mesos: switch to https for maven

Fixes: #78702
Closes: #79260
(cherry picked from commit 157f392f57)

pkgs/applications/misc/djvulibre/CVE-2019-15142.patch

@@ -0,0 +1,72 @@
+commit 970fb11a296b5bbdc5e8425851253d2c5913c45e
+Author: Leon Bottou <leon@bottou.org>
+Date:   Tue Mar 26 20:36:31 2019 -0400
+
+    Fix bug#296
+
+diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
+index a6a39e0..0a0fac6 100644
+--- a/libdjvu/DjVmDir.cpp
++++ b/libdjvu/DjVmDir.cpp
+@@ -299,42 +299,44 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
+          memcpy((char*) strings+strings_size, buffer, length);
+       }
+       DEBUG_MSG("size of decompressed names block=" << strings.size() << "\n");
+-      if (strings[strings.size()-1] != 0)
+-        {
+-         int strings_size=strings.size();
+-         strings.resize(strings_size+1);
+-         strings[strings_size] = 0;
+-        }
++      int strings_size=strings.size();
++      strings.resize(strings_size+3);
++      memset((char*) strings+strings_size, 0, 4);
+       
+-         // Copy names into the files
++      // Copy names into the files
+       const char * ptr=strings;
+       for(pos=files_list;pos;++pos)
+       {
+          GP<File> file=files_list[pos];
+-
++         if (ptr >= (const char*)strings + strings_size)
++           G_THROW( "DjVu document is corrupted (DjVmDir)" );
+          file->id=ptr;
+          ptr+=file->id.length()+1;
+          if (file->flags & File::HAS_NAME)
+          {
+-            file->name=ptr;
+-            ptr+=file->name.length()+1;
+-         } else
++           file->name=ptr;
++           ptr+=file->name.length()+1;
++         }
++         else
+          {
+             file->name=file->id;
+          }
+          if (file->flags & File::HAS_TITLE)
+          {
+-            file->title=ptr;
+-       ptr+=file->title.length()+1;
+-         } else
+-       file->title=file->id;
+-   /* msr debug:  multipage file, file->title is null.  
++           file->title=ptr;
++           ptr+=file->title.length()+1;
++         }
++         else
++         {
++           file->title=file->id;
++         }
++         /* msr debug:  multipage file, file->title is null.  
+          DEBUG_MSG(file->name << ", " << file->id << ", " << file->title << ", " <<
+                    file->offset << ", " << file->size << ", " <<
+                    file->is_page() << "\n"); */
+       }
+ 
+-         // Check that there is only one file with SHARED_ANNO flag on
++      // Check that there is only one file with SHARED_ANNO flag on
+       int shared_anno_cnt=0;
+       for(pos=files_list;pos;++pos)
+       {

pkgs/applications/misc/djvulibre/CVE-2019-15143.patch

@@ -0,0 +1,39 @@
+commit b1f4e1b2187d9e5010cd01ceccf20b4a11ce723f
+Author: Leon Bottou <leon@bottou.org>
+Date:   Tue Mar 26 20:45:46 2019 -0400
+
+    fix for bug #297
+
+diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
+index 0a0fac6..5a49015 100644
+--- a/libdjvu/DjVmDir.cpp
++++ b/libdjvu/DjVmDir.cpp
+@@ -309,7 +309,7 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
+       {
+          GP<File> file=files_list[pos];
+          if (ptr >= (const char*)strings + strings_size)
+-           G_THROW( "DjVu document is corrupted (DjVmDir)" );
++           G_THROW( ByteStream::EndOfFile );
+          file->id=ptr;
+          ptr+=file->id.length()+1;
+          if (file->flags & File::HAS_NAME)
+diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
+index 0e487f0..c2fdbe4 100644
+--- a/libdjvu/GBitmap.cpp
++++ b/libdjvu/GBitmap.cpp
+@@ -890,11 +890,13 @@ GBitmap::read_rle_raw(ByteStream &bs)
+   int c = 0;
+   while (n >= 0)
+     {
+-      bs.read(&h, 1);
++      if (bs.read(&h, 1) <= 0)
++        G_THROW( ByteStream::EndOfFile );
+       int x = h;
+       if (x >= (int)RUNOVERFLOWVALUE)
+         {
+-          bs.read(&h, 1);
++          if (bs.read(&h, 1) <= 0)
++            G_THROW( ByteStream::EndOfFile );
+           x = h + ((x - (int)RUNOVERFLOWVALUE) << 8);
+         }
+       if (c+x > ncolumns)

pkgs/applications/misc/djvulibre/CVE-2019-15144.patch

@@ -0,0 +1,111 @@
+commit e15d51510048927f172f1bf1f27ede65907d940d
+Author: Leon Bottou <leon@bottou.org>
+Date:   Mon Apr 8 22:25:55 2019 -0400
+
+    bug 299 fixed
+
+diff --git a/libdjvu/GContainer.h b/libdjvu/GContainer.h
+index 96b067c..0140211 100644
+--- a/libdjvu/GContainer.h
++++ b/libdjvu/GContainer.h
+@@ -550,52 +550,61 @@ public:
+ template <class TYPE> void
+ GArrayTemplate<TYPE>::sort(int lo, int hi)
+ {
+-  if (hi <= lo)
+-    return;
+-  if (hi > hibound || lo<lobound)
+-    G_THROW( ERR_MSG("GContainer.illegal_subscript") );
+   TYPE *data = (TYPE*)(*this);
+-  // Test for insertion sort
+-  if (hi <= lo + 50)
++  while(true)
+     {
+-      for (int i=lo+1; i<=hi; i++)
++      if (hi <= lo)
++        return;
++      if (hi > hibound || lo<lobound)
++        G_THROW( ERR_MSG("GContainer.illegal_subscript") );
++      // Test for insertion sort
++      if (hi <= lo + 50)
+         {
+-          int j = i;
+-          TYPE tmp = data[i];
+-          while ((--j>=lo) && !(data[j]<=tmp))
+-            data[j+1] = data[j];
+-          data[j+1] = tmp;
++          for (int i=lo+1; i<=hi; i++)
++            {
++              int j = i;
++              TYPE tmp = data[i];
++              while ((--j>=lo) && !(data[j]<=tmp))
++                data[j+1] = data[j];
++              data[j+1] = tmp;
++            }
++          return;
+         }
+-      return;
+-    }
+-  // -- determine suitable quick-sort pivot
+-  TYPE tmp = data[lo];
+-  TYPE pivot = data[(lo+hi)/2];
+-  if (pivot <= tmp)
+-    { tmp = pivot; pivot=data[lo]; }
+-  if (data[hi] <= tmp)
+-    { pivot = tmp; }
+-  else if (data[hi] <= pivot)
+-    { pivot = data[hi]; }
+-  // -- partition set
+-  int h = hi;
+-  int l = lo;
+-  while (l < h)
+-    {
+-      while (! (pivot <= data[l])) l++;
+-      while (! (data[h] <= pivot)) h--;
+-      if (l < h)
++      // -- determine median-of-three pivot
++      TYPE tmp = data[lo];
++      TYPE pivot = data[(lo+hi)/2];
++      if (pivot <= tmp)
++        { tmp = pivot; pivot=data[lo]; }
++      if (data[hi] <= tmp)
++        { pivot = tmp; }
++      else if (data[hi] <= pivot)
++        { pivot = data[hi]; }
++      // -- partition set
++      int h = hi;
++      int l = lo;
++      while (l < h)
+         {
+-          tmp = data[l];
+-          data[l] = data[h];
+-          data[h] = tmp;
+-          l = l+1;
+-          h = h-1;
++          while (! (pivot <= data[l])) l++;
++          while (! (data[h] <= pivot)) h--;
++          if (l < h)
++            {
++              tmp = data[l];
++              data[l] = data[h];
++              data[h] = tmp;
++              l = l+1;
++              h = h-1;
++            }
++        }
++      // -- recurse, small partition first
++      //    tail-recursion elimination
++      if (h - lo <= hi - l) {
++        sort(lo,h);
++        lo = l; // sort(l,hi)
++      } else {
++        sort(l,hi);
++        hi = h; // sort(lo,h)
+       }
+     }
+-  // -- recursively restart
+-  sort(lo, h);
+-  sort(l, hi);
+ }
+ 
+ template<class TYPE> inline TYPE&

pkgs/applications/misc/djvulibre/CVE-2019-15145.patch

@@ -0,0 +1,28 @@
+commit 9658b01431cd7ff6344d7787f855179e73fe81a7
+Author: Leon Bottou <leon@bottou.org>
+Date:   Mon Apr 8 22:55:38 2019 -0400
+
+    fix bug #298
+
+diff --git a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h
+index e8e0c9b..ca89a19 100644
+--- a/libdjvu/GBitmap.h
++++ b/libdjvu/GBitmap.h
+@@ -566,7 +566,7 @@ GBitmap::operator[](int row)
+ {
+   if (!bytes) 
+     uncompress();
+-  if (row<0 || row>=nrows) {
++  if (row<0 || row>=nrows || !bytes) {
+ #ifndef NDEBUG
+     if (zerosize < bytes_per_row + border)
+       G_THROW( ERR_MSG("GBitmap.zero_small") );
+@@ -581,7 +581,7 @@ GBitmap::operator[](int row) const
+ {
+   if (!bytes) 
+     ((GBitmap*)this)->uncompress();
+-  if (row<0 || row>=nrows) {
++  if (row<0 || row>=nrows || !bytes) {
+ #ifndef NDEBUG
+     if (zerosize < bytes_per_row + border)
+       G_THROW( ERR_MSG("GBitmap.zero_small") );

pkgs/applications/misc/djvulibre/CVE-2019-18804.patch

@@ -0,0 +1,32 @@
+commit c8bec6549c10ffaa2f2fbad8bbc629efdf0dd125
+Author: Leon Bottou <leon@bottou.org>
+Date:   Thu Oct 17 22:20:31 2019 -0400
+
+    Fixed bug 309
+
+diff --git a/libdjvu/IW44EncodeCodec.cpp b/libdjvu/IW44EncodeCodec.cpp
+index 00752a0..f81eaeb 100644
+--- a/libdjvu/IW44EncodeCodec.cpp
++++ b/libdjvu/IW44EncodeCodec.cpp
+@@ -405,7 +405,7 @@ filter_fv(short *p, int w, int h, int rowsize, int scale)
+   int y = 0;
+   int s = scale*rowsize;
+   int s3 = s+s+s;
+-  h = ((h-1)/scale)+1;
++  h = (h>0) ? ((h-1)/scale)+1 : 0;
+   y += 1;
+   p += s;
+   while (y-3 < h)
+diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
+index 6d0df3b..7109952 100644
+--- a/tools/ddjvu.cpp
++++ b/tools/ddjvu.cpp
+@@ -279,7 +279,7 @@ render(ddjvu_page_t *page, int pageno)
+       prect.h = (ih * 100) / dpi;
+     }
+   /* Process aspect ratio */
+-  if (flag_aspect <= 0)
++  if (flag_aspect <= 0 && iw>0 && ih>0)
+     {
+       double dw = (double)iw / prect.w;
+       double dh = (double)ih / prect.h;

pkgs/applications/misc/djvulibre/default.nix

@@ -12,6 +12,17 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libjpeg libtiff librsvg libiconv ];
 
+  patches = [
+    ./CVE-2019-18804.patch
+    # This one is needed to make the following
+    # two CVE patches apply cleanly
+    ./fix_hongfuzz_crash.patch
+    ./CVE-2019-15142.patch
+    ./CVE-2019-15143.patch
+    ./CVE-2019-15144.patch
+    ./CVE-2019-15145.patch
+  ];
+
   meta = with stdenv.lib; {
     description = "A library and viewer for the DJVU file format for scanned images";
     homepage = http://djvu.sourceforge.net;

pkgs/applications/misc/djvulibre/fix_hongfuzz_crash.patch

@@ -0,0 +1,51 @@
+commit 89d71b01d606e57ecec2c2930c145bb20ba5bbe3
+Author: Leon Bottou <leon@bottou.org>
+Date:   Fri Jul 13 08:46:22 2018 -0400
+
+    fix hongfuzz crash.
+
+diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
+index d322323..a6a39e0 100644
+--- a/libdjvu/DjVmDir.cpp
++++ b/libdjvu/DjVmDir.cpp
+@@ -299,7 +299,13 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
+          memcpy((char*) strings+strings_size, buffer, length);
+       }
+       DEBUG_MSG("size of decompressed names block=" << strings.size() << "\n");
+-   
++      if (strings[strings.size()-1] != 0)
++        {
++         int strings_size=strings.size();
++         strings.resize(strings_size+1);
++         strings[strings_size] = 0;
++        }
++      
+          // Copy names into the files
+       const char * ptr=strings;
+       for(pos=files_list;pos;++pos)
+diff --git a/libdjvu/miniexp.cpp b/libdjvu/miniexp.cpp
+index 6a5cd90..828addc 100644
+--- a/libdjvu/miniexp.cpp
++++ b/libdjvu/miniexp.cpp
+@@ -1065,7 +1065,7 @@ print_c_string(const char *s, char *d, int flags, size_t len)
+       c = (unsigned char)(*s++);
+       if (char_quoted(c, flags))
+         {
+-          char buffer[10];
++          char buffer[16]; /* 10+1 */
+           static const char *tr1 = "\"\\tnrbf";
+           static const char *tr2 = "\"\\\t\n\r\b\f";
+           buffer[0] = buffer[1] = 0;
+diff --git a/tools/csepdjvu.cpp b/tools/csepdjvu.cpp
+index 7ed13ad..fab9472 100644
+--- a/tools/csepdjvu.cpp
++++ b/tools/csepdjvu.cpp
+@@ -1834,7 +1834,7 @@ main(int argc, const char **argv)
+                 ByteStream::create(GURL::Filename::UTF8(arg),"rb");
+               BufferByteStream ibs(*fbs);
+               do {
+-                char pagename[16];
++                char pagename[20];
+                 sprintf(pagename, "p%04d.djvu", ++pageno);
+                 if (opts.verbose > 1)
+                   DjVuPrintErrorUTF8("%s","--------------------\n");

pkgs/applications/misc/electrum/dash.nix

@@ -42,5 +42,6 @@ python2Packages.buildPythonApplication rec {
     homepage = https://github.com/dashpay/electrum-dash;
     license = licenses.gpl3;
     maintainers = with maintainers; [ np ];
+    knownVulnerabilities = [ "CVE-2018-1000022" ];
   };
 }

pkgs/applications/misc/tnef/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.17";
-  name = "tnef-${version}";
+  version = "1.4.18";
+  pname = "tnef";
 
   src = fetchFromGitHub {
     owner  = "verdammelt";
     repo   = "tnef";
     rev    = version;
-    sha256 = "0cq2xh5wd74qn6k2nnw5rayxgqhjl3jbzf4zlc4babcwxrv32ldh";
+    sha256 = "104g48mcm00bgiyzas2vf86331w7bnw7h3bc11ib4lp7rz6zqfck";
   };
 
   doCheck = true;

pkgs/applications/networking/browsers/chromium/plugins.nix

@@ -100,11 +100,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.255";
+    version = "32.0.0.293";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1rqb54kqxq66vvqk5yrr3rsy3wcj9r9wnkngk27c7jayzm6bwgvv";
+      sha256 = "0rgriqdbyrzpm1bcph35bhzd5dz21yim56z93hkmbpdqg7767dwm";
       stripRoot = false;
     };
 
@@ -136,7 +136,11 @@ let
 
     dontStrip = true;
 
-    meta.platforms = platforms.x86_64;
+    meta = {
+      license = stdenv.lib.licenses.unfree;
+      maintainers = with stdenv.lib.maintainers; [ taku0 ];
+      platforms = platforms.x86_64;
+    };
   };
 
 in {

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0al26nfcxa00gvgn02iasjm53wq089r3c6b3rqqanljffng565y7";
-    sha256bin64 = "0qfj08adqn19sxsgd98fy5l23cikvfkpzkz9mqq90mlabmhhrp0z";
-    version = "78.0.3904.50";
+    sha256 = "0pw0z35v04jzcnshsfwbc8cz95cl0dq6405rlmh2a3xz2gxaacqi";
+    sha256bin64 = "1xyvaksik5a1jkkv7zqyys33n8x0n7q8xzf5mpgj71iany57z2sv";
+    version = "79.0.3945.16";
   };
   dev = {
-    sha256 = "0ck52j5acdns7vqqvb665xpc68yl6qz0ca8lwjfhriw5hn8g1pjy";
-    sha256bin64 = "073gxyfayrb1dqsq8ngmnrs8ajwwrr2qbs311ns64davn1z3sscf";
-    version = "79.0.3928.4";
+    sha256 = "169iwzqc5zvbmm7cq1q185w2j2y2r716pbgpadps7ng2i47z6rqs";
+    sha256bin64 = "0ravjdmmbwlf3ydgmk7hdd5d92zxh67nv49igr5km6mr4fi1xsw2";
+    version = "80.0.3955.4";
   };
   stable = {
-    sha256 = "1y3ay0ppwakbw2hqrmxbv4ykil8dahf62ypld17ddkqxkfqgk4np";
-    sha256bin64 = "0j1sk36nfmhx6nk8lmsdi93vcrmn58pidhb5hzkapx8mgk6xraq7";
-    version = "77.0.3865.120";
+    sha256 = "0mpb7798hzpysidp10k4x54b56c3fm7wqfj4s3kl7z47835gzxld";
+    sha256bin64 = "1y75687w0rls03yps63hi4m0qfdm0qzgq1jhp1jicyyhjkp0xw5q";
+    version = "78.0.3904.87";
   };
 }

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -92,10 +92,10 @@ rec {
 
   firefox-esr-68 = common rec {
     pname = "firefox-esr";
-    ffversion = "68.1.0esr";
+    ffversion = "68.2.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0n8iy9xwf8wldkknq3y3nlm0cmb48baamvz4wmmbpfb2kfrxbsj3wnnd9ayk9zxhrsdq0na9gvkc374mv06nyqijrahd67wljv08fx5";
+      sha512 = "3p4gic3nlz1rxfc64xnv6vgfvf84w8752vpkdc1sfl3qx0w05q5d23rsvmkm8nb45bnsq3ch3jsrsh4p6fan4k9hvmzv8zgp6k2qlpn";
     };
 
     patches = [

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix

@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.255";
+  version = "32.0.0.293";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1hd5z8qmki36k2wdwgg3v4sj32g8590r5563gdrjrk7bmrqfjnji"
+          "0lz1na68gdi9n23hfj5c731dbskm9684cwar7ji8yjfhfryfg5yn"
         else
-          "0y13bxdgkxaqsyab09skiqj8dfjw76n2lr7p525ba8lbfbc8xj52"
+          "10gm2ynndlyk66fndfbh7ah5ssqpyw8415i10n3lpw940x201dk0"
       else
         if arch == "x86_64" then
-          "0qkslkaiw3c9xk1rjcl4x9d0fi6i91k7g01mf0gq28wgzcyz4cw7"
+          "0hmlv0v9lbgxrmz0n7czfnrbrwjwxhy99gsr5g1m0aqgw0y61clc"
         else
-          "0qblmaa3nq1g7825yhvz98pvd1591q3q7bsrhv5bbhdbmb9c1qd5";
+          "0qdw4f48xhnkzdly3jz63v14nmzd0gg49az5wxb08ghs8laaqlik";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix

@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation rec {
   pname = "flashplayer-standalone";
-  version = "32.0.0.255";
+  version = "32.0.0.293";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "1igc23mljmw1bw6fwx3rwpz7kxiy8n5znkng20w3yin2zh8qw8sy"
+        "13mrknvl3yd8vrcs7mp6szz6f9ssfs72apzvc60f9qfwkhiwlg87"
       else
-        "0rfvgx1g0s8wswwpmfjx6p59yh1cxya3x3bczbissrq4rcb1v315";
+        "0isvmzyi4isxvxxc5ksplcqc5cafpvbrln3dddpms8zps2dxpyzi";
   };
 
   nativeBuildInputs = [ unzip ];
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     description = "Adobe Flash Player standalone executable";
     homepage = https://www.adobe.com/support/flashplayer/debug_downloads.html;
     license = stdenv.lib.licenses.unfree;
-    maintainers = [];
+    maintainers = with stdenv.lib.maintainers; [ taku0 ];
     platforms = [ "x86_64-linux" ];
     # Application crashed with an unhandled SIGSEGV
     # Not on all systems, though. Video driver problem?

pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh

@@ -4,7 +4,7 @@ header "fetching Apache Mesos maven repo"
 function fetchArtifact {
   repoPath="$1"
   echo "Fetching $repoPath"
-  url="http://repo.maven.apache.org/maven2/$repoPath"
+  url="https://repo.maven.apache.org/maven2/$repoPath"
   mkdir -p $(dirname $out/$repoPath)
   curl --fail --location --insecure --retry 3 --max-redirs 20 "$url" --output "$out/$repoPath"
 }

pkgs/applications/version-management/git-and-tools/git/default.nix

@@ -20,7 +20,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.19.2";
+  version = "2.19.3";
   svn = subversionClient.override { perlBindings = perlSupport; };
 in
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "1scbggzghkzzfqg4ky3qh7h9w87c3zya4ls5disz7dbx56is7sgw";
+    sha256 = "1kka8v10mq07zwrcc01q1qiib6gdaps0p8rfkkxykxfkxlzg6mq4";
   };
 
   outputs = [ "out" ] ++ stdenv.lib.optional perlSupport "gitweb";

pkgs/applications/virtualization/qemu/default.nix

@@ -87,6 +87,14 @@ stdenv.mkDerivation rec {
       name = "CVE-2019-12155.patch";
       sha256 = "0h2q71mcz3gvlrbfkqcgla74jdg73hvzcrwr4max2ckpxx8x9207";
     })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/q/qemu/1:3.1+dfsg-8+deb10u2/debian/patches/slirp-fix-heap-overflow-in-ip_reass-on-big-packet-input-CVE-2019-14378.patch";
+      sha256 = "1yf7cw4ajiy9pwjfscxyfmmbawpk3rkd046y6fd6h4zpf4cc2fn5";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/q/qemu/1:3.1+dfsg-8+deb10u2/debian/patches/qemu-bridge-helper-restrict-interface-name-to-IFNAMSIZ-CVE-2019-13164.patch";
+      sha256 = "1ypcdlpg3nap0kg9xkrgrqw33j5ah4j7l4i2cp6d5ap8vrw9nn3l";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optional pulseSupport ./fix-hda-recording.patch
     ++ optionals stdenv.hostPlatform.isMusl [

pkgs/development/haskell-modules/make-package-set.nix

@@ -132,7 +132,7 @@ let
       installPhase = ''
         export HOME="$TMP"
         mkdir -p "$out"
-        cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.system} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
+        cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.config} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
       '';
   };
 

pkgs/development/interpreters/php/default.nix

@@ -248,24 +248,24 @@ let
 
 in {
   php71 = generic {
-    version = "7.1.32";
-    sha256 = "0ymbkj8117pakcs40rkkrsrvcc2rn9nrd7ilcdzw2nn7vnns3iyp";
+    version = "7.1.33";
+    sha256 = "0jsgiwawlais8s1l38lz51h1x2ci5ildk0ksfdmkg6xpwbrfb9cm";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php71-darwin-isfinite.patch;
   };
 
   php72 = generic {
-    version = "7.2.22";
-    sha256 = "12phn0rrd5r1j6xlz83h7v6gszmj4lb5gwj927psbbc6nn1rh2n1";
+    version = "7.2.24";
+    sha256 = "00znhjcn6k4mbxz6jqlqf6bzr4cqdf8pnbmxkg6bns1hnr6r6yd0";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php72-darwin-isfinite.patch;
   };
 
   php73 = generic {
-    version = "7.3.9";
-    sha256 = "1i33v50rbqrfwjwch1d46mbpwbxrg1xfycs9mjl7xsy9m04rg753";
+    version = "7.3.11";
+    sha256 = "1rxm256vhnvyabfwmyv51sqrkjlid1g8lczcy4skc2f72d5zzlcj";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = optional stdenv.isDarwin ./php73-darwin-isfinite.patch;

pkgs/development/interpreters/python/default.nix

@@ -63,10 +63,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "5";
-      patch = "7";
+      patch = "9";
       suffix = "";
     };
-    sha256 = "1p67pnp2ca5przx2s45r8m55dcn6f5hsm0l4s1zp7mglkf4r4n18";
+    sha256 = "0jdh9pvx6m6lfz2liwvvhn7vks7qrysqgwn517fkpxb77b33fjn2";
     inherit (darwin) CF configd;
     inherit passthruFun;
   };

pkgs/development/libraries/expat/default.nix

@@ -15,12 +15,9 @@ stdenv.mkDerivation rec {
       sha256 = "1i7bq9sp2k5348dvbfv26bprzv6ka1abf0j5ixjaff9alndm4f19";
       stripLen = 1;
     })
-    (fetchpatch {
-      name = "CVE-2019-15903.patch";
-      url = "https://sources.debian.org/data/main/e/expat/2.2.7-2/debian/patches/CVE-2019-15903_Deny_internal_entities_closing_the_doctype.patch";
+    (fetchurl {
+      url = "https://raw.githubusercontent.com/vcunat/patch-mirror/master/CVE-2019-15903.patch";
       sha256 = "0lv4392ihpk71fgaf1fz03gandqkaqisal8xrzvcqnvnq4mnmwxp";
-      stripLen = 1;
-      excludes = [ "tests/runtests.c" "Changes" ];
     })
   ];
 

pkgs/development/libraries/ffmpeg/2.8.nix

@@ -1,7 +1,7 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "${branch}.14";
+  version = "${branch}.15";
   branch = "2.8";
-  sha256 = "1g6x3lyjl1zlfksizj1ys61kj97yg0xf4dlr6sr5acpbja3a26yn";
+  sha256 = "08gf493a1ici1rn6gda6bxkcsk3fqbs6pdr0phcifjkd3xn7yr1m";
 })

pkgs/development/libraries/ffmpeg/3.4.nix

@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "3.4.6";
-  sha256 = "1s20wzgxxrm56gckyb8cf1lh36hdnkdxvmmnnvdxvia4zb3grf1b";
+  branch = "3.4.7";
+  sha256 = "0hj91gjps92f4w3yyqss89yrs6s75574hbj5gz9g5affd6294yhc";
   darwinFrameworks = [ Cocoa CoreMedia ];
 })

pkgs/development/libraries/gdal/default.nix

@@ -16,6 +16,15 @@ stdenv.mkDerivation rec {
     sha256 = "09qgy36z0jc9w05373m4n0vm4j54almdzql6z9p9zr9pdp61syf3";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-17545.patch";
+      url = "https://github.com/OSGeo/gdal/commit/8cd2d2eb6327cf782a74dae263ffa6f89f46c93d.patch";
+      stripLen = 1;
+      sha256 = "06h88a659jcqf6ps1m91qy78s6s9krbkwnz28f5qh7032vlp6qpw";
+    })
+  ];
+
   buildInputs = [ unzip libjpeg libtiff libpng proj openssl sqlite
     libspatialite poppler hdf4 qhull giflib expat libxml2 ]
   ++ (with pythonPackages; [ python numpy wrapPython ])

pkgs/development/libraries/libexif/default.nix

@@ -9,21 +9,32 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-   (fetchpatch {
-     name = "CVE-2017-7544.patch";
-     url = https://sourceforge.net/p/libexif/bugs/_discuss/thread/fc394c4b/489a/attachment/xx.pat;
-     sha256 = "1qgk8hgnxr8d63jsc4vljxz9yg33mbml280dq4a6050rmk9wq4la";
-   })
+    (fetchpatch {
+      name = "CVE-2017-7544.patch";
+      url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch";
+      sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd";
+    })
+    (fetchpatch {
+      name = "CVE-2018-20030-1.patch";
+      url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch";
+      sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3";
+    })
+    (fetchpatch {
+      name = "CVE-2018-20030-2.patch";
+      url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch";
+      sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx";
+      excludes = [ "NEWS" ];
+    })
   ];
-  patchFlags = "-p0";
 
   buildInputs = [ gettext ];
 
   meta = {
-    homepage = http://libexif.sourceforge.net/;
+    homepage = https://libexif.github.io/;
     description = "A library to read and manipulate EXIF data in digital photographs";
     license = stdenv.lib.licenses.lgpl21;
     platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.erictapen ];
   };
 
 }

pkgs/development/libraries/libextractor/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, libtool, gettext, zlib, bzip2, flac, libvorbis
+{ fetchurl, fetchpatch, stdenv, libtool, gettext, zlib, bzip2, flac, libvorbis
 , exiv2, libgsf, rpm, pkgconfig
 , gtkSupport ? true, glib ? null, gtk3 ? null
 , videoSupport ? true, ffmpeg ? null, libmpeg2 ? null}:
@@ -14,6 +14,15 @@ stdenv.mkDerivation rec {
     sha256 = "1z1cb35griqzvshqdv5ck98dy0sgpsswn7fgiy7lbzi34sma8dg2";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-15531.patch";
+      url = "https://git.gnunet.org/libextractor.git/patch/?id=d2b032452241708bee68d02aa02092cfbfba951a";
+      sha256 = "01xhcjbzv6p53wz7y2ii76kb8m9iwvnm4ip9w4a0bpgaxqz4b9fw";
+      excludes = [ "ChangeLog" ];
+    })
+  ];
+
   preConfigure =
     '' echo "patching installation directory in \`extractor.c'..."
        sed -i "src/main/extractor.c" \

pkgs/development/libraries/libvncserver/default.nix

@@ -1,41 +1,43 @@
-{stdenv, fetchurl, fetchpatch,
- libtool, libjpeg, openssl, zlib, libgcrypt, autoreconfHook, pkgconfig, libpng,
- systemd
+{ stdenv, fetchzip, fetchpatch, cmake
+, libjpeg, openssl, zlib, libgcrypt, libpng
+, systemd
 }:
 
 let
   s = # Generated upstream information
   rec {
-    baseName="libvncserver";
-    version="0.9.11";
-    name="${baseName}-${version}";
-    url="https://github.com/LibVNC/libvncserver/archive/LibVNCServer-${version}.tar.gz";
-    sha256="15189n09r1pg2nqrpgxqrcvad89cdcrca9gx6qhm6akjf81n6g8r";
+    pname = "libvncserver";
+    version = "0.9.12";
+    url = "https://github.com/LibVNC/libvncserver/archive/LibVNCServer-${version}.tar.gz";
+    sha256 = "1226hb179l914919f5nm2mlf8rhaarqbf48aa649p4rwmghyx9vm"; # unpacked archive checksum
   };
 in
 stdenv.mkDerivation {
-  inherit (s) name version;
-  src = fetchurl {
+  inherit (s) pname version;
+  src = fetchzip {
     inherit (s) url sha256;
   };
   patches = [
-    # CVE-2018-7225. Remove with the next release
     (fetchpatch {
-      url = https://salsa.debian.org/debian/libvncserver/raw/master/debian/patches/CVE-2018-7225.patch;
-      sha256 = "1hj1lzxsrdmzzl061vg0ncdpvfmvvkrpk8q12mp70qvszcqa7ja3";
+      name = "CVE-2018-20750.patch";
+      url = "https://github.com/LibVNC/libvncserver/commit/09e8fc02f59f16e2583b34fe1a270c238bd9ffec.patch";
+      sha256 = "004h50786nvjl3y3yazpsi2b767vc9gqrwm1ralj3zgy47kwfhqm";
+    })
+    (fetchpatch {
+      name = "CVE-2019-15681.patch";
+      url = "https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.patch";
+      sha256 = "0hf0ss7all2m50z2kan4mck51ws44yim4ymn8p0d991y465y6l9s";
     })
   ];
-  preConfigure = ''
-    sed -e 's@/usr/include/linux@${stdenv.cc.libc}/include/linux@g' -i configure
-  '';
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ cmake ];
   buildInputs = [
-    libtool libjpeg openssl libgcrypt libpng
+    libjpeg openssl libgcrypt libpng
   ] ++ stdenv.lib.optional stdenv.isLinux systemd;
   propagatedBuildInputs = [ zlib ];
   meta = {
     inherit (s) version;
-    description =  "VNC server library";
+    description = "VNC server library";
+    homepage = "https://libvnc.github.io/";
     license = stdenv.lib.licenses.gpl2Plus ;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.unix;

pkgs/development/libraries/mbedtls/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   name = "mbedtls-${version}";
-  version = "2.15.1";
+  version = "2.16.3";
 
   src = fetchFromGitHub {
     owner = "ARMmbed";
     repo = "mbedtls";
     rev = name;
-    sha256 = "0w6cm2f7d43wp8cx6r5h4icq8zcix1jnvivshypir1rbk1q83gx8";
+    sha256 = "1mzh92yyz93099a1gb2wvwc76jv12d1k1wg9k3dimbgczxgrkirc";
   };
 
   nativeBuildInputs = [ cmake ninja perl python ];

pkgs/development/libraries/opencv/3.x.nix

@@ -35,20 +35,20 @@
 }:
 
 let
-  version = "3.4.5";
+  version = "3.4.8";
 
   src = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv";
     rev    = version;
-    sha256 = "0hz9316ys2qi0lx9dcbsk3mkn8cn08q12hc96p6zz2d4is6d5wsc";
+    sha256 = "1dnz3gfj70lm1gbrk8pz28apinlqi2x6nvd6xcy5hs08505nqnjp";
   };
 
   contribSrc = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv_contrib";
     rev    = version;
-    sha256 = "1fw7qwgibiznqal2dg4alkw8hrrrpjc0jaicf2406604rjm2lx6h";
+    sha256 = "0psaa1yx36n34l09zd1y8jxgf8q4jzxd3vn06fqmzwzy85hcqn8i";
   };
 
   # Contrib must be built in order to enable Tesseract support:

pkgs/development/libraries/opencv/4.x.nix

@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchurl, fetchFromGitHub
+, fetchurl, fetchFromGitHub, fetchpatch
 , cmake, pkgconfig, unzip, zlib, pcre, hdf5
 , glog, boost, google-gflags, protobuf
 , config
@@ -160,6 +160,24 @@ stdenv.mkDerivation rec {
     cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-14491.CVE-2019-14492.patch";
+      url = "https://github.com/opencv/opencv/pull/15150/commits/321c74ccd6077bdea1d47450ca4fe955cb5b6330.patch";
+      sha256 = "03nxq24wsyszpl24i9fz3k06np75g9p4pqgnn1iw0nqdn7qds8pm";
+    })
+    (fetchpatch {
+      name = "CVE-2019-14493.patch";
+      url = "https://github.com/opencv/opencv/pull/15145/commits/5691d998ead1d9b0542bcfced36c2dceb3a59023.patch";
+      sha256 = "14qva9f5z10apz5q0skdyiclr9sgkhab4fzksy1w3b6j6hg4wm7m";
+    })
+    (fetchpatch {
+      name = "CVE-2019-15939.patch";
+      url = "https://github.com/opencv/opencv/pull/15382/commits/5a497077f109d543ab86dfdf8add1c76c0e47d29.patch";
+      sha256 = "18wqsss5zz3f6i1ih8gd17h2zrrqpgfd7jmc45v70gk30nmhcj5b";
+    })
+  ];
+
   # This prevents cmake from using libraries in impure paths (which
   # causes build failure on non NixOS)
   # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with

pkgs/development/python-modules/koji/default.nix

@@ -1,19 +1,19 @@
-{ stdenv, fetchurl, buildPythonPackage, pycurl, six, rpm, dateutil }:
+{ stdenv, fetchurl, buildPythonPackage, isPy3k, pycurl, six, rpm, dateutil }:
 
 buildPythonPackage rec {
   pname = "koji";
-  version = "1.13.0";
+  version = "1.14.3";
   format = "other";
 
   src = fetchurl {
     url = "https://releases.pagure.org/koji/${pname}-${version}.tar.bz2";
-    sha256 = "18b18rcbdqqw33g7h20hf5bpbci2ixdi05yda1fvpv30c1kkzd8w";
+    sha256 = "0a3kn3qvspvx15imgzzzjsbvw6bqmbk29apbliqwifa9cj7pvb40";
   };
 
   propagatedBuildInputs = [ pycurl six rpm dateutil ];
 
   # Judging from SyntaxError
-  #disabled = isPy3k;
+  disabled = isPy3k;
 
   makeFlags = "DESTDIR=$(out)";
 
@@ -24,7 +24,9 @@ buildPythonPackage rec {
   '';
 
   meta = {
-    maintainers = [ ];
+    description = "An RPM-based build system";
+    homepage = https://pagure.io/koji;
+    license = stdenv.lib.licenses.lgpl21;
     platforms = stdenv.lib.platforms.unix;
   };
 }

pkgs/development/ruby-modules/bundler/default.nix

@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "1.17.2";
-  source.sha256 = "0dbnq6703mjvgsri45vaw7b4wjqr89z1h8xkzsacqcp24a706m5r";
+  version = "1.17.3";
+  source.sha256 = "0ln3gnk7cls81gwsbxvrmlidsfd78s6b2hzlm4d4a9wbaidzfjxw";
   dontPatchShebangs = true;
 
   postFixup = ''

pkgs/development/tools/fedpkg/default.nix

@@ -31,5 +31,6 @@ in buildPythonApplication rec {
     homepage = https://pagure.io/fedpkg;
     license = licenses.gpl2;
     maintainers = with maintainers; [ ];
+    broken = true;
   };
 }

pkgs/misc/ghostscript/9.26-CVE-2019-10216.patch

@@ -0,0 +1,36 @@
+Based on upstream commit 5b85ddd19a8420a1bd2d5529325be35d78e94234
+--- a/Resource/Init/gs_type1.ps
++++ b/Resource/Init/gs_type1.ps
+@@ -118,25 +118,25 @@
+                          ( to be the same as glyph: ) print 1 index //== exec } if
+                    3 index exch 3 index //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
+                                                                  % scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
+-                 }
++                 }executeonly
+                  {pop} ifelse
+-               } forall
++               } executeonly forall
+                pop pop
+-             }
++             } executeonly
+              {
+                pop pop pop
+              } ifelse
+-           }
++           } executeonly
+            {
+                                                                % scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
+              pop pop
+            } ifelse
+-         } forall
++         } executeonly forall
+          3 1 roll pop pop
+-     } if
++     } executeonly if
+      pop
+      dup /.AGLprocessed~GS //true //.growput systemdict /superexec known {//superexec}{1183615869 internaldict /superexec get exec} ifelse
+-   } if
++   } executeonly if
+ 
+    %% We need to excute the C .buildfont1 in a stopped context so that, if there
+    %% are errors we can put the stack back sanely and exit. Otherwise callers won't

pkgs/misc/ghostscript/default.nix

@@ -51,6 +51,30 @@ stdenv.mkDerivation rec {
       url = "http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=d3537a54740d78c5895ec83694a07b3e4f616f61";
       sha256 = "1hr8bpi87bbg1kvv28kflmfh1dhzxw66p9q0ddvbrj72qd86p3kx";
     })
+    (fetchpatch {
+      name = "CVE-2019-3839-part-1";
+      url = "http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9";
+      sha256 = "0gn1n9fq5msrxxzspidcnmykp1iv3yvx5485fddmgrslr52ngcf9";
+    })
+    (fetchpatch {
+      name = "CVE-2019-3839-part-2";
+      url = "http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=db24f253409d5d085c2760c814c3e1d3fa2dac59";
+      sha256 = "1h6kpwc6ryr6jlxjr6bfnvmmf8x0kqmyjlx3hggqjs23n0wsr9p9";
+    })
+    ./9.26-CVE-2019-10216.patch
+    (fetchpatch {
+        name = "CVE-2019-14811.CVE-2019-14812.CVE-2019-14813.patch";
+        url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33";
+        sha256 = "19928sr7xpx7iibk9gn127g0r1yv2lcfpwgk2ipzz4wgrs3f5j70";
+    })
+    (fetchpatch {
+        name = "CVE-2019-14817-partial.patch";
+        url = "https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19";
+        # patch doesn't apply cleanly to all files, but at least partially applying it fixes
+        # *some* of the problematic sites.
+        excludes = ["Resource/Init/pdf_font.ps" "Resource/Init/pdf_draw.ps"];
+        sha256 = "04sy05svm3d2hyyzq41x5aqg3cgg2shaq08ivdqsys95nlihccpn";
+    })
   ];
 
   outputs = [ "out" "man" "doc" ];

pkgs/os-specific/linux/dpdk/default.nix

@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "dpdk-${version}" + lib.optionalString mod "-${kernel.version}";
-  version = "17.11.2";
+  version = "17.11.9";
 
   src = fetchurl {
     url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-    sha256 = "19m5l3jkrns8r1zbjb6ry18w50ff36kbl5b5g6pfcp9p57sfisd2";
+    sha256 = "0vrcc9mdjs5fk69lh7bigsk9208dfmjsz3jxaddkjlvk2hds1id6";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix

@@ -2,7 +2,7 @@
 
 let
 
-  version = "1.43_4";
+  version = "1.43_5";
 
 
   # Updated according to https://github.com/patjak/bcwc_pcie/pull/81/files
@@ -10,8 +10,8 @@ let
   # and https://github.com/patjak/bcwc_pcie/blob/5a7083bd98b38ef3bd223f7ee531d58f4fb0fe7c/firmware/extract-firmware.sh
 
   # From the Makefile:
-  dmgUrl = "https://support.apple.com/downloads/DL1877/en_US/osxupd10.11.5.dmg";
-  dmgRange = "205261917-208085450"; # the whole download is 1.3GB, this cuts it down to 2MB
+  dmgUrl = "https://updates.cdn-apple.com/2019/cert/041-88431-20191011-e7ee7d98-2878-4cd9-bc0a-d98b3a1e24b1/OSXUpd10.11.5.dmg";
+  dmgRange = "204909802-207733123"; # the whole download is 1.3GB, this cuts it down to 2MB
   # Notes:
   # 1. Be sure to update the sha256 below in the fetch_url
   # 2. Be sure to update the homepage in the meta
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   name = "facetimehd-firmware-${version}";
   src = fetchurl {
     url = dmgUrl;
-    sha256 = "0xqkl4yds0n9fdjvnk0v5mj382q02crry6wm2q7j3ncdqwsv02sv";
+    sha256 = "0s8crlh8rvpanzk1w4z3hich0a3mw0m5xhpcg07bxy02calhpdk1";
     curlOpts = "-r ${dmgRange}";
   };
 
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "facetimehd firmware";
-    homepage = https://support.apple.com/downloads/DL1877;
+    homepage = https://support.apple.com/kb/DL1877;
     license = licenses.unfree;
     maintainers = with maintainers; [ womfoo grahamc ];
     platforms = [ "i686-linux" "x86_64-linux" ];

pkgs/os-specific/linux/kernel/linux-4.14.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.149";
+  version = "4.14.150";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15pjngy3j5vnisv462ll7wsg78qv7q2cz86da0bcwh446v9ap7g6";
+    sha256 = "1c2pxfvv31af0mzcqnbfjk8pc0wrhg4yhspl8a3ab2w5dfwa9ib5";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.79";
+  version = "4.19.80";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0d2bcg0krahia2ylgqaxdppyr9idq2pi6y1si6h8n9sg6rj3a57i";
+    sha256 = "1v776s6q5wxn8ci86dwa8s8y41b94g09fnpgvzysg2h89rvbmac0";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.4.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.196";
+  version = "4.4.197";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0vd7fra22ky4sqp6vamracp5xd4900md5vdx0n4i6dhkf03kz7hn";
+    sha256 = "0ypfl1q1bdbk81hk0bm8a0grqzz4z5rp7z7asa3191ji3r8q9x4w";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.9.nix

@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.196";
+  version = "4.9.197";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1vy6j9ycl5aw0dmj4n9kih5i8igybk0ilahlwbn30mlp9aq15az0";
+    sha256 = "032as6g4xvqjarqhvx7mr14yhn6idak4g0ps1skmsl4dfav6hdam";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/ledger-udev-rules/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ledger-udev-rules";
-  version = "unstable-2019-02-13";
+  version = "unstable-2019-05-30";
 
   src = fetchFromGitHub {
     owner = "LedgerHQ";
     repo = "udev-rules";
-    rev = "20cc1651eb551c4855aaa56628c77eaeb3031c22";
-    sha256 = "0riydkc4in10pv4qlrvbg3w78qsvxly5caa3zwyqcmsm5fmprqky";
+    rev = "765b7fdf57b20fd9326cedf48ee52e905024ab4f";
+    sha256 = "10a42al020zpkx918y6b1l9az45vk3921b2l1mx87w3m0ad9qvif";
   };
 
   dontBuild = true;

pkgs/os-specific/linux/wpa_supplicant/default.nix

@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "15ixzm347n8w6gdvi3j3yks3i15qmp6by9ayvswm34d929m372d6";
   };
 
+  patches = [
+    (fetchurl {
+      name = "CVE-2019-16275.patch";
+      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
+      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
+    })
+  ];
+
   # TODO: Patch epoll so that the dbus actually responds
   # TODO: Figure out how to get privsep working, currently getting SIGBUS
   extraConfig = ''

pkgs/servers/computing/slurm/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, libtool, curl
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, libtool, curl
 , python, munge, perl, pam, openssl, zlib
 , ncurses, mysql, gtk2, lua, hwloc, numactl
 , readline, freeipmi, libssh2, xorg, lz4
@@ -22,6 +22,21 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-12838-prerequisite-1.patch";
+      url = "https://github.com/SchedMD/slurm/commit/e8567e06be57190825bff737e5523c307da51530.patch";
+      sha256 = "1sxllghnc8j5sh4md1lv3hdj3h3xag3ylqv3v00nhxfximgc74d6";
+      excludes = [ "NEWS" ];
+    })
+    (fetchpatch {
+      name = "CVE-2019-12838.patch";
+      url = "https://github.com/SchedMD/slurm/commit/afa7d743f407c60a7c8a4bd98a10be32c82988b5.patch";
+      sha256 = "017zskjr2yyphij61zws391znghmnh7r7zr21kjngqaixpjaark9";
+      excludes = [ "NEWS" ];
+    })
+  ];
+
   prePatch = stdenv.lib.optional enableX11 ''
     substituteInPlace src/common/x11_util.c \
         --replace '"/usr/bin/xauth"' '"${xorg.xauth}/bin/xauth"'

pkgs/servers/mqtt/mosquitto/default.nix

@@ -7,13 +7,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "mosquitto-${version}";
-  version = "1.5.8";
+  version = "1.5.9";
 
   src = fetchFromGitHub {
     owner  = "eclipse";
     repo   = "mosquitto";
     rev    = "v${version}";
-    sha256 = "1rf8g6fq7g1mhwsajsgvvlynasybgc51v0qg5j6ynsxfh8yi7s6r";
+    sha256 = "0yrmivvqfzr9nl5cchlrxjpl1l3b0dqanx8gx1hd1vvnymlaipay";
   };
 
   postPatch = ''

pkgs/servers/samba/4.x.nix

@@ -37,6 +37,50 @@ stdenv.mkDerivation rec {
         url = "https://patch-diff.githubusercontent.com/raw/samba-team/samba/pull/107.patch";
         sha256 = "0r6q34vjj0bdzmcbnrkad9rww58k4krbwicv4gs1g3dj49skpvd6";
       })
+      # note the following is a patch against the 4.8 branch, but luckily it applies
+      # and works against 4.7
+      (fetchpatch {
+        name = "4.8-CVE-2019-3880.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/9a3ee861e43f84d48ef47998ceeb3bbf29f0c948.patch";
+        sha256 = "12822dpdar7jp65r86ppd2f0az414azzvaslb04ngbcz62zwskfw";
+      })
+      # and the following are all patches against the 4.9 branch, but luckily they all apply
+      # and work against 4.7 too
+      (fetchpatch {
+        name = "4.9-CVE-2019-10218.part1.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/fc6022b9b19473076c4236fdf4ac474f44ca73e2.patch";
+        sha256 = "1y6cax6rhrwqnqhyh764sdc19vask3v3abrk7vnvyb24rc52q4v9";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-10218.part2.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/167f78aa97af6502cb2027dc9dad40399b0a9c4f.patch";
+        sha256 = "1ncib6j4nrybzdq1bg02va7yh98s2faplfngwg3d0mkd4l1lr1wc";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-14833.part1.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/e6de467a763b93152eef27726957a32879268fb7.patch";
+        sha256 = "13s6n4kb9m8vp1cn3kvldnqdirxmk3lm0klr0kjd81n762gmc0r3";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-14833.part2.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/70078d4ddf3b842eeadee058dadeef82ec4edf0b.patch";
+        sha256 = "0z80x6qycip28lp0x0xdbj0a0f2s1cjzl1ry4ds3wr4hi9v9dqps";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-14847.part1.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/ea39bdd6293041af668f1bfdfea39a725733bad3.patch";
+        sha256 = "1rrdz6a649is3mqx3syzlq769f08yavr2hjnd626hkxxxbvhsysc";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-14847.part2.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/bdb3e3f669bd991da819040e726e003e4e2b841d.patch";
+        sha256 = "12mjby9vzp29s93q2wk73kalpr345gx813lhmvgkalbn6186w5f7";
+      })
+      (fetchpatch {
+        name = "4.9-CVE-2019-14847.part3.patch";
+        url = "https://gitlab.com/samba-team/samba/commit/77b10b360f4ffb7ac90bc5fce0a80306515c1aca.patch";
+        sha256 = "0mclx3zdb2l8w4p1iyak6d82dpnyksp3ixj5syck6v0f10nkniz8";
+      })
     ];
 
   buildInputs =

pkgs/servers/varnish/default.nix

@@ -1,9 +1,10 @@
-{ stdenv, fetchurl, pcre, libxslt, groff, ncurses, pkgconfig, readline, libedit
+{ stdenv, fetchurl, fetchpatch, pcre, libxslt, groff, ncurses, pkgconfig, readline, libedit
 , python2, makeWrapper }:
 
 let
-  common = { version, sha256, extraBuildInputs ? [] }:
+  common = { version, sha256, extraBuildInputs ? [], patches ? null }:
     stdenv.mkDerivation rec {
+      inherit patches;
       name = "varnish-${version}";
 
       src = fetchurl {
@@ -50,5 +51,11 @@ in
     version = "6.1.1";
     sha256 = "0gf9hzzrr1lndbbqi8cwlfasi7l517cy3nbgna88i78lm247rvp0";
     extraBuildInputs = [ python2.pkgs.sphinx ];
+    patches = [
+      (fetchpatch {
+        url = "https://sources.debian.org/data/main/v/varnish/6.1.1-1+deb10u1/debian/patches/CVE-2019-15892.patch";
+        sha256 = "03jlflgry4j9f34kxni64j6583jqr828zgy68ywdmglpxkgpyma7";
+      })
+    ];
   };
 }

pkgs/shells/zsh/zsh-history-substring-search/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zsh-history-substring-search-${version}";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "zsh-users";
     repo = "zsh-history-substring-search";
     rev = "v${version}";
-    sha256 = "0lgmq1xcccnz5cf7vl0r0qj351hwclx9p80cl0qczxry4r2g5qaz";
+    sha256 = "0y8va5kc2ram38hbk2cibkk64ffrabfv1sh4xm7pjspsba9n5p1y";
   };
 
   installPhase = ''

pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15678.patch

@@ -0,0 +1,18 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
+diff --git a/vncviewer/rfbproto.c b/vncviewer/rfbproto.c
+index 04b0230..47a6863 100644
+--- a/vncviewer/rfbproto.c
++++ b/vncviewer/rfbproto.c
+@@ -1217,6 +1217,12 @@ HandleRFBServerMessage()
+     if (serverCutText)
+       free(serverCutText);
+ 
++    if (msg.sct.length > 1<<20) {
++      fprintf(stderr,"Ignoring too big cut text length sent by server: %u B > 1 MB\n",
++              (unsigned int)msg.sct.length);
++      return False;
++    }
++
+     serverCutText = malloc(msg.sct.length+1);
+ 
+     if (!ReadFromRFBServer(serverCutText, msg.sct.length))

pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15679.patch

@@ -0,0 +1,19 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7
+diff --git a/vncviewer/rfbproto.c b/vncviewer/rfbproto.c
+index 04b0230..bd11b54 100644
+--- a/vncviewer/rfbproto.c
++++ b/vncviewer/rfbproto.c
+@@ -303,7 +303,12 @@ InitialiseRFBConnection(void)
+   si.format.blueMax = Swap16IfLE(si.format.blueMax);
+   si.nameLength = Swap32IfLE(si.nameLength);
+ 
+-  /* FIXME: Check arguments to malloc() calls. */
++  if (si.nameLength > 1<<20) {
++    fprintf(stderr, "Too big desktop name length sent by server: %lu B > 1 MB\n",
++            (unsigned long)si.nameLength);
++    return False;
++  }
++
+   desktopName = malloc(si.nameLength + 1);
+   if (!desktopName) {
+     fprintf(stderr, "Error allocating memory for desktop name, %lu bytes\n",

pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15680.patch

@@ -0,0 +1,16 @@
+diff --git a/vncviewer/zlib.c b/vncviewer/zlib.c
+index 80c4eee..76998d8 100644
+--- a/vncviewer/zlib.c
++++ b/vncviewer/zlib.c
+@@ -55,6 +55,11 @@ HandleZlibBPP (int rx, int ry, int rw, int rh)
+     raw_buffer_size = (( rw * rh ) * ( BPP / 8 ));
+     raw_buffer = (char*) malloc( raw_buffer_size );
+ 
++    if ( raw_buffer == NULL ) {
++      fprintf(stderr,
++              "couldn't allocate raw_buffer in HandleZlibBPP");
++      return False;
++    }
+   }
+ 
+   if (!ReadFromRFBServer((char *)&hdr, sz_rfbZlibHeader))

pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-8287.patch

@@ -0,0 +1,14 @@
+Adapted from https://github.com/LibVNC/libvncserver/commit/7b1ef0ffc4815cab9a96c7278394152bdc89dc4d
+diff --git a/vncviewer/corre.c b/vncviewer/corre.c
+index c846a10..a4c272d 100644
+--- a/vncviewer/corre.c
++++ b/vncviewer/corre.c
+@@ -56,7 +56,7 @@ HandleCoRREBPP (int rx, int ry, int rw, int rh)
+     XChangeGC(dpy, gc, GCForeground, &gcv);
+     XFillRectangle(dpy, desktopWin, gc, rx, ry, rw, rh);
+ 
+-    if (!ReadFromRFBServer(buffer, hdr.nSubrects * (4 + (BPP / 8))))
++    if (hdr.nSubrects > BUFFER_SIZE / (4 + (BPP / 8)) || !ReadFromRFBServer(buffer, hdr.nSubrects * (4 + (BPP / 8))))
+ 	return False;
+ 
+     ptr = (CARD8 *)buffer;

pkgs/tools/admin/tightvnc/default.nix

@@ -9,6 +9,13 @@ stdenv.mkDerivation {
     sha256 = "f48c70fea08d03744ae18df6b1499976362f16934eda3275cead87baad585c0d";
   };
 
+  patches = [
+    ./1.3.10-CVE-2019-15678.patch
+    ./1.3.10-CVE-2019-15679.patch
+    ./1.3.10-CVE-2019-15680.patch
+    ./1.3.10-CVE-2019-8287.patch
+  ];
+
   # for the builder script
   inherit fontDirectories;
 

pkgs/tools/graphics/jhead/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libjpeg }:
+{ stdenv, fetchurl, fetchpatch, libjpeg }:
 
 stdenv.mkDerivation rec {
   name = "jhead-${version}";
@@ -9,6 +9,19 @@ stdenv.mkDerivation rec {
     sha256 = "1hn0yqcicq3qa20h1g313l1a671r8mccpb9gz0w1056r500lw6c2";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2019-1010301.patch";
+      url = "https://sources.debian.org/data/main/j/jhead/1:3.03-3/debian/patches/36_CVE-2019-1010301";
+      sha256 = "1vvrg50z5y7sjhfi973wh1q1v79sqp7hk5d4z0dlnx3fqgkjrx7q";
+    })
+    (fetchpatch {
+      name = "CVE-2019-1010302.patch";
+      url = "https://sources.debian.org/data/main/j/jhead/1:3.03-3/debian/patches/37_CVE-2019-1010302";
+      sha256 = "1h11mpsi7hpwbi8kpnkjwn6zpqf88f132h0rsg8sggcs3vva2x8y";
+    })
+  ];
+
   buildInputs = [ libjpeg ];
 
   patchPhase = ''

pkgs/tools/misc/file/default.nix

@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
   patches = [
     (fetchpatch {
       name = "CVE-2019-18218.patch";
-      url = "https://sources.debian.org/data/main/f/file/1:5.37-6/debian/patches/cherry-pick.FILE5_37-67-g46a8443f.limit-the-number-of-elements-in-a-vector-found-by-oss-fuzz.patch";
+      urls = [
+        "https://src.fedoraproject.org/rpms/file/raw/f6dd8461/f/file-5.37-CVE-2019-18218.patch"
+        "https://git.in-ulm.de/cbiedl/file/raw/054940e842528dca434a92820f9abb89adce0574/debian/patches/cherry-pick.FILE5_37-67-g46a8443f.limit-the-number-of-elements-in-a-vector-found-by-oss-fuzz.patch"
+        "https://sources.debian.org/data/main/f/file/1:5.35-4+deb10u1/debian/patches/cherry-pick.FILE5_37-67-g46a8443f.limit-the-number-of-elements-in-a-vector-found-by-oss-fuzz.patch"
+      ];
       sha256 = "1i22y91yndc3n2p2ngczp1lwil8l05sp8ciicil74xrc5f91y6mj";
     })
   ];

pkgs/tools/networking/keepalived/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, libnfnetlink, libnl, net_snmp, openssl, pkgconfig }:
+{ stdenv, fetchFromGitHub, fetchpatch, libnfnetlink, libnl, net_snmp, openssl, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "keepalived-${version}";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "154yxs6kwpi9yc4pa45ba3z3bfwzgmmmja5nk3d9mxq6w6s1swcy";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-19115.patch";
+      url = "https://github.com/acassen/keepalived/pull/961/commits/f28015671a4b04785859d1b4b1327b367b6a10e9.patch";
+      sha256 = "1jnwk7x4qdgv7fb4jzw6sihv62n8wv04myhgwm2vxn8nfkcgd1mm";
+    })
+  ];
+
   buildInputs = [
     libnfnetlink
     libnl

pkgs/tools/package-management/disnix/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, glib, libxml2, libxslt, getopt, nixUnstable, dysnomia, libintl, libiconv }:
 
 stdenv.mkDerivation {
-  name = "disnix-0.9";
+  name = "disnix-0.9.1";
 
   src = fetchurl {
-    url = https://github.com/svanderburg/disnix/releases/download/disnix-0.9/disnix-0.9.tar.gz;
-    sha256 = "1kc4520zjc1z72mknylfvrsyda9rbmm5c9mw8w13zhdwg3zbna06";
+    url = https://github.com/svanderburg/disnix/releases/download/disnix-0.9.1/disnix-0.9.1.tar.gz;
+    sha256 = "0bidln5xw3raqkvdks9aipis8aaza8asgyapmilnxkkrxgmw7rdf";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/tools/security/sudo/default.nix

@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.27";
+  name = "sudo-1.8.28";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "1h1f7v9pv0rzp14cxzv8kaa8mdd717fbqv83l7c5dvvi8jwnisvv";
+    sha256 = "188k3w67aflbmi4b5z23pxrvzfcfndi22b84w86gzjh8b9sglaci";
   };
 
   prePatch = ''

pkgs/top-level/perl-packages.nix

@@ -12545,7 +12545,8 @@ let
       sha256 = "5010e1b7df1115cbd475f46587fc05fefc97301f9bba0c2f15106005ca017507";
     };
     nativeBuildInputs = [ pkgs.docbook_xsl pkgs.docbook_xsl pkgs.docbook_xsl_ns ];
-    propagatedBuildInputs = [ TextWrapI18N LocaleGettext TermReadKey SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
+    propagatedBuildInputs = [ TextWrapI18N LocaleGettext SGMLSpm ModuleBuild UnicodeLineBreak ModuleBuild ];
+    # TermReadKey was removed from propagatedBuildInputs to unfreeze the build
     buildInputs = [ pkgs.gettext pkgs.libxslt pkgs.glibcLocales pkgs.docbook_xml_dtd_412 pkgs.docbook_sgml_dtd_41 pkgs.texlive.combined.scheme-basic pkgs.jade ];
     LC_ALL="en_US.UTF-8";
     SGML_CATALOG_FILES = "${pkgs.docbook_xml_dtd_412}/xml/dtd/docbook/catalog.xml";