diff options
| author | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-07-30 19:53:48 -0300 |
|---|---|---|
| committer | André Fabian Silva Delgado <emulatorman@parabola.nu> | 2014-07-30 19:53:48 -0300 |
| commit | 9f6ae13fc72cd48c1c61bc2b5be2c9bd28c5ce43 (patch) | |
| tree | 9dbe16ac7e4b9bee99510e2c3968415fd78a5496 /libre | |
| parent | 752d55343df5033d2b6956e8d23863dd639a27d9 (diff) | |
kdelibs-libre-4.13.3-2: fix CVE-2014-5033
Diffstat (limited to 'libre')
| -rw-r--r-- | libre/kdelibs-libre/PKGBUILD | 11 | ||||
| -rw-r--r-- | libre/kdelibs-libre/kdelibs-cve-2014-5033.patch | 36 |
2 files changed, 43 insertions, 4 deletions
diff --git a/libre/kdelibs-libre/PKGBUILD b/libre/kdelibs-libre/PKGBUILD index 498a341bb..14bba6a23 100644 --- a/libre/kdelibs-libre/PKGBUILD +++ b/libre/kdelibs-libre/PKGBUILD @@ -1,4 +1,4 @@ -# $Id: PKGBUILD 217476 2014-07-18 18:34:16Z andrea $ +# $Id: PKGBUILD 218409 2014-07-30 20:11:02Z svenstaro $ # Maintainer (Arch): Andrea Scarpino <andrea@archlinux.org # Contributor (Arch): Pierre Schmitz <pierre@archlinux.de> # Maintainer: André Silva <emulatorman@parabola.nu> @@ -6,7 +6,7 @@ _pkgname=kdelibs pkgname=kdelibs-libre pkgver=4.13.3 -pkgrel=1 +pkgrel=2 pkgdesc="KDE Core Libraries, without nonfree plugins recommendation support" arch=('i686' 'x86_64' 'mips64el') url='https://projects.kde.org/projects/kde/kdelibs' @@ -22,12 +22,13 @@ makedepends=('cmake' 'automoc4' 'avahi' 'libgl' 'hspell' 'mesa') install=${_pkgname}.install source=("http://download.kde.org/stable/${pkgver}/src/${_pkgname}-${pkgver}.tar.xz" 'kde-applications-menu.patch' 'khtml-fsdg.diff' 'qt4.patch' - 'pyqt.patch') + 'pyqt.patch' 'kdelibs-cve-2014-5033.patch') sha1sums=('9c0e963fa2db119ac37e15f31c05d18d3043a58e' '86ee8c8660f19de8141ac99cd6943964d97a1ed7' 'a1502a964081ad583a00cf90c56e74bf60121830' 'ed1f57ee661e5c7440efcaba7e51d2554709701c' - 'd32534d7d6dc287c80951d24caf0259ab18c9abc') + 'd32534d7d6dc287c80951d24caf0259ab18c9abc' + '9c808a7e382f59d730a4ced06ef88165f3d87eec') prepare() { mkdir build @@ -41,6 +42,8 @@ prepare() { # support newer PyQt build system patch -p1 -i "${srcdir}"/pyqt.patch + + patch -p1 -i "${srcdir}/kdelibs-cve-2014-5033.patch" } build() { diff --git a/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch b/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch new file mode 100644 index 000000000..c85eccd6b --- /dev/null +++ b/libre/kdelibs-libre/kdelibs-cve-2014-5033.patch @@ -0,0 +1,36 @@ +--- a/kdecore/auth/backends/polkit-1/Polkit1Backend.cpp ++++ b/kdecore/auth/backends/polkit-1/Polkit1Backend.cpp +@@ -144,7 +144,7 @@ + + Action::AuthStatus Polkit1Backend::actionStatus(const QString &action) + { +- PolkitQt1::UnixProcessSubject subject(QCoreApplication::applicationPid()); ++ PolkitQt1::SystemBusNameSubject subject(QString::fromUtf8(callerID())); + PolkitQt1::Authority::Result r = PolkitQt1::Authority::instance()->checkAuthorizationSync(action, subject, + PolkitQt1::Authority::None); + switch (r) { +@@ -160,21 +160,12 @@ + + QByteArray Polkit1Backend::callerID() const + { +- QByteArray a; +- QDataStream s(&a, QIODevice::WriteOnly); +- s << QCoreApplication::applicationPid(); +- +- return a; ++ return QDBusConnection::systemBus().baseService().toUtf8(); + } + + bool Polkit1Backend::isCallerAuthorized(const QString &action, QByteArray callerID) + { +- QDataStream s(&callerID, QIODevice::ReadOnly); +- qint64 pid; +- +- s >> pid; +- +- PolkitQt1::UnixProcessSubject subject(pid); ++ PolkitQt1::SystemBusNameSubject subject(QString::fromUtf8(callerID)); + PolkitQt1::Authority *authority = PolkitQt1::Authority::instance(); + + PolkitResultEventLoop e; + |