From 484f7a886219ed6d7633c6ee71fc802d677d14ed Mon Sep 17 00:00:00 2001 From: Kei Kebreau Date: Sat, 6 May 2017 10:45:57 -0400 Subject: gnu: libtiff: Add fixes several security flaws. Fixes CVE-2017-{7593, 7594, 7595, 7596, 7597, 7598, 7599, 7600, 7601, 7602}. * gnu/packages/patches/libtiff-CVE-2017-7593.patch, gnu/packages/patches/libtiff-CVE-2017-7594.patch, gnu/packages/patches/libtiff-multiple-UBSAN-crashes.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/image.scm (libtiff)[replacement]: New field. (libtiff/fixed): New variable. --- gnu/packages/image.scm | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'gnu/packages/image.scm') diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 2027395ca6..1a1108563d 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -13,7 +13,7 @@ ;;; Copyright © 2016 Tobias Geerinckx-Rice ;;; Copyright © 2016 Eric Bavier ;;; Copyright © 2016 Arun Isaac -;;; Copyright © 2016 Kei Kebreau +;;; Copyright © 2016, 2017 Kei Kebreau ;;; Copyright © 2017 ng0 ;;; ;;; This file is part of GNU Guix. @@ -299,6 +299,7 @@ extracting icontainer icon files.") (define-public libtiff (package (name "libtiff") + (replacement libtiff/fixed) (version "4.0.7") (source (origin (method url-fetch) @@ -347,6 +348,19 @@ collection of tools for doing simple manipulations of TIFF images.") "See COPYRIGHT in the distribution.")) (home-page "http://www.simplesystems.org/libtiff/"))) +(define libtiff/fixed + (package + (inherit libtiff) + (source + (origin + (inherit (package-source libtiff)) + (patches + (append + (origin-patches (package-source libtiff)) + (search-patches "libtiff-CVE-2017-7593.patch" + "libtiff-CVE-2017-7594.patch" + "libtiff-multiple-UBSAN-crashes.patch"))))))) + (define-public libwmf (package (name "libwmf") -- cgit v1.2.3