diff --git a/blender-2.45-cve-2008-4863.patch b/blender-2.45-cve-2008-4863.patch new file mode 100644 index 0000000..6a32eff --- /dev/null +++ b/blender-2.45-cve-2008-4863.patch @@ -0,0 +1,12 @@ +diff -up blender-2.45/source/blender/python/BPY_interface.c.cve blender-2.45/source/blender/python/BPY_interface.c +--- blender-2.45/source/blender/python/BPY_interface.c.cve 2007-09-18 06:58:31.000000000 +0200 ++++ blender-2.45/source/blender/python/BPY_interface.c 2008-11-03 18:30:59.000000000 +0100 +@@ -216,6 +216,8 @@ void BPY_start_python( int argc, char ** + Py_Initialize( ); + PySys_SetArgv( argc_copy, argv_copy ); + ++ PyRun_SimpleString('import sys; sys.path = filter(None, sys.path)'); ++ + //Overrides __import__ + init_ourImport( ); + init_ourReload( ); diff --git a/blender.spec b/blender.spec index 815ef6a..f8b960b 100644 --- a/blender.spec +++ b/blender.spec @@ -3,7 +3,7 @@ Name: blender Version: 2.45 -Release: 13%{?dist} +Release: 14%{?dist} Summary: 3D modeling, animation, rendering and post-production @@ -32,6 +32,7 @@ Patch4: blender-2.45-yafray.patch Patch5: blender-2.45-sc.patch Patch100: blender-2.45-cve-2008-1102.patch +Patch101: blender-2.45-cve-2008-4863.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -85,7 +86,8 @@ available. %patch4 -p1 %endif -%patch100 -p1 -b .cve +%patch100 -p1 +%patch101 -p1 -b .cve PYVER=$(%{__python} -c "import sys ; print sys.version[:3]") @@ -189,6 +191,9 @@ update-desktop-database %{_datadir}/applications > /dev/null 2>&1 || : %{_datadir}/mime/packages/blender.xml %changelog +* Mon Nov 3 2008 Jochen Schmitt 2.45-14 +- Fix security issue (#469655, CVE-2008-4863) + * Sun Apr 27 2008 Jochen Schmitt 2.45-13 - More generic patch for scons issue