unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
* [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024
@ 2016-04-21  3:19 Leo Famulari
  2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Leo Famulari @ 2016-04-21  3:19 UTC (permalink / raw)
  To: guix-devel

This applies from a patch from imlib2's source code repository.

The change fixes an integer overflow on 32-bit machines. The upstream
says:

Security implications:
*) for 32-bit machines: insufficient heap allocation and heap overwrite
in many image loaders, with escalation potential to remote code
execution;
*) for 64-bit machines: it seems, no impact.

In the patch file, there are references to imlib2's source repo and the
CVE page on Mitre.

I tested that feh and scrot still work with this change.

Leo Famulari (2):
  gnu: imlib2: Update to 1.4.8.
  gnu: imlib2: Fix CVE-2016-4024.

 gnu-system.am                                   |  1 +
 gnu/packages/image.scm                          |  5 ++-
 gnu/packages/patches/imlib2-CVE-2016-4024.patch | 52 +++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 2 deletions(-)
 create mode 100644 gnu/packages/patches/imlib2-CVE-2016-4024.patch

-- 
2.7.4

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2016-04-23  4:01 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-21  3:19 [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Leo Famulari
2016-04-21  3:19 ` [PATCH 1/2] gnu: imlib2: Update to 1.4.8 Leo Famulari
2016-04-21  3:19 ` [PATCH 2/2] gnu: imlib2: Fix CVE-2016-4024 Leo Famulari
2016-04-23  3:20 ` [PATCH 0/2] Update imlib2 and patch against CVE-2016-4024 Mark H Weaver
2016-04-23  4:01   ` Leo Famulari

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).