nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-09-19 22:30:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

glib: fix CVE-2019-13012

Browse Source 
CVE-2019-13012 Description:

The keyfile settings backend in GLib before 2.59.1 creates directories
using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and
files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE,
G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL).
Consequently, it does not properly restrict directory (and file) permissions.
Instead, for directories, 0777 permissions are used; for files, default file
permissions are used.

Patch Summary:

Changes the permissions when a directory is created,
using 700 instead 777 in gio/gkeyfilesettingsbackend.c
and changes test to run in a temp directory in gio/tests/gsettings.c.

Upstream Issue: https://gitlab.gnome.org/GNOME/glib/issues/1658
Upstream MR: https://gitlab.gnome.org/GNOME/glib/merge_requests/604

Fixes #64657
This commit is contained in:
worldofpeace
2019-07-12 16:27:34 -04:00
parent 88f069e2d8
commit 35e28b488f
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkgs/development/libraries/glib/default.nix
View File

@@ -91,6 +91,12 @@ stdenv.mkDerivation rec {
name = "CVE-2019-12450.patch";
sha256 = "03ris8lllbb7i18qvbpqaf7xdwfz1dkskx8mb533dmwlp2ll69hg";
})
# https://gitlab.gnome.org/GNOME/glib/issues/1658
(fetchpatch {
name = "CVE-2019-13012.patch";
url = "https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429.patch";
sha256 = "0ykfx9i1ipz06n7hvz27qw0l9hy9jslg5gqqxyfiivy81q4p7lnl";
})
];
outputs = [ "bin" "out" "dev" "devdoc" ];