From unknown Sat Jun 14 03:53:53 2025 X-Loop: help-debbugs@gnu.org Subject: bug#26857: [PATCH] gnu: lxterminal: Fix CVE-2016-10369. Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 09 May 2017 17:04:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 26857 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 26857@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.14943494221034 (code B ref -1); Tue, 09 May 2017 17:04:01 +0000 Received: (at submit) by debbugs.gnu.org; 9 May 2017 17:03:42 +0000 Received: from localhost ([127.0.0.1]:34385 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d88Y2-0000Gb-0V for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:42 -0400 Received: from eggs.gnu.org ([208.118.235.92]:41455) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d88Xx-0000GM-Gn for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d88Xq-00041d-Tz for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:32 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=BAYES_40,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:37543) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d88Xq-00041O-Ra for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:30 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60638) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d88Xp-0007q0-Cg for guix-patches@gnu.org; Tue, 09 May 2017 13:03:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d88Xl-0003yQ-Hw for guix-patches@gnu.org; Tue, 09 May 2017 13:03:29 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:48797) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d88Xl-0003y8-Dw for guix-patches@gnu.org; Tue, 09 May 2017 13:03:25 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 55E65208AD; Tue, 9 May 2017 13:03:24 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Tue, 09 May 2017 13:03:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=5gHdTb8Sk8OhX9HmJTE7RaX4h9a nLcoj0YHtao0HqZI=; b=EIOZgH26FTVfxVWNib7Jc1JhsQN+hwc83q4Q6Y+a9Gp PCStxNNEVKaeYa+hrGqEjAzu1Bx1jOVjFjboY46rmIkQKRSgQ/SMtgKcEW67QP8a FlVfJ2wpBOtiaWiKQ8oSGzq+rouZbajf+MwbmBUXFWKcdDF2C+qGlmjf5J3Iwi6s = DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=5gHdTb 8Sk8OhX9HmJTE7RaX4h9anLcoj0YHtao0HqZI=; b=Q4q06VrmpC6L39Nw4Z+6xn nEEcpogn9lOCReyIwS9nhUHL2M/vrsDjNeIlMczEtz6/uNr7L0aYXew4G6Uwo/Sp 8Tomm/beA1P3BxCTrDUq2U2rNhVlPrfxiZBgQ6/pYYZFWSS+5DIti60H/Q1/Z6RA krPlFHq05CCglkBF+AGs6fLedeUPCmRtg7HItGMPQ5aKwVnRrJr+eV+Ey61vL+0G MD4k2Kb/sHUb2aLdAuwyW7wr2SBnl5ypOYIJo9zgkLMgt7njO2JFuGT0V2eV5FMO UUlI3hgjf1SGN8MvNpGoi5/80ugppFdSvTGOLYhJofWVOF6jbTyUgWDRyKEHdFFQ == X-ME-Sender: X-Sasl-enc: t0zKH8XCkil9+OrUGsTX/oKNhEzA1KcMKbG1LMk1CTp0 1494349404 Received: from localhost.localdomain (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id 04D7F246E8 for ; Tue, 9 May 2017 13:03:23 -0400 (EDT) From: Leo Famulari Date: Tue, 9 May 2017 13:03:13 -0400 Message-Id: X-Mailer: git-send-email 2.12.2 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.1 (----) * gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/lxde.scm (lxterminal)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/lxde.scm | 1 + .../patches/lxterminal-CVE-2016-10369.patch | 37 ++++++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 gnu/packages/patches/lxterminal-CVE-2016-10369.patch diff --git a/gnu/local.mk b/gnu/local.mk index af37e6764..0d8daf766 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -790,6 +790,7 @@ dist_patch_DATA = \ %D%/packages/patches/luminance-hdr-qt-printer.patch \ %D%/packages/patches/lvm2-static-link.patch \ %D%/packages/patches/lxsession-use-gapplication.patch \ + %D%/packages/patches/lxterminal-CVE-2016-10369.patch \ %D%/packages/patches/lz4-fix-test-failures.patch \ %D%/packages/patches/make-impure-dirs.patch \ %D%/packages/patches/mars-install.patch \ diff --git a/gnu/packages/lxde.scm b/gnu/packages/lxde.scm index 1164ba8cb..cc1156ae6 100644 --- a/gnu/packages/lxde.scm +++ b/gnu/packages/lxde.scm @@ -162,6 +162,7 @@ toolkit. It allows users to monitor and control of running processes.") (uri (string-append "mirror://sourceforge/lxde/LXTerminal" "%20%28terminal%20emulator%29/LXTerminal%20" version "/" name "-" version ".tar.xz")) + (patches (search-patches "lxterminal-CVE-2016-10369.patch")) (sha256 (base32 "1yf76s15zvfw0h42b0ay1slpq47khgjmcry8ki2z812zar9lchia")))) diff --git a/gnu/packages/patches/lxterminal-CVE-2016-10369.patch b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch new file mode 100644 index 000000000..809eef08d --- /dev/null +++ b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch @@ -0,0 +1,37 @@ +Fix CVE-2016-10369: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369 + +Patch copied from upstream source repository: + +https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 + +From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001 +From: Yao Wei +Date: Mon, 8 May 2017 00:47:55 +0800 +Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory + +This bug is pointed out by stackexchange user that putting socket file in +/tmp is a potential risk. Putting the socket dir in user directory could +mitigate the risk. +--- + src/unixsocket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/unixsocket.c b/src/unixsocket.c +index 4c660ac..f88284c 100644 +--- a/src/unixsocket.c ++++ b/src/unixsocket.c +@@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar + * This function returns TRUE if this process should keep running and FALSE if it should exit. */ + + /* Formulate the path for the Unix domain socket. */ +- gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name()); ++ gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default())); ++ printf("%s\n", socket_path); + + /* Create socket. */ + int fd = socket(PF_UNIX, SOCK_STREAM, 0); +-- +2.1.4 + -- 2.12.2 From unknown Sat Jun 14 03:53:53 2025 X-Loop: help-debbugs@gnu.org Subject: bug#26857: [PATCH] gnu: lxterminal: Fix CVE-2016-10369. Resent-From: Kei Kebreau Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 09 May 2017 23:32:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 26857 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Leo Famulari Cc: 26857@debbugs.gnu.org Received: via spool by 26857-submit@debbugs.gnu.org id=B26857.149437271311823 (code B ref 26857); Tue, 09 May 2017 23:32:02 +0000 Received: (at 26857) by debbugs.gnu.org; 9 May 2017 23:31:53 +0000 Received: from localhost ([127.0.0.1]:34739 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8Ebh-00034d-Gf for submit@debbugs.gnu.org; Tue, 09 May 2017 19:31:53 -0400 Received: from lb1.openmailbox.org ([5.79.108.160]:53328 helo=mail.openmailbox.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8Ebc-00034Q-0J for 26857@debbugs.gnu.org; Tue, 09 May 2017 19:31:51 -0400 Received: by mail.openmailbox.org (Postfix, from userid 20002) id DFD9D51166F; Wed, 10 May 2017 01:31:46 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org; s=openmailbox; t=1494372706; bh=G1GOPYj+wLmexkBxd24qdqIQa/YnuvHS/Yyoil+x11w=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=r3unYjoKk7mHhHM8DoEGqjb5Jzao3RI1y3Kx4hrdTMuxVfRcBKe95UoyqzKU0rpoF aSBvM/sYt3y6mo35czXqQftwnOdP6vdPPrErzBZ2gBrfRRftlwtf4mYwLMlICX+ngK VdpL5/Df2JwdJtFPioK6U+X6n89PdtfNfcofehOc= From: Kei Kebreau DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org; s=openmailbox; t=1494372706; bh=G1GOPYj+wLmexkBxd24qdqIQa/YnuvHS/Yyoil+x11w=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=r3unYjoKk7mHhHM8DoEGqjb5Jzao3RI1y3Kx4hrdTMuxVfRcBKe95UoyqzKU0rpoF aSBvM/sYt3y6mo35czXqQftwnOdP6vdPPrErzBZ2gBrfRRftlwtf4mYwLMlICX+ngK VdpL5/Df2JwdJtFPioK6U+X6n89PdtfNfcofehOc= In-Reply-To: (Leo Famulari's message of "Tue, 9 May 2017 13:03:13 -0400") References: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux) Date: Tue, 09 May 2017 19:31:41 -0400 Message-ID: <87efvxk3oi.fsf@openmailbox.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --=-=-= Content-Type: text/plain Leo Famulari writes: > * gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/lxde.scm (lxterminal)[source]: Use it. > --- > gnu/local.mk | 1 + > gnu/packages/lxde.scm | 1 + > .../patches/lxterminal-CVE-2016-10369.patch | 37 ++++++++++++++++++++++ > 3 files changed, 39 insertions(+) LGTM. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEg7ZwOtzKO2lLzi2m5qXuPBlGeg0FAlkSUV4ACgkQ5qXuPBlG eg3Xcg//f3uj4Z/SGOZg3NYfB83BM/hjYsvp0wB9UBtTVpeicZRlmMPX2iHx8ndB 4mBK92UUt/X1bAC8uwod6oR3J7qg3RFVfd7gm8pzkXC97kvifFW5Ke7aIMpfsHRA mwartiVwrdzAT3DkJb+cIErk8hxA3XUCbX0Vc6S0W5A+S9nsXgcGPiXejxfzzirM oSXgnD/TS32Glj1ahCTPZpgm+48ODWLiPzMT5E8RwU7Rzv08YGJt8LgDJp7Z8sU+ /Npt8ZhhDQLm3QNsL9IlmDwTG2ErJHRtrGpq4IgvrPgMVMcFb6bYCcawAs4/2ETH 3jZ9axa5yn3xmQsCJ2BwejQBht12W4FFnHQGN4cVahByxQnLB2HLLJrwRrlZAH3S jtnL1SpTGflj5QbVr6dayVIsvEtzTtDP7rdVImNgI/wcPpMvWNvqVaMcuYE9K9/g hVKgZfisHXtO6GA4G4dKuT3XeftLC3Du5PEFwC/CctyU0rO1DBIGbJ/VCTQ1Ytsb qv2PVisxqO8m8C5v2HfmbehUXp8DvVbwEK9hgcxxqWcaf1sDVtywi6NsF5pRqR4i uF7gaaezMo7BhTEKFjEw2vpfjHTWCwZOKISnZKQsnd8femtHXxa7RYZckYC3XcRQ aMoBccUm9JZ1p+qzADJSSbi5nM8vqL6qLop+kGe7dCujj7HLXgA= =Kq8e -----END PGP SIGNATURE----- --=-=-=-- From unknown Sat Jun 14 03:53:53 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Leo Famulari Subject: bug#26857: closed (Re: bug#26857: [PATCH] gnu: lxterminal: Fix CVE-2016-10369.) Message-ID: References: <20170509233634.GA18598@jasmine> X-Gnu-PR-Message: they-closed 26857 X-Gnu-PR-Package: guix-patches X-Gnu-PR-Keywords: patch Reply-To: 26857@debbugs.gnu.org Date: Tue, 09 May 2017 23:37:01 +0000 Content-Type: multipart/mixed; boundary="----------=_1494373021-12289-1" This is a multi-part message in MIME format... ------------=_1494373021-12289-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #26857: [PATCH] gnu: lxterminal: Fix CVE-2016-10369. which was filed against the guix-patches package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 26857@debbugs.gnu.org. --=20 26857: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D26857 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1494373021-12289-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 26857-done) by debbugs.gnu.org; 9 May 2017 23:36:44 +0000 Received: from localhost ([127.0.0.1]:34744 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8EgO-0003Bl-3Z for submit@debbugs.gnu.org; Tue, 09 May 2017 19:36:44 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:36747) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8EgI-0003BY-Dl for 26857-done@debbugs.gnu.org; Tue, 09 May 2017 19:36:40 -0400 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id C8572208BC; Tue, 9 May 2017 19:36:37 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute7.internal (MEProxy); Tue, 09 May 2017 19:36:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=mesmtp; bh=YZWV5REwru/6uEe0mK9Rdk0whIEtJFCat89UJO okhM0=; b=uj3bZEY1C7iHdxelsYWpBAddcW1txWEeNgilgDuUltbGQEIQhQuPxw zrAhS2vEzNFKtNlR0QRO+D2AcIsw/OcS/K/aZ04M3xNPUluZt2a3+XWPvmbvG2Ei BkJbknaRj87An9RLRRUfygjJISz+Pg+Nltl+XlBODl7wK49CDG6+o= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=YZWV5REwru/6uEe0mK 9Rdk0whIEtJFCat89UJOokhM0=; b=mUEFEcCeYz/UY18e/sty6mWwBf4UCAjk2X dlCcwQHdh6MR2hVkUNkIi3yqQnNavuKV+85Xi8npad18hW1BHGkHbC/0QxJz2NRp nAyoHjYsgIoWy+TK1MD0HRezO5mtkDqXKVd0WnT2iql+buhQ6O+sd0HniV6949VR XXkshQZaJpVo1mbij7ZiSs7TW4ocShoAOVASP6RkSqu2k/ZWe7Bgh6dPdERZMiiT UnH1HaSNu59upNszb3wL6nCHPDDMtObvggOUomcd1OXjpjX2Opu+X42W2op6hmvw takdbIj+OES9Dvisir7aNhFrUt+LysyaPUzHclCnR4CFfBwIBd2g== X-ME-Sender: X-Sasl-enc: sWd4mOwSXKa6berQ8REvYjsnkusBkWUaaYYkrj3p4UMg 1494372997 Received: from localhost (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id 859D37E876; Tue, 9 May 2017 19:36:37 -0400 (EDT) Date: Tue, 9 May 2017 19:36:34 -0400 From: Leo Famulari To: Kei Kebreau Subject: Re: bug#26857: [PATCH] gnu: lxterminal: Fix CVE-2016-10369. Message-ID: <20170509233634.GA18598@jasmine> References: <87efvxk3oi.fsf@openmailbox.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="fdj2RfSjLxBAspz7" Content-Disposition: inline In-Reply-To: <87efvxk3oi.fsf@openmailbox.org> User-Agent: Mutt/1.8.2 (2017-04-18) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 26857-done Cc: 26857-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --fdj2RfSjLxBAspz7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, May 09, 2017 at 07:31:41PM -0400, Kei Kebreau wrote: > Leo Famulari writes: >=20 > > * gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file. > > * gnu/local.mk (dist_patch_DATA): Add it. > > * gnu/packages/lxde.scm (lxterminal)[source]: Use it. > > --- > > gnu/local.mk | 1 + > > gnu/packages/lxde.scm | 1 + > > .../patches/lxterminal-CVE-2016-10369.patch | 37 ++++++++++++++= ++++++++ > > 3 files changed, 39 insertions(+) >=20 > LGTM. Thanks, pushed as 8775fc10c61f493c9363ca288402f5f764b6d949. --fdj2RfSjLxBAspz7 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlkSUoIACgkQJkb6MLrK fwgrPRAA2hZeatOe6xPocQNnf+aA86mD7xzsfINBk9/uVGcbWSmpLAZ3AZE6kj9S vNavauDrHp2D4U/CXwlGqMTsbalOAwmk4jWIGAtHgZAqyXoK2kWXfz/UM8Cu2m+R WlssOD3UJ04Rnl9l01dcwecKQ7cKYRoQRMcQcDsIGYnaNp/N+KVwZBnRFTf+salg wLp5nKOuu8e1//gYs/hIl6srQMefCCbZ3271FEFpwFuspHkL1FWC5Y9P2cC/Qx1w y+D0Yqyhjv3RI09SyszWMJPgIeUErEmom7dR6iIknAVlD8J85METeF1euif251jB TrOxadDWYOivUl7Xl7ZOHhKYk58p1o19F0BZbAqVbq2itrmDQSoJFzH3VIvZ9PTJ qZaEjy5RnePeG0wuS92liIupW2TiqTxkIjdmZBBmWLKkmDzF/rnPexNLs9chfb8e 7/qS9dN9G7610x2S0pr0V045wWCmEPQIApy8v/5QfgsDxyPwwuwkXhdhkBJEpzoD /SjamcMWLcV4DpmEWHVWKfj7bZS1Qiao6tVucXvDSoKedehJm9T05zSJ5cDMDs3+ 32zK/JOWqSJkLU6F+W1bgG/Um8sauPubPRco1ageP8oC+M5mzGZtbY4f/VplRHeT JHSafXf8q0cdBYWcxHlxC8UJx1chbGJ2ghlT1Akt3UjvH9ecuHQ= =A4gG -----END PGP SIGNATURE----- --fdj2RfSjLxBAspz7-- ------------=_1494373021-12289-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 9 May 2017 17:03:42 +0000 Received: from localhost ([127.0.0.1]:34385 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d88Y2-0000Gb-0V for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:42 -0400 Received: from eggs.gnu.org ([208.118.235.92]:41455) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d88Xx-0000GM-Gn for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d88Xq-00041d-Tz for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:32 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=BAYES_40,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:37543) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d88Xq-00041O-Ra for submit@debbugs.gnu.org; Tue, 09 May 2017 13:03:30 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60638) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d88Xp-0007q0-Cg for guix-patches@gnu.org; Tue, 09 May 2017 13:03:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d88Xl-0003yQ-Hw for guix-patches@gnu.org; Tue, 09 May 2017 13:03:29 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:48797) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d88Xl-0003y8-Dw for guix-patches@gnu.org; Tue, 09 May 2017 13:03:25 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 55E65208AD; Tue, 9 May 2017 13:03:24 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Tue, 09 May 2017 13:03:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=5gHdTb8Sk8OhX9HmJTE7RaX4h9a nLcoj0YHtao0HqZI=; b=EIOZgH26FTVfxVWNib7Jc1JhsQN+hwc83q4Q6Y+a9Gp PCStxNNEVKaeYa+hrGqEjAzu1Bx1jOVjFjboY46rmIkQKRSgQ/SMtgKcEW67QP8a FlVfJ2wpBOtiaWiKQ8oSGzq+rouZbajf+MwbmBUXFWKcdDF2C+qGlmjf5J3Iwi6s = DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=5gHdTb 8Sk8OhX9HmJTE7RaX4h9anLcoj0YHtao0HqZI=; b=Q4q06VrmpC6L39Nw4Z+6xn nEEcpogn9lOCReyIwS9nhUHL2M/vrsDjNeIlMczEtz6/uNr7L0aYXew4G6Uwo/Sp 8Tomm/beA1P3BxCTrDUq2U2rNhVlPrfxiZBgQ6/pYYZFWSS+5DIti60H/Q1/Z6RA krPlFHq05CCglkBF+AGs6fLedeUPCmRtg7HItGMPQ5aKwVnRrJr+eV+Ey61vL+0G MD4k2Kb/sHUb2aLdAuwyW7wr2SBnl5ypOYIJo9zgkLMgt7njO2JFuGT0V2eV5FMO UUlI3hgjf1SGN8MvNpGoi5/80ugppFdSvTGOLYhJofWVOF6jbTyUgWDRyKEHdFFQ == X-ME-Sender: X-Sasl-enc: t0zKH8XCkil9+OrUGsTX/oKNhEzA1KcMKbG1LMk1CTp0 1494349404 Received: from localhost.localdomain (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id 04D7F246E8 for ; Tue, 9 May 2017 13:03:23 -0400 (EDT) From: Leo Famulari To: guix-patches@gnu.org Subject: [PATCH] gnu: lxterminal: Fix CVE-2016-10369. Date: Tue, 9 May 2017 13:03:13 -0400 Message-Id: X-Mailer: git-send-email 2.12.2 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.1 (----) * gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/lxde.scm (lxterminal)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/lxde.scm | 1 + .../patches/lxterminal-CVE-2016-10369.patch | 37 ++++++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 gnu/packages/patches/lxterminal-CVE-2016-10369.patch diff --git a/gnu/local.mk b/gnu/local.mk index af37e6764..0d8daf766 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -790,6 +790,7 @@ dist_patch_DATA = \ %D%/packages/patches/luminance-hdr-qt-printer.patch \ %D%/packages/patches/lvm2-static-link.patch \ %D%/packages/patches/lxsession-use-gapplication.patch \ + %D%/packages/patches/lxterminal-CVE-2016-10369.patch \ %D%/packages/patches/lz4-fix-test-failures.patch \ %D%/packages/patches/make-impure-dirs.patch \ %D%/packages/patches/mars-install.patch \ diff --git a/gnu/packages/lxde.scm b/gnu/packages/lxde.scm index 1164ba8cb..cc1156ae6 100644 --- a/gnu/packages/lxde.scm +++ b/gnu/packages/lxde.scm @@ -162,6 +162,7 @@ toolkit. It allows users to monitor and control of running processes.") (uri (string-append "mirror://sourceforge/lxde/LXTerminal" "%20%28terminal%20emulator%29/LXTerminal%20" version "/" name "-" version ".tar.xz")) + (patches (search-patches "lxterminal-CVE-2016-10369.patch")) (sha256 (base32 "1yf76s15zvfw0h42b0ay1slpq47khgjmcry8ki2z812zar9lchia")))) diff --git a/gnu/packages/patches/lxterminal-CVE-2016-10369.patch b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch new file mode 100644 index 000000000..809eef08d --- /dev/null +++ b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch @@ -0,0 +1,37 @@ +Fix CVE-2016-10369: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369 + +Patch copied from upstream source repository: + +https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 + +From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001 +From: Yao Wei +Date: Mon, 8 May 2017 00:47:55 +0800 +Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory + +This bug is pointed out by stackexchange user that putting socket file in +/tmp is a potential risk. Putting the socket dir in user directory could +mitigate the risk. +--- + src/unixsocket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/unixsocket.c b/src/unixsocket.c +index 4c660ac..f88284c 100644 +--- a/src/unixsocket.c ++++ b/src/unixsocket.c +@@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar + * This function returns TRUE if this process should keep running and FALSE if it should exit. */ + + /* Formulate the path for the Unix domain socket. */ +- gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name()); ++ gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default())); ++ printf("%s\n", socket_path); + + /* Create socket. */ + int fd = socket(PF_UNIX, SOCK_STREAM, 0); +-- +2.1.4 + -- 2.12.2 ------------=_1494373021-12289-1--