From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/1] fontconfig: CVE-2016-5384 Date: Mon, 8 Aug 2016 18:59:40 -0400 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47502) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bWtWc-0007FC-HB for guix-devel@gnu.org; Mon, 08 Aug 2016 19:00:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bWtWW-0005vh-IR for guix-devel@gnu.org; Mon, 08 Aug 2016 19:00:01 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:47205) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bWtWV-0005ug-90 for guix-devel@gnu.org; Mon, 08 Aug 2016 18:59:56 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id B36F3F2C38 for ; Mon, 8 Aug 2016 18:59:46 -0400 (EDT) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org This patch uses a graft to apply the upstream fix to fontconfig for CVE-2016-5384. I learned about the bug from a Debian security advisory: https://security-tracker.debian.org/tracker/CVE-2016-5384 https://www.debian.org/security/2016/dsa-3644 Another potential option is to try grafting the latest version of fontconfig, 2.12.1. One way or another, ~2000 packages are depend on fontconfig. Thoughts? Leo Famulari (1): gnu: fontconfig: Fix CVE-2016-5384. gnu/local.mk | 1 + gnu/packages/fontutils.scm | 8 + .../patches/fontconfig-CVE-2016-5384.patch | 170 +++++++++++++++++++++ 3 files changed, 179 insertions(+) create mode 100644 gnu/packages/patches/fontconfig-CVE-2016-5384.patch -- 2.9.2