From 674ebc241dde3b747e8c47a5ca1b5825cba95c38 Mon Sep 17 00:00:00 2001 From: Shea Levy Date: Fri, 4 Nov 2016 23:05:26 -0400 Subject: [PATCH 1/2] tar: patch for CVE-2016-6321 https://lwn.net/Vulnerabilities/705216/ (cherry picked from commit ac59e2f184fe0beeec2920dc9d6d9830813d9212) --- .../archivers/gnutar/CVE-2016-6321.patch | 35 +++++++++++++++++++ pkgs/tools/archivers/gnutar/default.nix | 2 +- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 pkgs/tools/archivers/gnutar/CVE-2016-6321.patch diff --git a/pkgs/tools/archivers/gnutar/CVE-2016-6321.patch b/pkgs/tools/archivers/gnutar/CVE-2016-6321.patch new file mode 100644 index 000000000000..c53d92891fc4 --- /dev/null +++ b/pkgs/tools/archivers/gnutar/CVE-2016-6321.patch @@ -0,0 +1,35 @@ +commit 7340f67b9860ea0531c1450e5aa261c50f67165d +Author: Paul Eggert +Date: Sat Oct 29 21:04:40 2016 -0700 + + When extracting, skip ".." members + + * NEWS: Document this. + * src/extract.c (extract_archive): Skip members whose names + contain "..". + +diff --git a/src/extract.c b/src/extract.c +index f982433..7904148 100644 +--- a/src/extract.c ++++ b/src/extract.c +@@ -1629,12 +1629,20 @@ extract_archive (void) + { + char typeflag; + tar_extractor_t fun; ++ bool skip_dotdot_name; + + fatal_exit_hook = extract_finish; + + set_next_block_after (current_header); + ++ skip_dotdot_name = (!absolute_names_option ++ && contains_dot_dot (current_stat_info.orig_file_name)); ++ if (skip_dotdot_name) ++ ERROR ((0, 0, _("%s: Member name contains '..'"), ++ quotearg_colon (current_stat_info.orig_file_name))); ++ + if (!current_stat_info.file_name[0] ++ || skip_dotdot_name + || (interactive_option + && !confirm ("extract", current_stat_info.file_name))) + { diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix index 16660fea3e72..80c84236b8db 100644 --- a/pkgs/tools/archivers/gnutar/default.nix +++ b/pkgs/tools/archivers/gnutar/default.nix @@ -9,7 +9,7 @@ stdenv.mkDerivation rec { sha256 = "097hx7sbzp8qirl4m930lw84kn0wmxhmq7v1qpra3mrg0b8cyba0"; }; - patches = [ ]; # FIXME: remove on another stdenv rebuild + patches = [ ./CVE-2016-6321.patch ]; # FIXME: remove on another stdenv rebuild # avoid retaining reference to CF during stdenv bootstrap configureFlags = stdenv.lib.optionals stdenv.isDarwin [ From da8c5d95d81d6279803c6d0bb8e7d03af86be941 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sun, 6 Nov 2016 11:38:55 +0100 Subject: [PATCH 2/2] Merge #20206: libtiff: patch for some more CVEs (cherry picked from commit b4c296ee0962c18c3bea80958476e3020147d077) --- .../development/libraries/libtiff/default.nix | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index b632b910f01f..1911a5a93b09 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -2,6 +2,7 @@ let version = "4.0.6"; + debversion = "3"; in stdenv.mkDerivation rec { name = "libtiff-${version}"; @@ -19,35 +20,48 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; - patches = [ + patches = let p = "https://sources.debian.net/data/main/t/tiff/${version}-${debversion}/debian/patches"; in [ (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/01-CVE-2015-8665_and_CVE-2015-8683.patch"; + url = "${p}/01-CVE-2015-8665_and_CVE-2015-8683.patch"; sha256 = "1c4zmvxj124873al8fvkiv8zq7wx5mv2vd4f1y9w8liv92cm7hkc"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/02-fix_potential_out-of-bound_writes_in_decode_functions.patch"; + url = "${p}/02-fix_potential_out-of-bound_writes_in_decode_functions.patch"; sha256 = "0rsc7zh7cdhgcmx2vbjfaqrb0g93a3924ngqkrzb14w5j2fqfbxv"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/03-fix_potential_out-of-bound_write_in_NeXTDecode.patch"; + url = "${p}/03-fix_potential_out-of-bound_write_in_NeXTDecode.patch"; sha256 = "1s01xhp4sl04yhqhqwp50gh43ykcqk230mmbv62vhy2jh7v0ky3a"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/04-CVE-2016-5314_CVE-2016-5316_CVE-2016-5320_CVE-2016-5875.patch"; + url = "${p}/04-CVE-2016-5314_CVE-2016-5316_CVE-2016-5320_CVE-2016-5875.patch"; sha256 = "0by35qxpzv9ib3mnh980gd30jf3qmsfp2kl730rq4pq66wpzg9m8"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/05-CVE-2016-6223.patch"; + url = "${p}/05-CVE-2016-6223.patch"; sha256 = "0rh8ia0wsf5yskzwdjrlbiilc9m0lq0igs42k6922pl3sa1lxzv1"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/06-CVE-2016-5321.patch"; + url = "${p}/06-CVE-2016-5321.patch"; sha256 = "0n0igfxbd3kqvvj2k2xgysrp63l4v2gd110fwkk4apfpm0hvzwh0"; }) (fetchpatch { - url = "https://sources.debian.net/data/main/t/tiff/4.0.6-2/debian/patches/07-CVE-2016-5323.patch"; + url = "${p}/07-CVE-2016-5323.patch"; sha256 = "1j6w8g6qizkx5h4aq95kxzx6bgkn4jhc8l22swwhvlkichsh4910"; }) + (fetchurl { + url = "${p}/08-CVE-2016-3623_CVE-2016-3624.patch"; + sha256 = "1xnvwjvgyxi387h1sdiyp4360a3176jmipb7ghm8vwiz7cisdn9z"; + }) + (fetchurl { + url = "${p}/09-CVE-2016-5652.patch"; + sha256 = "1yqfq32gzh21ab2jfqkq13gaz0nin0492l06adzsyhr5brvdhnx8"; + }) + (fetchurl { + url = "${p}/10-CVE-2016-3658.patch"; + sha256 = "01kb8rfk30fgjf1hy0m088yhjfld1yyh4bk3gkg8jx3dl9bd076d"; + }) + ];