From 8ff4f2f51a6cf07fc33742ce3bee81328896e49b Mon Sep 17 00:00:00 2001 From: Patrick J Volkerding Date: Fri, 25 May 2018 23:29:36 +0000 Subject: Fri May 25 23:29:36 UTC 2018 patches/packages/glibc-zoneinfo-2018e-noarch-2_slack14.1.txz: Rebuilt. Handle removal of US/Pacific-New timezone. If we see that the machine is using this, it will be automatically switched to US/Pacific. --- patches/source/mutt/mutt.CVE-2014-9116.diff | 34 +++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 patches/source/mutt/mutt.CVE-2014-9116.diff (limited to 'patches/source/mutt/mutt.CVE-2014-9116.diff') diff --git a/patches/source/mutt/mutt.CVE-2014-9116.diff b/patches/source/mutt/mutt.CVE-2014-9116.diff new file mode 100644 index 000000000..97f6fd816 --- /dev/null +++ b/patches/source/mutt/mutt.CVE-2014-9116.diff @@ -0,0 +1,34 @@ +# HG changeset patch +# User Kevin McCarthy +# Date 1417472364 28800 +# Node ID 0aebf1df43598b442ac75ae4fe17875351854db0 +# Parent 5a86319adad0d17e4acaf8a580bfc9eb247547d0 +Revert write_one_header() to skip space and tab. (closes #3716) + +This patch fixes CVE-2014-9116 in the stable branch. It reverts +write_one_header() to the pre [f251d523ca5a] code for skipping +whitespace. + +Thanks to Antonio Radici and Tomas Hoger for their analysis and patches +to mutt, which this patch is based off of. + +diff -r 5a86319adad0 -r 0aebf1df4359 sendlib.c +--- a/sendlib.c Mon Jan 05 18:28:59 2015 -0800 ++++ b/sendlib.c Mon Dec 01 14:19:24 2014 -0800 +@@ -1814,7 +1814,14 @@ + { + tagbuf = mutt_substrdup (start, t); + /* skip over the colon separating the header field name and value */ +- t = skip_email_wsp(t + 1); ++ ++t; ++ ++ /* skip over any leading whitespace (WSP, as defined in RFC5322) ++ * NOTE: skip_email_wsp() does the wrong thing here. ++ * See tickets 3609 and 3716. */ ++ while (*t == ' ' || *t == '\t') ++ t++; ++ + valbuf = mutt_substrdup (t, end); + } + dprint(4,(debugfile,"mwoh: buf[%s%s] too long, " + -- cgit v1.2.3