rpms/evolution/F-7 evolution-2.10.3-CVE-2008-0072.patch, NONE, 1.1 evolution.spec, 1.271, 1.272

Matthew Barnes (mbarnes) fedora-extras-commits at redhat.com
Wed Mar 5 15:10:28 UTC 2008


Author: mbarnes

Update of /cvs/pkgs/rpms/evolution/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6618

Modified Files:
	evolution.spec 
Added Files:
	evolution-2.10.3-CVE-2008-0072.patch 
Log Message:

* Tue Mar 04 2008 Matthew Barnes <mbarnes at redhat.com> - 2.10.3-8.fc7
- Add patch for CVE-2008-0072 (format string vulnerability).


evolution-2.10.3-CVE-2008-0072.patch:

--- NEW FILE evolution-2.10.3-CVE-2008-0072.patch ---
diff -up evolution-2.10.3/mail/em-format.c.CVE-2008-0072 evolution-2.10.3/mail/em-format.c
--- evolution-2.10.3/mail/em-format.c.CVE-2008-0072	2008-03-04 15:44:32.000000000 -0500
+++ evolution-2.10.3/mail/em-format.c	2008-03-04 15:45:23.000000000 -0500
@@ -1155,7 +1155,7 @@ emf_application_xpkcs7mime(EMFormat *emf
 	opart = camel_mime_part_new();
 	valid = camel_cipher_decrypt(context, part, opart, ex);
 	if (valid == NULL) {
-		em_format_format_error(emf, stream, ex->desc?ex->desc:_("Could not parse S/MIME message: Unknown error"));
+		em_format_format_error(emf, stream, "%s", ex->desc?ex->desc:_("Could not parse S/MIME message: Unknown error"));
 		em_format_part_as(emf, stream, part, NULL);
 	} else {
 		if (emfc == NULL)
@@ -1305,7 +1305,7 @@ emf_multipart_encrypted(EMFormat *emf, C
 	if (valid == NULL) {
 		em_format_format_error(emf, stream, ex->desc?("Could not parse S/MIME message"):_("Could not parse S/MIME message: Unknown error"));
 		if (ex->desc)
-			em_format_format_error(emf, stream, ex->desc);
+			em_format_format_error(emf, stream, "%s", ex->desc);
 		em_format_part_as(emf, stream, part, "multipart/mixed");
 	} else {
 		if (emfc == NULL)
@@ -1470,7 +1470,7 @@ emf_multipart_signed(EMFormat *emf, Came
 		if (valid == NULL) {
 			em_format_format_error(emf, stream, ex->desc?_("Error verifying signature"):_("Unknown error verifying signature"));
 			if (ex->desc)
-				em_format_format_error(emf, stream, ex->desc);
+				em_format_format_error(emf, stream, "%s", ex->desc);
 			em_format_part_as(emf, stream, part, "multipart/mixed");
 		} else {
 			if (emfc == NULL)
@@ -1536,7 +1536,7 @@ emf_inlinepgp_signed(EMFormat *emf, Came
 	if (!valid) {
 		em_format_format_error(emf, stream, ex->desc?_("Error verifying signature"):_("Unknown error verifying signature"));
 		if (ex->desc)
-			em_format_format_error(emf, stream, ex->desc);
+			em_format_format_error(emf, stream, "%s", ex->desc);
 		em_format_format_source(emf, stream, ipart);
 		/* I think this will loop: em_format_part_as(emf, stream, part, "text/plain"); */
 		camel_exception_free(ex);
@@ -1607,7 +1607,7 @@ emf_inlinepgp_encrypted(EMFormat *emf, C
 	if (!valid) {
 		em_format_format_error(emf, stream, ex->desc?("Could not parse S/MIME message"):_("Could not parse S/MIME message: Unknown error"));
 		if (ex->desc)
-			em_format_format_error(emf, stream, ex->desc);
+			em_format_format_error(emf, stream, "%s", ex->desc);
 		em_format_format_source(emf, stream, ipart);
 		/* I think this will loop: em_format_part_as(emf, stream, part, "text/plain"); */
 		camel_exception_free(ex);


Index: evolution.spec
===================================================================
RCS file: /cvs/pkgs/rpms/evolution/F-7/evolution.spec,v
retrieving revision 1.271
retrieving revision 1.272
diff -u -r1.271 -r1.272
--- evolution.spec	3 Nov 2007 19:26:30 -0000	1.271
+++ evolution.spec	5 Mar 2008 15:09:49 -0000	1.272
@@ -47,7 +47,7 @@
 
 Name: evolution
 Version: 2.10.3
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPL
 Group: Applications/Productivity
 Summary: GNOME's next-generation groupware suite
@@ -179,6 +179,9 @@
 # RH bug #249640 / GNOME bug #442329
 Patch57: evolution-2.10.3-todo-conduit.patch
 
+# CVE-2008-0072
+Patch58: evolution-2.10.3-CVE-2008-0072.patch
+
 ## Dependencies ###
 
 Requires(post): GConf2
@@ -338,6 +341,7 @@
 %patch55 -p1 -b .version-checks
 %patch56 -p1 -b .ETreeTableAdapter-idle-crash
 %patch57 -p1 -b .todo-conduit
+%patch58 -p1 -b .CVE-2008-0072
 
 mkdir -p krb5-fakeprefix/include
 mkdir -p krb5-fakeprefix/lib
@@ -759,6 +763,9 @@
 %{_libdir}/evolution/%{evo_major}/libmenus.so
 
 %changelog
+* Tue Mar 04 2008 Matthew Barnes <mbarnes at redhat.com> - 2.10.3-8.fc7
+- Add patch for CVE-2008-0072 (format string vulnerability).
+
 * Sat Nov 03 2007 Matthew Barnes <mbarnes at redhat.com> - 2.10.3-7.fc7
 - Add patch for RH bug #249640 (todo conduit crash).
 




More information about the fedora-extras-commits mailing list