mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-01 06:21:56 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/sylpheed: fix CVE-2021-37746

Browse Source 
textview_uri_security_check in textview.c in Claws Mail before 3.18.0,
and Sylpheed through 3.7.0, does not have sufficient link checks before
accepting a click.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 634dcbd50d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Fabrice Fontaine
2021-08-14 23:00:42 +02:00
committed by Peter Korsgaard
parent 37edb86fa6
commit 28c2796c23
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
package/sylpheed/0001-harden-link-checker-before-accepting-click.patch Normal file
View File

@@ -0,0 +1,37 @@
From ac286a71ed78429e16c612161251b9ea90ccd431 Mon Sep 17 00:00:00 2001
From: Paul <paul@claws-mail.org>
Date: Sun, 23 May 2021 12:16:40 +0100
Subject: [PATCH] harden link checker before accepting click
[Retrieved from:
https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
src/textview.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/textview.c b/src/textview.c
index 62ad46eaf..3cdf5d911 100644
--- a/src/textview.c
+++ b/src/textview.c
@@ -2885,7 +2885,7 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
gboolean retval = TRUE;
if (is_uri_string(uri->uri) == FALSE)
- return TRUE;
+ return FALSE;
visible_str = textview_get_visible_uri(textview, uri);
if (visible_str == NULL)
@@ -2922,6 +2922,8 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
if (aval == G_ALERTALTERNATE)
retval = TRUE;
}
+ if (strlen(uri->uri) > get_uri_len(uri->uri))
+ retval = FALSE;
g_free(visible_str);
--
2.25.1

3
package/sylpheed/sylpheed.mk
View File

@@ -14,6 +14,9 @@ SYLPHEED_CPE_ID_VENDOR = sylpheed_project
SYLPHEED_CONF_OPTS = --disable-gtkspell --disable-gpgme SYLPHEED_CONF_OPTS = --disable-gtkspell --disable-gpgme
SYLPHEED_DEPENDENCIES = host-pkgconf libgtk2 SYLPHEED_DEPENDENCIES = host-pkgconf libgtk2
# 0001-harden-link-checker-before-accepting-click.patch
SYLPHEED_IGNORE_CVES += CVE-2021-37746
# Remove the -I$(includedir) from the Makefiles # Remove the -I$(includedir) from the Makefiles
# because it refers to the host /usr/include. # because it refers to the host /usr/include.
define SYLPHEED_PRECONFIGURE define SYLPHEED_PRECONFIGURE