rpms/emacs
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI emacs-27.2-11.el9_5.1

Browse Source
This commit is contained in:
eabdullin 2025-02-27 20:43:08 +00:00
parent 443cbf996b
commit a60db5b024
5 changed files with 209 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
SOURCES/emacs-consider-org-file-contents-unsafe.patch Normal file
View File

@ -0,0 +1,36 @@
From 2bc865ace050ff118db43f01457f95f95112b877 Mon Sep 17 00:00:00 2001
From: Ihor Radchenko <yantar92@posteo.net>
Date: Tue, 20 Feb 2024 14:59:20 +0300
Subject: org-file-contents: Consider all remote files unsafe
* lisp/org/org.el (org-file-contents): When loading files, consider all
remote files (like TRAMP-fetched files) unsafe, in addition to URLs.
---
lisp/org/org.el | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/lisp/org/org.el b/lisp/org/org.el
index 0f5d17d..76559c9 100644
--- a/lisp/org/org.el
+++ b/lisp/org/org.el
@@ -4576,12 +4576,16 @@ from file or URL, and return nil.
If NOCACHE is non-nil, do a fresh fetch of FILE even if cached version
is available. This option applies only if FILE is a URL."
(let* ((is-url (org-file-url-p file))
+ (is-remote (condition-case nil
+ (file-remote-p file)
+ ;; In case of error, be safe.
+ (t t)))
(cache (and is-url
(not nocache)
(gethash file org--file-cache))))
(cond
(cache)
- (is-url
+ ((or is-url is-remote)
(with-current-buffer (url-retrieve-synchronously file)
(goto-char (point-min))
;; Move point to after the url-retrieve header.
--
cgit v1.1

57
SOURCES/emacs-latex-preview.patch Normal file
View File

@ -0,0 +1,57 @@
From 6f9ea396f49cbe38c2173e0a72ba6af3e03b271c Mon Sep 17 00:00:00 2001
From: Ihor Radchenko <yantar92@posteo.net>
Date: Tue, 20 Feb 2024 12:47:24 +0300
Subject: org-latex-preview: Add protection when `untrusted-content' is non-nil
* lisp/org/org.el (org--latex-preview-when-risky): New variable
controlling how to handle LaTeX previews in Org files from untrusted
origin.
(org-latex-preview): Consult `org--latex-preview-when-risky' before
generating previews.
This patch adds a layer of protection when LaTeX preview is requested
for an email attachment, where `untrusted-content' is set to non-nil.
---
lisp/org/org.el | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/lisp/org/org.el b/lisp/org/org.el
index c75afbf..0f5d17d 100644
--- a/lisp/org/org.el
+++ b/lisp/org/org.el
@@ -1140,6 +1140,24 @@ the following lines anywhere in the buffer:
:package-version '(Org . "8.0")
:type 'boolean)
+(defvar untrusted-content) ; defined in files.el
+(defvar org--latex-preview-when-risky nil
+ "If non-nil, enable LaTeX preview in Org buffers from unsafe source.
+
+Some specially designed LaTeX code may generate huge pdf or log files
+that may exhaust disk space.
+
+This variable controls how to handle LaTeX preview when rendering LaTeX
+fragments that originate from incoming email messages. It has no effect
+when Org mode is unable to determine the origin of the Org buffer.
+
+An Org buffer is considered to be from unsafe source when the
+variable `untrusted-content' has a non-nil value in the buffer.
+
+If this variable is non-nil, LaTeX previews are rendered unconditionally.
+
+This variable may be renamed or changed in the future.")
+
(defcustom org-insert-mode-line-in-empty-file nil
"Non-nil means insert the first line setting Org mode in empty files.
When the function `org-mode' is called interactively in an empty file, this
@@ -15695,6 +15713,7 @@ fragments in the buffer."
(interactive "P")
(cond
((not (display-graphic-p)) nil)
+ ((and untrusted-content (not org--latex-preview-when-risky)) nil)
;; Clear whole buffer.
((equal arg '(64))
(org-clear-latex-preview (point-min) (point-max))
--
cgit v1.1

57
SOURCES/emacs-man-el-shell-injection-vulnerability.patch Normal file
View File

@ -0,0 +1,57 @@
From 820f0793f0b46448928905552726c1f1b999062f Mon Sep 17 00:00:00 2001
From: Xi Lu <lx@shellcodes.org>
Date: Tue, 10 Oct 2023 22:20:05 +0800
Subject: Fix man.el shell injection vulnerability
* lisp/man.el (Man-translate-references): Fix shell injection
vulnerability. (Bug#66390)
* test/lisp/man-tests.el (man-tests-Man-translate-references): New
test.
---
lisp/man.el | 6 +++++-
test/lisp/man-tests.el | 12 ++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/lisp/man.el b/lisp/man.el
index 55cb938..d963964 100644
--- a/lisp/man.el
+++ b/lisp/man.el
@@ -761,7 +761,11 @@ and the `Man-section-translations-alist' variables)."
(setq name (match-string 2 ref)
section (match-string 1 ref))))
(if (string= name "")
- ref ; Return the reference as is
+ ;; see Bug#66390
+ (mapconcat 'identity
+ (mapcar #'shell-quote-argument
+ (split-string ref "\\s-+"))
+ " ") ; Return the reference as is
(if Man-downcase-section-letters-flag
(setq section (downcase section)))
(while slist
diff --git a/test/lisp/man-tests.el b/test/lisp/man-tests.el
index 140482e..11f5f80 100644
--- a/test/lisp/man-tests.el
+++ b/test/lisp/man-tests.el
@@ -161,6 +161,18 @@ DESCRIPTION
(let ((button (button-at (match-beginning 0))))
(should (and button (eq 'Man-xref-header-file (button-type button))))))))))
+(ert-deftest man-tests-Man-translate-references ()
+ (should (equal (Man-translate-references "basename")
+ "basename"))
+ (should (equal (Man-translate-references "basename(3)")
+ "3 basename"))
+ (should (equal (Man-translate-references "basename(3v)")
+ "3v basename"))
+ (should (equal (Man-translate-references ";id")
+ "\\;id"))
+ (should (equal (Man-translate-references "-k basename")
+ "-k basename")))
+
(provide 'man-tests)
;;; man-tests.el ends here
--
cgit v1.1

25
SOURCES/emacs-mark-contents-untrusted.patch Normal file
View File

@ -0,0 +1,25 @@
From 937b9042ad7426acdcca33e3d931d8f495bdd804 Mon Sep 17 00:00:00 2001
From: Ihor Radchenko <yantar92@posteo.net>
Date: Tue, 20 Feb 2024 12:44:30 +0300
Subject: * lisp/gnus/mm-view.el (mm-display-inline-fontify): Mark contents
untrusted.
---
lisp/gnus/mm-view.el | 1 +
1 file changed, 1 insertion(+)
diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el
index 2e1261c..5f234e5 100644
--- a/lisp/gnus/mm-view.el
+++ b/lisp/gnus/mm-view.el
@@ -504,6 +504,7 @@ If MODE is not set, try to find mode automatically."
(setq coding-system (mm-find-buffer-file-coding-system)))
(setq text (buffer-string))))
(with-temp-buffer
+ (setq untrusted-content t)
(buffer-disable-undo)
(mm-enable-multibyte)
(insert (cond ((eq charset 'gnus-decoded)
--
cgit v1.1

51
SPECS/emacs.spec
View File

@ -5,7 +5,7 @@ Summary: GNU Emacs text editor
Name: emacs
Epoch: 1
Version: 27.2
Release: 10%{?dist}
Release: 11%{?dist}.1
License: GPLv3+ and CC0-1.0
URL: http://www.gnu.org/software/emacs/
Source0: https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz
@ -33,8 +33,11 @@ Patch6: emacs-etags-local-command-injection-vulnerability.patch
Patch7: emacs-htmlfontify-command-injection-vulnerability.patch
Patch8: emacs-ruby-mode-local-command-injection-vulnerability.patch
Patch9: emacs-ob-latex-command-injection-vulnerability.patch
Patch10: emacs-org-link-expand-abbrev-unsafe-elisp.patch
Patch10: emacs-consider-org-file-contents-unsafe.patch
Patch11: emacs-mark-contents-untrusted.patch
Patch12: emacs-latex-preview.patch
Patch13: emacs-org-link-expand-abbrev-unsafe-elisp.patch
Patch14: emacs-man-el-shell-injection-vulnerability.patch
BuildRequires: gcc
BuildRequires: atk-devel
BuildRequires: cairo-devel
@ -193,16 +196,20 @@ Development header files for Emacs.
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
%setup -q
%patch1 -p1 -b .spellchecker
%patch2 -p1 -b .system-crypto-policies
%patch3 -p1 -b .glibc2.34
%patch4 -p1 -b .ctags-local-command-execute-vulnerability
%patch5 -p1 -b .64KB-page-size-for-pdump
%patch6 -p1 -b .etags-local-command-injection-vulnerability
%patch7 -p1 -b .htmlfontify-command-injection-vulnerability
%patch8 -p1 -b .ruby-mode-local-command-injection-vulnerability
%patch9 -p1 -b .ob-latex-command-injection-vulnerability
%patch10 -p1 -b .org-link-expand-abbrev-unsafe-elisp
%patch -P 1 -p1 -b .spellchecker
%patch -P 2 -p1 -b .system-crypto-policies
%patch -P 3 -p1 -b .glibc2.34
%patch -P 4 -p1 -b .ctags-local-command-execute-vulnerability
%patch -P 5 -p1 -b .64KB-page-size-for-pdump
%patch -P 6 -p1 -b .etags-local-command-injection-vulnerability
%patch -P 7 -p1 -b .htmlfontify-command-injection-vulnerability
%patch -P 8 -p1 -b .ruby-mode-local-command-injection-vulnerability
%patch -P 9 -p1 -b .ob-latex-command-injection-vulnerability
%patch -P 10 -p1 -b .consider-org-file-contents-unsafe
%patch -P 11 -p1 -b .mark-contents-untrusted
%patch -P 12 -p1 -b .latex-preview
%patch -P 13 -p1 -b .org-link-expand-abbrev-unsafe-elisp
%patch -P 14 -p1 -b .man-el-shell-injection-vulnerability
autoconf
# We prefer our emacs.desktop file
@ -493,11 +500,21 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
%{_includedir}/emacs-module.h
%changelog
* Fri Aug 23 2024 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
- Disable xwidgets (RHEL-33447)
* Mon Feb 24 2025 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
- Fix man.el shell injection vulnerability (RHEL-79021)
- Eliminate use of obsolete patch syntax (RHEL-80450)
* Sun Apr 02 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
* Wed Feb 19 2025 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11
- Fix man.el shell injection vulnerability (RHEL-79025)
* Fri Mar 15 2024 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
- Disable xwidgets (RHEL-14551)
- org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
- Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
- Add protection for LaTeX preview (CVE-2024-30204)
- org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)
* Sun Apr 2 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
- Fix etags local command injection vulnerability (#2175190)
- Fix htmlfontify.el command injection vulnerability (#2175179)
- Fix ruby-mode.el local command injection vulnerability (#2175142)