Security fix for CVE-2015-0856 (#1271992,#1271993)

0012-Disable-greeters-from-loading-KDE-s-debug-hander.patch

@@ -0,0 +1,39 @@
+From 4cfed6b0a625593fb43876f04badc4dd99799d86 Mon Sep 17 00:00:00 2001
+From: David Edmundson <kde@davidedmundson.co.uk>
+Date: Wed, 14 Oct 2015 00:08:59 +0100
+Subject: [PATCH 12/13] Disable greeters from loading KDE's debug hander
+
+Some themes may use KDE components which will automatically load KDE's
+crash handler.
+
+If the greeter were to then somehow crash, that would leave a crash
+handler allowing other actions, albeit as the locked down SDDM user.
+
+Only SDDM users using the breeze theme from plasma-workspace are
+affected. Safest and simplest fix is to handle this inside SDDM
+disabling kcrash via an environment variable for all future themes that
+may use these libraries.
+
+CVE-2015-0856
+---
+ src/daemon/Greeter.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/daemon/Greeter.cpp b/src/daemon/Greeter.cpp
+index 68c4dc3..8c936b7 100644
+--- a/src/daemon/Greeter.cpp
++++ b/src/daemon/Greeter.cpp
+@@ -145,6 +145,10 @@ namespace SDDM {
+             env.insert(QStringLiteral("XDG_VTNR"), QString::number(m_display->terminalId()));
+             env.insert(QStringLiteral("XDG_SESSION_CLASS"), QStringLiteral("greeter"));
+             env.insert(QStringLiteral("XDG_SESSION_TYPE"), m_display->sessionType());
++
++            //some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
++            //counterintuitively setting this env disables that handler
++            env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
+             m_auth->insertEnvironment(env);
+ 
+             // log message
+-- 
+2.5.0
+

sddm.spec

@@ -2,7 +2,7 @@
 
 Name:           sddm
 Version:        0.12.0
-Release:        4%{?dist}
+Release:        5%{?dist}
 # code GPLv2+, fedora theme CC-BY-SA
 License:        GPLv2+ and CC-BY-SA
 Summary:        QML based X11 desktop manager
@@ -13,6 +13,8 @@ Source0:        https://github.com/sddm/sddm/archive/v%{version}.tar.gz
 ## upstream patches
 #Patch8: 0008-Inherit-path-environment-variables-from-parent.patch
 Patch11: 0011-Don-t-cast-QByteArray-to-char.patch
+# CVE-2015-0856
+Patch12: 0012-Disable-greeters-from-loading-KDE-s-debug-hander.patch
 
 ## downstream patches
 # downstream fedora-specific configuration
@@ -172,6 +174,9 @@ exit 0
 
 
 %changelog
+* Thu Oct 15 2015 Rex Dieter <rdieter@fedoraproject.org> 0.12.0-5
+- Security fix for CVE-2015-0856 (#1271992,#1271993)
+
 * Thu Sep 24 2015 Rex Dieter <rdieter@fedoraproject.org> 0.12.0-4
 - omit 0008-Inherit-path-environment-variables-from-parent.patch pending security concerns