import UBI emacs-27.2-11.el9_5.1

SOURCES/emacs-consider-org-file-contents-unsafe.patch

@@ -0,0 +1,36 @@
+From 2bc865ace050ff118db43f01457f95f95112b877 Mon Sep 17 00:00:00 2001
+From: Ihor Radchenko <yantar92@posteo.net>
+Date: Tue, 20 Feb 2024 14:59:20 +0300
+Subject: org-file-contents: Consider all remote files unsafe
+
+* lisp/org/org.el (org-file-contents): When loading files, consider all
+remote files (like TRAMP-fetched files) unsafe, in addition to URLs.
+---
+ lisp/org/org.el | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lisp/org/org.el b/lisp/org/org.el
+index 0f5d17d..76559c9 100644
+--- a/lisp/org/org.el
++++ b/lisp/org/org.el
+@@ -4576,12 +4576,16 @@ from file or URL, and return nil.
+ If NOCACHE is non-nil, do a fresh fetch of FILE even if cached version
+ is available.  This option applies only if FILE is a URL."
+   (let* ((is-url (org-file-url-p file))
++         (is-remote (condition-case nil
++                        (file-remote-p file)
++                      ;; In case of error, be safe.
++                      (t t)))
+          (cache (and is-url
+                      (not nocache)
+                      (gethash file org--file-cache))))
+     (cond
+      (cache)
+-     (is-url
++     ((or is-url is-remote)
+       (with-current-buffer (url-retrieve-synchronously file)
+ 	(goto-char (point-min))
+ 	;; Move point to after the url-retrieve header.
+-- 
+cgit v1.1
+

SOURCES/emacs-latex-preview.patch

@@ -0,0 +1,57 @@
+From 6f9ea396f49cbe38c2173e0a72ba6af3e03b271c Mon Sep 17 00:00:00 2001
+From: Ihor Radchenko <yantar92@posteo.net>
+Date: Tue, 20 Feb 2024 12:47:24 +0300
+Subject: org-latex-preview: Add protection when `untrusted-content' is non-nil
+
+* lisp/org/org.el (org--latex-preview-when-risky): New variable
+controlling how to handle LaTeX previews in Org files from untrusted
+origin.
+(org-latex-preview): Consult `org--latex-preview-when-risky' before
+generating previews.
+
+This patch adds a layer of protection when LaTeX preview is requested
+for an email attachment, where `untrusted-content' is set to non-nil.
+---
+ lisp/org/org.el | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/lisp/org/org.el b/lisp/org/org.el
+index c75afbf..0f5d17d 100644
+--- a/lisp/org/org.el
++++ b/lisp/org/org.el
+@@ -1140,6 +1140,24 @@ the following lines anywhere in the buffer:
+   :package-version '(Org . "8.0")
+   :type 'boolean)
+ 
++(defvar untrusted-content) ; defined in files.el
++(defvar org--latex-preview-when-risky nil
++  "If non-nil, enable LaTeX preview in Org buffers from unsafe source.
++
++Some specially designed LaTeX code may generate huge pdf or log files
++that may exhaust disk space.
++
++This variable controls how to handle LaTeX preview when rendering LaTeX
++fragments that originate from incoming email messages.  It has no effect
++when Org mode is unable to determine the origin of the Org buffer.
++
++An Org buffer is considered to be from unsafe source when the
++variable `untrusted-content' has a non-nil value in the buffer.
++
++If this variable is non-nil, LaTeX previews are rendered unconditionally.
++
++This variable may be renamed or changed in the future.")
++
+ (defcustom org-insert-mode-line-in-empty-file nil
+   "Non-nil means insert the first line setting Org mode in empty files.
+ When the function `org-mode' is called interactively in an empty file, this
+@@ -15695,6 +15713,7 @@ fragments in the buffer."
+   (interactive "P")
+   (cond
+    ((not (display-graphic-p)) nil)
++   ((and untrusted-content (not org--latex-preview-when-risky)) nil)
+    ;; Clear whole buffer.
+    ((equal arg '(64))
+     (org-clear-latex-preview (point-min) (point-max))
+-- 
+cgit v1.1
+

SOURCES/emacs-man-el-shell-injection-vulnerability.patch

@@ -0,0 +1,57 @@
+From 820f0793f0b46448928905552726c1f1b999062f Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Tue, 10 Oct 2023 22:20:05 +0800
+Subject: Fix man.el shell injection vulnerability
+
+* lisp/man.el (Man-translate-references): Fix shell injection
+vulnerability.  (Bug#66390)
+* test/lisp/man-tests.el (man-tests-Man-translate-references): New
+test.
+---
+ lisp/man.el            |  6 +++++-
+ test/lisp/man-tests.el | 12 ++++++++++++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/lisp/man.el b/lisp/man.el
+index 55cb938..d963964 100644
+--- a/lisp/man.el
++++ b/lisp/man.el
+@@ -761,7 +761,11 @@ and the `Man-section-translations-alist' variables)."
+       (setq name (match-string 2 ref)
+ 	    section (match-string 1 ref))))
+     (if (string= name "")
+-	ref				; Return the reference as is
++        ;; see Bug#66390
++	(mapconcat 'identity
++                   (mapcar #'shell-quote-argument
++                           (split-string ref "\\s-+"))
++                   " ")                 ; Return the reference as is
+       (if Man-downcase-section-letters-flag
+ 	  (setq section (downcase section)))
+       (while slist
+diff --git a/test/lisp/man-tests.el b/test/lisp/man-tests.el
+index 140482e..11f5f80 100644
+--- a/test/lisp/man-tests.el
++++ b/test/lisp/man-tests.el
+@@ -161,6 +161,18 @@ DESCRIPTION
+           (let ((button (button-at (match-beginning 0))))
+             (should (and button (eq 'Man-xref-header-file (button-type button))))))))))
+ 
++(ert-deftest man-tests-Man-translate-references ()
++  (should (equal (Man-translate-references "basename")
++                 "basename"))
++  (should (equal (Man-translate-references "basename(3)")
++                 "3 basename"))
++  (should (equal (Man-translate-references "basename(3v)")
++                 "3v basename"))
++  (should (equal (Man-translate-references ";id")
++                 "\\;id"))
++  (should (equal (Man-translate-references "-k basename")
++                 "-k basename")))
++
+ (provide 'man-tests)
+ 
+ ;;; man-tests.el ends here
+-- 
+cgit v1.1
+

SOURCES/emacs-mark-contents-untrusted.patch

@@ -0,0 +1,25 @@
+From 937b9042ad7426acdcca33e3d931d8f495bdd804 Mon Sep 17 00:00:00 2001
+From: Ihor Radchenko <yantar92@posteo.net>
+Date: Tue, 20 Feb 2024 12:44:30 +0300
+Subject: * lisp/gnus/mm-view.el (mm-display-inline-fontify): Mark contents
+ untrusted.
+
+---
+ lisp/gnus/mm-view.el | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el
+index 2e1261c..5f234e5 100644
+--- a/lisp/gnus/mm-view.el
++++ b/lisp/gnus/mm-view.el
+@@ -504,6 +504,7 @@ If MODE is not set, try to find mode automatically."
+ 	  (setq coding-system (mm-find-buffer-file-coding-system)))
+ 	(setq text (buffer-string))))
+     (with-temp-buffer
++      (setq untrusted-content t)
+       (buffer-disable-undo)
+       (mm-enable-multibyte)
+       (insert (cond ((eq charset 'gnus-decoded)
+-- 
+cgit v1.1
+

SPECS/emacs.spec

@@ -5,7 +5,7 @@ Summary:       GNU Emacs text editor
 Name:          emacs
 Epoch:         1
 Version:       27.2
-Release:       10%{?dist}
+Release:       11%{?dist}.1
 License:       GPLv3+ and CC0-1.0
 URL:           http://www.gnu.org/software/emacs/
 Source0:       https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz
@@ -33,8 +33,11 @@ Patch6:        emacs-etags-local-command-injection-vulnerability.patch
 Patch7:        emacs-htmlfontify-command-injection-vulnerability.patch
 Patch8:        emacs-ruby-mode-local-command-injection-vulnerability.patch
 Patch9:        emacs-ob-latex-command-injection-vulnerability.patch
-Patch10:       emacs-org-link-expand-abbrev-unsafe-elisp.patch
+Patch10:       emacs-consider-org-file-contents-unsafe.patch
-
+Patch11:       emacs-mark-contents-untrusted.patch
+Patch12:       emacs-latex-preview.patch
+Patch13:       emacs-org-link-expand-abbrev-unsafe-elisp.patch
+Patch14:       emacs-man-el-shell-injection-vulnerability.patch
 BuildRequires: gcc
 BuildRequires: atk-devel
 BuildRequires: cairo-devel
@@ -193,16 +196,20 @@ Development header files for Emacs.
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 
-%patch1 -p1 -b .spellchecker
+%patch -P 1 -p1 -b .spellchecker
-%patch2 -p1 -b .system-crypto-policies
+%patch -P 2 -p1 -b .system-crypto-policies
-%patch3 -p1 -b .glibc2.34
+%patch -P 3 -p1 -b .glibc2.34
-%patch4 -p1 -b .ctags-local-command-execute-vulnerability
+%patch -P 4 -p1 -b .ctags-local-command-execute-vulnerability
-%patch5 -p1 -b .64KB-page-size-for-pdump
+%patch -P 5 -p1 -b .64KB-page-size-for-pdump
-%patch6 -p1 -b .etags-local-command-injection-vulnerability
+%patch -P 6 -p1 -b .etags-local-command-injection-vulnerability
-%patch7 -p1 -b .htmlfontify-command-injection-vulnerability
+%patch -P 7 -p1 -b .htmlfontify-command-injection-vulnerability
-%patch8 -p1 -b .ruby-mode-local-command-injection-vulnerability
+%patch -P 8 -p1 -b .ruby-mode-local-command-injection-vulnerability
-%patch9 -p1 -b .ob-latex-command-injection-vulnerability
+%patch -P 9 -p1 -b .ob-latex-command-injection-vulnerability
-%patch10 -p1 -b .org-link-expand-abbrev-unsafe-elisp
+%patch -P 10 -p1 -b .consider-org-file-contents-unsafe
+%patch -P 11 -p1 -b .mark-contents-untrusted
+%patch -P 12 -p1 -b .latex-preview
+%patch -P 13 -p1 -b .org-link-expand-abbrev-unsafe-elisp
+%patch -P 14 -p1 -b .man-el-shell-injection-vulnerability
 autoconf
 
 # We prefer our emacs.desktop file
@@ -493,11 +500,21 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
 %{_includedir}/emacs-module.h
 
 %changelog
-* Fri Aug 23 2024 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
+* Mon Feb 24 2025 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
-- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
+- Fix man.el shell injection vulnerability (RHEL-79021)
-- Disable xwidgets (RHEL-33447)
+- Eliminate use of obsolete patch syntax (RHEL-80450)
 
-* Sun Apr 02 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
+* Wed Feb 19 2025 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11
+- Fix man.el shell injection vulnerability (RHEL-79025)
+
+* Fri Mar 15 2024 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
+- Disable xwidgets (RHEL-14551)
+- org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
+- Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
+- Add protection for LaTeX preview (CVE-2024-30204)
+- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
+
+* Sun Apr 2 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
 - Fix etags local command injection vulnerability (#2175190)
 - Fix htmlfontify.el command injection vulnerability (#2175179)
 - Fix ruby-mode.el local command injection vulnerability (#2175142)