July 2016 - openSUSE Commits - openSUSE Mailing Lists

commit polarssl for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package polarssl for openSUSE:13.2:Update checked in at 2016-08-01 01:21:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/polarssl (Old) and /work/SRC/openSUSE:13.2:Update/.polarssl.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "polarssl" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.YPh8N7/_old 2016-08-01 01:21:33.000000000 +0200 +++ /var/tmp/diff_new_pack.YPh8N7/_new 2016-08-01 01:21:33.000000000 +0200 @@ -1 +1 @@ -<link package='polarssl.4517' cicount='copy' /> +<link package='polarssl.5404' cicount='copy' />

1 0

commit patchinfo.5398 for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package patchinfo.5398 for openSUSE:13.2:Update checked in at 2016-08-01 01:12:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/patchinfo.5398 (Old) and /work/SRC/openSUSE:13.2:Update/.patchinfo.5398.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "patchinfo.5398" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _patchinfo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _patchinfo ++++++ <patchinfo incident="5398"> <issue id="990195" tracker="bnc">VUL-1: CVE-2016-6265: mupdf: use-after-free</issue> <issue id="2016-6265" tracker="cve" /> <category>security</category> <rating>moderate</rating> <packager>namtrac</packager> <description> This update for mupdf fixes the following issues: Security issues fixed: - CVE-2016-6265: Fixed a use-after-free issue (boo#990195). </description> <summary>Security update for mupdf</summary> </patchinfo>

1 0

commit patchinfo.5397 for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package patchinfo.5397 for openSUSE:13.2:Update checked in at 2016-08-01 01:11:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/patchinfo.5397 (Old) and /work/SRC/openSUSE:13.2:Update/.patchinfo.5397.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "patchinfo.5397" Changes: -------- New Changes file: NO CHANGES FILE!!! New: ---- _patchinfo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _patchinfo ++++++ <patchinfo incident="5397"> <issue id="990189" tracker="bnc">VUL-1: CVE-2015-8948,CVE-2016-6262: libidn: out-of-bounds-read when reading one zero byte as input</issue> <issue id="990191" tracker="bnc">VUL-1: CVE-2016-6263: libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8</issue> <issue id="2015-8948" tracker="cve" /> <issue id="2016-6262" tracker="cve" /> <issue id="2016-6263" tracker="cve" /> <category>security</category> <rating>moderate</rating> <packager>scarabeus_iv</packager> <description> This libidn update to version 1.33 fixes the following issues: Security issues fixed: - CVE-2015-8948, CVE-2016-6262: Fixed an out-of-bounds-read when reading one zero byte as input (bsc#990189). - CVE-2016-6263: Fixed stringprep_utf8_nfkc_normalize to reject invalid UTF-8 (bsc#boo#990191). Included bugfixes: - Fixed crash in idna_to_unicode_8z8z and idna_to_unicode_8zlz (introduced in 1.31). - API and ABI is backwards compatible with the previous version. - Update gpg keyring </description> <summary>Security update for libidn</summary> </patchinfo>

1 0

commit libidn for openSUSE:13.2:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package libidn for openSUSE:13.2:Update checked in at 2016-08-01 01:11:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.2:Update/libidn (Old) and /work/SRC/openSUSE:13.2:Update/.libidn.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "libidn" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.QD5uTV/_old 2016-08-01 01:11:37.000000000 +0200 +++ /var/tmp/diff_new_pack.QD5uTV/_new 2016-08-01 01:11:37.000000000 +0200 @@ -1 +1 @@ -<link package='libidn.3905' cicount='copy' /> +<link package='libidn.5397' cicount='copy' />

1 0

commit chromium for openSUSE:13.1:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package chromium for openSUSE:13.1:Update checked in at 2016-07-31 17:28:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/chromium (Old) and /work/SRC/openSUSE:13.1:Update/.chromium.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "chromium" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.ZwKRr9/_old 2016-07-31 17:28:11.000000000 +0200 +++ /var/tmp/diff_new_pack.ZwKRr9/_new 2016-07-31 17:28:11.000000000 +0200 @@ -1 +1 @@ -<link package='chromium.4645' cicount='copy' /> +<link package='chromium.4655' cicount='copy' />

1 0

commit dropbear for openSUSE:13.1:Update
by root＠hilbert.suse.de 31 Jul '16

31 Jul '16

Hello community, here is the log from the commit of package dropbear for openSUSE:13.1:Update checked in at 2016-07-31 12:09:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/dropbear (Old) and /work/SRC/openSUSE:13.1:Update/.dropbear.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "dropbear" Changes: -------- New Changes file: NO CHANGES FILE!!! ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _link ++++++ --- /var/tmp/diff_new_pack.AQK7z2/_old 2016-07-31 12:09:04.000000000 +0200 +++ /var/tmp/diff_new_pack.AQK7z2/_new 2016-07-31 12:09:04.000000000 +0200 @@ -1 +1 @@ -<link package='dropbear.4833' cicount='copy' /> +<link package='dropbear.4656' cicount='copy' />

1 0

commit hexchat for openSUSE:Factory
by root＠hilbert.suse.de 29 Jul '16

29 Jul '16

Hello community, here is the log from the commit of package hexchat for openSUSE:Factory checked in at 2016-07-30 00:28:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hexchat (Old) and /work/SRC/openSUSE:Factory/.hexchat.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "hexchat" Changes: -------- --- /work/SRC/openSUSE:Factory/hexchat/hexchat.changes 2016-05-08 10:46:22.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.hexchat.new/hexchat.changes 2016-07-30 00:28:36.000000000 +0200 @@ -1,0 +2,6 @@ +Thu Jul 28 08:38:38 UTC 2016 - tyang(a)suse.com + +- Modified migrate-configuration-from-xchat.patch. + To realize the migration of servlist.conf file.(bnc#989961) + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ migrate-configuration-from-xchat.patch ++++++ --- /var/tmp/diff_new_pack.NfaRAM/_old 2016-07-30 00:28:38.000000000 +0200 +++ /var/tmp/diff_new_pack.NfaRAM/_new 2016-07-30 00:28:38.000000000 +0200 @@ -1,16 +1,14 @@ diff --git a/src/common/cfgfiles.c b/src/common/cfgfiles.c -index 4bf2f47..35c330f 100644 +index 4bf2f47..1800d3f 100644 --- a/src/common/cfgfiles.c +++ b/src/common/cfgfiles.c -@@ -938,6 +938,84 @@ make_config_dirs (void) +@@ -950,6 +950,38 @@ make_dcc_dirs (void) return 0; } -+void -+migrate_conf_from_xchat (void) ++void migrate_from_xchat (void) +{ -+ char *xchat_conf; -+ char *logs_xchat; ++ char *servlist_conf, *logs_xchat; + char *xchat_dir = g_build_filename (g_get_home_dir (), ".xchat2", NULL); + if (!g_file_test (xchat_dir, G_FILE_TEST_EXISTS)) + { @@ -18,15 +16,14 @@ + g_free (xchat_dir); + return; + } -+ -+ xchat_conf = g_build_filename (xchat_dir, "xchat.conf", NULL); -+ if (g_file_test (xchat_conf, G_FILE_TEST_EXISTS)) ++ servlist_conf = g_build_filename (xchat_dir, "servlist_.conf", NULL); ++ if (g_file_test (servlist_conf, G_FILE_TEST_EXISTS)) + { -+ char *hexchat_conf = g_build_filename (get_xdir (), "hexchat.conf", NULL); -+ g_rename (xchat_conf, hexchat_conf); -+ g_free (hexchat_conf); ++ char *servlist_target = g_build_filename (get_xdir (), "servlist_.conf", NULL); ++ g_rename (servlist_conf, servlist_target); ++ g_free (servlist_target); + } -+ g_free (xchat_conf); ++ g_free (servlist_conf); + + logs_xchat = g_build_filename (xchat_dir, "xchatlogs", NULL); + if (g_file_test (logs_xchat, G_FILE_TEST_EXISTS)) @@ -40,80 +37,31 @@ + g_free (xchat_dir); +} + -+static void move_file_from_xchat_xdir (char *des_dir, char *src) -+{ -+ GFile *file = g_file_new_for_path (src); -+ char *filename = g_file_get_basename (file); -+ g_print ("move %s to %s\n",src,des_dir); -+ if (g_file_test (des_dir, G_FILE_TEST_EXISTS)) -+ { -+ char *des = g_build_filename (des_dir, filename, NULL); -+ g_print ("from %s to %s\n",src,des); -+ g_rename (src,des); -+ g_free (des); -+ } -+ -+ g_free (filename); -+ g_object_unref (file); -+} -+ -+static void move_to_dir_addons (char *filename) -+{ -+ char *des_dir = g_build_filename (get_xdir (), "addons", NULL); -+ move_file_from_xchat_xdir (des_dir, filename); -+ g_free (des_dir); -+} -+ -+static void move_to_dir_certs (char* filename) -+{ -+ char *des_dir = g_build_filename (get_xdir (), "certs", NULL); -+ move_file_from_xchat_xdir (des_dir, filename); -+ g_free (des_dir); -+} -+ -+void -+migrate_addons_and_certs_from_xchat (void) -+{ -+ char *xchat_dir = g_build_filename (g_get_home_dir (), ".xchat2", NULL); -+ if (g_file_test (xchat_dir, G_FILE_TEST_EXISTS)) -+ { -+ g_print ("~/.xchat/ exixts\n"); -+ for_files (xchat_dir, "*.so", move_to_dir_addons); -+ for_files (xchat_dir, "*.pem", move_to_dir_certs); -+ } -+ g_free (xchat_dir); -+} + int - make_dcc_dirs (void) + load_config (void) { diff --git a/src/common/cfgfiles.h b/src/common/cfgfiles.h -index b421884..a2e7620 100644 +index b421884..151e9bd 100644 --- a/src/common/cfgfiles.h +++ b/src/common/cfgfiles.h -@@ -39,6 +39,8 @@ int cfg_put_color (int fh, guint16 r, guint16 g, guint16 b, char *var); - char *get_xdir (void); - int check_config_dir (void); +@@ -41,6 +41,7 @@ int check_config_dir (void); void load_default_config (void); -+void migrate_conf_from_xchat (void); -+void migrate_addons_and_certs_from_xchat (void); int make_config_dirs (void); int make_dcc_dirs (void); ++void migrate_from_xchat (void); int load_config (void); + int save_config (void); + void list_free (GSList ** list); diff --git a/src/common/hexchat.c b/src/common/hexchat.c -index caa20eb..e07d7a8 100644 +index caa20eb..056ae84 100644 --- a/src/common/hexchat.c +++ b/src/common/hexchat.c -@@ -1041,8 +1041,11 @@ main (int argc, char *argv[]) - } else - { - /* this is probably the first run */ -- load_default_config (); +@@ -1044,6 +1044,7 @@ main (int argc, char *argv[]) + load_default_config (); make_config_dirs (); -+ migrate_conf_from_xchat (); -+ if (load_config () != 0) -+ load_default_config (); -+ migrate_addons_and_certs_from_xchat (); make_dcc_dirs (); ++ migrate_from_xchat (); } + /* we MUST do this after load_config () AND before fe_init (thus gtk_init) otherwise it will fail */

1 0

commit krb5-auth-dialog for openSUSE:Factory
by root＠hilbert.suse.de 29 Jul '16

29 Jul '16

Hello community, here is the log from the commit of package krb5-auth-dialog for openSUSE:Factory checked in at 2016-07-30 00:28:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/krb5-auth-dialog (Old) and /work/SRC/openSUSE:Factory/.krb5-auth-dialog.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "krb5-auth-dialog" Changes: -------- --- /work/SRC/openSUSE:Factory/krb5-auth-dialog/krb5-auth-dialog.changes 2015-03-30 19:11:53.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.krb5-auth-dialog.new/krb5-auth-dialog.changes 2016-07-30 00:28:35.000000000 +0200 @@ -1,0 +2,10 @@ +Sat Jul 23 20:26:54 UTC 2016 - zaitor(a)opensuse.org + +- Update to version 3.20.0: + + Use yelp-tools instead of gtk-doc-utils. + + Remove some deprecated macros. + + Updated translations. +- Replace gnome-doc-utils-devel for yelp-tools BuildRequires + following upstream changes. + +------------------------------------------------------------------- Old: ---- krb5-auth-dialog-3.15.4.tar.xz New: ---- krb5-auth-dialog-3.20.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ krb5-auth-dialog.spec ++++++ --- /var/tmp/diff_new_pack.6LZiez/_old 2016-07-30 00:28:36.000000000 +0200 +++ /var/tmp/diff_new_pack.6LZiez/_new 2016-07-30 00:28:36.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package krb5-auth-dialog # -# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # Copyright (c) 2009 Dominique Leuenberger, Almere, The Netherlands. # # All modifications and additions to the file contributed by third parties @@ -21,18 +21,18 @@ Summary: Kerberos 5 ticket monitoring tray applet License: GPL-2.0+ Group: Productivity/Security -Version: 3.15.4 +Version: 3.20.0 Release: 0 Url: http://download.gnome.org/sources/krb5-auth-dialog/ -Source: http://download.gnome.org/sources/krb5-auth-dialog/3.15/%{name}-%{version}.… +Source: http://download.gnome.org/sources/krb5-auth-dialog/3.20/%{name}-%{version}.… BuildRequires: bison BuildRequires: flex -BuildRequires: gnome-doc-utils-devel BuildRequires: intltool BuildRequires: krb5-devel BuildRequires: pam-devel BuildRequires: translation-update-upstream BuildRequires: update-desktop-files +BuildRequires: yelp-tools BuildRequires: pkgconfig(glib-2.0) >= 2.28 BuildRequires: pkgconfig(gtk+-3.0) >= 3.14 BuildRequires: pkgconfig(libnm-glib) @@ -83,13 +83,7 @@ %files %defattr(-,root,root) -%dir %{_datadir}/gnome/ -%dir %{_datadir}/gnome/help/ -%dir %{_datadir}/gnome/help/%{name}/ -%doc %{_datadir}/gnome/help/%{name}/C/ -%dir %{_datadir}/omf/ -%dir %{_datadir}/omf/%{name}/ -%doc %{_datadir}/omf/%{name}/%{name}-C.omf +%doc %{_datadir}/help/C/%{name}/ %{_bindir}/%{name}* %{_libdir}/%{name}/ %dir %{_datadir}/appdata ++++++ krb5-auth-dialog-3.15.4.tar.xz -> krb5-auth-dialog-3.20.0.tar.xz ++++++ ++++ 52111 lines of diff (skipped)

1 0

commit shibboleth-sp for openSUSE:Factory
by root＠hilbert.suse.de 29 Jul '16

29 Jul '16

Hello community, here is the log from the commit of package shibboleth-sp for openSUSE:Factory checked in at 2016-07-30 00:28:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/shibboleth-sp (Old) and /work/SRC/openSUSE:Factory/.shibboleth-sp.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "shibboleth-sp" Changes: -------- --- /work/SRC/openSUSE:Factory/shibboleth-sp/shibboleth-sp.changes 2016-05-19 12:15:56.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.shibboleth-sp.new/shibboleth-sp.changes 2016-07-30 00:28:33.000000000 +0200 @@ -1,0 +2,6 @@ +Tue Jul 19 18:11:33 UTC 2016 - dimstar(a)opensuse.org + +- Use %tmpfiles_create macro: gracefully fails in case of missing + binaries (e.g. container setups). + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ shibboleth-sp.spec ++++++ --- /var/tmp/diff_new_pack.wRgJP4/_old 2016-07-30 00:28:34.000000000 +0200 +++ /var/tmp/diff_new_pack.wRgJP4/_new 2016-07-30 00:28:34.000000000 +0200 @@ -182,7 +182,8 @@ chown %{runuser}:%{runuser} %{_localstatedir}/log/%{realname}/* 2>/dev/null || : %service_add_post shibd.service -systemd-tmpfiles --create %{_tmpfilesdir}/%{realname}.conf + +%tmpfiles_create %{_tmpfilesdir}/%{realname}.conf %preun # On final removal, stop shibd and remove service, restart Apache if running.

1 0

commit apache2-mod_fcgid for openSUSE:Factory
by root＠hilbert.suse.de 29 Jul '16

29 Jul '16

Hello community, here is the log from the commit of package apache2-mod_fcgid for openSUSE:Factory checked in at 2016-07-30 00:28:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apache2-mod_fcgid (Old) and /work/SRC/openSUSE:Factory/.apache2-mod_fcgid.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "apache2-mod_fcgid" Changes: -------- --- /work/SRC/openSUSE:Factory/apache2-mod_fcgid/apache2-mod_fcgid.changes 2015-09-24 06:14:20.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.apache2-mod_fcgid.new/apache2-mod_fcgid.changes 2016-07-30 00:28:27.000000000 +0200 @@ -1,0 +2,8 @@ +Wed Jul 27 13:35:31 UTC 2016 - kstreitova(a)suse.com + +- add mod_fcgid-2.3.9-CVE-2016-1000104.patch - don't allow setting + the HTTP_PROXY environment variable from a http header + [CVE-2016-1000104], [bsc#988492] +- run spec-cleaner to clean specfile + +------------------------------------------------------------------- New: ---- mod_fcgid-2.3.9-CVE-2016-1000104.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apache2-mod_fcgid.spec ++++++ --- /var/tmp/diff_new_pack.yttzrI/_old 2016-07-30 00:28:28.000000000 +0200 +++ /var/tmp/diff_new_pack.yttzrI/_new 2016-07-30 00:28:28.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package apache2-mod_fcgid # -# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,30 +17,26 @@ Name: apache2-mod_fcgid -# Version: 2.3.9 Release: 0 -# Summary: Alternative FastCGI module for Apache2 License: GPL-2.0+ Group: Productivity/Networking/Web/Servers -# Url: http://httpd.apache.org/mod_fcgid/ Source: http://mirror.synyx.de/apache/httpd/mod_fcgid/mod_fcgid-%{version}.tar.bz2 Source1: apache2-mod_fcgid.conf Patch0: mod_fcgid-2.3.5_suse_paths.patch +# PATCH-FIX-UPSTREAM bsc#988492 kstreitova(a)suse.com -- don't allow setting the HTTP_PROXY variable +Patch1: mod_fcgid-2.3.9-CVE-2016-1000104.patch BuildRequires: apache-rpm-macros BuildRequires: apache2-devel Requires: %{apache_mmn} Requires: %{apache_suse_maintenance_mmn} Requires: apache2 -# -# BuildRoot: %{_tmppath}/%{name}-%{version}-build %description -A binary compatibile alternative to the Apache -module mod_fastcgi. +A binary compatibile alternative to the Apache module mod_fastcgi. The module implements an efficient process pool management for external CGI program invocation. The pool of CGI programs is mapped against the @@ -56,13 +52,14 @@ %prep %setup -q -n mod_fcgid-%{version} %patch0 +%patch1 -p1 %build APXS="%{apache_apxs}-prefork" ./configure.apxs make %{?_smp_mflags} %install -make DESTDIR=%{buildroot} install %{?_smp_mflags} +make %{?_smp_mflags} DESTDIR=%{buildroot} install install -D -m 0644 %{SOURCE1} %{buildroot}%{apache_sysconfdir}/conf.d/mod_fcgid.conf install -d -m 0755 %{buildroot}%{_localstatedir}/lib/apache2/fcgid/ @@ -70,8 +67,8 @@ set +x mkdir -p %{apache_test_module_dir} cp %{SOURCE1} %{apache_test_module_dir}/mod_fcgid-test.conf -mkdir -p "%{apache_test_module_dir}/var/lib/apache2/fcgid/" -sed -i "s:/var/lib:%{apache_test_module_dir}/var/lib:" %{apache_test_module_dir}/mod_fcgid-test.conf +mkdir -p "%{apache_test_module_dir}%{_localstatedir}/lib/apache2/fcgid/" +sed -i "s:%{_localstatedir}/lib:%{apache_test_module_dir}%{_localstatedir}/lib:" %{apache_test_module_dir}/mod_fcgid-test.conf %apache_test_module_load -m fcgid -i mod_fcgid-test.conf set -x ++++++ mod_fcgid-2.3.9-CVE-2016-1000104.patch ++++++ Index: mod_fcgid-2.3.9/modules/fcgid/mod_fcgid.c =================================================================== --- mod_fcgid-2.3.9.orig/modules/fcgid/mod_fcgid.c +++ mod_fcgid-2.3.9/modules/fcgid/mod_fcgid.c @@ -155,9 +155,15 @@ static void fcgid_add_cgi_vars(request_r * consistent with legacy mod_fcgid behavior and mod_fastcgi * prior to 2.4.7 */ - apr_table_setn(r->subprocess_env, *hdr, val); - /* standard munging of header name (upcase, HTTP_, etc.) */ - apr_table_setn(r->subprocess_env, http2env(r->pool, *hdr), val); + /* boo#988492 httpoxy don't set HTTP_PROXY */ + if ( strcasecmp(*hdr, "HTTP_PROXY") != 0 && strcasecmp(*hdr, "HTTP-PROXY") != 0) { + apr_table_setn(r->subprocess_env, *hdr, val); + } + /* boo#988492 httpoxy don't set HTTP_PROXY */ + if ( strcasecmp(*hdr, "PROXY") != 0 ) { + /* standard munging of header name (upcase, HTTP_, etc.) */ + apr_table_setn(r->subprocess_env, http2env(r->pool, *hdr), val); + } } } }

1 0