diff options
| author | Nicolas Reynolds <fauno@kiwwwi.com.ar> | 2011-10-28 11:35:50 -0300 |
|---|---|---|
| committer | Nicolas Reynolds <fauno@kiwwwi.com.ar> | 2011-10-28 11:35:50 -0300 |
| commit | 8856e6fe26ce35b4caf6beeac324f583ec1b6133 (patch) | |
| tree | c42a03e2b7610a39d167af36357607399aa40045 /extra/kdeutils/CVE-2011-2725.patch | |
| parent | 5100458465d1ed420073c3213349bf430075ddbc (diff) | |
| parent | 0424b5fc47f106db6498c4cda3476e1d49fe0f82 (diff) | |
Merge branch 'master' of ssh://vparabola/home/parabola/abslibre-pre-mips64el
Conflicts:
community/esmtp/PKGBUILD
community/geany-plugins/PKGBUILD
community/giggle/PKGBUILD
community/guichan/PKGBUILD
community/mxml/PKGBUILD
community/ruby-gtk2/PKGBUILD
core/libtool/PKGBUILD
core/mkinitcpio-busybox/PKGBUILD
core/udev/PKGBUILD
extra/audacious/PKGBUILD
extra/conky/PKGBUILD
extra/gnome-control-center/PKGBUILD
extra/gtk2/PKGBUILD
extra/gtk3/PKGBUILD
extra/gvfs/PKGBUILD
extra/kdeutils/PKGBUILD
extra/kino/PKGBUILD
extra/mkvtoolnix/PKGBUILD
extra/poppler/PKGBUILD
extra/postfix/PKGBUILD
extra/pulseaudio/PKGBUILD
extra/qtcurve-gtk2/PKGBUILD
extra/transmission/PKGBUILD
extra/xfburn/PKGBUILD
extra/xfce4-xkb-plugin/PKGBUILD
extra/xorg-server/PKGBUILD
extra/yelp/PKGBUILD
kde-unstable/calligra/PKGBUILD
multilib/lib32-gtk2/PKGBUILD
multilib/lib32-libpulse/PKGBUILD
multilib/libtool-multilib/PKGBUILD
multilib/wine/PKGBUILD
multilib/wine/wine.install
Diffstat (limited to 'extra/kdeutils/CVE-2011-2725.patch')
| -rw-r--r-- | extra/kdeutils/CVE-2011-2725.patch | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/extra/kdeutils/CVE-2011-2725.patch b/extra/kdeutils/CVE-2011-2725.patch new file mode 100644 index 000000000..986bebc90 --- /dev/null +++ b/extra/kdeutils/CVE-2011-2725.patch @@ -0,0 +1,20 @@ +--- a/part/part.cpp ++++ b/part/part.cpp +@@ -558,8 +558,15 @@ void Part::slotPreviewExtracted(KJob *jo + if (!job->error()) { + const ArchiveEntry& entry = + m_model->entryForIndex(m_view->selectionModel()->currentIndex()); +- const QString fullName = +- m_previewDir->name() + QLatin1Char( '/' ) + entry[ FileName ].toString(); ++ ++ QString fullName = ++ m_previewDir->name() + QLatin1Char('/') + entry[FileName].toString(); ++ ++ // Make sure a maliciously crafted archive with parent folders named ".." do ++ // not cause the previewed file path to be located outside the temporary ++ // directory, resulting in a directory traversal issue. ++ fullName.remove(QLatin1String("../")); ++ + ArkViewer::view(fullName, widget()); + } else { + KMessageBox::error(widget(), job->errorString()); |