Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package joe for openSUSE:Factory checked in at 2026-07-17 18:47:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/joe (Old) and /work/SRC/openSUSE:Factory/.joe.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "joe" Fri Jul 17 18:47:31 2026 rev:34 rq:1366232 version:4.6 Changes: -------- --- /work/SRC/openSUSE:Factory/joe/joe.changes 2024-02-23 16:41:33.355129804 +0100 +++ /work/SRC/openSUSE:Factory/.joe.new.24530/joe.changes 2026-07-17 18:48:12.086665381 +0200 @@ -1,0 +2,6 @@ +Thu Jul 16 17:38:36 UTC 2026 - Martin Schreiner <[email protected]> + +- Fix bsc#1269379 / CVE-2026-13412 +- Add CVE-2026-13412.patch + +------------------------------------------------------------------- New: ---- CVE-2026-13412.patch ----------(New B)---------- New:- Fix bsc#1269379 / CVE-2026-13412 - Add CVE-2026-13412.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ joe.spec ++++++ --- /var/tmp/diff_new_pack.p0Mlxt/_old 2026-07-17 18:48:13.050697884 +0200 +++ /var/tmp/diff_new_pack.p0Mlxt/_new 2026-07-17 18:48:13.054698019 +0200 @@ -1,7 +1,7 @@ # # spec file for package joe # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -32,6 +32,7 @@ Patch8: joe-3.7-spec_association.patch Patch10: joe-sigiot.patch Patch12: joe-4.6-nonvoid-functions.patch +Patch13: CVE-2026-13412.patch BuildRequires: automake BuildRequires: libselinux-devel BuildRequires: ncurses-devel @@ -48,6 +49,7 @@ %patch -P 8 %patch -P 10 %patch -P 12 -p1 +%patch -P 13 -p1 %build autoreconf -fiv ++++++ CVE-2026-13412.patch ++++++ Description: Fix tags file command execution (CVE-2026-13412) A crafted tags file, or grep/error output parsed by :tag or the error jump commands, may contain a target "filename" beginning with '!' or '>>'. When JOE jumps to such a target, bload()/bsave() interpret the leading '!' as a popen() shell pipe and '>>' as an append redirect, so an attacker who controls a tags or error file can execute arbitrary shell commands. . This adds hack_check(), which rejects names that bload()/bsave() would treat as anything other than a plain filename, and calls it before the tag jump (utag.c) and the error/grep jump (uerror.c). . Backported to joe 4.6. The b.c, uerror.c and utag.c hunks are identical to upstream. Deviations: * b.h: upstream declares "extern bool guess_utf16;" preceding the new prototype; 4.6 declares it as int, so the hunk context uses int. * The upstream commit also comments out fclose(stdin) in main.c. That is an unrelated stdin/SIGPIPE change; 4.6 has no such call, so the main.c hunk is dropped. Origin: upstream, https://github.com/jhallen/joe-editor/commit/85cbce79094a00a46dda776ff4017c0dfc845b01 Bug: https://bugzilla.suse.com/show_bug.cgi?id=XXXXXXX Bug-CVE: CVE-2026-13412 Forwarded: not-needed Author: jhallen <[email protected]> --- a/joe/b.c +++ b/joe/b.c @@ -2511,6 +2511,19 @@ return b; } +/* Return true if filename will be interpreted as something other than a filename by bload() + It would be better to have a flag on bload, but more plumbing required */ + +int hack_check(const char *name) +{ + if (name[0] == '!') + return 1; + else if (name[0] == '>' && name[1] == '>') + return 1; + else + return 0; +} + /* Parse file name. * * Removes ',xxx,yyy' from end of name and puts their value into skip and amnt --- a/joe/b.h +++ b/joe/b.h @@ -341,3 +341,6 @@ char *ansi_string(int code); extern int guess_utf16; + +/* Return true if filename will be interpreted as something other than a filename */ +int hack_check(const char *name); --- a/joe/uerror.c +++ b/joe/uerror.c @@ -471,6 +471,9 @@ static int jump_to_file_line(BW *bw,char *file,off_t line,char *msg) { int omid; + /* Do not allow shell command! */ + if (hack_check(file)) + return -1; if (!bw->b->name || zcmp(file, bw->b->name)) { if (doswitch(bw->parent, vsdup(file), NULL, NULL)) return -1; --- a/joe/utag.c +++ b/joe/utag.c @@ -222,7 +222,7 @@ ++x; } for (y = x; buf[y] && buf[y] != ' ' && buf[y] != '\t' && buf[y] != '\n'; ++y) ; - if (x != y) { + if (x != y && !hack_check(buf + x)) { /* Do not allow shell commands in tags file! */ char *file = 0; c = buf[y]; buf[y] = 0;
