svn commit: r435966 - in head/x11/kde4-runtime: . files
Raphael Kubo da Costa
rakuco at FreeBSD.org
Sat Mar 11 21:42:58 UTC 2017
Author: rakuco
Date: Sat Mar 11 21:42:56 2017
New Revision: 435966
URL: https://svnweb.freebsd.org/changeset/ports/435966
Log:
Add patch for CVE-2016-7787 in kdesu.
MFH: 2017Q1
Security: 41fe4724-06a2-11e7-8e3e-5453ed2e2b49
Added:
head/x11/kde4-runtime/files/patch-kdesu_kdesu_kdesu.cpp (contents, props changed)
Modified:
head/x11/kde4-runtime/Makefile
Modified: head/x11/kde4-runtime/Makefile
==============================================================================
--- head/x11/kde4-runtime/Makefile Sat Mar 11 21:42:07 2017 (r435965)
+++ head/x11/kde4-runtime/Makefile Sat Mar 11 21:42:56 2017 (r435966)
@@ -2,7 +2,7 @@
PORTNAME= kde-runtime
PORTVERSION= ${KDE4_VERSION}
-PORTREVISION= 4
+PORTREVISION= 5
CATEGORIES= x11 kde kde-kde4
MAINTAINER= kde at FreeBSD.org
Added: head/x11/kde4-runtime/files/patch-kdesu_kdesu_kdesu.cpp
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/x11/kde4-runtime/files/patch-kdesu_kdesu_kdesu.cpp Sat Mar 11 21:42:56 2017 (r435966)
@@ -0,0 +1,27 @@
+Fix for https://www.kde.org/info/security/advisory-20160930-1.txt
+--- kdesu/kdesu/kdesu.cpp.orig 2014-10-30 23:50:20 UTC
++++ kdesu/kdesu/kdesu.cpp
+@@ -141,6 +141,10 @@ int main(int argc, char *argv[])
+ {
+ KMessageBox::sorry(0, i18n("Cannot execute command '%1'.", QString::fromLocal8Bit(command)));
+ }
++ if (result == -2)
++ {
++ KMessageBox::sorry(0, i18n("Cannot execute command '%1'. It contains invalid characters.", QString::fromLocal8Bit(command)));
++ }
+
+ return result;
+ }
+@@ -367,6 +371,12 @@ static int startApp()
+ kDebug() << "Don't need password!!\n";
+ }
+
++ for (const QChar character : QString::fromLocal8Bit(command)) {
++ if (!character.isPrint() && character.category() != QChar::Other_Surrogate) {
++ return -2;
++ }
++ }
++
+ // Start the dialog
+ QString password;
+ if (needpw)
More information about the svn-ports-all
mailing list