nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-03 13:30:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'staging-16.09' into release-16.09

Browse Source 
There are security fixes for tar and libtiff.
I forgot to push this immediately.
This commit is contained in:
Vladimír Čunát
2016-11-06 12:03:46 +01:00
parent 0cec5cb3ca da8c5d95d8
commit c662d2c7ed
3 changed files with 58 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
pkgs/development/libraries/libtiff/default.nix
View File

@@ -2,6 +2,7 @@
let
version = "4.0.6";
debversion = "3";
in
stdenv.mkDerivation rec {
name = "libtiff-${version}";
@@ -19,35 +20,48 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
patches = [
patches = let p = "https://sources.debian.net/data/main/t/tiff/${version}-${debversion}/debian/patches"; in [
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/01-CVE-2015-8665_and_CVE-2015-8683.patch";
url = "${p}/01-CVE-2015-8665_and_CVE-2015-8683.patch";
sha256 = "1c4zmvxj124873al8fvkiv8zq7wx5mv2vd4f1y9w8liv92cm7hkc";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/02-fix_potential_out-of-bound_writes_in_decode_functions.patch";
url = "${p}/02-fix_potential_out-of-bound_writes_in_decode_functions.patch";
sha256 = "0rsc7zh7cdhgcmx2vbjfaqrb0g93a3924ngqkrzb14w5j2fqfbxv";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/03-fix_potential_out-of-bound_write_in_NeXTDecode.patch";
url = "${p}/03-fix_potential_out-of-bound_write_in_NeXTDecode.patch";
sha256 = "1s01xhp4sl04yhqhqwp50gh43ykcqk230mmbv62vhy2jh7v0ky3a";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/04-CVE-2016-5314_CVE-2016-5316_CVE-2016-5320_CVE-2016-5875.patch";
url = "${p}/04-CVE-2016-5314_CVE-2016-5316_CVE-2016-5320_CVE-2016-5875.patch";
sha256 = "0by35qxpzv9ib3mnh980gd30jf3qmsfp2kl730rq4pq66wpzg9m8";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/05-CVE-2016-6223.patch";
url = "${p}/05-CVE-2016-6223.patch";
sha256 = "0rh8ia0wsf5yskzwdjrlbiilc9m0lq0igs42k6922pl3sa1lxzv1";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/06-CVE-2016-5321.patch";
url = "${p}/06-CVE-2016-5321.patch";
sha256 = "0n0igfxbd3kqvvj2k2xgysrp63l4v2gd110fwkk4apfpm0hvzwh0";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/07-CVE-2016-5323.patch";
url = "${p}/07-CVE-2016-5323.patch";
sha256 = "1j6w8g6qizkx5h4aq95kxzx6bgkn4jhc8l22swwhvlkichsh4910";
})
(fetchurl {
url = "${p}/08-CVE-2016-3623_CVE-2016-3624.patch";
sha256 = "1xnvwjvgyxi387h1sdiyp4360a3176jmipb7ghm8vwiz7cisdn9z";
})
(fetchurl {
url = "${p}/09-CVE-2016-5652.patch";
sha256 = "1yqfq32gzh21ab2jfqkq13gaz0nin0492l06adzsyhr5brvdhnx8";
})
(fetchurl {
url = "${p}/10-CVE-2016-3658.patch";
sha256 = "01kb8rfk30fgjf1hy0m088yhjfld1yyh4bk3gkg8jx3dl9bd076d";
})
];

35
pkgs/tools/archivers/gnutar/CVE-2016-6321.patch Normal file
View File

@@ -0,0 +1,35 @@
commit 7340f67b9860ea0531c1450e5aa261c50f67165d
Author: Paul Eggert <eggert@Penguin.CS.UCLA.EDU>
Date: Sat Oct 29 21:04:40 2016 -0700
When extracting, skip ".." members
* NEWS: Document this.
* src/extract.c (extract_archive): Skip members whose names
contain "..".
diff --git a/src/extract.c b/src/extract.c
index f982433..7904148 100644
--- a/src/extract.c
+++ b/src/extract.c
@@ -1629,12 +1629,20 @@ extract_archive (void)
{
char typeflag;
tar_extractor_t fun;
+ bool skip_dotdot_name;
fatal_exit_hook = extract_finish;
set_next_block_after (current_header);
+ skip_dotdot_name = (!absolute_names_option
+ && contains_dot_dot (current_stat_info.orig_file_name));
+ if (skip_dotdot_name)
+ ERROR ((0, 0, _("%s: Member name contains '..'"),
+ quotearg_colon (current_stat_info.orig_file_name)));
+
if (!current_stat_info.file_name[0]
+ || skip_dotdot_name
|| (interactive_option
&& !confirm ("extract", current_stat_info.file_name)))
{

2
pkgs/tools/archivers/gnutar/default.nix
View File

@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
sha256 = "097hx7sbzp8qirl4m930lw84kn0wmxhmq7v1qpra3mrg0b8cyba0";
};
patches = [ ]; # FIXME: remove on another stdenv rebuild
patches = [ ./CVE-2016-6321.patch ]; # FIXME: remove on another stdenv rebuild
# avoid retaining reference to CF during stdenv bootstrap
configureFlags = stdenv.lib.optionals stdenv.isDarwin [