diff options
| author | Leo Famulari <leo@famulari.name> | 2017-05-09 13:02:12 -0400 |
|---|---|---|
| committer | Leo Famulari <leo@famulari.name> | 2017-05-09 19:35:00 -0400 |
| commit | 8775fc10c61f493c9363ca288402f5f764b6d949 (patch) | |
| tree | 633b0af670cfdddb66d4a132cb1bd423f7801a95 | |
| parent | b4f8edb799f7cfc587d70f7e709b01454c0dbedc (diff) | |
| download | gnu-guix-8775fc10c61f493c9363ca288402f5f764b6d949.tar gnu-guix-8775fc10c61f493c9363ca288402f5f764b6d949.tar.gz | |
gnu: lxterminal: Fix CVE-2016-10369.
* gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/lxde.scm (lxterminal)[source]: Use it.
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/lxde.scm | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/lxterminal-CVE-2016-10369.patch | 37 |
3 files changed, 39 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index af37e67647..0d8daf766a 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -790,6 +790,7 @@ dist_patch_DATA = \ %D%/packages/patches/luminance-hdr-qt-printer.patch \ %D%/packages/patches/lvm2-static-link.patch \ %D%/packages/patches/lxsession-use-gapplication.patch \ + %D%/packages/patches/lxterminal-CVE-2016-10369.patch \ %D%/packages/patches/lz4-fix-test-failures.patch \ %D%/packages/patches/make-impure-dirs.patch \ %D%/packages/patches/mars-install.patch \ diff --git a/gnu/packages/lxde.scm b/gnu/packages/lxde.scm index 1164ba8cbb..cc1156ae60 100644 --- a/gnu/packages/lxde.scm +++ b/gnu/packages/lxde.scm @@ -162,6 +162,7 @@ toolkit. It allows users to monitor and control of running processes.") (uri (string-append "mirror://sourceforge/lxde/LXTerminal" "%20%28terminal%20emulator%29/LXTerminal%20" version "/" name "-" version ".tar.xz")) + (patches (search-patches "lxterminal-CVE-2016-10369.patch")) (sha256 (base32 "1yf76s15zvfw0h42b0ay1slpq47khgjmcry8ki2z812zar9lchia")))) diff --git a/gnu/packages/patches/lxterminal-CVE-2016-10369.patch b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch new file mode 100644 index 0000000000..809eef08da --- /dev/null +++ b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch @@ -0,0 +1,37 @@ +Fix CVE-2016-10369: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369 + +Patch copied from upstream source repository: + +https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 + +From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001 +From: Yao Wei <mwei@lxde.org> +Date: Mon, 8 May 2017 00:47:55 +0800 +Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory + +This bug is pointed out by stackexchange user that putting socket file in +/tmp is a potential risk. Putting the socket dir in user directory could +mitigate the risk. +--- + src/unixsocket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/unixsocket.c b/src/unixsocket.c +index 4c660ac..f88284c 100644 +--- a/src/unixsocket.c ++++ b/src/unixsocket.c +@@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar + * This function returns TRUE if this process should keep running and FALSE if it should exit. */ + + /* Formulate the path for the Unix domain socket. */ +- gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name()); ++ gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default())); ++ printf("%s\n", socket_path); + + /* Create socket. */ + int fd = socket(PF_UNIX, SOCK_STREAM, 0); +-- +2.1.4 + |