From 634dcbd50dd5cf4b25153689e61bcba45163c841 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 14 Aug 2021 23:00:42 +0200 Subject: [PATCH] package/sylpheed: fix CVE-2021-37746 textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click. Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni --- ...-link-checker-before-accepting-click.patch | 37 +++++++++++++++++++ package/sylpheed/sylpheed.mk | 3 ++ 2 files changed, 40 insertions(+) create mode 100644 package/sylpheed/0001-harden-link-checker-before-accepting-click.patch diff --git a/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch b/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch new file mode 100644 index 0000000000..fe3375bc91 --- /dev/null +++ b/package/sylpheed/0001-harden-link-checker-before-accepting-click.patch @@ -0,0 +1,37 @@ +From ac286a71ed78429e16c612161251b9ea90ccd431 Mon Sep 17 00:00:00 2001 +From: Paul +Date: Sun, 23 May 2021 12:16:40 +0100 +Subject: [PATCH] harden link checker before accepting click + +[Retrieved from: +https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431] +Signed-off-by: Fabrice Fontaine +--- + src/textview.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/textview.c b/src/textview.c +index 62ad46eaf..3cdf5d911 100644 +--- a/src/textview.c ++++ b/src/textview.c +@@ -2885,7 +2885,7 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri) + gboolean retval = TRUE; + + if (is_uri_string(uri->uri) == FALSE) +- return TRUE; ++ return FALSE; + + visible_str = textview_get_visible_uri(textview, uri); + if (visible_str == NULL) +@@ -2922,6 +2922,8 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri) + if (aval == G_ALERTALTERNATE) + retval = TRUE; + } ++ if (strlen(uri->uri) > get_uri_len(uri->uri)) ++ retval = FALSE; + + g_free(visible_str); + +-- +2.25.1 + diff --git a/package/sylpheed/sylpheed.mk b/package/sylpheed/sylpheed.mk index 2f8a7aeff9..a7c7adade3 100644 --- a/package/sylpheed/sylpheed.mk +++ b/package/sylpheed/sylpheed.mk @@ -14,6 +14,9 @@ SYLPHEED_CPE_ID_VENDOR = sylpheed_project SYLPHEED_CONF_OPTS = --disable-gtkspell --disable-gpgme SYLPHEED_DEPENDENCIES = host-pkgconf libgtk2 +# 0001-harden-link-checker-before-accepting-click.patch +SYLPHEED_IGNORE_CVES += CVE-2021-37746 + # Remove the -I$(includedir) from the Makefiles # because it refers to the host /usr/include. define SYLPHEED_PRECONFIGURE -- 2.30.2