Accepting request 1187225 from GNOME:Factory

OBS-URL: https://build.opensuse.org/request/show/1187225
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gtk2?expand=0&rev=186

CVE-2024-6655.patch

@@ -0,0 +1,35 @@
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Sat, 15 Jun 2024 14:18:01 -0400
+Subject: Stop looking for modules in cwd
+
+This is just not a good idea. It is surprising, and can be misused.
+
+Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
+(cherry picked from commit 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7)
+
+Origin: gtk 3.24.43
+---
+ gtk/gtkmodules.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
+index 50729b6..c0f0c30 100644
+--- a/gtk/gtkmodules.c
++++ b/gtk/gtkmodules.c
+@@ -229,13 +229,8 @@ find_module (const gchar *name)
+   gchar *module_name;
+ 
+   module_name = _gtk_find_module (name, "modules");
+-  if (!module_name)
+-    {
+-      /* As last resort, try loading without an absolute path (using system
+-       * library path)
+-       */
+-      module_name = g_module_build_path (NULL, name);
+-    }
++  if (module_name == NULL)
++    return NULL;
+ 
+   module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
+ 
+

gtk2.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Jul 12 18:40:00 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules
+  in cwd.
+
 -------------------------------------------------------------------
 Mon Apr 29 07:09:25 UTC 2024 - pgajdos@suse.com
 

gtk2.spec

@@ -54,6 +54,9 @@ Patch8:         gtk2-updateiconcache_sort.patch
 Patch9:         gtk2-check-attribute.patch
 # PATCH-FIX-UPSTREAM gtk2-gcc14.patch mgorse@suse.com -- fix building with gcc14.
 Patch10:        gtk2-gcc14.patch
+# PATCH-FIX-UPSTREAM CVE-2024-6655.patch -- CVE-2024-6655 Stop looking for modules in cwd
+Patch11:        CVE-2024-6655.patch
+
 BuildRequires:  cairo-devel
 BuildRequires:  cups-devel
 BuildRequires:  fdupes
@@ -325,6 +328,7 @@ cp -a %{SOURCE2} .
 %patch -P 8 -p1
 %patch -P 9 -p1
 %patch -P 10 -p1
+%patch -P 11 -p1
 gnome-patch-translation-update
 
 %build