← Back to branch summary

~ubuntu-branches/debian/sid/ntfs-3g/sid

« back to all changes in this revision

Viewing changes to debian/patches/0002-CVE-2015-3202.patch

  • Committer: Package Import Robot
  • Author(s): Laszlo Boszormenyi (GCS), Salvatore Bonaccorso
  • Date: 2015-05-26 17:23:19 UTC
  • Revision ID: package-import@ubuntu.com-20150526172319-67zzx37k989ucquw
Tags: 1:2014.2.15AR.3-3
http://bugs.debian.org/786475
[ Salvatore Bonaccorso <carnil@debian.org> ]
Change all relevant execl() calls to execle() to fix all possible cases
of CVE-2015-3202 (closes: #786475).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0002-CVE-2015-3202.patch
2
2
 Missing scrubbing of the environment before executing a mount or umount
3
3
 of a filesystem.
4
4
Origin: backport
 
5
Bug-Debian: https://bugs.debian.org/786475
5
6
Author: Miklos Szeredi <miklos@szeredi.hu>
6
 
Last-Update: 2015-05-19
 
7
Last-Update: 2015-05-26
7
8
 
8
9
---
9
10
 lib/mount_util.c |   23 +++++++++++++++++------
68
69
         fprintf(stderr, "%s: failed to execute /bin/mount: %s\n", progname,
69
70
                 strerror(errno));
70
71
         exit(1);
 
72
@@ -353,11 +362,18 @@ int fuse_mnt_umount(const char *progname
 
73
         return -1;
 
74
     }
 
75
     if (res == 0) {
 
76
+        char *env = NULL;
 
77
+
 
78
         if (setuid(geteuid()))
 
79
             fprintf(stderr, "%s: failed to setuid : %s\n", progname,
 
80
                          strerror(errno));
 
81
-        execl("/bin/umount", "/bin/umount", "-i", mnt, lazy ? "-l" : NULL,
 
82
-              NULL);
 
83
+        if (lazy) {
 
84
+                execle("/bin/umount", "/bin/umount", "-i", mnt, "-l",
 
85
+                        NULL, &env);
 
86
+        } else {
 
87
+                execle("/bin/umount", "/bin/umount", "-i", mnt,
 
88
+                        NULL, &env);
 
89
+        }
 
90
         fprintf(stderr, "%s: failed to execute /bin/umount: %s\n", progname,
 
91
                 strerror(errno));
 
92
         exit(1);