.

OBS-URL: https://build.opensuse.org/package/show/Publishing:TeXLive/texlive?expand=0&rev=240

source.dif

@@ -634,7 +634,15 @@
 +%$SELFAUTOPARENT/texmf/web2c\
 +%}
  %
- % For reference, here is the old brace-using definition:
+ % For reference, here is the old brace-using definition:
+ %TEXMFCNF = {$SELFAUTOLOC,$SELFAUTODIR,$SELFAUTOPARENT}{,{/share,}/texmf{-local,}/web2c}
+@@ -568,7 +569,6 @@ extractbb,\
+ gregorio,\
+ kpsewhich,\
+ makeindex,\
+-mpost,\
+ repstopdf,\
+ 
  % we'd like to allow:
 @@ -791,3 +791,33 @@ max_cols.gftype = 8191
  % Guess input encoding (SJIS vs. Unicode, etc.) in pTeX and friends?

texlive.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Mar  8 12:02:02 UTC 2017 - werner@suse.de
+
+- Modify patch kpathsea_cnf.dif to remove mpost from the allowed
+  shell escaping commands (bsc#1028271, CVE-2016-10243)
+
 -------------------------------------------------------------------
 Tue Dec  6 16:57:18 UTC 2016 - werner@suse.de
 

texlive.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package texlive
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed