From 39366733c3fe943363566756e2e152c45a1b3cb2 Mon Sep 17 00:00:00 2001
From: Patrick J Volkerding <volkerdi@slackware.com>
Date: Fri, 25 May 2018 23:29:36 +0000
Subject: Fri May 25 23:29:36 UTC 2018

patches/packages/glibc-zoneinfo-2018e-noarch-2_slack14.2.txz:  Rebuilt.
  Handle removal of US/Pacific-New timezone. If we see that the machine is
  using this, it will be automatically switched to US/Pacific.
---
 patches/source/libXfont/patch/libXfont.patch       |   1 +
 .../patch/libXfont/libXfont.CVE-2017-16611.diff    | 105 +++++++++++++++++++++
 2 files changed, 106 insertions(+)
 create mode 100644 patches/source/libXfont/patch/libXfont.patch
 create mode 100644 patches/source/libXfont/patch/libXfont/libXfont.CVE-2017-16611.diff

(limited to 'patches/source/libXfont/patch')

diff --git a/patches/source/libXfont/patch/libXfont.patch b/patches/source/libXfont/patch/libXfont.patch
new file mode 100644
index 000000000..7b6e24570
--- /dev/null
+++ b/patches/source/libXfont/patch/libXfont.patch
@@ -0,0 +1 @@
+zcat $CWD/patch/libXfont/libXfont.CVE-2017-16611.diff.gz | patch -p1 || { touch ${SLACK_X_BUILD_DIR}/${PKGNAME}.failed ; continue ; }
diff --git a/patches/source/libXfont/patch/libXfont/libXfont.CVE-2017-16611.diff b/patches/source/libXfont/patch/libXfont/libXfont.CVE-2017-16611.diff
new file mode 100644
index 000000000..5b50ae664
--- /dev/null
+++ b/patches/source/libXfont/patch/libXfont/libXfont.CVE-2017-16611.diff
@@ -0,0 +1,105 @@
+From 7b377456f95d2ec3ead40f4fb74ea620191f88c8 Mon Sep 17 00:00:00 2001
+From: Michal Srb <msrb@suse.com>
+Date: Thu, 26 Oct 2017 09:48:13 +0200
+Subject: Open files with O_NOFOLLOW. (CVE-2017-16611)
+
+A non-privileged X client can instruct X server running under root to open any
+file by creating own directory with "fonts.dir", "fonts.alias" or any font file
+being a symbolic link to any other file in the system. X server will then open
+it. This can be issue with special files such as /dev/watchdog.
+
+Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
+
+diff --git a/src/fontfile/dirfile.c b/src/fontfile/dirfile.c
+index 04cfa40..2802980 100644
+--- a/src/fontfile/dirfile.c
++++ b/src/fontfile/dirfile.c
+@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group.
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#include <fcntl.h>
+ #include <errno.h>
+ #include <limits.h>
+ 
+@@ -61,8 +62,9 @@ FontFileReadDirectory (const char *directory, FontDirectoryPtr *pdir)
+     char        dir_file[MAXFONTFILENAMELEN];
+     char	dir_path[MAXFONTFILENAMELEN];
+     char	*ptr;
+-    FILE       *file;
+-    int         count,
++    FILE       *file = 0;
++    int         file_fd,
++                count,
+                 num_fonts,
+                 status;
+     struct stat	statb;
+@@ -92,7 +94,14 @@ FontFileReadDirectory (const char *directory, FontDirectoryPtr *pdir)
+     if (dir_file[strlen(dir_file) - 1] != '/')
+ 	strcat(dir_file, "/");
+     strcat(dir_file, FontDirFile);
++#ifndef WIN32
++    file_fd = open(dir_file, O_RDONLY | O_NOFOLLOW);
++    if (file_fd >= 0) {
++	file = fdopen(file_fd, "rt");
++    }
++#else
+     file = fopen(dir_file, "rt");
++#endif
+     if (file) {
+ #ifndef WIN32
+ 	if (fstat (fileno(file), &statb) == -1)
+@@ -262,7 +271,8 @@ ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir)
+     char		alias[MAXFONTNAMELEN];
+     char		font_name[MAXFONTNAMELEN];
+     char		alias_file[MAXFONTFILENAMELEN];
+-    FILE		*file;
++    int			file_fd;
++    FILE		*file = 0;
+     FontDirectoryPtr	dir;
+     int			token;
+     char		*lexToken;
+@@ -280,7 +290,16 @@ ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir)
+ 	    strcat(alias_file, "/");
+ 	strcat(alias_file, FontAliasFile);
+     }
++
++#ifndef WIN32
++    file_fd = open(alias_file, O_RDONLY | O_NOFOLLOW);
++    if (file_fd >= 0) {
++	file = fdopen(file_fd, "rt");
++    }
++#else
+     file = fopen(alias_file, "rt");
++#endif
++
+     if (!file)
+ 	return ((errno == ENOENT) ? Successful : BadFontPath);
+     if (!dir)
+diff --git a/src/fontfile/fileio.c b/src/fontfile/fileio.c
+index 074ebcb..05374b4 100644
+--- a/src/fontfile/fileio.c
++++ b/src/fontfile/fileio.c
+@@ -40,6 +40,9 @@ in this Software without prior written authorization from The Open Group.
+ #ifndef O_CLOEXEC
+ #define O_CLOEXEC 0
+ #endif
++#ifndef O_NOFOLLOW
++#define O_NOFOLLOW 0
++#endif
+ 
+ FontFilePtr
+ FontFileOpen (const char *name)
+@@ -48,7 +51,7 @@ FontFileOpen (const char *name)
+     int		len;
+     BufFilePtr	raw, cooked;
+ 
+-    fd = open (name, O_BINARY|O_CLOEXEC);
++    fd = open (name, O_BINARY|O_CLOEXEC|O_NOFOLLOW);
+     if (fd < 0)
+ 	return 0;
+     raw = BufFileOpenRead (fd);
+-- 
+cgit v0.10.2
+
+
-- 
cgit v1.2.3