Sun Jul 13 18:22:01 2008 UTC ()
Fix an insecure temp file creation vulnerability in zsh's difflog.pl
(CVE-2007-6209).


(tonnerre)
diff -r1.51 -r1.52 pkgsrc/shells/zsh/Makefile
diff -r1.46 -r1.47 pkgsrc/shells/zsh/Makefile.common
diff -r1.26 -r1.27 pkgsrc/shells/zsh/distinfo
diff -r0 -r1.7 pkgsrc/shells/zsh/patches/patch-aa
cvs diff -r1.51 -r1.52 pkgsrc/shells/zsh/Makefile (expand / switch to unified diff)

--- pkgsrc/shells/zsh/Makefile 2005/12/07 03:00:50 1.51
+++ pkgsrc/shells/zsh/Makefile 2008/07/13 18:22:01 1.52
@@ -1,8 +1,9 @@ @@ -1,8 +1,9 @@
1# $NetBSD: Makefile,v 1.51 2005/12/07 03:00:50 uebayasi Exp $ 1# $NetBSD: Makefile,v 1.52 2008/07/13 18:22:01 tonnerre Exp $
2 2
3.include "../../shells/zsh/Makefile.common" 3.include "../../shells/zsh/Makefile.common"
4 4
5ZSH_VERSION= 4.2.6 5ZSH_VERSION= 4.2.6
6ZSH_MAINTAINER= uebayasi@NetBSD.org 6ZSH_MAINTAINER= uebayasi@NetBSD.org
 7PKGREVISION= 1
7 8
8.include "../../mk/bsd.pkg.mk" 9.include "../../mk/bsd.pkg.mk"
cvs diff -r1.46 -r1.47 pkgsrc/shells/zsh/Attic/Makefile.common (expand / switch to unified diff)

--- pkgsrc/shells/zsh/Attic/Makefile.common 2008/07/03 09:07:26 1.46
+++ pkgsrc/shells/zsh/Attic/Makefile.common 2008/07/13 18:22:01 1.47
@@ -1,38 +1,40 @@ @@ -1,38 +1,40 @@
1# $NetBSD: Makefile.common,v 1.46 2008/07/03 09:07:26 uebayasi Exp $ 1# $NetBSD: Makefile.common,v 1.47 2008/07/13 18:22:01 tonnerre Exp $
2 2
3DISTNAME= zsh-${ZSH_VERSION} 3DISTNAME= zsh-${ZSH_VERSION}
4CATEGORIES= shells 4CATEGORIES= shells
5MASTER_SITES= ftp://mirrors.dotsrc.org/zsh/ \ 5MASTER_SITES= ftp://mirrors.dotsrc.org/zsh/ \
6 ftp://ftp.fu-berlin.de/pub/unix/shells/zsh/ \ 6 ftp://ftp.fu-berlin.de/pub/unix/shells/zsh/ \
7 ftp://ftp.funet.fi/pub/unix/shells/zsh/ \ 7 ftp://ftp.funet.fi/pub/unix/shells/zsh/ \
8 http://www.math.technion.ac.il/pub/zsh/ \ 8 http://www.math.technion.ac.il/pub/zsh/ \
9 ftp://ftp.zsh.org/zsh/ 9 ftp://ftp.zsh.org/zsh/
10EXTRACT_SUFX= .tar.bz2 10EXTRACT_SUFX= .tar.bz2
11 11
12MAINTAINER= ${ZSH_MAINTAINER} 12MAINTAINER= ${ZSH_MAINTAINER}
13HOMEPAGE= http://zsh.dotsrc.org/ 13HOMEPAGE= http://zsh.dotsrc.org/
14COMMENT= The Z shell 14COMMENT= The Z shell
15 15
16PKG_DESTDIR_SUPPORT= user-destdir 16PKG_DESTDIR_SUPPORT= user-destdir
17 17
18GNU_CONFIGURE= yes 18GNU_CONFIGURE= yes
19 19
20CONFIGURE_ARGS+= --enable-etcdir=${PKG_SYSCONFDIR:Q} 20CONFIGURE_ARGS+= --enable-etcdir=${PKG_SYSCONFDIR:Q}
21 21
22USE_TOOLS+= makeinfo 22USE_TOOLS+= makeinfo
23INFO_FILES= # PLIST 23INFO_FILES= # PLIST
24TEXINFO_REQD= 4.0 24TEXINFO_REQD= 4.0
25 25
 26DEPENDS+= p5-File-Temp-[0-9]*:../../devel/p5-File-Temp
 27
26PKG_INSTALLATION_TYPES= overwrite pkgviews 28PKG_INSTALLATION_TYPES= overwrite pkgviews
27 29
28.include "../../mk/bsd.prefs.mk" 30.include "../../mk/bsd.prefs.mk"
29 31
30# Handle any PKG_OPTIONS that this package might have. 32# Handle any PKG_OPTIONS that this package might have.
31.sinclude "options.mk" 33.sinclude "options.mk"
32 34
33BUILD_DEFS+= ZSH_STATIC 35BUILD_DEFS+= ZSH_STATIC
34MAKE_JOBS_SAFE= no 36MAKE_JOBS_SAFE= no
35 37
36.if defined(ZSH_STATIC) && !empty(ZSH_STATIC:M[Yy][Ee][Ss]) 38.if defined(ZSH_STATIC) && !empty(ZSH_STATIC:M[Yy][Ee][Ss])
37CONFIGURE_ARGS+= --disable-dynamic 39CONFIGURE_ARGS+= --disable-dynamic
38 40
cvs diff -r1.26 -r1.27 pkgsrc/shells/zsh/distinfo (expand / switch to unified diff)

--- pkgsrc/shells/zsh/distinfo 2006/04/07 15:28:49 1.26
+++ pkgsrc/shells/zsh/distinfo 2008/07/13 18:22:01 1.27
@@ -1,8 +1,9 @@ @@ -1,8 +1,9 @@
1$NetBSD: distinfo,v 1.26 2006/04/07 15:28:49 jlam Exp $ 1$NetBSD: distinfo,v 1.27 2008/07/13 18:22:01 tonnerre Exp $
2 2
3SHA1 (zsh-4.2.6.tar.bz2) = e00c3eda3f52c9514bb625bb56e4480358170d39 3SHA1 (zsh-4.2.6.tar.bz2) = e00c3eda3f52c9514bb625bb56e4480358170d39
4RMD160 (zsh-4.2.6.tar.bz2) = e4400fc6311bf6996128ecf7899592d6d8cdb310 4RMD160 (zsh-4.2.6.tar.bz2) = e4400fc6311bf6996128ecf7899592d6d8cdb310
5Size (zsh-4.2.6.tar.bz2) = 2098671 bytes 5Size (zsh-4.2.6.tar.bz2) = 2098671 bytes
 6SHA1 (patch-aa) = 15f9d45ea98f89945ca274fc5b0298fa9397f89d
6SHA1 (patch-ab) = 815de90c379035dbc02b251cee148f6df47f9a65 7SHA1 (patch-ab) = 815de90c379035dbc02b251cee148f6df47f9a65
7SHA1 (patch-ac) = 965b56e5ae39d6523416752c1390f01315c5d758 8SHA1 (patch-ac) = 965b56e5ae39d6523416752c1390f01315c5d758
8SHA1 (patch-ae) = 7d4514d0bad6553d3c0cf115874bf50ed0da3d48 9SHA1 (patch-ae) = 7d4514d0bad6553d3c0cf115874bf50ed0da3d48
File Added: pkgsrc/shells/zsh/patches/Attic/patch-aa
$NetBSD: patch-aa,v 1.7 2008/07/13 18:22:01 tonnerre Exp $

--- Util/difflog.pl.orig	2002-04-18 16:35:17.000000000 +0200
+++ Util/difflog.pl
@@ -2,10 +2,13 @@
 
 use strict;
 use IO::File;
+use File::Temp;
 
 my @differ = qw(diff -bw);
-my $oldtmp = "/tmp/difflog$$.old";
-my $newtmp = "/tmp/difflog$$.new";
+my $oldf = new File::Temp(TEMPLATE => 'difflogXXXXX', DIR => '/tmp/', SUFFIX => '.old');
+my $newf = new File::Temp(TEMPLATE => 'difflogXXXXX', DIR => '/tmp/', SUFFIX => '.new');
+my $oldtmp = $oldf->filename;
+my $newtmp = $newf->filename;
 
 my $newfn = pop(@ARGV);
 my $oldfn = pop(@ARGV);