On Fri, Mar 03, 2017 at 02:04:11PM +0800, Alex Vong wrote:
> Leo Famulari <leo@famulari.name> writes:
> 
> > On Thu, Mar 02, 2017 at 09:15:29PM +0800, Alex Vong wrote:
> >> This patch (applied to core-updates) fixes the two CVEs disclosed recently.
> >
> > Can you send a patch for the master branch instead? The patches should
> > be applied to mupdf/fixed in (gnu packages pdf).
> 
> Sure, here it is:
> 

> From 24ceef58b2ebb70d45c01e7e1bc43cc2056f8705 Mon Sep 17 00:00:00 2001
> From: Alex Vong <alexvong1995@gmail.com>
> Date: Thu, 2 Mar 2017 19:59:05 +0800
> Subject: [PATCH] gnu: mupdf: Fix CVE-2017-{5896,5991}.
> 
> * gnu/packages/patches/mupdf-CVE-2017-5896.patch,
> gnu/packages/patches/mupdf-CVE-2017-5991.patch: New files.
> * gnu/packages/pdf.scm (mupdf/fixed)[source]: Add patches.
> * gnu/local.mk (dist_patch_DATA): Add them.

Thanks, pushed!