* [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR
@ 2021-08-14 21:00 Fabrice Fontaine
2021-08-14 21:00 ` [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746 Fabrice Fontaine
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Fabrice Fontaine @ 2021-08-14 21:00 UTC (permalink / raw)
To: buildroot; +Cc: Fabrice Fontaine
cpe:2.3:a:sylpheed_project:sylpheed is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asylpheed_project%3Asylpheed
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
package/sylpheed/sylpheed.mk | 1 +
1 file changed, 1 insertion(+)
diff --git a/package/sylpheed/sylpheed.mk b/package/sylpheed/sylpheed.mk
index 0453fba521..2f8a7aeff9 100644
--- a/package/sylpheed/sylpheed.mk
+++ b/package/sylpheed/sylpheed.mk
@@ -10,6 +10,7 @@ SYLPHEED_SOURCE = sylpheed-$(SYLPHEED_VERSION).tar.xz
SYLPHEED_SITE = http://sylpheed.sraoss.jp/sylpheed/v$(SYLPHEED_VERSION_MAJOR)
SYLPHEED_LICENSE = GPL-2.0+ (executables), LGPL-2.1+ (library, attachment plugin)
SYLPHEED_LICENSE_FILES = COPYING COPYING.LIB
+SYLPHEED_CPE_ID_VENDOR = sylpheed_project
SYLPHEED_CONF_OPTS = --disable-gtkspell --disable-gpgme
SYLPHEED_DEPENDENCIES = host-pkgconf libgtk2
--
2.30.2
_______________________________________________
buildroot mailing list
buildroot@busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746
2021-08-14 21:00 [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Fabrice Fontaine
@ 2021-08-14 21:00 ` Fabrice Fontaine
2021-09-04 20:33 ` Peter Korsgaard
2021-08-15 7:26 ` [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Thomas Petazzoni
2021-09-04 20:33 ` Peter Korsgaard
2 siblings, 1 reply; 5+ messages in thread
From: Fabrice Fontaine @ 2021-08-14 21:00 UTC (permalink / raw)
To: buildroot; +Cc: Fabrice Fontaine
textview_uri_security_check in textview.c in Claws Mail before 3.18.0,
and Sylpheed through 3.7.0, does not have sufficient link checks before
accepting a click.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
...-link-checker-before-accepting-click.patch | 37 +++++++++++++++++++
package/sylpheed/sylpheed.mk | 3 ++
2 files changed, 40 insertions(+)
create mode 100644 package/sylpheed/0001-harden-link-checker-before-accepting-click.patch
diff --git a/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch b/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch
new file mode 100644
index 0000000000..fe3375bc91
--- /dev/null
+++ b/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch
@@ -0,0 +1,37 @@
+From ac286a71ed78429e16c612161251b9ea90ccd431 Mon Sep 17 00:00:00 2001
+From: Paul <paul@claws-mail.org>
+Date: Sun, 23 May 2021 12:16:40 +0100
+Subject: [PATCH] harden link checker before accepting click
+
+[Retrieved from:
+https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ src/textview.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/textview.c b/src/textview.c
+index 62ad46eaf..3cdf5d911 100644
+--- a/src/textview.c
++++ b/src/textview.c
+@@ -2885,7 +2885,7 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
+ gboolean retval = TRUE;
+
+ if (is_uri_string(uri->uri) == FALSE)
+- return TRUE;
++ return FALSE;
+
+ visible_str = textview_get_visible_uri(textview, uri);
+ if (visible_str == NULL)
+@@ -2922,6 +2922,8 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
+ if (aval == G_ALERTALTERNATE)
+ retval = TRUE;
+ }
++ if (strlen(uri->uri) > get_uri_len(uri->uri))
++ retval = FALSE;
+
+ g_free(visible_str);
+
+--
+2.25.1
+
diff --git a/package/sylpheed/sylpheed.mk b/package/sylpheed/sylpheed.mk
index 2f8a7aeff9..a7c7adade3 100644
--- a/package/sylpheed/sylpheed.mk
+++ b/package/sylpheed/sylpheed.mk
@@ -14,6 +14,9 @@ SYLPHEED_CPE_ID_VENDOR = sylpheed_project
SYLPHEED_CONF_OPTS = --disable-gtkspell --disable-gpgme
SYLPHEED_DEPENDENCIES = host-pkgconf libgtk2
+# 0001-harden-link-checker-before-accepting-click.patch
+SYLPHEED_IGNORE_CVES += CVE-2021-37746
+
# Remove the -I$(includedir) from the Makefiles
# because it refers to the host /usr/include.
define SYLPHEED_PRECONFIGURE
--
2.30.2
_______________________________________________
buildroot mailing list
buildroot@busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR
2021-08-14 21:00 [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Fabrice Fontaine
2021-08-14 21:00 ` [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746 Fabrice Fontaine
@ 2021-08-15 7:26 ` Thomas Petazzoni
2021-09-04 20:33 ` Peter Korsgaard
2 siblings, 0 replies; 5+ messages in thread
From: Thomas Petazzoni @ 2021-08-15 7:26 UTC (permalink / raw)
To: Fabrice Fontaine; +Cc: buildroot
On Sat, 14 Aug 2021 23:00:41 +0200
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:
> cpe:2.3:a:sylpheed_project:sylpheed is a valid CPE identifier for this
> package:
>
> https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asylpheed_project%3Asylpheed
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
> package/sylpheed/sylpheed.mk | 1 +
> 1 file changed, 1 insertion(+)
Both applied to master!
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR
2021-08-14 21:00 [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Fabrice Fontaine
2021-08-14 21:00 ` [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746 Fabrice Fontaine
2021-08-15 7:26 ` [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Thomas Petazzoni
@ 2021-09-04 20:33 ` Peter Korsgaard
2 siblings, 0 replies; 5+ messages in thread
From: Peter Korsgaard @ 2021-09-04 20:33 UTC (permalink / raw)
To: Fabrice Fontaine; +Cc: buildroot
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
> cpe:2.3:a:sylpheed_project:sylpheed is a valid CPE identifier for this
> package:
> https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asylpheed_project%3Asylpheed
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Committed to 2021.02.x and 2021.05.x, thanks.
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@lists.buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746
2021-08-14 21:00 ` [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746 Fabrice Fontaine
@ 2021-09-04 20:33 ` Peter Korsgaard
0 siblings, 0 replies; 5+ messages in thread
From: Peter Korsgaard @ 2021-09-04 20:33 UTC (permalink / raw)
To: Fabrice Fontaine; +Cc: buildroot
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
> textview_uri_security_check in textview.c in Claws Mail before 3.18.0,
> and Sylpheed through 3.7.0, does not have sufficient link checks before
> accepting a click.
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Committed to 2021.02.x and 2021.05.x, thanks.
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@lists.buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-09-04 20:33 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-14 21:00 [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Fabrice Fontaine
2021-08-14 21:00 ` [Buildroot] [PATCH 2/2] package/sylpheed: fix CVE-2021-37746 Fabrice Fontaine
2021-09-04 20:33 ` Peter Korsgaard
2021-08-15 7:26 ` [Buildroot] [PATCH 1/2] package/sylpheed: add SYLPHEED_CPE_ID_VENDOR Thomas Petazzoni
2021-09-04 20:33 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.