[security] gnome-session update required

[security] gnome-session update required

[rennes]

Hello,

> Will some helpful GNOME user update gnome-session to 3.20.2?
> 
> There is a heap overflow in the version of gnome-session that we
> package:
> https://bugzilla.gnome.org/show_bug.cgi?id=768441
> http://seclists.org/oss-sec/2016/q3/526

I would like to help but do not understand what needs to be done?

Re: [security] gnome-session update required

[Leo Famulari]

On Fri, Sep 16, 2016 at 06:02:54PM -0500, rennes wrote:
> Hello,
> 
> > Will some helpful GNOME user update gnome-session to 3.20.2?
> > 
> > There is a heap overflow in the version of gnome-session that we
> > package:
> > https://bugzilla.gnome.org/show_bug.cgi?id=768441
> > http://seclists.org/oss-sec/2016/q3/526
> 
> I would like to help but do not understand what needs to be done?

Try updating gnome-session to 3.20.2 and see if your GuixSD / GNOME
system still works. Please ask for help on #guix on freenode if you need
help doing that.

If not, I will just push the update later today or tomorrow and wait for
bug reports.

Re: [security] gnome-session update required

[rennes]

[-- Attachment #1: Type: text/plain, Size: 420 bytes --]


> Try updating gnome-session to 3.20.2 and see if your GuixSD / GNOME
> system still works. Please ask for help on #guix on freenode if you
> need
> help doing that.
> 
> If not, I will just push the update later today or tomorrow and wait
> for
> bug reports.

This is the patch to update the version of gnome-session to 3.20.2.

GuixSD and GNOME works fine after install gnome-session-3.20.2.

Thanks

[-- Attachment #2: 0001-gnu-gnome-session-Update-to-3.20.2.patch --]
[-- Type: text/x-patch, Size: 1192 bytes --]

From 31fdcede0ef12250dd71da4d30e05bb6edd0af76 Mon Sep 17 00:00:00 2001
From: Rene Saavedra <rennes@openmailbox.org>
Date: Sat, 17 Sep 2016 11:31:56 -0500
Subject: [PATCH] gnu: gnome-session: Update to 3.20.2.

	* gnu/packages/gnome.scm (gnome-session): Update to 3.20.2.

---
 gnu/packages/gnome.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 19e982d..c0461e1 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -3920,7 +3920,7 @@ such as gzip tarballs.")
 (define-public gnome-session
   (package
     (name "gnome-session")
-    (version "3.20.1")
+    (version "3.20.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3928,7 +3928,7 @@ such as gzip tarballs.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "04w90gyl0kdx5vwmdcgfdk3qr9xhip00vgpgzci151agqwyzbs9a"))))
+                "1npnjm6wirz2v0liv7n23ivp2w0y1q230qcdb681hhzmp7h9fpq2"))))
     (arguments
      '(#:phases
        (modify-phases %standard-phases
-- 
2.6.3

Re: [security] gnome-session update required

[Leo Famulari]

On Sat, Sep 17, 2016 at 11:52:03AM -0500, rennes wrote:
> This is the patch to update the version of gnome-session to 3.20.2.
> 
> GuixSD and GNOME works fine after install gnome-session-3.20.2.

Thank you for writing and testing the patch! Pushed!

[security] gnome-session update required

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 226 bytes --]

Will some helpful GNOME user update gnome-session to 3.20.2?

There is a heap overflow in the version of gnome-session that we
package:
https://bugzilla.gnome.org/show_bug.cgi?id=768441
http://seclists.org/oss-sec/2016/q3/526

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]