From 899fa2937e2272c3c0086c011b379458384cb0cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Schr=C3=B6ter?= Date: Wed, 16 Oct 2024 09:30:18 +0200 Subject: [PATCH] Sync from SUSE:ALP:Source:Standard:1.0 gtk3 revision 3bbfd87a5096c309de8258eb8de1763a --- CVE-2024-6655.patch | 35 +++++++++++++++++++++++++++++++++++ gtk3.changes | 6 ++++++ gtk3.spec | 2 ++ 3 files changed, 43 insertions(+) create mode 100644 CVE-2024-6655.patch diff --git a/CVE-2024-6655.patch b/CVE-2024-6655.patch new file mode 100644 index 0000000..6f335dc --- /dev/null +++ b/CVE-2024-6655.patch @@ -0,0 +1,35 @@ +From: Matthias Clasen +Date: Sat, 15 Jun 2024 14:18:01 -0400 +Subject: Stop looking for modules in cwd + +This is just not a good idea. It is surprising, and can be misused. + +Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/6786 +(cherry picked from commit 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7) + +Origin: gtk 3.24.43 +--- + gtk/gtkmodules.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c +index 50729b6..c0f0c30 100644 +--- a/gtk/gtkmodules.c ++++ b/gtk/gtkmodules.c +@@ -229,13 +229,8 @@ find_module (const gchar *name) + gchar *module_name; + + module_name = _gtk_find_module (name, "modules"); +- if (!module_name) +- { +- /* As last resort, try loading without an absolute path (using system +- * library path) +- */ +- module_name = g_module_build_path (NULL, name); +- } ++ if (module_name == NULL) ++ return NULL; + + module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY); + + diff --git a/gtk3.changes b/gtk3.changes index 64a8972..17a27b1 100644 --- a/gtk3.changes +++ b/gtk3.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Fri Jul 26 21:39:13 UTC 2024 - Michael Gorse + +- Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules + in cwd (bsc#1228120). + ------------------------------------------------------------------- Mon May 01 08:48:59 UTC 2023 - bjorn.lie@gmail.com diff --git a/gtk3.spec b/gtk3.spec index ed6cee8..ab4746b 100644 --- a/gtk3.spec +++ b/gtk3.spec @@ -45,6 +45,8 @@ Source99: baselibs.conf Patch0: gtk3-GTK_PATH64.patch # PATCH-FIX-OPENSUSE gtk3-revert-forced-xftdpi.patch fvogt@opensuse.org -- Revert very controversal commit on GTK3, forcing DPI to 96 Patch1: gtk3-revert-forced-xftdpi.patch +# PATCH-FIX-UPSTREAM CVE-2024-6655.patch -- CVE-2024-6655 Stop looking for modules in cwd +Patch2: CVE-2024-6655.patch BuildRequires: cups-devel >= 1.7 BuildRequires: docbook-xsl-stylesheets