nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-21 16:11:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge #171516: libxml2: add CVE patches (into staging-21.11)

Browse Source
This commit is contained in:
Vladimír Čunát
2022-05-06 08:43:23 +02:00
parent 7bb83c9d8b 61220008cb
commit f5694753ac
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkgs/development/libraries/libxml2/default.nix
View File

@@ -35,6 +35,26 @@ stdenv.mkDerivation rec {
url = "https://gitlab.gnome.org/GNOME/libxml2/commit/85b1792e37b131e7a51af98a37f92472e8de5f3f.patch";
sha256 = "epqlNs2S0Zczox3KyCB6R2aJKh87lXydlZ0x6tLHweE=";
})
# Fix [CVE-2022-23308] Use-after-free of ID and IDREF attributes
# See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.13
# TODO: Remove once this package is >= v2.9.13
(fetchpatch {
name = "libxml2-CVE-2022-23308-Use-after-free-of-ID-and-IDREF-attributes.patch";
url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12a858989b14eed4e84e453059cd3ba340e.patch";
sha256 = "1rwb2xbvddkqgigdq9vjzqqaj6hhrhzk8m6hkcicqrc4ik9d636r";
})
# Fix [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
# See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14
# Page https://nvd.nist.gov/vuln/detail/CVE-2022-29824 links the fix commits for
# `libxml2` master and the 2.9.14 backport we use here.
# TODO: Remove once this package is >= v2.9.14
(fetchpatch {
name = "libxml2-CVE-2022-29824-Fix-integer-overflows-in-xmlBuf-and-xmlBuffer.patch";
url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab.patch";
sha256 = "1kyzxh8fp5sfyqi9zghd7c2d32ld0mvp8hrk55mnvkg7aq42j0nz";
})
];
outputs = [ "bin" "dev" "out" "man" "doc" ]