Control: tags 802828 + pending Dear maintainer,
I've prepared an NMU for pygments (versioned as 2.0.1+dfsg-1.2) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards, Salvatore
diff -Nru pygments-2.0.1+dfsg/debian/changelog pygments-2.0.1+dfsg/debian/changelog --- pygments-2.0.1+dfsg/debian/changelog 2015-03-22 10:24:35.000000000 +0100 +++ pygments-2.0.1+dfsg/debian/changelog 2016-01-10 17:01:17.000000000 +0100 @@ -1,3 +1,12 @@ +pygments (2.0.1+dfsg-1.2) unstable; urgency=high + + * Non-maintainer upload. + * Add CVE-2015-8557.patch patch. + CVE-2015-8557: Shell injection in FontManager._get_nix_font_path. + (Closes: #802828) + + -- Salvatore Bonaccorso <[email protected]> Sun, 10 Jan 2016 17:00:31 +0100 + pygments (2.0.1+dfsg-1.1) unstable; urgency=medium * Non-maintainer upload. diff -Nru pygments-2.0.1+dfsg/debian/patches/CVE-2015-8557.patch pygments-2.0.1+dfsg/debian/patches/CVE-2015-8557.patch --- pygments-2.0.1+dfsg/debian/patches/CVE-2015-8557.patch 1970-01-01 01:00:00.000000000 +0100 +++ pygments-2.0.1+dfsg/debian/patches/CVE-2015-8557.patch 2016-01-10 17:01:17.000000000 +0100 @@ -0,0 +1,41 @@ +Description: CVE-2015-8557: Shell injection in FontManager._get_nix_font_path +Origin: backport, https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92f +Bug: https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff +Bug-Debian: https://bugs.debian.org/802828 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1276321 +Bug-Mageia: https://bugs.mageia.org/show_bug.cgi?id=17331 +Forwarded: not-needed +Author: Salvatore Bonaccorso <[email protected]> +Last-Update: 2016-01-10 + +--- a/pygments/formatters/img.py ++++ b/pygments/formatters/img.py +@@ -15,6 +15,8 @@ from pygments.formatter import Formatter + from pygments.util import get_bool_opt, get_int_opt, get_list_opt, \ + get_choice_opt, xrange + ++import subprocess ++ + # Import this carefully + try: + from PIL import Image, ImageDraw, ImageFont +@@ -75,14 +77,11 @@ class FontManager(object): + self._create_nix() + + def _get_nix_font_path(self, name, style): +- try: +- from commands import getstatusoutput +- except ImportError: +- from subprocess import getstatusoutput +- exit, out = getstatusoutput('fc-list "%s:style=%s" file' % +- (name, style)) +- if not exit: +- lines = out.splitlines() ++ proc = subprocess.Popen(['fc-list', "%s:style=%s" % (name, style), 'file'], ++ stdout=subprocess.PIPE, stderr=None) ++ stdout, _ = proc.communicate() ++ if proc.returncode == 0: ++ lines = stdout.splitlines() + if lines: + path = lines[0].strip().strip(':') + return path diff -Nru pygments-2.0.1+dfsg/debian/patches/series pygments-2.0.1+dfsg/debian/patches/series --- pygments-2.0.1+dfsg/debian/patches/series 2014-11-09 23:04:05.000000000 +0100 +++ pygments-2.0.1+dfsg/debian/patches/series 2016-01-10 17:01:17.000000000 +0100 @@ -1 +1,2 @@ change_docs_theme.patch +CVE-2015-8557.patch
