tourl (&idata->conn->account, &url); + url.path = mbox; + url_ciss_tostring (&url, cachepath, sizeof (cachepath), U_PATH); +-- +2.18.0 + diff --git a/mutt.spec b/mutt.spec index 199d073..86fe679 100644 --- a/mutt.spec +++ b/mutt.spec @@ -19,7 +19,7 @@ Summary: A text mode mail user agent Name: mutt Version: 1.9.2 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 5 # The entire source code is GPLv2+ except # pgpewrap.c setenv.c sha1.c wcwidth.c which are Public Domain @@ -35,6 +35,34 @@ Patch3: mutt-1.7.0-syncdebug.patch # FIXME make it to upstream Patch8: mutt-1.5.23-system_certs.patch Patch9: mutt-1.9.0-ssl_ciphers.patch + +# CVE-2018-14354 CVE-2018-14357 +Patch10: mutt-1.9.2-quote_mbox_names.patch + +# CVE-2018-14362 +Patch11: mutt-1.9.2-sanitize_pop_paths.patch + +# CVE-2018-14355 +Patch12: mutt-1.9.2-selectively_cache_headers.patch + +# CVE-2018-14349 +Patch13: mutt-1.9.2-Handle_NO_response_without_message_properly.patch + +# CVE-2018-14350 CVE-2018-14358 +Patch14: mutt-1.9.2-Don_t_overflow_tmp_in_msg_parse_fetch.patch + +# CVE-2018-14351 +Patch15: mutt-1.9.2-Verify_IMAP_status_mailbox_literal_count_size.patch + +# CVE-2018-14352 CVE-2018-14353 +Patch16: mutt-1.9.2-Fix_imap_quote_string_length_check_errors.patch + +# CVE-2018-14356 +Patch17: mutt-1.9.2-Ensure_UID_in_fetch_uidl.patch + +# CVE-2018-14359 +Patch18: mutt-1.9.2-Check_outbuf_length_in_mutt_from_base64.patch + Url: http://www.mutt.org Requires: mailcap, urlview BuildRequires: ncurses-devel, gettext, automake @@ -84,6 +112,15 @@ autoreconf --install %patch3 -p1 -b .syncdebug %patch8 -p1 -b .system_certs %patch9 -p1 -b .ssl_ciphers +%patch10 -p1 -b .quote_mbox_names +%patch11 -p1 -b .sanitize_pop_paths +%patch12 -p1 -b .selectively_cache_headers +%patch13 -p1 -b .Handle_NO_response_without_message_properly +%patch14 -p1 -b .Don_t_overflow_tmp_in_msg_parse_fetch +%patch15 -p1 -b .Verify_IMAP_status_mailbox_literal_count_size +%patch16 -p1 -b .Fix_imap_quote_string_length_check_errors +%patch17 -p1 -b .Ensure_UID_in_fetch_uidl +%patch18 -p1 -b .Check_outbuf_length_in_mutt_from_base64 sed -i -r 's/`$GPGME_CONFIG --libs`/"\0 -lgpg-error"/' configure # disable mutt_dotlock program - remove support from mutt binary @@ -196,6 +233,16 @@ ln -sf ./muttrc.5 %{buildroot}%{_mandir}/man5/muttrc.local.5 %changelog +* Thu Jul 19 2018 Matej Mužila - 5:1.9.2-2 +- Backport security patches from mutt-1.10.1 +- Resolves: #1602082 (CVE-2018-14354, CVE-2018-14355, CVE-2018-14362) +- Resolves: #1602916 (CVE-2018-14357) +- Resolves: #1602923 (CVE-2018-14350) +- Resolves: #1602935 (CVE-2018-14349) +- Resolves: #1602954 (CVE-2018-14351) +- Resolves: CVE-2018-14358, CVE-2018-14352, CVE-2018-14353, CVE-2018-14356, + CVE-2018-14359 + * Wed Dec 20 2017 Matej Mužila - 5:1.9.2-1 - Upgrade to 1.9.2