Block remote code execution via enriched text

Add 0012-A-remote-execution-exploit-via-enriched-text-has-bee.patch to
fix the problem.

Thanks to David Bremner for the alert and Salvatore Bonaccorso for
reporting the problem to Debian.

Closes: 875447

diff --cc debian/.git-dpm
index 0756d5aad41bf8ce973a184e9600748e4102aa99,0000000000000000000000000000000000000000..a26940771511c593b51d7c5768ab61f95ad5c40d
mode 100644,000000..100644
--- 1/debian/.git-dpm
--- /dev/null
+++ b/debian/.git-dpm
@@@ -1,8 -1,0 +1,8 @@@
- 8900499027b692994a3b411954850c3672b9d2f6
- 8900499027b692994a3b411954850c3672b9d2f6
 +# see git-dpm(1) from git-dpm package
++4089d95cb69c449bb92a68b22ebb69cc4e4cb26b
++4089d95cb69c449bb92a68b22ebb69cc4e4cb26b
 +09a20fd582947ca08f0e80bc5353ae8abfe1e5ed
 +09a20fd582947ca08f0e80bc5353ae8abfe1e5ed
 +emacs25_25.2+1.orig.tar.xz
 +655de53b3ee88f19a7c85005636fa8851a6f71b1
 +23189972

diff --cc debian/patches/0012-A-remote-execution-exploit-via-enriched-text-has-bee.patch
index 0000000000000000000000000000000000000000,0000000000000000000000000000000000000000..8fb7c920f74ca1dd11d44f4300a7977261a12239
new file mode 100644 (file)
--- /dev/null
--- /dev/null
+++ b/debian/patches/0012-A-remote-execution-exploit-via-enriched-text-has-bee.patch
@@@ -1,0 -1,0 +1,89 @@@
++From 4089d95cb69c449bb92a68b22ebb69cc4e4cb26b Mon Sep 17 00:00:00 2001
++From: Lars Ingebrigtsen <larsi@gnus.org>
++Date: Fri, 8 Sep 2017 20:23:31 -0700
++Subject: A remote execution exploit via enriched text has been blocked
++
++This upstream patch has been incorporated to fix the problem:
++
++  Remove unsafe enriched mode translations
++
++  * lisp/gnus/mm-view.el (mm-inline-text):
++  Do not worry about enriched or richtext type.
++  * lisp/textmodes/enriched.el (enriched-translations):
++  Remove translations for FUNCTION, display (Bug#28350).
++  (enriched-handle-display-prop, enriched-decode-display-prop): Remove.
++
++Origin: backport, commit: 9ad0fcc54442a9a01d41be19880250783426db70)
++Bug: https://bugs.gnu.org/28350
++Bug-Debian: http://bugs.debian.org/875447
++Forwarded: not-needed
++---
++ lisp/gnus/mm-view.el       |  4 ----
++ lisp/textmodes/enriched.el | 32 --------------------------------
++ 2 files changed, 36 deletions(-)
++
++diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el
++index e5859d002cf..77ad271d1da 100644
++--- a/lisp/gnus/mm-view.el
+++++ b/lisp/gnus/mm-view.el
++@@ -383,10 +383,6 @@ mm-inline-text
++      (goto-char (point-max))))
++     (save-restriction
++       (narrow-to-region b (point))
++-      (when (member type '("enriched" "richtext"))
++-        (set-text-properties (point-min) (point-max) nil)
++-     (ignore-errors
++-       (enriched-decode (point-min) (point-max))))
++       (mm-handle-set-undisplayer
++        handle
++        `(lambda ()
++diff --git a/lisp/textmodes/enriched.el b/lisp/textmodes/enriched.el
++index beb6c6dda39..a8f0d3891a8 100644
++--- a/lisp/textmodes/enriched.el
+++++ b/lisp/textmodes/enriched.el
++@@ -117,12 +117,7 @@ enriched-translations
++                 (full        "flushboth")
++                 (center      "center"))
++     (PARAMETER     (t           "param")) ; Argument of preceding annotation
++-    ;; The following are not part of the standard:
++-    (FUNCTION      (enriched-decode-foreground "x-color")
++-                (enriched-decode-background "x-bg-color")
++-                (enriched-decode-display-prop "x-display"))
++     (read-only     (t           "x-read-only"))
++-    (display    (nil         enriched-handle-display-prop))
++     (unknown       (nil         format-annotate-value))
++ ;   (font-size     (2           "bigger")       ; unimplemented
++ ;               (-2          "smaller"))
++@@ -477,32 +472,5 @@ enriched-decode-background
++     (message "Warning: no color specified for <x-bg-color>")
++     nil))
++ \f
++-;;; Handling the `display' property.
++-
++-
++-(defun enriched-handle-display-prop (old new)
++-  "Return a list of annotations for a change in the `display' property.
++-OLD is the old value of the property, NEW is the new value.  Value
++-is a list `(CLOSE OPEN)', where CLOSE is a list of annotations to
++-close and OPEN a list of annotations to open.  Each of these lists
++-has the form `(ANNOTATION PARAM ...)'."
++-  (let ((annotation "x-display")
++-     (param (prin1-to-string (or old new))))
++-    (if (null old)
++-        (cons nil (list (list annotation param)))
++-      (cons (list (list annotation param)) nil))))
++-
++-(defun enriched-decode-display-prop (start end &optional param)
++-  "Decode a `display' property for text between START and END.
++-PARAM is a `<param>' found for the property.
++-Value is a list `(START END SYMBOL VALUE)' with START and END denoting
++-the range of text to assign text property SYMBOL with value VALUE."
++-  (let ((prop (when (stringp param)
++-             (condition-case ()
++-                 (car (read-from-string param))
++-               (error nil)))))
++-    (unless prop
++-      (message "Warning: invalid <x-display> parameter %s" param))
++-    (list start end 'display prop)))
++ 
++ ;;; enriched.el ends here

diff --cc debian/patches/series
index 4894c8bdc4747f1e0d4b7995b223c8e06dfbd15e,0000000000000000000000000000000000000000..c5968b80b6646931a77a56c695418d1271fde160
mode 100644,000000..100644
--- 1/debian/patches/series
--- /dev/null
+++ b/debian/patches/series
@@@ -1,11 -1,0 +1,12 @@@
 +0001-Prefer-usr-share-info-emacs-MAJORVERSION.patch
 +0002-Run-debian-startup-and-set-debian-emacs-flavor.patch
 +0003-Remove-files-that-appear-to-be-incompatible-with-the.patch
 +0004-Adjust-documentation-references-for-Debian.patch
 +0005-Modify-the-output-of-version-to-indicate-Debian-modi.patch
 +0006-Don-t-try-to-build-src-macuvs.h-via-IVD_Sequences.tx.patch
 +0007-Kill-gpg-agent-in-package-test.el-to-avoid-a-race.patch
 +0008-Don-t-provide-openssl-s_client-as-an-option-for-ssl-.patch
 +0009-A-memory-alignment-problem-causing-m68k-failures-has.patch
 +0010-Don-t-downcase-real-xref-in-elisp-mode-tests.patch
 +0011-Disable-eieio-test-method-order-list-6.patch
++0012-A-remote-execution-exploit-via-enriched-text-has-bee.patch