diff options
| author | Tobias C. Berner <tcberner@FreeBSD.org> | 2020-03-13 05:46:56 +0000 |
|---|---|---|
| committer | Tobias C. Berner <tcberner@FreeBSD.org> | 2020-03-13 05:46:56 +0000 |
| commit | 6dbf57ae7cc6f2b07e0ba7f7964e3ff76ae43c61 (patch) | |
| tree | f6b84f8d52125d176242c4beb44549e09a68c8ec /graphics/okular | |
| parent | c0ba18d09a9cb23ffba3c68305205536e0b7adca (diff) | |
| download | ports-6dbf57ae7cc6f2b07e0ba7f7964e3ff76ae43c61.tar.gz ports-6dbf57ae7cc6f2b07e0ba7f7964e3ff76ae43c61.zip | |
graphics/okular: add upstream security fix
https://kde.org/info/security/advisory-20200312-1.txt:
Overview
========
Okular can be tricked into executing local binaries via specially crafted
PDF files.
This binary execution can require almost no user interaction.
No parameters can be passed to those local binaries.
We have not been able to identify any binary that will cause actual damage,
be it in the hardware or software level, when run without parameters.
We remain relatively confident that for this issue to do any actual damage,
it has to run a binary specially crafted. That binary must have been deployed
to the user system via another method, be it the user downloading it directly
as an email attachment, webpage download, etc. or by the system being already
compromised.
Solution
========
- Update to Okular >= 1.10.0
- or apply the following patch:
https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244
Workaround
==========
There's no real workaround other than not opening PDF files from untrusted sources.
Credits
=======
Thanks to Mickael Karatekin from Sysdream Labs for the discovery and to
Albert Astals Cid for the fix.
Security: c3600a64-64ea-11ea-bdff-e0d55e2a8bf9
Notes
Notes:
svn path=/head/; revision=528331
Diffstat (limited to 'graphics/okular')
| -rw-r--r-- | graphics/okular/Makefile | 5 | ||||
| -rw-r--r-- | graphics/okular/distinfo | 4 |
2 files changed, 7 insertions, 2 deletions
diff --git a/graphics/okular/Makefile b/graphics/okular/Makefile index 9d500c402f5f..b6625a2406dd 100644 --- a/graphics/okular/Makefile +++ b/graphics/okular/Makefile @@ -2,9 +2,12 @@ PORTNAME= okular DISTVERSION= ${KDE_APPLICATIONS_VERSION} -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= graphics kde kde-applications +PATCH_SITES= https://invent.kde.org/kde/okular/-/commit/ +PATCHFILES= 6a93a033b4f9248b3cd4d04689b8391df754e244.patch:-p1 + MAINTAINER= kde@FreeBSD.org COMMENT= KDE universal document viewer diff --git a/graphics/okular/distinfo b/graphics/okular/distinfo index 87c13ae4b41a..1cc6b1027ea8 100644 --- a/graphics/okular/distinfo +++ b/graphics/okular/distinfo @@ -1,3 +1,5 @@ -TIMESTAMP = 1583439045 +TIMESTAMP = 1584078208 SHA256 (KDE/applications/19.12.3/okular-19.12.3.tar.xz) = c5de22cc4292e3b7adae3f6ef6566dcba33a1dd5995fb0b968ea3e705a4c04e0 SIZE (KDE/applications/19.12.3/okular-19.12.3.tar.xz) = 7208888 +SHA256 (KDE/applications/19.12.3/6a93a033b4f9248b3cd4d04689b8391df754e244.patch) = c9541537053041e492f129e93fe118115bdf5dbe62ba8f11d529c340903df234 +SIZE (KDE/applications/19.12.3/6a93a033b4f9248b3cd4d04689b8391df754e244.patch) = 902 |