mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-01 06:21:56 -09:00
029c492e87
Prior to improving check-package to verify that the comment preceding a <pkg>_IGNORE_CVES entry mentions an existing patch, and that the patch itself contains a CVE: tag, we fix all problematic cases that currently exist in Buildroot: - In the case of binutils: the CVE was only applicable to binutils 2.43/2.44, and the oldest version now supported is 2.45, so the patch doesn't exist anymore in Buildroot - For x11vnc, fix a typo in the patch name - Similarly for micropython, the patches were dropped in [1] along with the version bump - Add missing 'CVE:' tag to net-tools patch 0001 - edk2 add missing CVE trailer - libfreeglut add missing CVE trailer - libfreeimage correct reference to patch - libical add missing CVE trailer - proftpd correct reference to patch - sylpheed add missing CVE trailer [1]28eeca9a98package/micropython: bump to version 1.28.0 Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commit636f69ab45) [thomas: adapt to 2025.02.x] Signed-off-by: Thomas Perale <thomas.perale@mind.be>
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From 876c54b2927e48ab6900e5e6b9395742f75e840e Mon Sep 17 00:00:00 2001
|
|
From: Paul <paul@claws-mail.org>
|
|
Date: Sun, 23 May 2021 12:16:40 +0100
|
|
Subject: [PATCH] harden link checker before accepting click
|
|
|
|
CVE: CVE-2021-37746
|
|
[Retrieved from:
|
|
https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431]
|
|
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
|
[Julien: rebased patch on version 3.7.0]
|
|
Signed-off-by: Julien Olivain <ju.o@free.fr>
|
|
---
|
|
src/textview.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/textview.c b/src/textview.c
|
|
index e55eea9..6fbb8a1 100644
|
|
--- a/src/textview.c
|
|
+++ b/src/textview.c
|
|
@@ -2689,7 +2689,7 @@ static gboolean textview_uri_security_check(TextView *textview, RemoteURI *uri)
|
|
gboolean retval = TRUE;
|
|
|
|
if (is_uri_string(uri->uri) == FALSE)
|
|
- return TRUE;
|
|
+ return FALSE;
|
|
|
|
buffer = gtk_text_view_get_buffer(GTK_TEXT_VIEW(textview->text));
|
|
gtk_text_buffer_get_iter_at_offset(buffer, &start_iter, uri->start);
|
|
@@ -2725,6 +2725,8 @@ static gboolean textview_uri_security_check(TextView *textview, RemoteURI *uri)
|
|
if (aval == G_ALERTDEFAULT)
|
|
retval = TRUE;
|
|
}
|
|
+ if (strlen(uri->uri) > get_uri_len(uri->uri))
|
|
+ retval = FALSE;
|
|
|
|
g_free(visible_str);
|
|
|
|
--
|
|
2.45.2
|
|
|