[Frugalware-git] frugalware-current: emacs-22.2-2-i686

[Miklos Vajna]

Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=4abb406e86a32c1aa9812bea02a32e218e030f34

commit 4abb406e86a32c1aa9812bea02a32e218e030f34
Author: Miklos Vajna <vmiklos at frugalware.org>
Date:   Sat Apr 12 14:50:41 2008 +0200

emacs-22.2-2-i686
- added CVE-2008-1694.patch
- closes #3006

diff --git a/source/xapps/emacs/CVE-2008-1694.patch b/source/xapps/emacs/CVE-2008-1694.patch
new file mode 100644
index 0000000..7f59d6a
--- /dev/null
+++ b/source/xapps/emacs/CVE-2008-1694.patch
@@ -0,0 +1,25 @@
+Steve Grubb of Red Hat discovered that vcdiff script as shipped with Emacs
+(confirmed in versions 20.7 to 22.1.50) uses temporary files insecurely,
+which makes it possible for local attacker to conduct a symlink attack and
+make the victim overwrite arbitrary file.
+
+diff -ur emacs-21.4.orig/lib-src/vcdiff emacs-21.4/lib-src/vcdiff
+--- emacs-21.4.orig/lib-src/vcdiff	2006-09-28 12:07:51.000000000 -0400
++++ emacs-21.4/lib-src/vcdiff	2006-09-28 15:58:53.000000000 -0400
+@@ -86,14 +86,14 @@
+ 	case $f in
+ 	s.* | */s.*)
+ 		if
+-			rev1=/tmp/geta$$
++			rev1=`mktemp /tmp/geta.XXXXXXXX`
+ 			get -s -p -k $sid1 "$f" > $rev1 &&
+ 			case $sid2 in
+ 			'')
+ 				workfile=`expr " /$f" : '.*/s.\(.*\)'`
+ 				;;
+ 			*)
+-				rev2=/tmp/getb$$
++				rev2=`mktemp /tmp/getb.XXXXXXXX`
+ 				get -s -p -k $sid2 "$f" > $rev2
+ 				workfile=$rev2
+ 			esac
diff --git a/source/xapps/emacs/FrugalBuild b/source/xapps/emacs/FrugalBuild
index b1ff73f..94cf8ab 100644
--- a/source/xapps/emacs/FrugalBuild
+++ b/source/xapps/emacs/FrugalBuild
@@ -5,7 +5,7 @@
pkgname=emacs
pkgver=22.2
pkgextraver=
-pkgrel=1
+pkgrel=2
pkgdesc="An extensible, customizable, self-documenting real-time display editor"
url="http://www.gnu.org/software/emacs/"
Finclude texinfo
@@ -14,14 +14,16 @@ depends=('xaw3d' 'libtiff' 'libjpeg' 'libpng' 'libungif' 'ncurses' 'libxcb')
groups=('xapps')
archs=('i686' 'x86_64')
up2date="lynx -dump http://ftp.gnu.org/pub/gnu/emacs/ |Flasttar"
-source=(ftp://ftp.gnu.org/gnu/emacs/$pkgname-$pkgver$pkgextraver.tar.gz emacs-21.4-amd64.patch)
-signatures=($source.sig '')
+source=(ftp://ftp.gnu.org/gnu/emacs/$pkgname-$pkgver$pkgextraver.tar.gz emacs-21.4-amd64.patch \
+	CVE-2008-1694.patch)
+signatures=($source.sig '' '')

build() {
# LDFLAGS="-Wl,--hash-style=both" does not compile
LDFLAGS=""
Fcd $pkgname-$pkgver
[[ "$CARCH" == "x86_64" ]] && Fpatch emacs-21.4-amd64.patch
+	Fpatch CVE-2008-1694.patch
Fmake --with-x11 --with-x-toolkit --with-pop
Fmakeinstall
[ -e $Fdestdir/usr/info/dir.old ] && Frm /usr/info/dir.old