From owner-svn-ports-head@freebsd.org Fri Mar 13 05:46:57 2020 Return-Path: Delivered-To: svn-ports-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 5B3AE274AA5; Fri, 13 Mar 2020 05:46:57 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48dvpT0X2dz3LQm; Fri, 13 Mar 2020 05:46:57 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id CD8D113AB; Fri, 13 Mar 2020 05:46:56 +0000 (UTC) (envelope-from tcberner@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 02D5ku9G002041; Fri, 13 Mar 2020 05:46:56 GMT (envelope-from tcberner@FreeBSD.org) Received: (from tcberner@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 02D5kuUu002039; Fri, 13 Mar 2020 05:46:56 GMT (envelope-from tcberner@FreeBSD.org) Message-Id: <202003130546.02D5kuUu002039@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tcberner set sender to tcberner@FreeBSD.org using -f From: "Tobias C. Berner" Date: Fri, 13 Mar 2020 05:46:56 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r528331 - head/graphics/okular X-SVN-Group: ports-head X-SVN-Commit-Author: tcberner X-SVN-Commit-Paths: head/graphics/okular X-SVN-Commit-Revision: 528331 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Mar 2020 05:46:57 -0000 Author: tcberner Date: Fri Mar 13 05:46:56 2020 New Revision: 528331 URL: https://svnweb.freebsd.org/changeset/ports/528331 Log: graphics/okular: add upstream security fix https://kde.org/info/security/advisory-20200312-1.txt: Overview ======== Okular can be tricked into executing local binaries via specially crafted PDF files. This binary execution can require almost no user interaction. No parameters can be passed to those local binaries. We have not been able to identify any binary that will cause actual damage, be it in the hardware or software level, when run without parameters. We remain relatively confident that for this issue to do any actual damage, it has to run a binary specially crafted. That binary must have been deployed to the user system via another method, be it the user downloading it directly as an email attachment, webpage download, etc. or by the system being already compromised. Solution ======== - Update to Okular >= 1.10.0 - or apply the following patch: https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244 Workaround ========== There's no real workaround other than not opening PDF files from untrusted sources. Credits ======= Thanks to Mickael Karatekin from Sysdream Labs for the discovery and to Albert Astals Cid for the fix. Security: c3600a64-64ea-11ea-bdff-e0d55e2a8bf9 Modified: head/graphics/okular/Makefile head/graphics/okular/distinfo Modified: head/graphics/okular/Makefile ============================================================================== --- head/graphics/okular/Makefile Fri Mar 13 05:39:11 2020 (r528330) +++ head/graphics/okular/Makefile Fri Mar 13 05:46:56 2020 (r528331) @@ -2,8 +2,11 @@ PORTNAME= okular DISTVERSION= ${KDE_APPLICATIONS_VERSION} -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= graphics kde kde-applications + +PATCH_SITES= https://invent.kde.org/kde/okular/-/commit/ +PATCHFILES= 6a93a033b4f9248b3cd4d04689b8391df754e244.patch:-p1 MAINTAINER= kde@FreeBSD.org COMMENT= KDE universal document viewer Modified: head/graphics/okular/distinfo ============================================================================== --- head/graphics/okular/distinfo Fri Mar 13 05:39:11 2020 (r528330) +++ head/graphics/okular/distinfo Fri Mar 13 05:46:56 2020 (r528331) @@ -1,3 +1,5 @@ -TIMESTAMP = 1583439045 +TIMESTAMP = 1584078208 SHA256 (KDE/applications/19.12.3/okular-19.12.3.tar.xz) = c5de22cc4292e3b7adae3f6ef6566dcba33a1dd5995fb0b968ea3e705a4c04e0 SIZE (KDE/applications/19.12.3/okular-19.12.3.tar.xz) = 7208888 +SHA256 (KDE/applications/19.12.3/6a93a033b4f9248b3cd4d04689b8391df754e244.patch) = c9541537053041e492f129e93fe118115bdf5dbe62ba8f11d529c340903df234 +SIZE (KDE/applications/19.12.3/6a93a033b4f9248b3cd4d04689b8391df754e244.patch) = 902