From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/2] OpenJPEG security fixes (CVE-2016-{5157,7163}) Date: Fri, 9 Sep 2016 02:04:39 -0400 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52796) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biEvw-00052g-Sk for guix-devel@gnu.org; Fri, 09 Sep 2016 02:05:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1biEvt-0006xI-Lm for guix-devel@gnu.org; Fri, 09 Sep 2016 02:05:04 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:54176) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biEvr-0006v9-DB for guix-devel@gnu.org; Fri, 09 Sep 2016 02:05:01 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 8046FCCE96 for ; Fri, 9 Sep 2016 02:04:50 -0400 (EDT) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org Two bugs disclosed in OpenJPEG, CVE-2016-5157 and CVE-2016-7163. Both can be used to execute arbitrary code, apparently. CVE-2016-7163: http://seclists.org/oss-sec/2016/q3/442 CVE-2016-5157: http://seclists.org/oss-sec/2016/q3/441 Leo Famulari (2): gnu: openjpeg-2.*: Fix CVE-2016-7163. gnu: openjpeg-2.*: Fix CVE-2016-5157. gnu/local.mk | 2 + gnu/packages/image.scm | 8 +- gnu/packages/patches/openjpeg-CVE-2016-5157.patch | 98 +++++++++++++++++++++++ gnu/packages/patches/openjpeg-CVE-2016-7163.patch | 71 ++++++++++++++++ 4 files changed, 177 insertions(+), 2 deletions(-) create mode 100644 gnu/packages/patches/openjpeg-CVE-2016-5157.patch create mode 100644 gnu/packages/patches/openjpeg-CVE-2016-7163.patch -- 2.10.0