From ec0b22aff020270725745a3c4fdbdcd98b08976d Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Mon, 6 May 2024 22:28:21 +0200 Subject: [PATCH] glibc: 2.38-66 -> 2.38-77 Fixes GLIBC-SA-2024-0005 (CVE-2024-33599), GLIBC-SA-2024-0006 (CVE-2024-33600), GLIBC-SA-2024-0007 (CVE-2024-33601) and GLIBC-SA-2024-0008 (CVE-2024-33602). https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005;h=a59596610a0ea74d905a2452fc50283dad58e115;hb=HEAD https://sourceware.org/git?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006;h=d44148d3d97bddac42450649032ebbd96b59062e;hb=HEAD https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007;h=b6928fa27a69e325624b1a395ecb1bbba537ad80;hb=HEAD https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0008;h=d93e2a6f0bf084df419efadee2d1a48c4f9003d7;hb=HEAD --- .../libraries/glibc/2.38-master.patch.gz | Bin 79225 -> 89075 bytes pkgs/development/libraries/glibc/common.nix | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/glibc/2.38-master.patch.gz b/pkgs/development/libraries/glibc/2.38-master.patch.gz index 4b9fd43a54e356bdcb15e8db256485dc238f9dba..3babd2f706dfa0403cba153ccd1afbc23549e2b1 100644 GIT binary patch delta 10854 zcmYLvQ*@xw(rj$owl%SBTNB&%7u%lLwkMN`ZB1<3<~`^95BIfK_e-zZyQ`}E^$g;^ z9Wt;5^pX|0Fwk*amqZEh03i2^!a`-)9HSNOdc)1dBX2-n*|Mc`4)Ote2lWRGKgit}2__3eYv^IzW!FH{ zO++mgrFoOsvcw`g`UtqtVK1&$I0Xn|hqXegi3o8+8cl<-&*_qSaV2$Q8XKD0rNct8 z1GHIAVC=5KX39?evg;#%iT9HF?|=s{?B${9vGB$)UujXMR}%ycCTQ)ZDtv@`>Gu~T zDnJ9r5IdxDP@6VM5O+@vWcys7G1*%~_`lqbhOK73w+hMGv9zx!3Y?J|OmK!`-JuqT z@p(j@N}D3HV!>&b1PKw)TsQVv0<{gX^V3Lh-OE@peoo*q;%3? z(2%f9ZCvo-#Li$$wL$y#6u&^3TuU2&(hdmLG&o2dUozEI>F*b|m96gT3ZXIY0ZBzIfdOt$53@j`VI>|yTSVk0_;v3yQht*7rmz4K zji@GW#k7nE>#xFlrV>-IX1q7uND~;5slSSFV5SOYnA3(a8Txd2oMZIH8$4ag{0@%W z2fiwnRhg9PMwSP@vQtzNmW+sL4pB$fx~Y0FRtBCbD$=haoIFf0Lh675;^A$_!-B&(d!Z>60H$BEpzciTM^qW4Vq zg9cPPTrJm44j?mc0ZIS*$H**xMrnJOcHD^7p}JJYQRB%}+!FW;MGCR3r1U2o!yLn) zz7XFsM1o+a;88YfwZQoOQRlL!WNHk88KXX0Zqoz*A!V1tc&IlD@4wG?6Sx7qLW5_u z_-Q&NEEqj`qg&K9EC-IYmvdMNTGI-Awg7W}qD>o3Roi~OojTmXADy(P_-cW0dk!VA>{7iyVe(Bp88Tq%kckl1d+sXl0ZbB!~2KPDv-}xUN z4fyX1km{f;_IvW}dD~5^pE&>(Do%S04@E*M7H8{C@tQ8-Ud;v)nzk)9;dcj%%WBr@ z4-Ex)Li_~p$Wi!R$Ab#Zjx*J8NUkLh^oKl z55ewId)Qn=aH>sKhIP>VSVHh2U%%lWWy?BcK* zxKZw|Ao8Ao>JG51%ND>76*2moT?cAY=}Z_|Iz?{W|ADadPaZvsVZCwEZoW&|DLJb?3j_MuJ3lsoI*?M4iTpP&+r3k=IO&f-#|TJag&qJfVK zN~D?a*QV@C`jp((Ap%w5diOb_QDpxXZGUV$cFEz{4~$~2ZTy8lR4xT3t_|0su{Wq3X78P!N#s?+b&!NWm;90hoIi1z{wyNDf(Fa)r%Uad3JnQyEzG&gO-j`&uXA>yo8L$(RD~=$rK1&3cVX0<9?jM-A4$M`KZ8+fb5b7ctmCOU-&{;Z-BxFYsx)~>#|))$FBqLkt)HxvvPJ+ zySj{iX13z|HkIQ%U7oWeJciX`14R6vIxXip6$%>Z=D7B-G%ZDn^HjnZN(=Un#-+eijnn za{(mZ#8BqGO<__473|s0Nf~og<66abS$VxYmu>-Efs`GP6Md%)8=wz_-xpGY#mgl% znsncM7SlB5lCslrz&w@9x`CunX8=SU?QvW4ibF*3{`|84E0 zfu2$b3&t0{?_x!gXwcI?uKeTo`Sj!@z&<`ur)>D!fw@gavXBfZY5kwV z#-F|*(~v=PxZ~s^wx8GV3_4bUmtmezpsYkHyCPQ7VEgQ?-*}sYf5>&0VGg;cgrmkg z4?q^g{Ul-!GqKEvLFA24vo-$!gZYdYNv%FU0Xlgadlsg+p(XOYIUd)qCG~p(=y{mS zu7%amk0HpfUL?5(P~mTTYq+R+!K%d(NhMuZ{kqls@V9CVGfLmbH8m;nn}-oQ6OWtUvRA-#S|~8z14pVZR;8oA*hnYOw5T`N2Oj z^S+?1ABs!lo2fP-2=K`&n6_aQ|Hv={Z>16ZOiw-F`Pe@e z+;_i)2Ba`pePN zmCwiNk%il*4mj}1mq^&r1r_k}UA%c<;Z@o^x_mIIqe+tPa&XDOHFdp8@T1jK5WG+~ z020MV^H2O+MGtR+JsI1{r~He9(br-_R+`FwLZ_AYA@c?i*7I);xyt7zl^fOQ9P9`I zM$WkTNod`C;+0iZsnmIq6)oiVGvlBB>+d~4%?o z8WZ>f)D~h`OKS9&~AH-j>^J^iD+^<>Wy6WJAJ3*hNE|^&@ME-EwoepqD z7x+C+FPkVo=rlS((A+_ix_TPAWWiv`U2`B}vl7xW{l{c|JM5JJ==yZ!Ao>JH-UJdM z&gI&P|NXjTg|TEF6r%5&k(p?2sm&9H-gi8!*bU+qCt~j0*N=Xu)Sd8M!haGB9*3bL zuZU$=!>v7e%I$gxamOE&;VDj|DHSD$10fPOuVIJZS^8UN`QWeeRBbb^@g zM>zIVVo)efjR^N2TJA7y0zda*5;joI?~`ni2ClXlmR1`9dXAF5p|+Pmi}ze zM|bsYZaO$G(jXp8iN=t`-YotW8{ZriSv=Z6R!){4`;~dZUDCe8JvW1d>0)MtQ{8r_ z%r4M1r$}GaoJYBpWJIGVE_wg5gD+qu;I=Ga$Kxi&0M|BHc;KHkbcBVNe+CGw;~N@4 z!Bc3H^nvlP!a?#5HUM?HXgLEtHhYlAmo0yt|pEj(f5-$@`tpVtIjN~1o?4 zdc_2zpjmu{o0Tk#XrzZF2FO?4INp38c0V^a)1l^rU(u+I?{5%$>d|u4ehty0d#j|2 zqKs+F%E4VTO7UaMqcGqIL~lQPQ*!hmQ=>|1Me6sZw7>c{4=pSnZ~>aspM5v`CRu~g zduC`b%*$AlCan32BR{kXj=JqL?YL~NWQTj`_LAzV)IX;MqLEdb8|%McAX2O&oo3s$ zIYV1166iHqLQ$1uCBtYM#bt(+sk|9jlPkxuBAZYC4fz~&rahgUr>zdjt$0u;Uz%m@ zw@9OFvL-hnXf)hW=m2SfBFqw5Br?^h`wZ?!KR98pw(NwWEmGaIDug^~W4LADRHJuM zN;39h*^~L _DpGGdz9xNmZJ?W#@aDmiY>{mP>=?5UYnDj8H`edJ5Jfvxrr=DhG zh~*uZe8M*MlYDB@Cz;B_-~rzEqlkUuwBihC97{R+V{=w13w%~j+On%H_~cr!d7QTp z(~UfD zZxdK$(Du7PO<2#dM?KcaYk=u2jZC+PHkuJkeQhe2)#9$sLNO%0#_ zsX7VEai>4#8lZ0uy})ev`D0cEI%E5K;~)J_hsc)5!yW0eW|)7)mucX8oV)7C6!6~G zZS}CL%PhGL3Wl!`RN3pSLmJD<3|q@h4LL0#LW|8qr!2qEJ%A~ssJ2lbTQ;hmw;QWp zI+RzI3DTi2QGH6L%Se~DvwVQsF$`kXV4;b|=cTQX4^V-d?^YhLx!jqXyYw>r-7BGH zFt(P}NZi3N9gb!=lt{l-HG>%{K&g(!Qgy)&tU~Qhioq0?el2j7M>6V|V3c=VtRQWX zh9reVrNl=PS*B2TNj2pQ?bKZxQr2QbEaL9Nlk5Ti?<6TPkaNsoK@p_x=^rOuyATV4 zjK!`5l6<6@t$ix#N~tG?pP<6}EwGVPzWgkQ!#6cJWlHl9UdARfaT%tbjb(6#Tdj9J z@i6-5V7ea_qMGPehW01QE}5cTIXMC=M*r2G-9*o6bYZxuU1vAUc{E{SkJ~VMO)k*L zv^s%>)~J&m9yC@UQTDXPAX;Du1MrXUZgJ#_YM-i5E$T`!0ji%bbLeyA%C!-?hA6 z$`b|re8Sw!vfFAYPqP$^T6!a70!Vs+7DcfLdd>kJEH0%diQqcqbuzVK6Zxs_8B|$V zbX59|@YSx*opQuf03@;xl`4Cpvf`% zO|7ID5HXS&jfeAZ86AwGml2@Fr@;ZH%2F=tTxj43z~Ctzz7d^;C4+RYkEvLw3mxqXGnMgsp2sbLF` zu#VxX`_%Tl&|oOew#>-c<@ zIC6JPE$^CrhRJ!k-YpRKz`y26GzPV0g$>8OhA{agVM9kTfm>dVJ+LnY$HaJEOC(B! zIkRhFBt-jCt9DM@z=0hK##*<(s^@keOu%`z;pGV&Wgzx-w(8!;eQ--0*athb#5xpp ztXy+pqZmo|1Y{f+e+(j);F9+arg1n;=k?zYoGyZvoU17osAbcHQCmO84EUIv`)^To z{#ehc*zzrrT?rNyoEOr>i28|%=;2s-5BNx91PpHt4eMwrV5~@Ry*0_VTETq>J+TpU z@Jzs5%2N51kz!TnllvPKzsFO9G@?!5Z#9M%ex^)4pQ|i7nT|7wtk1W&5^*2-$pF;9 zrG{$0adX$>Et%FW>X*%7_Oi+~LhT78zkx~fHKvsJ<}yd(fIGYkBM##yGHYUJSDD^x zU-I+c!pvo5!14xB_3{FFd)xb^y0NSj35_-(pPW@cbrFvCXrVolO|{~IRB#an8Jp>G zqN+(H4Q*hn4WyAmv4)~?J=v(MM11NJsJ*sm1?g+=gXzVnh{6vDrT3l%qi6uo-+ zYznlq#9dcrn!*5LcJ!P$Es7=+Eiv_EIT~n@*+)nJNWu29t?vr)X;&7~@W3H!soC7| z-@fj+J5bB_P(Xx0n4;!x66A`{4A(PlB+yos$S6K=X-<&a88$QGFr7PP$2x-G$^A_P z;Il2iK6;To38qwidkxlJO=Q%&?GbFM6T4|KfxLB$JTp#up zKt%a-8M6DAab?1h@1t^VVIm;Bmtzc?pIIBDwz3q-Jb%jT779n!&#QxjWZc#e=yie! zzv}ou3!}?G&bD6|rTd*em|7xECRXK?)(E2yn@S*6wg1Q%v4Sy9)#n7bo)p~JJSkK^ zk#Jfzv*b$o<=Cy`nJOZ7X_%8&oFZ}IZ87TzJ>FueS_u5B;|KvhUOL)2(Xqbnwv zs)f6YDx|t%6V14LKN%Ibaj9^f zHxB{`$Q$ARlQfkZl(x41?i{-?ppNX<6#F|lM9}=5tdgQ^W&~`ldiAWn$rt3YD%Efw z4vW3CV3|hipF%UB7buKfIB8&TDH+rVYyR*?L(UDkUJRWqi`@Gvp&Nmp)p)w<1A6`y z*IgoU+t2#PyyR9QJ60i<%F5fkESZwZy%2h-OPY0_;-X{YBloH&u$`D=_cBD!$xuE% z_X_T(F-_RK@t5>snwTE54B{C7TvPWW9Z(ts2+&)gMdl-L1ZX)sEUzD?Dp zp6QX;w@KZ13CfYagN1f#Vgc)>1Zlb)D@XTx@vWC5;d2x@#A@>>6r7vqRD1sH&rtz4nnqD??7l!a5KD_xYBel56KwdakJO$rJ(p$b4H;89_94*vy6{w!A0se=D%=Pd! ziDc9DkSWOOr^MDuAh86t`bp0ZQ_4@x1>=olSHXD(rrjdX-)Dc63Yo-Ee27mlK*Wax z0Qo2V2y3<$yBih97E!Py{v6?(NEeAF_r_gqA-T~_y@aS#Bk0E zE#0vl4CX>1*_@+nn2NeRC{UFp+r=Vd<;9Gji+{%R2P*&hrK;}fr?g|dwI3mUdDc%U zUwm5gv@kfam!NEfcf=~1C1&Y5yd;nY0NhNJ4I+7i^>Ko6zqjor^P0tW9S%n@Z66fz(pCAnTT7EpGLLN5;5?8xFOHyAChi z8Hq~R@!AzXt>(i4A5PCbd`k13--mEIeszC|W;^=qK{9%!RBSxgOnw#Wtp7t)0lX@Z zv0-W+n17|GQNG?UA&{ebk|{!mUKkfZjfPQ-t1G^A;xs|}`<s1# zNU~Op8CSsKTZ!=ULCf5nO zMuFNU5DuVt_(2ilaey$R2)KZ1MyqQlZO~~gkp-t!c{|pveMRx?%ooIFf zZaNR-C#i^@>)H%lP};PJAO4A&_iKX-hg@*f5Gd07;n1634}iyN751)OZz2f4naQye zAbBq@O=3&EKo)1S5aH+aY0Iv2&xwrQK$Lweo*+>rx0 zl7*L15|T$zG4Ugu(84d!&O!Vr)9#&S7>EyBl-Lb__nX6z^|O%B!ph%=ac6;W=~D_V zZgj3fyXjB)3n-+|fs@QJWi22cwuTe8(yJf(hMF#Inl*WLDQrIa;EC>xGl&!Z)HDS{ zl7f2dElxGHsA$^Q?nb^g7^xbkL&VFg{GfI$10h1_N2%utOZF&dd@oD{`ze<-03hqIB3@4R(W+&ek~XKJYZA!D4ueI-nJ}vfg3^g_&fz)SJfyz1T0fDKdf9>3cf`P*7&zRI!YxK*y zQeSHc@l-qJ8BSKl=>=}&T58d5mwi^p6?tkX#n05z)cy`C%Z#MIradu2nZk3uDgNG6 za5O2Duog%3xjVHDFUfa(+aN9o42VVt{bLsmK{sI0P#M$?!r zhMxaPKv}u}17*=iI1kE zyyI&Bf;JN{PGr$WaWSI2(+;E3q)Ee5>w9T2_`^UIYHv;&hSlNWlrnXl?goniEVMnA zf3p-3B}9ebx_2e%;D^GPZ2x-4E&Jp|qsq0K!E z0-l~kd<$&;i90gj&BU9h7n2uU&6m%TWNavoXur|~2SDey8J}>1BHnfh-;mlZS6tPW z#OCl*xNlvbsxR81+-L#C)R2C=F}Ds`kkP3oY&DRYMx?+K_n~rH6qVBO#z3UI^a9`B zC{bTc0j2DFOv2%iM>P~n5vL|{L;a6pes?I`y(xL=%J@S_d4kW#WlM+{8}85$V`m8| z?m0q{;jp|7TI9c4&Y+}nrR3#&raA}^AMSpBkZVN`*7h+(R)IjwbU9|Z4rH)ce*2!= z3_)YdJ^D4~Gnb+CQmNY9z2Ay7?@b%ATe1`0QHb1gBun$Yr1GFbvX^_(FBW=AiUR`2 z{+DKfk1+J4SzN(xSX%dVgFN0+i|S%vfSJ=Wzk1KSEmPpw=>!8Q2dmkSwcf0Fw_9cK zcP3KZjihe%-yy)4H`)hFOv_SB=ijA`piS10Un`S~we$086m15xmePd#S7iI>HO|03 zQPbF?)dw;)32)Z1TC+FN1O#%uo)>jR6?-4}eTkSG`jansizUfpg$K%c0;i|U%kETe z>jZ!;@Upmk_oPy#^BaHdgFl8~#?PaRh zT!pgC_q15a?@q!fVAvji$ zp0#OFE?6>OKjbvK_=B6X`(501Tg0W0h_iM5JMwH^4~S8MANb8;aRd3R7E-0=VRy(P zE|Ce9a|XbiRP9K@o14?wK@D@Pbh%zDH#QLE`ARDNW7y^bYV;@m^C6?~A2YjDh32Ts z>_dP(^kzKF$|@saXgFQ;G%MBThKi=;pt$UFpBwlJu-l@-^`GDTdqEf2FCc=~piON& zLuwbwMIPl9L&3e=dQhJ}uds511ps6 z3*Zr(9O_4G9B^zDH8?^{9{tT5K?<19bTRSIejG7@bvqvL@fZ2wH<(?E^>eQ$>tMyZ zf#pN{aoZ2obtfcATR)qtAsP-0qLhagTJdB0Bgb6X0rKXrD)n8rsC?yJBDgSXJ-&%G zP9*L`+F)Olg2oe?0R`N)^p1&Ve)Pw$fbMN>tqu+zlM*l8d%B9%KKyv+s21Cz=yCLm zz#kWhpzE~pGEFu`sa?>EGXYv%6tmq)`{LY(ilZ;3#sPOWwPrf{$fYJu z@0RrpQqG#Q<}PfrwMaf5=K7}!$D8s2 z0K3E#r(SaACe@z+pZ#|*E1=g?48ocb`G>qrR-MWPRLin}v@N|_XQ&w0lViimY|#o` zb8f|CeQ4v>NDX&4nB2*KH~(W9YxzOcR`ttX>Kfp(xOX_Tx;Y;w%u{zrQ$tHY7ez0N zXhZEBY)THrakI-_TA^(F#ce^LEKs6ATA;LMsh~rYdU|GAc6rZF4_vEx$&OB2q@Z|; zUcjb>K}ii(Hp%QU{EEy`J?R{9%u(T7tC>)qFjwjIv}v3vQkjgtc&3qOOHU6`7Z1H5uJFX54aD;_X`yZ-C}Ec{*V->eQc!X|ypc8o}WpOQ>Fz{4(W zX$PVd?YD5_AKN1d&~qk!D4Ez}ma8msz!_OHHL0iR-F-XNZ=4xefaS)$R!4v{dmp#& zB`#(edC~B%B*^qBp`aDXSJ&ZKv2wVL>3g{}{4p@4V-Uz3qcO+0aMZ$|&sHJXpxh~Oo29}f_07A5e!c`K zNNvIFUEbFT;G?=TCppuzX-3G~=@jY=gl4dVw-^O^x0V`kKkFos5v)=BD~EzwTR=(< zriD`{YdK5vNf8TX{ncpSs)+zfelP&17Dgtp!K`~f#T{@-^u9UqY@ z32;A|H56IV>TY&VBbH`{-~P7>_?tW97|en(GP4f+6yZc>LSMqNI-O%!Wm>le{&SvY z(gabg|8f1iMPEUp7m1gUey7^dMO>QCthUlii{{U;pgBfH{{wrvv|rZz_u+4Ijr6r> z+6*lo>;P$#pl6_uQvFRm=h@>Y?%69T%V2KivF3isPrGN`^|HMv08;gX`yA=*naw67sqJtB%H#S=qC?H^J={x`*h`tExwT| z#*N92sI$EhQ25cvF3(9b%#xJlBkFbZb-Dpi60@*os_{$*q&4zG9;cKq^&tdHW~z;A z81miJAA{BATVO{;(oYI^2&VB;8K%+vOC%3@-kRu`U3=fT*|=c=n~s zSmX!EIyhM*&ZD2OxFKC1M=!u_UFl|wp{5CEJ;8CPWyJT)Z<&nqOP3T^d|_f$kwG(B qxf!FqN~cc4V$jrlSo_sW1lP5_U7#%hO`#GQ06p5AnK)mA0QrAt3k16W delta 927 zcmV;Q17Q5~w*~p?1c0;w?Jp-q*fg-Vek zH+F-i+K!x5by2x-;`ean*C74}-#ol=9LhroPQCcGyR(m(-JRW;{k%&Ch`;?=-8_u5 zx(%PL+2s%H7VZFfp4Ovsm;QkZK#~OM3IVl|JS{M@Am4g24dn btcZSIW9G!oP*X z9LmVL0i#Z-9bg(v*o=CiPNah75D{*$ge5_a)t%U;d)>k4sC(q|kui)N6Z)~Pxd>>6 zQEM?(R(p$XNSsGEnShR9aUYDuG+i$9O^_%84(|tE6F4ocDM^CKSvHGt~D0NX5+w|TAvRF1u3m@1VF583u%N|q-&n2h;phYQw!Lin8qrt zpMY|qUiHC$fn6r;Mx#(dP(w4Ycl=Hq1FCyBiY})9#3kgSwA+7dN{xHXdp2QKdO#Bi z3{X|Xj_Ot-I2>jp7P+MjL+%J8Xh2Zz^aWH><1}h@Xh6d{862$dkVb`s1HV5YLuTjT zY~;V~KnDYfhp&vI6rmV2UA4;VKZxey7eG8hj(DY~-9-dc6IDD9)CR4Vd9vnDC+|_b zNi-+6F=Djis)c`iwHy?A&uo+tG#{kjgqngtEfj~~Yk@vLHO>)KFt3d4iKO)W)@ySs z&u@C2f$y2a*74}L*EwwseAdBk`AZ8jb#~Z2>3dphB3~pB+&LXGbttFDl(#1rD~GNv z%%burla0@$)Cpk8w!O4ZSKm>zx`ypmsp)q2r30yK*!F+rwvSU}&Zqnv!y?)q7U#jR z2yl;{4~v};&zlWfRO@6Bi?2j%UYZxUv1^2?+H|6knHs0$`@!@T;tGF00Rm);Nxk zFGX0WVy%CH$=5dy&nKSoH}^Yj_cyW?$*N!FfVFEKK|U;Vx=#)-jM~m#PkeS_X@~V! zZ2bE9ivjz#z)E6g_;dC(x9|D)@A 2.38-master.patch.gz To compare the archive contents zdiff can be used.