nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-25 17:55:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

zip: fix command injection

Browse Source 
There is no CVE assigned yet. See:
https://security-tracker.debian.org/tracker/TEMP-1143866-6DBA82

(cherry picked from commit dd9b9f6c0b)
This commit is contained in:
Julian Stecklina
2026-08-17 13:47:40 +02:00
committed by github-actions[bot]
parent 6f65e77cdb
commit 04c2dcfc21
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkgs/by-name/zi/zip/package.nix
View File

@@ -88,6 +88,14 @@ stdenv.mkDerivation (finalAttrs: {
patch = "buffer-overflow-cve-2018-13410.patch";
hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
})
# Command injection in zip -T for specially crafted file
# names. See: https://seclists.org/oss-sec/2026/q3/494
(fetchDebianPatch {
inherit (finalAttrs) pname version;
debianRevision = "16";
patch = "fix-command-injection.patch";
hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI=";
})
]
++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];