From 0fa9f29a5100f19a8494521659a1fa3baaa7fd0e Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Wed, 4 Dec 2019 22:18:43 +0100 Subject: gnu: libjpeg-turbo: Fix CVE-2019-13960 and CVE-2019-2201. * gnu/packages/patches/libjpeg-turbo-CVE-2019-2201.patch: New file. * gnu/local.mk (dist_patch_DATA): Adjust accordingly. * gnu/packages/image.scm (libjpeg-turbo/fixed): New variable. (libjpeg-turbo)[replacement]: New field. --- gnu/packages/image.scm | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'gnu/packages/image.scm') diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 731a1e8aed..71bd381cef 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -19,7 +19,7 @@ ;;; Copyright © 2018 Joshua Sierles, Nextjournal ;;; Copyright © 2018 Fis Trivial ;;; Copyright © 2018 Pierre Neidhardt -;;; Copyright © 2018 Marius Bakke +;;; Copyright © 2018, 2019 Marius Bakke ;;; Copyright © 2018 Pierre-Antoine Rouby ;;; Copyright © 2018 Alex Vong ;;; Copyright © 2018 Rutger Helling @@ -1489,6 +1489,7 @@ is hereby granted.")))) (package (name "libjpeg-turbo") (version "2.0.2") + (replacement libjpeg-turbo/fixed) (source (origin (method url-fetch) (uri (string-append "mirror://sourceforge/libjpeg-turbo/" @@ -1518,6 +1519,20 @@ and decompress to 32-bit and big-endian pixel buffers (RGBX, XBGR, etc.).") license:ijg ;the libjpeg library and associated tools license:zlib)))) ;the libjpeg-turbo SIMD extensions +;; Replacement package to fix CVE-2019-13960 and CVE-2019-2201. +(define libjpeg-turbo/fixed + (package + (inherit libjpeg-turbo) + (version "2.0.3") + (source (origin + (method url-fetch) + (uri (string-append "mirror://sourceforge/libjpeg-turbo/" + version "/libjpeg-turbo-" version ".tar.gz")) + (sha256 + (base32 + "1ds16bnj17v6hzd43w8pzijz3imd9am4hw75ir0fxm240m8dwij2")) + (patches (search-patches "libjpeg-turbo-CVE-2019-2201.patch")))))) + (define-public niftilib (package (name "niftilib") -- cgit v1.2.3