From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Steve Cossette To: git-commits@fedoraproject.org Subject: [rpms/plasma-workspace] f44: Fix for a sandbox escape flaw Date: Sat, 04 Jul 2026 11:46:59 GMT Message-ID: <178316561905.1.16001944628936027510.rpms-plasma-workspace-227c81ad6c57@fedoraproject.org> List-ID: X-Git-Repo: rpms/plasma-workspace X-Git-Branch: f44 X-Git-Rev: 227c81ad6c57048aa76c4c524881b1b352509b28 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvcGxhc21hLXdvcmtz cGFjZQpCcmFuY2ggOiBmNDQKQ29tbWl0IDogMjI3YzgxYWQ2YzU3MDQ4YWE3NmM0YzUyNDg4MWIx YjM1MjUwOWIyOApBdXRob3IgOiBTdGV2ZSBDb3NzZXR0ZSA8ZmFyY2hvcmRAZ21haWwuY29tPgpE YXRlICAgOiAyMDI2LTA3LTA0VDA3OjQ1OjM0LTA0OjAwClN0YXRzICA6ICs4NC8tMSBpbiAyIGZp bGUocykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9wbGFzbWEt d29ya3NwYWNlL2MvMjI3YzgxYWQ2YzU3MDQ4YWE3NmM0YzUyNDg4MWIxYjM1MjUwOWIyOD9icmFu Y2g9ZjQ0CgpMb2c6CkZpeCBmb3IgYSBzYW5kYm94IGVzY2FwZSBmbGF3CgotLS0KZGlmZiAtLWdp dCBhLzY4MTkucGF0Y2ggYi82ODE5LnBhdGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAw MDAwMDAuLjFmMDljNjUKLS0tIC9kZXYvbnVsbAorKysgYi82ODE5LnBhdGNoCkBAIC0wLDAgKzEs ODAgQEAKK0Zyb20gODNhNDM5ZjBiYzYxODExZTQ1MGJjMDBlZDI4ZDFiOTY0YTFlMTkwMSBNb24g U2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IERhdmlkIEVkbXVuZHNvbiA8a2RlQGRhdmlkZWRt dW5kc29uLmNvLnVrPgorRGF0ZTogRnJpLCAzIEp1bCAyMDI2IDExOjI5OjU5ICswMDAwCitTdWJq ZWN0OiBbUEFUQ0hdIGxpYnRhc2ttYW5hZ2VyOiBMaW1pdCBsYXVuY2hpbmcgbmV3IGluc3RhbmNl cyB3aGVyZSBzZXJ2aWNlCisgZmlsZXMgZG8gbm90IGV4aXN0CisKK0xpYnRhc2ttYW5hZ2VyIGlz IGZ1bGwgb2YgbGVnYWN5IGNvZGUgdG8gaGFuZGxlIGFwcGxpY2F0aW9ucyBub3QKK3Byb3ZpZGlu ZyBhcHBsaWNhdGlvbiBJRHMgYW5kIGhhdmluZyB3b3JrYXJvdW5kcyBmb3IgdGhlbS4KKworVGhp cyBpbmNsdWRlcyBwcm92aWRpbmcgYSAiT3BlbiBhIE5ldyBXaW5kb3ciIGVudHJ5IGZvciBtb3N0 CithcHBsaWNhdGlvbnMgdW5sZXNzIGV4cGxpY2l0bHkgaW5oaWJpdGVkLiBXaGVyZSBhIG1hdGNo aW5nIC5kZXNrdG9wIGlzCitmb3VuZCB0aGUgRXhlYyBsaW5lIGZyb20gdGhlcmUgaXMgdXNlZCBv dGhlcndpc2UgdGhlcmUgaXMgYSBmYWxsYmFjayB0bworbGF1bmNoIHRoZSBzYW1lIGJpbmFyeSBh Z2Fpbi4KKworVGhpcyBsYXR0ZXIgZmFsbGJhY2sgaXMgbm90IHZlcnkgc2FuZGJveCBhd2FyZSBh bmQgY291bGQgYmUgZXhwbG9pdGVkIHRvCitsYXVuY2ggYSBkaWZmZXJlbnQgYmluYXJ5IG9uIHRo ZSBob3N0LiBJdCdzIG5vdCBlc3BlY2lhbGx5IGV4cGxvaXRhYmxlLAoraXQgcmVsaWVzIG9uIHRo ZSB1c2VyIGNsaWNraW5nIGFuIGFjdGlvbiwgYnV0IHdlIHNob3VsZCBjbG9zZSBpdCBhbnl3YXku CisKKworKGNoZXJyeSBwaWNrZWQgZnJvbSBjb21taXQgN2ZmMjA5ZmExNTExZGY2MTYxNDY2ZDA1 NmQwYThkNjM5MzBjMmI2NikKKworQ28tYXV0aG9yZWQtYnk6IERhdmlkIEVkbXVuZHNvbiA8a2Rl QGRhdmlkZWRtdW5kc29uLmNvLnVrPgorLS0tCisgbGlidGFza21hbmFnZXIvdGFza3Rvb2xzLmNw cCB8IDI2ICsrKysrKysrKysrKysrKy0tLS0tLS0tLS0tCisgMSBmaWxlIGNoYW5nZWQsIDE1IGlu c2VydGlvbnMoKyksIDExIGRlbGV0aW9ucygtKQorCitkaWZmIC0tZ2l0IGEvbGlidGFza21hbmFn ZXIvdGFza3Rvb2xzLmNwcCBiL2xpYnRhc2ttYW5hZ2VyL3Rhc2t0b29scy5jcHAKK2luZGV4IDYy NjgwYmMyNjMuLjU3Y2E4YzRmZTQgMTAwNjQ0CistLS0gYS9saWJ0YXNrbWFuYWdlci90YXNrdG9v bHMuY3BwCisrKysgYi9saWJ0YXNrbWFuYWdlci90YXNrdG9vbHMuY3BwCitAQCAtNjMxLDE1ICs2 MzEsNiBAQCB2b2lkIHJ1bkFwcChjb25zdCBBcHBEYXRhICZhcHBEYXRhLCBjb25zdCBRTGlzdDxR VXJsPiAmdXJscykKKyAgICAgICAgICAgICBqb2ItPnN0YXJ0KCk7CisgCisgICAgICAgICAgICAg S0FjdGl2aXRpZXM6OlJlc291cmNlSW5zdGFuY2U6Om5vdGlmeUFjY2Vzc2VkKFFVcmwoUVN0cmlu Zyh1ImFwcGxpY2F0aW9uczoiICsgc2VydmljZS0+c3RvcmFnZUlkKCkpKSwgUVN0cmluZ0xpdGVy YWwoIm9yZy5rZGUubGlidGFza21hbmFnZXIiKSk7CistICAgICAgICB9IGVsc2UgeworLSAgICAg ICAgICAgIGF1dG8gKmpvYiA9IG5ldyBLSU86Ok9wZW5VcmxKb2IoYXBwRGF0YS51cmwpOworLSAg ICAgICAgICAgIGpvYi0+c2V0VWlEZWxlZ2F0ZShuZXcgS05vdGlmaWNhdGlvbkpvYlVpRGVsZWdh dGUoS0pvYlVpRGVsZWdhdGU6OkF1dG9FcnJvckhhbmRsaW5nRW5hYmxlZCkpOworLSAgICAgICAg ICAgIGpvYi0+c2V0UnVuRXhlY3V0YWJsZXModHJ1ZSk7CistICAgICAgICAgICAgam9iLT5zdGFy dCgpOworLQorLSAgICAgICAgICAgIGlmICghYXBwRGF0YS5pZC5pc0VtcHR5KCkpIHsKKy0gICAg ICAgICAgICAgICAgS0FjdGl2aXRpZXM6OlJlc291cmNlSW5zdGFuY2U6Om5vdGlmeUFjY2Vzc2Vk KFFVcmwoUVN0cmluZyh1ImFwcGxpY2F0aW9uczoiICsgYXBwRGF0YS5pZCkpLCBRU3RyaW5nTGl0 ZXJhbCgib3JnLmtkZS5saWJ0YXNrbWFuYWdlciIpKTsKKy0gICAgICAgICAgICB9CisgICAgICAg ICB9CisgICAgIH0KKyB9CitAQCAtNjU3LDcgKzY0OCwyMSBAQCBib29sIGNhbkxhdWNoTmV3SW5z dGFuY2UoY29uc3QgQXBwRGF0YSAmYXBwRGF0YSkKKyAgICAgICAgIGRlc2t0b3BFbnRyeS5jaG9w KDgpOworICAgICB9CisgCistICAgIGNvbnN0IEtTZXJ2aWNlOjpQdHIgc2VydmljZSA9IEtTZXJ2 aWNlOjpzZXJ2aWNlQnlEZXNrdG9wTmFtZShkZXNrdG9wRW50cnkpOworKyAgICBLU2VydmljZTo6 UHRyIHNlcnZpY2U7CisrCisrICAgIC8vIGFwcGxpY2F0aW9uczogVVJMcyBhcmUgdXNlZCB0byBy ZWZlciB0byBhcHBsaWNhdGlvbnMgYnkgdGhlaXIgS1NlcnZpY2U6Om1lbnVJZAorKyAgICAvLyAo aS5lLiAuZGVza3RvcCBmaWxlIG5hbWUpIHJhdGhlciB0aGFuIHRoZSBhYnNvbHV0ZSBwYXRoIHRv IGEgLmRlc2t0b3AgZmlsZS4KKysgICAgaWYgKGFwcERhdGEudXJsLnNjaGVtZSgpID09IFFMYXRp bjFTdHJpbmcoImFwcGxpY2F0aW9ucyIpKSB7CisrICAgICAgICBzZXJ2aWNlID0gS1NlcnZpY2U6 OnNlcnZpY2VCeU1lbnVJZChhcHBEYXRhLnVybC5wYXRoKCkpOworKyAgICB9IGVsc2UgaWYgKGFw cERhdGEudXJsLnNjaGVtZSgpID09IFFMYXRpbjFTdHJpbmcoInByZWZlcnJlZCIpKSB7CisrICAg ICAgICBzZXJ2aWNlID0gS1NlcnZpY2U6OnNlcnZpY2VCeVN0b3JhZ2VJZChkZWZhdWx0QXBwbGlj YXRpb24oYXBwRGF0YS51cmwpKTsKKysgICAgfSBlbHNlIHsKKysgICAgICAgIHNlcnZpY2UgPSBL U2VydmljZTo6c2VydmljZUJ5RGVza3RvcFBhdGgoYXBwRGF0YS51cmwudG9Mb2NhbEZpbGUoKSk7 CisrICAgIH0KKysKKysgICAgaWYgKCFzZXJ2aWNlKSB7CisrICAgICAgICByZXR1cm4gZmFsc2U7 CisrICAgIH0KKyAKKyAgICAgaWYgKHNlcnZpY2UpIHsKKyAgICAgICAgIGlmIChzZXJ2aWNlLT5u b0Rpc3BsYXkoKSkgeworQEAgLTY4Niw3ICs2OTEsNiBAQCBib29sIGNhbkxhdWNoTmV3SW5zdGFu Y2UoY29uc3QgQXBwRGF0YSAmYXBwRGF0YSkKKyAgICAgICAgICAgICB9CisgICAgICAgICB9Cisg ICAgIH0KKy0KKyAgICAgcmV0dXJuIHRydWU7CisgfQorIH0KKy0tIAorR2l0TGFiCisKCmRpZmYg LS1naXQgYS9wbGFzbWEtd29ya3NwYWNlLnNwZWMgYi9wbGFzbWEtd29ya3NwYWNlLnNwZWMKaW5k ZXggMzFkNGExOS4uNDU4ZWRhMCAxMDA2NDQKLS0tIGEvcGxhc21hLXdvcmtzcGFjZS5zcGVjCisr KyBiL3BsYXNtYS13b3Jrc3BhY2Uuc3BlYwpAQCAtMyw3ICszLDcgQEAKIE5hbWU6ICAgIHBsYXNt YS13b3Jrc3BhY2UKIFN1bW1hcnk6IFBsYXNtYSB3b3Jrc3BhY2UsIGFwcGxpY2F0aW9ucyBhbmQg YXBwbGV0cwogVmVyc2lvbjogNi43LjIKLVJlbGVhc2U6IDElez9kaXN0fQorUmVsZWFzZTogMiV7 P2Rpc3R9CiAKICMgQXV0b21hdGljYWxseSBjb252ZXJ0ZWQgZnJvbSBvbGQgZm9ybWF0OiBCU0Qt Mi1DbGF1c2UgQU5EIEJTRC0zLUNsYXVzZSBBTkQgQ0MwLTEuMCBBTkQgR1BMLTIuMC1vbmx5IEFO RCBHUEwtMi4wLW9yLWxhdGVyIEFORCBHUEwtMy4wLW9ubHkgQU5EIExHUEwtMi4wLW9ubHkgQU5E IExHUEwtMi4wLW9yLWxhdGVyIEFORCBMR1BMLTIuMS1vbmx5IEFORCBMR1BMLTIuMS1vci1sYXRl ciBBTkQgTEdQTC0zLjAtb25seSBBTkQgTEdQTC0zLjAtb3ItbGF0ZXIgQU5EIChHUEwtMi4wLW9u bHkgT1IgR1BMLTMuMC1vbmx5KSBBTkQgKExHUEwtMi4xLW9ubHkgT1IgTEdQTC0zLjAtb25seSkg QU5EIE1JVCAtIHJldmlldyBpcyBoaWdobHkgcmVjb21tZW5kZWQuCiBMaWNlbnNlOiBCU0QtMi1D bGF1c2UgQU5EIEJTRC0zLUNsYXVzZSBBTkQgQ0MwLTEuMCBBTkQgR1BMLTIuMC1vbmx5IEFORCBH UEwtMi4wLW9yLWxhdGVyIEFORCBHUEwtMy4wLW9ubHkgQU5EIExHUEwtMi4wLW9ubHkgQU5EIExH UEwtMi4wLW9yLWxhdGVyIEFORCBMR1BMLTIuMS1vbmx5IEFORCBMR1BMLTIuMS1vci1sYXRlciBB TkQgTEdQTC0zLjAtb25seSBBTkQgTEdQTC0zLjAtb3ItbGF0ZXIgQU5EIChHUEwtMi4wLW9ubHkg T1IgR1BMLTMuMC1vbmx5KSBBTkQgKExHUEwtMi4xLW9ubHkgT1IgTEdQTC0zLjAtb25seSkgQU5E IE1JVApAQCAtNjYzLDYgKzY2Myw5IEBAIGZpCiAKIAogJWNoYW5nZWxvZworKiBTYXQgSnVsIDA0 IDIwMjYgU3RldmUgQ29zc2V0dGUgPGZhcmNob3JkQGdtYWlsLmNvbT4gLSA2LjcuMi0yCistIEZp eCBhbiBpc3N1ZSBmb3IgYSBzYW5kYm94IGVzY2FwZSB2dWxuCisKICogV2VkIEp1bCAwMSAyMDI2 IFN0ZXZlIENvc3NldHRlIDxmYXJjaG9yZEBnbWFpbC5jb20+IC0gNi43LjItMQogLSA2LjcuMgog Cg==