diff --git a/SOURCES/emacs-consider-org-file-contents-unsafe.patch b/SOURCES/emacs-consider-org-file-contents-unsafe.patch new file mode 100644 index 0000000..146dc64 --- /dev/null +++ b/SOURCES/emacs-consider-org-file-contents-unsafe.patch @@ -0,0 +1,36 @@ +From 2bc865ace050ff118db43f01457f95f95112b877 Mon Sep 17 00:00:00 2001 +From: Ihor Radchenko +Date: Tue, 20 Feb 2024 14:59:20 +0300 +Subject: org-file-contents: Consider all remote files unsafe + +* lisp/org/org.el (org-file-contents): When loading files, consider all +remote files (like TRAMP-fetched files) unsafe, in addition to URLs. +--- + lisp/org/org.el | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/lisp/org/org.el b/lisp/org/org.el +index 0f5d17d..76559c9 100644 +--- a/lisp/org/org.el ++++ b/lisp/org/org.el +@@ -4576,12 +4576,16 @@ from file or URL, and return nil. + If NOCACHE is non-nil, do a fresh fetch of FILE even if cached version + is available. This option applies only if FILE is a URL." + (let* ((is-url (org-file-url-p file)) ++ (is-remote (condition-case nil ++ (file-remote-p file) ++ ;; In case of error, be safe. ++ (t t))) + (cache (and is-url + (not nocache) + (gethash file org--file-cache)))) + (cond + (cache) +- (is-url ++ ((or is-url is-remote) + (with-current-buffer (url-retrieve-synchronously file) + (goto-char (point-min)) + ;; Move point to after the url-retrieve header. +-- +cgit v1.1 + diff --git a/SOURCES/emacs-latex-preview.patch b/SOURCES/emacs-latex-preview.patch new file mode 100644 index 0000000..29cbc74 --- /dev/null +++ b/SOURCES/emacs-latex-preview.patch @@ -0,0 +1,57 @@ +From 6f9ea396f49cbe38c2173e0a72ba6af3e03b271c Mon Sep 17 00:00:00 2001 +From: Ihor Radchenko +Date: Tue, 20 Feb 2024 12:47:24 +0300 +Subject: org-latex-preview: Add protection when `untrusted-content' is non-nil + +* lisp/org/org.el (org--latex-preview-when-risky): New variable +controlling how to handle LaTeX previews in Org files from untrusted +origin. +(org-latex-preview): Consult `org--latex-preview-when-risky' before +generating previews. + +This patch adds a layer of protection when LaTeX preview is requested +for an email attachment, where `untrusted-content' is set to non-nil. +--- + lisp/org/org.el | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/lisp/org/org.el b/lisp/org/org.el +index c75afbf..0f5d17d 100644 +--- a/lisp/org/org.el ++++ b/lisp/org/org.el +@@ -1140,6 +1140,24 @@ the following lines anywhere in the buffer: + :package-version '(Org . "8.0") + :type 'boolean) + ++(defvar untrusted-content) ; defined in files.el ++(defvar org--latex-preview-when-risky nil ++ "If non-nil, enable LaTeX preview in Org buffers from unsafe source. ++ ++Some specially designed LaTeX code may generate huge pdf or log files ++that may exhaust disk space. ++ ++This variable controls how to handle LaTeX preview when rendering LaTeX ++fragments that originate from incoming email messages. It has no effect ++when Org mode is unable to determine the origin of the Org buffer. ++ ++An Org buffer is considered to be from unsafe source when the ++variable `untrusted-content' has a non-nil value in the buffer. ++ ++If this variable is non-nil, LaTeX previews are rendered unconditionally. ++ ++This variable may be renamed or changed in the future.") ++ + (defcustom org-insert-mode-line-in-empty-file nil + "Non-nil means insert the first line setting Org mode in empty files. + When the function `org-mode' is called interactively in an empty file, this +@@ -15695,6 +15713,7 @@ fragments in the buffer." + (interactive "P") + (cond + ((not (display-graphic-p)) nil) ++ ((and untrusted-content (not org--latex-preview-when-risky)) nil) + ;; Clear whole buffer. + ((equal arg '(64)) + (org-clear-latex-preview (point-min) (point-max)) +-- +cgit v1.1 + diff --git a/SOURCES/emacs-man-el-shell-injection-vulnerability.patch b/SOURCES/emacs-man-el-shell-injection-vulnerability.patch new file mode 100644 index 0000000..584d9ff --- /dev/null +++ b/SOURCES/emacs-man-el-shell-injection-vulnerability.patch @@ -0,0 +1,57 @@ +From 820f0793f0b46448928905552726c1f1b999062f Mon Sep 17 00:00:00 2001 +From: Xi Lu +Date: Tue, 10 Oct 2023 22:20:05 +0800 +Subject: Fix man.el shell injection vulnerability + +* lisp/man.el (Man-translate-references): Fix shell injection +vulnerability. (Bug#66390) +* test/lisp/man-tests.el (man-tests-Man-translate-references): New +test. +--- + lisp/man.el | 6 +++++- + test/lisp/man-tests.el | 12 ++++++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/lisp/man.el b/lisp/man.el +index 55cb938..d963964 100644 +--- a/lisp/man.el ++++ b/lisp/man.el +@@ -761,7 +761,11 @@ and the `Man-section-translations-alist' variables)." + (setq name (match-string 2 ref) + section (match-string 1 ref)))) + (if (string= name "") +- ref ; Return the reference as is ++ ;; see Bug#66390 ++ (mapconcat 'identity ++ (mapcar #'shell-quote-argument ++ (split-string ref "\\s-+")) ++ " ") ; Return the reference as is + (if Man-downcase-section-letters-flag + (setq section (downcase section))) + (while slist +diff --git a/test/lisp/man-tests.el b/test/lisp/man-tests.el +index 140482e..11f5f80 100644 +--- a/test/lisp/man-tests.el ++++ b/test/lisp/man-tests.el +@@ -161,6 +161,18 @@ DESCRIPTION + (let ((button (button-at (match-beginning 0)))) + (should (and button (eq 'Man-xref-header-file (button-type button)))))))))) + ++(ert-deftest man-tests-Man-translate-references () ++ (should (equal (Man-translate-references "basename") ++ "basename")) ++ (should (equal (Man-translate-references "basename(3)") ++ "3 basename")) ++ (should (equal (Man-translate-references "basename(3v)") ++ "3v basename")) ++ (should (equal (Man-translate-references ";id") ++ "\\;id")) ++ (should (equal (Man-translate-references "-k basename") ++ "-k basename"))) ++ + (provide 'man-tests) + + ;;; man-tests.el ends here +-- +cgit v1.1 + diff --git a/SOURCES/emacs-mark-contents-untrusted.patch b/SOURCES/emacs-mark-contents-untrusted.patch new file mode 100644 index 0000000..31e8437 --- /dev/null +++ b/SOURCES/emacs-mark-contents-untrusted.patch @@ -0,0 +1,25 @@ +From 937b9042ad7426acdcca33e3d931d8f495bdd804 Mon Sep 17 00:00:00 2001 +From: Ihor Radchenko +Date: Tue, 20 Feb 2024 12:44:30 +0300 +Subject: * lisp/gnus/mm-view.el (mm-display-inline-fontify): Mark contents + untrusted. + +--- + lisp/gnus/mm-view.el | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el +index 2e1261c..5f234e5 100644 +--- a/lisp/gnus/mm-view.el ++++ b/lisp/gnus/mm-view.el +@@ -504,6 +504,7 @@ If MODE is not set, try to find mode automatically." + (setq coding-system (mm-find-buffer-file-coding-system))) + (setq text (buffer-string)))) + (with-temp-buffer ++ (setq untrusted-content t) + (buffer-disable-undo) + (mm-enable-multibyte) + (insert (cond ((eq charset 'gnus-decoded) +-- +cgit v1.1 + diff --git a/SPECS/emacs.spec b/SPECS/emacs.spec index c1990a7..a9df8fa 100644 --- a/SPECS/emacs.spec +++ b/SPECS/emacs.spec @@ -5,7 +5,7 @@ Summary: GNU Emacs text editor Name: emacs Epoch: 1 Version: 27.2 -Release: 10%{?dist} +Release: 11%{?dist}.1 License: GPLv3+ and CC0-1.0 URL: http://www.gnu.org/software/emacs/ Source0: https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz @@ -33,8 +33,11 @@ Patch6: emacs-etags-local-command-injection-vulnerability.patch Patch7: emacs-htmlfontify-command-injection-vulnerability.patch Patch8: emacs-ruby-mode-local-command-injection-vulnerability.patch Patch9: emacs-ob-latex-command-injection-vulnerability.patch -Patch10: emacs-org-link-expand-abbrev-unsafe-elisp.patch - +Patch10: emacs-consider-org-file-contents-unsafe.patch +Patch11: emacs-mark-contents-untrusted.patch +Patch12: emacs-latex-preview.patch +Patch13: emacs-org-link-expand-abbrev-unsafe-elisp.patch +Patch14: emacs-man-el-shell-injection-vulnerability.patch BuildRequires: gcc BuildRequires: atk-devel BuildRequires: cairo-devel @@ -193,16 +196,20 @@ Development header files for Emacs. %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %setup -q -%patch1 -p1 -b .spellchecker -%patch2 -p1 -b .system-crypto-policies -%patch3 -p1 -b .glibc2.34 -%patch4 -p1 -b .ctags-local-command-execute-vulnerability -%patch5 -p1 -b .64KB-page-size-for-pdump -%patch6 -p1 -b .etags-local-command-injection-vulnerability -%patch7 -p1 -b .htmlfontify-command-injection-vulnerability -%patch8 -p1 -b .ruby-mode-local-command-injection-vulnerability -%patch9 -p1 -b .ob-latex-command-injection-vulnerability -%patch10 -p1 -b .org-link-expand-abbrev-unsafe-elisp +%patch -P 1 -p1 -b .spellchecker +%patch -P 2 -p1 -b .system-crypto-policies +%patch -P 3 -p1 -b .glibc2.34 +%patch -P 4 -p1 -b .ctags-local-command-execute-vulnerability +%patch -P 5 -p1 -b .64KB-page-size-for-pdump +%patch -P 6 -p1 -b .etags-local-command-injection-vulnerability +%patch -P 7 -p1 -b .htmlfontify-command-injection-vulnerability +%patch -P 8 -p1 -b .ruby-mode-local-command-injection-vulnerability +%patch -P 9 -p1 -b .ob-latex-command-injection-vulnerability +%patch -P 10 -p1 -b .consider-org-file-contents-unsafe +%patch -P 11 -p1 -b .mark-contents-untrusted +%patch -P 12 -p1 -b .latex-preview +%patch -P 13 -p1 -b .org-link-expand-abbrev-unsafe-elisp +%patch -P 14 -p1 -b .man-el-shell-injection-vulnerability autoconf # We prefer our emacs.desktop file @@ -493,11 +500,21 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg %{_includedir}/emacs-module.h %changelog -* Fri Aug 23 2024 Jacek Migacz - 1:27.2-10 -- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) -- Disable xwidgets (RHEL-33447) +* Mon Feb 24 2025 Jacek Migacz - 1:27.2-11.el9_5.1 +- Fix man.el shell injection vulnerability (RHEL-79021) +- Eliminate use of obsolete patch syntax (RHEL-80450) -* Sun Apr 02 2023 Jacek Migacz - 1:27.2-9 +* Wed Feb 19 2025 Jacek Migacz - 1:27.2-11 +- Fix man.el shell injection vulnerability (RHEL-79025) + +* Fri Mar 15 2024 Jacek Migacz - 1:27.2-10 +- Disable xwidgets (RHEL-14551) +- org-file-contents: Consider all remote files unsafe (CVE-2024-30205) +- Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203) +- Add protection for LaTeX preview (CVE-2024-30204) +- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) + +* Sun Apr 2 2023 Jacek Migacz - 1:27.2-9 - Fix etags local command injection vulnerability (#2175190) - Fix htmlfontify.el command injection vulnerability (#2175179) - Fix ruby-mode.el local command injection vulnerability (#2175142)