import gtk3-3.22.30-12.el8_10

SOURCES/0001-Stop-looking-for-modules-in-cwd.patch

@@ -0,0 +1,35 @@
+From 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Sat, 15 Jun 2024 14:18:01 -0400
+Subject: [PATCH] Stop looking for modules in cwd
+
+This is just not a good idea. It is surprising, and can be misused.
+
+Fixes: #6786
+---
+ gtk/gtkmodules.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
+index 704e412aeb..f93101c272 100644
+--- a/gtk/gtkmodules.c
++++ b/gtk/gtkmodules.c
+@@ -214,13 +214,8 @@ find_module (const gchar *name)
+   gchar *module_name;
+ 
+   module_name = _gtk_find_module (name, "modules");
+-  if (!module_name)
+-    {
+-      /* As last resort, try loading without an absolute path (using system
+-       * library path)
+-       */
+-      module_name = g_module_build_path (NULL, name);
+-    }
++  if (module_name == NULL)
++    return NULL;
+ 
+   module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
+ 
+-- 
+2.45.2
+

SOURCES/gtk3-icon-browser-no-icon.patch

@@ -0,0 +1,26 @@
+From a7a10aa63fa4e24d109b2e50f98c9616818f7e7a Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Wed, 21 Apr 2021 15:08:22 -0400
+Subject: [PATCH] iconbrowser: Don't use a nonexistent icon
+
+We don't have this icon, so don't put it in the
+desktop file, or tools will get upset.
+---
+ demos/icon-browser/gtk3-icon-browser.desktop | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/demos/icon-browser/gtk3-icon-browser.desktop b/demos/icon-browser/gtk3-icon-browser.desktop
+index c1a546e1d2..a7d6b4f0cb 100644
+--- a/demos/icon-browser/gtk3-icon-browser.desktop
++++ b/demos/icon-browser/gtk3-icon-browser.desktop
+@@ -2,7 +2,6 @@
+ Name=Icon Browser
+ Comment=An application that shows themed icons
+ Exec=gtk3-icon-browser
+-Icon=gtk3-icon-browser
+ Terminal=false
+ Type=Application
+ StartupNotify=true
+-- 
+GitLab
+

SPECS/gtk3.spec

@@ -22,7 +22,7 @@
 
 Name: gtk3
 Version: 3.22.30
-Release: 11%{?dist}
+Release: 12%{?dist}
 Summary: GTK+ graphical user interface library
 
 License: LGPLv2+
@@ -55,6 +55,11 @@ Patch12: gtk-3.22.20-quiet-exit.patch
 Patch13: gtk-3.22.20-avoid-cellarea-crash.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2058260
 Patch14: 0001-Remove-the-without-parent-warning.patch
+# Fix the rpminspect warning
+# https://gitlab.gnome.org/GNOME/gtk/-/commit/5e673e94de3f59e3b937ce14d22b8c07c6e975cd
+Patch15: gtk3-icon-browser-no-icon.patch
+# Fix loading modules from cwd
+Patch16: 0001-Stop-looking-for-modules-in-cwd.patch
 
 BuildRequires: pkgconfig(atk) >= %{atk_version}
 BuildRequires: pkgconfig(atk-bridge-2.0)
@@ -208,6 +213,8 @@ the functionality of the installed %{name} package.
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
+%patch15 -p1
+%patch16 -p1
 
 %build
 export CFLAGS='-fno-strict-aliasing %optflags'
@@ -366,6 +373,10 @@ gtk-query-immodules-3.0-%{__isa_bits} --update-cache &>/dev/null || :
 %{_datadir}/installed-tests
 
 %changelog
+* Wed Jul 10 2024 Matthias Clasen <mclasen@redhat.com> - 3.22.30-12
+- Stop loading modules from cwd (CVE-2024-6655)
+- Resolves: RHEL-46988
+
 * Tue Jul 25 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 3.22.30-11
 - Rebuilt for MSVSphere 8.8