Merge branch 'f20' into f21
This commit is contained in:
Jiri Popelka
commit
e97153e718
99
cups-CVE-2014-5029-5030-5031.patch
Normal file
99
cups-CVE-2014-5029-5030-5031.patch
Normal file
@ -0,0 +1,99 @@
|
||||
From d40220801eec992804cb728d51228d19496fffd9 Mon Sep 17 00:00:00 2001
|
||||
From: msweet <msweet@a1ca3aef-8c08-0410-bb20-df032aa958be>
|
||||
Date: Tue, 22 Jul 2014 14:03:19 +0000
|
||||
Subject: [PATCH] Mirror changes from trunk.
|
||||
|
||||
git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/branches/branch-1.7@12057 a1ca3aef-8c08-0410-bb20-df032aa958be
|
||||
---
|
||||
diff --git a/scheduler/client.c b/scheduler/client.c
|
||||
index e5959fa..366b351 100644
|
||||
--- a/scheduler/client.c
|
||||
+++ b/scheduler/client.c
|
||||
@@ -3310,7 +3310,7 @@ get_file(cupsd_client_t *con, /* I - Client connection */
|
||||
* then fallback to the default one...
|
||||
*/
|
||||
|
||||
- if ((status = stat(filename, filestats)) != 0 && language[0] &&
|
||||
+ if ((status = lstat(filename, filestats)) != 0 && language[0] &&
|
||||
strncmp(con->uri, "/icons/", 7) &&
|
||||
strncmp(con->uri, "/ppd/", 5) &&
|
||||
strncmp(con->uri, "/rss/", 5) &&
|
||||
@@ -3408,13 +3408,13 @@ get_file(cupsd_client_t *con, /* I - Client connection */
|
||||
plen = len - (ptr - filename);
|
||||
|
||||
strlcpy(ptr, "index.html", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
|
||||
#ifdef HAVE_JAVA
|
||||
if (status)
|
||||
{
|
||||
strlcpy(ptr, "index.class", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
}
|
||||
#endif /* HAVE_JAVA */
|
||||
|
||||
@@ -3422,7 +3422,7 @@ get_file(cupsd_client_t *con, /* I - Client connection */
|
||||
if (status)
|
||||
{
|
||||
strlcpy(ptr, "index.pl", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
}
|
||||
#endif /* HAVE_PERL */
|
||||
|
||||
@@ -3430,7 +3430,7 @@ get_file(cupsd_client_t *con, /* I - Client connection */
|
||||
if (status)
|
||||
{
|
||||
strlcpy(ptr, "index.php", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
}
|
||||
#endif /* HAVE_PHP */
|
||||
|
||||
@@ -3438,18 +3438,39 @@ get_file(cupsd_client_t *con, /* I - Client connection */
|
||||
if (status)
|
||||
{
|
||||
strlcpy(ptr, "index.pyc", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
}
|
||||
|
||||
if (status)
|
||||
{
|
||||
strlcpy(ptr, "index.py", plen);
|
||||
- status = stat(filename, filestats);
|
||||
+ status = lstat(filename, filestats);
|
||||
}
|
||||
#endif /* HAVE_PYTHON */
|
||||
|
||||
}
|
||||
while (status && language[0]);
|
||||
+
|
||||
+ /*
|
||||
+ * If we've found a symlink, 404 the sucker to avoid disclosing information.
|
||||
+ */
|
||||
+
|
||||
+ if (!status && S_ISLNK(filestats->st_mode))
|
||||
+ {
|
||||
+ cupsdLogMessage(CUPSD_LOG_INFO, "[Client %d] Symlinks such as \"%s\" are not allowed.", con->http.fd, filename);
|
||||
+ return (NULL);
|
||||
+ }
|
||||
+
|
||||
+ /*
|
||||
+ * Similarly, if the file/directory does not have world read permissions, do
|
||||
+ * not allow access...
|
||||
+ */
|
||||
+
|
||||
+ if (!status && !(filestats->st_mode & S_IROTH))
|
||||
+ {
|
||||
+ cupsdLogMessage(CUPSD_LOG_INFO, "[Client %d] Files/directories such as \"%s\" must be world-readable.", con->http.fd, filename);
|
||||
+ return (NULL);
|
||||
+ }
|
||||
}
|
||||
|
||||
cupsdLogMessage(CUPSD_LOG_DEBUG2,
|
||||
--
|
||||
1.9.3
|
||||
|
||||
17
cups-cgi.patch
Normal file
17
cups-cgi.patch
Normal file
@ -0,0 +1,17 @@
|
||||
diff -up cups-1.7.4/scheduler/client.c~ cups-1.7.4/scheduler/client.c
|
||||
--- cups-1.7.4/scheduler/client.c~ 2014-07-18 13:34:25.243248601 +0100
|
||||
+++ cups-1.7.4/scheduler/client.c 2014-07-18 14:50:55.356614243 +0100
|
||||
@@ -3980,12 +3980,7 @@ pipe_command(cupsd_client_t *con, /* I -
|
||||
argv[0] = command;
|
||||
|
||||
if (options)
|
||||
- {
|
||||
- commptr = options;
|
||||
- if (*commptr == ' ')
|
||||
- commptr ++;
|
||||
- strlcpy(argbuf, commptr, sizeof(argbuf));
|
||||
- }
|
||||
+ strlcpy(argbuf, options, sizeof(argbuf));
|
||||
else
|
||||
argbuf[0] = '\0';
|
||||
|
||||
14
cups.spec
14
cups.spec
@ -11,7 +11,7 @@ Summary: CUPS printing system
|
||||
Name: cups
|
||||
Epoch: 1
|
||||
Version: 1.7.4
|
||||
Release: 1%{?dist}
|
||||
Release: 3%{?dist}
|
||||
License: GPLv2
|
||||
Url: http://www.cups.org/
|
||||
Source: http://www.cups.org/software/%{version}/cups-%{version}-source.tar.bz2
|
||||
@ -65,6 +65,8 @@ Patch36: cups-web-devices-timeout.patch
|
||||
Patch37: cups-final-content-type.patch
|
||||
Patch38: cups-journal.patch
|
||||
Patch39: cups-synconclose.patch
|
||||
Patch40: cups-cgi.patch
|
||||
Patch41: cups-CVE-2014-5029-5030-5031.patch
|
||||
|
||||
Patch100: cups-lspp.patch
|
||||
|
||||
@ -264,6 +266,10 @@ Sends IPP requests to the specified URI and tests and/or displays the results.
|
||||
%patch38 -p1 -b .journal
|
||||
# Set the default for SyncOnClose to Yes.
|
||||
%patch39 -p1 -b .synconclose
|
||||
# Fix CGI handling (STR #4454).
|
||||
%patch40 -p1 -b .cgi
|
||||
# CVE-2014-5029, CVE-2014-5030, CVE-2014-5031 (#1122601)
|
||||
%patch41 -p1 -b .CVE-2014-5029-5030-5031
|
||||
|
||||
%if %lspp
|
||||
# LSPP support.
|
||||
@ -671,6 +677,12 @@ rm -f %{cups_serverbin}/backend/smb
|
||||
%{_mandir}/man5/ipptoolfile.5.gz
|
||||
|
||||
%changelog
|
||||
* Wed Jul 23 2014 Jiri Popelka <jpopelka@redhat.com> - 1:1.7.4-3
|
||||
- CVE-2014-5029, CVE-2014-5030, CVE-2014-5031 (#1122601)
|
||||
|
||||
* Wed Jul 23 2014 Tim Waugh <twaugh@redhat.com> - 1:1.7.4-2
|
||||
- Fix CGI handling (STR #4454).
|
||||
|
||||
* Mon Jul 14 2014 Jiri Popelka <jpopelka@redhat.com> - 1:1.7.4-1
|
||||
- 1.7.4: CVE-2014-3537
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user