ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2025-01-11 13:49:23 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: libpng: Replace with 1.6.37 [security fixes].

Browse source 
This fixes CVE-2018-14048, CVE-2018-14550, and CVE-2019-7317.

* gnu/packages/image.scm (libpng)[replacement]: New field.
(libpng-1.6.37): New public variable.
This commit is contained in:
Marius Bakke 2019-04-17 22:36:47 +02:00
parent 30023aa670
commit a18581a02d
No known key found for this signature in database
GPG key ID: A2A06DF2A33A54FA
1 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
gnu/packages/image.scm
View file

@ -87,6 +87,7 @@ (define-public libpng
(package
(name "libpng")
(version "1.6.34")
(replacement libpng-1.6.37)
(source (origin
(method url-fetch)
(uri (list (string-append "mirror://sourceforge/libpng/libpng16/"
@ -112,6 +113,25 @@ (define-public libpng
(license license:zlib)
(home-page "http://www.libpng.org/pub/png/libpng.html")))
;; This graft exists to fix CVE-2018-14048, CVE-2018-14550, and CVE-2019-7317.
(define-public libpng-1.6.37
(package
(inherit libpng)
(version "1.6.37")
(source (origin
(method url-fetch)
(uri (list (string-append "mirror://sourceforge/libpng/libpng16/"
version "/libpng-" version ".tar.xz")
(string-append
"ftp://ftp.simplesystems.org/pub/libpng/png/src"
"/libpng16/libpng-" version ".tar.xz")
(string-append
"ftp://ftp.simplesystems.org/pub/libpng/png/src/history"
"/libpng16/libpng-" version ".tar.xz")))
(sha256
(base32
"1jl8in381z0128vgxnvn33nln6hzckl7l7j9nqvkaf1m9n1p0pjh"))))))
;; libpng-apng should be updated when the APNG patch is released:
;; <https://bugs.gnu.org/27556>
(define-public libpng-apng