From 8775fc10c61f493c9363ca288402f5f764b6d949 Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Tue, 9 May 2017 13:02:12 -0400 Subject: gnu: lxterminal: Fix CVE-2016-10369. * gnu/packages/patches/lxterminal-CVE-2016-10369.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/lxde.scm (lxterminal)[source]: Use it. --- .../patches/lxterminal-CVE-2016-10369.patch | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 gnu/packages/patches/lxterminal-CVE-2016-10369.patch (limited to 'gnu/packages/patches') diff --git a/gnu/packages/patches/lxterminal-CVE-2016-10369.patch b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch new file mode 100644 index 0000000000..809eef08da --- /dev/null +++ b/gnu/packages/patches/lxterminal-CVE-2016-10369.patch @@ -0,0 +1,37 @@ +Fix CVE-2016-10369: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369 + +Patch copied from upstream source repository: + +https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 + +From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001 +From: Yao Wei +Date: Mon, 8 May 2017 00:47:55 +0800 +Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory + +This bug is pointed out by stackexchange user that putting socket file in +/tmp is a potential risk. Putting the socket dir in user directory could +mitigate the risk. +--- + src/unixsocket.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/unixsocket.c b/src/unixsocket.c +index 4c660ac..f88284c 100644 +--- a/src/unixsocket.c ++++ b/src/unixsocket.c +@@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar + * This function returns TRUE if this process should keep running and FALSE if it should exit. */ + + /* Formulate the path for the Unix domain socket. */ +- gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name()); ++ gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default())); ++ printf("%s\n", socket_path); + + /* Create socket. */ + int fd = socket(PF_UNIX, SOCK_STREAM, 0); +-- +2.1.4 + -- cgit 1.4.1