diff --git a/pkgs/applications/graphics/batik/default.nix b/pkgs/applications/graphics/batik/default.nix index a88209bfbd89..5a45d88a985a 100644 --- a/pkgs/applications/graphics/batik/default.nix +++ b/pkgs/applications/graphics/batik/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "batik"; - version = "1.14"; + version = "1.16"; src = fetchurl { url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz"; - sha256 = "sha256-D06qgb5wdS5AahnznDnAGISPCZY/CPqJdGQFRwUsRhg="; + sha256 = "sha256-Y4bJ6X46sKx1+fmNkOS2RU7gn7n0fKDnkOYMq0S8fYM="; }; meta = with lib; { diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json index 1d08aec3d487..542cd9413a38 100644 --- a/pkgs/applications/networking/browsers/chromium/upstream-info.json +++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json @@ -45,9 +45,9 @@ } }, "ungoogled-chromium": { - "version": "107.0.5304.110", - "sha256": "1k7yjsb4i7m8i5mk018v7z25r4x1ypyprz4hnyrn7vk2983lhdfk", - "sha256bin64": "06rlxwbvp7rpw2rdpnjzl1cn7cr1rwlb20wz8r0cndjcjyzd3rjj", + "version": "107.0.5304.122", + "sha256": "0f2jdvlnp1s5ia01lnqk0ykqji2x4ab9g4kxk637n4csf0i1gj85", + "sha256bin64": null, "deps": { "gn": { "version": "2022-09-14", @@ -56,8 +56,8 @@ "sha256": "1c0dvpp4im1hf277bs5w7rgqxz3g2bax266i2g6smi3pl7a8jpnp" }, "ungoogled-patches": { - "rev": "107.0.5304.110-1", - "sha256": "14z9qi9i9l7kjx7gf74lzs63bpxqyd3wbqqpsvzvqgr2v0cgqahx" + "rev": "107.0.5304.122-1", + "sha256": "109j5jvsbj9dylj8prz7bkzc8czjv2c8bm0albwnkyxymcpd3w6p" } } } diff --git a/pkgs/development/libraries/drogon/default.nix b/pkgs/development/libraries/drogon/default.nix index 9cc3503acd6e..5cc4b3b896c7 100644 --- a/pkgs/development/libraries/drogon/default.nix +++ b/pkgs/development/libraries/drogon/default.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation rec { pname = "drogon"; - version = "1.8.1"; + version = "1.8.2"; src = fetchFromGitHub { owner = "drogonframework"; repo = "drogon"; rev = "v${version}"; - sha256 = "sha256-XzSJABYuZaYlNL12bi0ykQ1OyNsvB1AQiSTBPWiTNYU="; + sha256 = "sha256-IpECYpPuheoLelEdgV+J26b+95fMfRmeQ44q6JvqRtw="; fetchSubmodules = true; }; diff --git a/pkgs/misc/cups/drivers/kyocera/default.nix b/pkgs/misc/cups/drivers/kyocera/default.nix index cd4c049e67f7..7b2b6a2ed08f 100644 --- a/pkgs/misc/cups/drivers/kyocera/default.nix +++ b/pkgs/misc/cups/drivers/kyocera/default.nix @@ -17,9 +17,7 @@ stdenv.mkDerivation { dontStrip = true; src = fetchzip { - # this site does not like curl -> override useragent - curlOpts = "-A ''"; - url = "https://cdn.kyostatics.net/dlc/ru/driver/all/linuxdrv_1_1203_fs-1x2xmfp.-downloadcenteritem-Single-File.downloadcenteritem.tmp/LinuxDrv_1.1203_FS-1x2xMFP.zip"; + url = "https://web.archive.org/web/20220709011705/https://cdn.kyostatics.net/dlc/ru/driver/all/linuxdrv_1_1203_fs-1x2xmfp.-downloadcenteritem-Single-File.downloadcenteritem.tmp/LinuxDrv_1.1203_FS-1x2xMFP.zip"; sha256 = "0z1pbgidkibv4j21z0ys8cq1lafc6687syqa07qij2qd8zp15wiz"; }; diff --git a/pkgs/servers/web-apps/moodle/default.nix b/pkgs/servers/web-apps/moodle/default.nix index 77f02e7a78cd..4e5f1fa97a79 100644 --- a/pkgs/servers/web-apps/moodle/default.nix +++ b/pkgs/servers/web-apps/moodle/default.nix @@ -1,7 +1,7 @@ { lib, stdenv, fetchurl, writeText, plugins ? [ ] }: let - version = "3.11.6"; + version = "3.11.11"; stableVersion = lib.concatStrings (lib.take 2 (lib.splitVersion version)); in stdenv.mkDerivation rec { @@ -10,7 +10,7 @@ in stdenv.mkDerivation rec { src = fetchurl { url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz"; - sha256 = "sha256-g3qHYkxiXb18vJ23THUw8ej+s5SgIkJpmjQmmARwQhs="; + sha256 = "sha256-BZgJNzQs2KuhTs1JMpQGQ8B6eONGDewvG4PnE3xwVE8="; }; phpConfig = writeText "config.php" '' diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix index aff00402ed97..c556f31e6918 100644 --- a/pkgs/tools/compression/upx/default.nix +++ b/pkgs/tools/compression/upx/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, ucl, zlib, perl }: +{ lib, stdenv, fetchurl, ucl, zlib, perl, fetchpatch }: stdenv.mkDerivation rec { pname = "upx"; @@ -10,6 +10,14 @@ stdenv.mkDerivation rec { buildInputs = [ ucl zlib perl ]; + patches = [ + (fetchpatch { + url = "https://github.com/upx/upx/commit/13bc031163863cb3866aa6cdc018dff0697aa5d4.patch"; + sha256 = "sha256-7uazgx1lOgHh2J7yn3yb1q9lTJsv4BbexdGlWRiAG/M="; + name = "CVE-2021-20285.patch"; + }) + ]; + preConfigure = '' export UPX_UCLDIR=${ucl} ''; diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix index fe0ae20f557b..4c804a79d5f3 100644 --- a/pkgs/tools/filesystems/ntfs-3g/default.nix +++ b/pkgs/tools/filesystems/ntfs-3g/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config +{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config , gettext, mount, libuuid, kmod, macfuse-stubs, DiskArbitration , crypto ? false, libgcrypt, gnutls }: @@ -28,6 +28,16 @@ stdenv.mkDerivation rec { # https://github.com/tuxera/ntfs-3g/pull/39 ./autoconf-sbin-helpers.patch ./consistent-sbindir-usage.patch + (fetchpatch { + name = "CVE-2022-40284-1.patch"; + url = "https://github.com/tuxera/ntfs-3g/commit/18bfc676119a1188e8135287b8327b0760ba44a1.patch"; + hash = "sha256-CxM1kHYqQ1Dbwj0VEUtqEnWrB9aQy/O65FHWtcznwDQ="; + }) + (fetchpatch { + name = "CVE-2022-40284-2.patch"; + url = "https://github.com/tuxera/ntfs-3g/commit/76c3a799a97fbcedeeeca57f598be508ae2a1656.patch"; + hash = "sha256-riGev/z++VQdFkwdMYfBwJa3F8WR6yGDUf2SIsb1kD4="; + }) ]; configureFlags = [ diff --git a/pkgs/tools/misc/fluentd/default.nix b/pkgs/tools/misc/fluentd/default.nix index 82ea02aae680..7010c4f71bc9 100644 --- a/pkgs/tools/misc/fluentd/default.nix +++ b/pkgs/tools/misc/fluentd/default.nix @@ -1,4 +1,4 @@ -{ lib, bundlerEnv, ruby, bundlerUpdateScript }: +{ lib, bundlerEnv, ruby, bundlerUpdateScript, defaultGemConfig, fetchpatch }: bundlerEnv { inherit ruby; @@ -6,6 +6,19 @@ bundlerEnv { pname = "fluentd"; gemdir = ./.; + gemConfig = defaultGemConfig // { + fluentd = attrs: { + dontBuild = false; + patches = [ + (fetchpatch { + name = "CVE-2022-39379.patch"; + url = "https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135.patch"; + hash = "sha256-BNREUXe8EQ1rsJSXUFVGyuDyC6XX2uEDTke+WarK/Vg="; + }) + ]; + }; + }; + passthru.updateScript = bundlerUpdateScript "fluentd"; meta = with lib; { diff --git a/pkgs/tools/networking/dropbear/default.nix b/pkgs/tools/networking/dropbear/default.nix index 1fd686735b7e..036c287de256 100644 --- a/pkgs/tools/networking/dropbear/default.nix +++ b/pkgs/tools/networking/dropbear/default.nix @@ -1,6 +1,7 @@ { stdenv, lib, fetchurl, glibc, zlib , enableStatic ? stdenv.hostPlatform.isStatic , sftpPath ? "/run/current-system/sw/libexec/sftp-server" +, fetchpatch }: stdenv.mkDerivation rec { @@ -27,6 +28,11 @@ stdenv.mkDerivation rec { # Allow sessions to inherit the PATH from the parent dropbear. # Otherwise they only get the usual /bin:/usr/bin kind of PATH ./pass-path.patch + (fetchpatch { + url = "https://github.com/mkj/dropbear/commit/210a9833496ed2a93b8da93924874938127ce0b5.patch"; + sha256 = "sha256-ufnE+2uTsG23m+a/LwHfOEPZ3mq53vdFktZrVFH3yk4="; + name = "CVE-2021-36369.patch"; + }) ]; buildInputs = [ zlib ] ++ lib.optionals enableStatic [ glibc.static zlib.static ];