CVE-2024-6655.patch

@@ -1,34 +0,0 @@
-From: Matthias Clasen <mclasen@redhat.com>
-Date: Sat, 15 Jun 2024 14:18:01 -0400
-Subject: Stop looking for modules in cwd
-
-This is just not a good idea. It is surprising, and can be misused.
-
-Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
-(cherry picked from commit 3bbf0b6176d42836d23c36a6ac410e807ec0a7a7)
-
-Origin: gtk 3.24.43
----
- gtk/gtkmodules.c | 9 ++-------
- 1 file changed, 2 insertions(+), 7 deletions(-)
-
-diff --git a/gtk/gtkmodules.c b/gtk/gtkmodules.c
-index 50729b6..c0f0c30 100644
---- a/gtk/gtkmodules.c
-+++ b/gtk/gtkmodules.c
-@@ -229,13 +229,8 @@ find_module (const gchar *name)
-   gchar *module_name;
- 
-   module_name = _gtk_find_module (name, "modules");
--  if (!module_name)
--    {
--      /* As last resort, try loading without an absolute path (using system
--       * library path)
--       */
--      module_name = g_module_build_path (NULL, name);
--    }
-+  if (module_name == NULL)
-+    return NULL;
- 
-   module = g_module_open (module_name, G_MODULE_BIND_LOCAL | G_MODULE_BIND_LAZY);
- 

gtk2.spec

@@ -6,9 +6,9 @@
 #Basic Information
 Name:            gtk2
 Version:         2.24.33
-Release:         10
+Release:         5
 Summary:         GTK+ graphical user interface library
-License:         LGPL-2.0-or-later
+License:         LGPLv2+
 URL:             http://www.gtk.org
 Source:          http://download.gnome.org/sources/gtk+/2.24/gtk+-%{version}.tar.xz
 Source2:         im-cedilla.conf
@@ -21,8 +21,6 @@ Patch1:  icon-padding.patch
 Patch2:  tooltip-positioning.patch
 # https://bugzilla.gnome.org/show_bug.cgi?id=611313
 Patch3: window-dragging.patch
-# https://gitlab.gnome.org/GNOME/gtk/-/issues/6786
-Patch4: CVE-2024-6655.patch
 
 #Dependency
 BuildRequires:   pkgconfig(glib-2.0) >= 2.28.0 pkgconfig(atk) >= 2.28.0
@@ -226,7 +224,7 @@ gtk-query-immodules-2.0-64 --update-cache
 %{_libdir}/pkgconfig/*
 %{_bindir}/gtk-builder-convert
 %{_bindir}/gtk-demo
-%exclude %{_datadir}/gtk-2.0/demo
+%{_datadir}/gtk-2.0/demo
 %{_datadir}/aclocal/*
 %{_datadir}/gir-1.0
 %{_includedir}/*
@@ -235,25 +233,11 @@ gtk-query-immodules-2.0-64 --update-cache
 %{_datadir}/gtk-doc
 %doc tmpdocs/tutorial
 %doc tmpdocs/faq
+%doc tmpdocs/examples
 %{_mandir}/man1/gtk-query-immodules-2.0*
-%{_mandir}/man1/gtk-builder-convert.1*
+%{_mandir}/man1/gtk-builder-convert.1.gz
 
 %changelog
-* Mon Jul 15 2024 Funda Wang <fundawang@yeah.net> - 2.24.33-10
-- fix CVE-2024-6655: Library injection from CWD
-
-* Thu Jan 18 2024 zhangpan <zhangpan103@h-partners.com> - 2.24.33-9
-- revert last commit
-
-* Tue Jan 16 2024 zhangpan <zhangpan103@h-partners.com> - 2.24.33-8
-- delete taboo words
-
-* Thu Dec 15 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 2.24.33-7
-- remove *.c and demo* from help and devel
-
-* Sat Jun 11 2022 wangkeorng <wangkeorng@h-partners.com> - 2.24.33-6
-- delete autosetup macro in changelog
-
 * Sat May 7 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2.24.33-5
 - fix changelog
 
@@ -261,7 +245,7 @@ gtk-query-immodules-2.0-64 --update-cache
 - Other distros disable cups
 
 * Fri Jul 30 2021 chenyanpanHW <chenyanpan@huawei.com> - 2.24.33-3
-- DESC: delete -Sgit from autosetup, and delete BuildRequires git
+- DESC: delete -Sgit from %autosetup, and delete BuildRequires git
 
 * Wed Mar 10 2021 yanan <yanan@huawei.com> - 2.24.33-2
 - use multi-thread to build