nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnu: lcms: Mention CVE-2016-10165. 

* gnu/packages/patches/lcms-fix-out-of-bounds-read.patch: Rename to ...
* gnu/packages/patches/lcms-CVE-2016-10165.patch: ... this.
* gnu/local.mk (dist_patch_DATA): Adjust.
* gnu/packages/ghostscript.scm (lcms)[source]: Use renamed patch.

Signed-off-by: Marius Bakke <mbakke@fastmail.com>
This commit is contained in:
Alex Vong 2017-02-11 22:58:19 +08:00 committed by Marius Bakke
parent e4f43bc517
commit ed7732bc62
No known key found for this signature in database
GPG Key ID: A2A06DF2A33A54FA
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
gnu/local.mk
View File

@ -9,6 +9,7 @@
# Copyright © 2016 Adonay "adfeno" Felipe Nogueira <https://libreplanet.org/wiki/User:Adfeno> <adfeno@openmailbox.org>
# Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
# Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
# Copyright © 2016, 2017 Alex Vong <alexvong1995@gmail.com>
#
# This file is part of GNU Guix.
#
@ -656,7 +657,7 @@ dist_patch_DATA = \
%D%/packages/patches/kobodeluxe-midicon-segmentation-fault.patch \
%D%/packages/patches/kobodeluxe-graphics-window-signed-char.patch \
%D%/packages/patches/laby-make-install.patch \
%D%/packages/patches/lcms-fix-out-of-bounds-read.patch \
%D%/packages/patches/lcms-CVE-2016-10165.patch \
%D%/packages/patches/ldc-disable-tests.patch \
%D%/packages/patches/ldc-1.1.0-disable-dmd-tests.patch \
%D%/packages/patches/ldc-1.1.0-disable-phobos-tests.patch \

2
gnu/packages/ghostscript.scm
View File

@ -45,7 +45,7 @@
(method url-fetch)
(uri (string-append "mirror://sourceforge/lcms/lcms/" version
"/lcms2-" version ".tar.gz"))
(patches (search-patches "lcms-fix-out-of-bounds-read.patch"))
(patches (search-patches "lcms-CVE-2016-10165.patch"))
(sha256 (base32
"08pvl289g0mbznzx5l6ibhaldsgx41kwvdn2c974ga9fkli2pl36"))))
(build-system gnu-build-system)

4
gnu/packages/patches/lcms-fix-out-of-bounds-read.patch → gnu/packages/patches/lcms-CVE-2016-10165.patch
View File

@ -1,7 +1,9 @@
Fix an out-of-bounds heap read in Type_MLU_Read():
Fix CVE-2016-10165, an out-of-bounds heap read in Type_MLU_Read():
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10165
http://seclists.org/oss-sec/2016/q3/288
https://bugzilla.redhat.com/show_bug.cgi?id=1367357
https://security-tracker.debian.org/tracker/CVE-2016-10165
Patch copied from upstream source repository: