From 226c957074842e37f6ce5a262b388f80cf7fecdf Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 13 May 2023 22:53:04 +0100
Subject: [PATCH 1/3] frr: add patches for CVE-2022-43681, CVE-2022-40302 &
 CVE-2022-40318

---
 pkgs/servers/frr/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 1215fbd34094..4936947402d4 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -48,6 +48,21 @@ stdenv.mkDerivation rec {
       url = "https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537ed.patch";
       sha256 = "sha256-b3nT6xco620hMSqlj/nTWTJCegf3ARAGaQbii4Yq6Ag=";
     })
+    (fetchpatch {
+      name = "CVE-2022-43681.patch";
+      url = "https://github.com/FRRouting/frr/commit/766eec1b7accffe2c04a5c9ebb14e9f487bb9f78.patch";
+      sha256 = "sha256-3XubiKvQos9QLQ4PaY89LLvLBjfYGoo6prulUgPXRgU=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-40302.patch";
+      url = "https://github.com/FRRouting/frr/commit/3e46b43e3788f0f87bae56a86b54d412b4710286.patch";
+      sha256 = "sha256-GlTJcoPg2BFw3JBSFEQk2CMEGGbYfXOPqsTjIoSe8WY=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-40318.patch";
+      url = "https://github.com/FRRouting/frr/commit/1117baca3c592877a4d8a13ed6a1d9bd83977487.patch";
+      sha256 = "sha256-txvpQZlqOyUl4kQ4VkLCUqSiA0lLdFt3uJdurnpJblM=";
+    })
   ];
 
   nativeBuildInputs = [

From 0a1f31518197a984202defb742dd672b69c4ef02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 May 2023 10:52:24 -0700
Subject: [PATCH 2/3] imagemagick: 7.1.1-8 -> 7.1.1-9

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.1-8...7.1.1-9
(cherry picked from commit c089534da5c928ea6f376672b0c828eb340d5cfa)
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 7b86371b9820..708e39578834 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-8";
+  version = "7.1.1-9";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-2wAm2y8YQwhgsPNqxGGJ65emL/kMYoVvF2phZMXTpZc=";
+    hash = "sha256-xTrkQpd4UYHEmHosb7ZLoqnDFSutrikjXPmuU5R9jQo=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

From d3be7ba4e5b60483587b90030e30c1374e2f8867 Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Tue, 16 May 2023 23:56:24 +0200
Subject: [PATCH 3/3] palemoon: 32.1.1 -> 32.2.0

(cherry picked from commit 6387628ca35b82b0c7987fedb83b979416d0797c)
---
 pkgs/applications/networking/browsers/palemoon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 69350e155599..c7b1bb9f655b 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "32.1.1";
+  version = "32.2.0";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-Z9dBYO5AGDYRLlnEfHUu6thgc2a8OK/tPuRzwp0j9J8=";
+    sha256 = "sha256-ftY3xSvpAdjnoPsNNL+XyVD6hFPRmReLyrYT5pqSNho=";
   };
 
   nativeBuildInputs = [