Log message:
Pullup ticket #5515 - requested by maya
print/evince3: security fix

Revisions pulled up:
- print/evince3/Makefile                                        1.62
- print/evince3/distinfo                                        1.13
- print/evince3/patches/patch-backend_comics_comics-document.c  1.1
- print/evince3/patches/patch-configure                         1.1
- print/evince3/patches/patch-configure.ac                      1.1

---
   Module Name:	pkgsrc
   Committed By:	maya
   Date:		Fri Jul 14 05:31:21 UTC 2017

   Modified Files:
   	pkgsrc/print/evince3: Makefile distinfo
   Added Files:
   	pkgsrc/print/evince3/patches: patch-backend_comics_comics-document.c
   	    patch-configure patch-configure.ac

   Log message:
   Patch CVE-2017-1000083

   From 717df38fd8509bf883b70d680c9b1b3cf36732ee Mon Sep 17 00:00:00 2001
   From: Bastien Nocera <hadess@hadess.net>
   Date: Thu, 6 Jul 2017 20:02:00 +0200
   Subject: [PATCH] comics: Remove support for tar and tar-like commands

   When handling tar files, or using a command with tar-compatible syntax,
   to open comic-book archives, both the archive name (the name of the
   comics file) and the filename (the name of a page within the archive)
   are quoted to not be interpreted by the shell.

   But the filename is completely with the attacker's control and can start
   with "--" which leads to tar interpreting it as a command line flag.

   This can be exploited by creating a CBT file (a tar archive with the
   .cbt suffix) with an embedded file named something like this:
   "--checkpoint-action=exec=bash -c 'touch ~/hacked;'.jpg"

   CBT files are infinitely rare (CBZ is usually used for DRM-free
   commercial releases, CBR for those from more dubious provenance), so
   removing support is the easiest way to avoid the bug triggering. All
   this code was rewritten in the development release for GNOME 3.26 to not
   shell out to any command, closing off this particular attack vector.

   This also removes the ability to use libarchive's bsdtar-compatible
   binary for CBZ (ZIP), CB7 (7zip), and CBR (RAR) formats. The first two
   are already supported by unzip and 7zip respectively. libarchive's RAR
   support is limited, so unrar is a requirement anyway.

   Discovered by Felix Wilhelm from the Google Security Team.

   https://bugzilla.gnome.org/show_bug.cgi?id=784630

   Bump PKGREVISION