From 4cf468acf47540b7b9848031da17e3f613c50a35 Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Sun, 26 Jul 2026 10:59:06 +0200 Subject: [PATCH] libvncserver: backport CVE-2026-32853 and CVE-2026-32854 fixes Backport the complete upstream bounds checks for UltraZip decoding and malformed HTTP proxy requests. https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) (cherry picked from commit 2cd494ee4e0b6f0b4bb9e7f05df557a0ba06786d) --- pkgs/by-name/li/libvncserver/package.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/pkgs/by-name/li/libvncserver/package.nix b/pkgs/by-name/li/libvncserver/package.nix index 29ce2959e878..ed38724c0e67 100644 --- a/pkgs/by-name/li/libvncserver/package.nix +++ b/pkgs/by-name/li/libvncserver/package.nix @@ -41,6 +41,18 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/LibVNC/libvncserver/commit/e64fa928170f22a2e21b5bbd6d46c8f8e7dd7a96.patch"; hash = "sha256-AAZ3H34+nLqQggb/sNSx2gIGK96m4zatHX3wpyjNLOA="; }) + + (fetchpatch { + name = "CVE-2026-32854.patch"; + url = "https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314.patch"; + hash = "sha256-CgVfvsrgZWnjIzu/0UegoAuCqO7WHhCDVvhH8Yk1cXo="; + }) + + (fetchpatch { + name = "CVE-2026-32853.patch"; + url = "https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931.patch"; + hash = "sha256-ZgpiIS7KoRzDmVLQ0J86wTFFykCBVMt6bZwJsFvIO74="; + }) ]; nativeBuildInputs = [