[PATCH 0/1] libpng security update (CVE-2015-8126)

[PATCH 0/1] libpng security update (CVE-2015-8126)

[Leo Famulari]

These buffer overflows in libpng were announced today:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126

This patch updates libpng to 1.5.24, which is claimed to be free of the bugs.

Leo Famulari (1):
  gnu: libpng: Add fixes for CVE-2015-8126.

 gnu/packages/image.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.6.2

[PATCH 1/1] gnu: libpng: Add fixes for CVE-2015-8126.

[Leo Famulari]

* gnu/packages/image.scm (libpng): Update to version 1.5.24
---
 gnu/packages/image.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index bde327c..c02b75d 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -49,7 +49,7 @@
 (define-public libpng
   (package
    (name "libpng")
-   (version "1.5.21")
+   (version "1.5.24")
    (source (origin
             (method url-fetch)
 
@@ -60,7 +60,7 @@
                         "ftp://ftp.simplesystems.org/pub/libpng/png/src"
                         "/libpng15/libpng-" version ".tar.xz")))
             (sha256
-             (base32 "19yvzw6sf9gf7v25ha9bla8bw1nijh82wj8ag6brjj3hpij1q5dm"))))
+             (base32 "1qhvfk1ypsaf6q6xkspyqqzmghpbahhq54ms8fa5ssqkyds38bmr"))))
    (build-system gnu-build-system)
 
    ;; libpng.la says "-lz", so propagate it.
-- 
2.6.2

Re: [PATCH 0/1] libpng security update (CVE-2015-8126)

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> These buffer overflows in libpng were announced today:
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126
>
> This patch updates libpng to 1.5.24, which is claimed to be free of the bugs.

In commit 1b076e6 on ‘master’, I made 1.5.24 a replacement for the
current libpng (info "(guix) Security Updates"), and in ‘tk-update’, I
upgraded libpng for good; we’ll starting building that branch hopefully
very soon.

Thanks for the heads-up!

Ludo’.

Grafting limitation

[Ludovic Courtès]

ludo@gnu.org (Ludovic Courtès) skribis:

> Leo Famulari <leo@famulari.name> skribis:
>
>> These buffer overflows in libpng were announced today:
>> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126
>>
>> This patch updates libpng to 1.5.24, which is claimed to be free of the bugs.
>
> In commit 1b076e6 on ‘master’, I made 1.5.24 a replacement for the
> current libpng (info "(guix) Security Updates")

As Mark rightfully reminded me, the grafting mechanism has a
shortcoming: it is not recursive.

IOW, if a package has a direct dependency on libpng, it is appropriately
grafted to refer to the new libpng.  However, if a package depends on
libfoo, which in turn depends on libpng, then that package will keep
referring to the old libfoo, which refers to the vulnerable libpng.

I’ll see how ‘graft-derivation’ in (guix derivations) can be made
recursive.

Ludo’.