nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-06-05 21:03:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

libredwg: 0.13.4 -> 0.13.4.8200

Browse Source 
Update to latest pre-release to fix multiple security vulnerabilities:

- CVE-2026-9500: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9501: heap-buffer-overflow in decode.c (read_2004_compressed_section)
- CVE-2026-9502: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9503: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9504: null pointer dereference in dwggrep.c (main)
- CVE-2026-9529: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9530: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9605: heap-buffer-overflow in decode.c (decompress_R2004_section)

Individual backports were not feasible as the decompressor was significantly
refactored on upstream's main branch between 0.13.4 and the fixes.
This commit is contained in:
Thorsten Weber
2026-05-27 20:35:18 +02:00
parent 83b719ab74
commit b27ee09e7d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/by-name/li/libredwg/package.nix
View File

@@ -18,13 +18,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "libredwg";
version = "0.13.4";
version = "0.13.4.8200";
src = fetchFromGitHub {
owner = "LibreDWG";
repo = "libredwg";
tag = finalAttrs.version;
hash = "sha256-FeDQCByFGKfHJDOPQA92GslXZ33nhGfB6/63t2TeugE=";
hash = "sha256-HaQvJyuEeaTfuUJbmlV4qcfXiLdHJ2vO4EGInwAKJYk=";
fetchSubmodules = true;
};