aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2016-05-31 13:23:17 -0400
committerLeo Famulari <leo@famulari.name>2016-05-31 13:33:09 -0400
commit4d93a76138246ba1f9d6f81da4039e89e14570be (patch)
tree1a2335254f0f4574bdfae3505c37b7a1bc533c23 /gnu/packages
parent151afd84dc9bf8f13de79a689f7f163fba7254ec (diff)
downloadguix-4d93a76138246ba1f9d6f81da4039e89e14570be.tar
guix-4d93a76138246ba1f9d6f81da4039e89e14570be.tar.gz
gnu: graphicsmagick: Update to 1.3.24 [security update].
Fixes CVE-2016-{2317, 2318, 5118} and many other security issues described in 'NEWS.txt'. * gnu/packages/patches/graphicsmagick-CVE-2016-5118.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. * gnu/packages/imagemagick.scm (graphicsmagick): Update to 1.3.24. [source]: Remove patch.
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/imagemagick.scm6
-rw-r--r--gnu/packages/patches/graphicsmagick-CVE-2016-5118.patch19
2 files changed, 3 insertions, 22 deletions
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index f129b16289..dc03ea48a4 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -2,6 +2,7 @@
;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2015 Eric Bavier <bavier@member.fsf.org>
;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -154,16 +155,15 @@ script.")
(define-public graphicsmagick
(package
(name "graphicsmagick")
- (version "1.3.23")
+ (version "1.3.24")
(source (origin
(method url-fetch)
(uri (string-append "ftp://ftp.graphicsmagick.org/pub/"
"GraphicsMagick/" (version-major+minor version)
"/GraphicsMagick-" version ".tar.xz"))
- (patches (search-patches "graphicsmagick-CVE-2016-5118.patch"))
(sha256
(base32
- "03g6l2h8cmf231y1vma0z7x85070jm1ysgs9ppqcd3jj56jka9gx"))))
+ "1q40w5hcl8rcpszm0r7rpr3a9lj390p39zfvavkvlgxyyk7bmgsj"))))
(build-system gnu-build-system)
(arguments
`(#:configure-flags
diff --git a/gnu/packages/patches/graphicsmagick-CVE-2016-5118.patch b/gnu/packages/patches/graphicsmagick-CVE-2016-5118.patch
deleted file mode 100644
index ddd1ce93f4..0000000000
--- a/gnu/packages/patches/graphicsmagick-CVE-2016-5118.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Fix CVE-2016-5118 (popen() shell vulnerability via filename).
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5118
-
-Upstream patch copied from the bug announcement:
-http://seclists.org/oss-sec/2016/q2/432
-https://marc.info/?l=oss-security&m=146455222600609&w=2
-
-diff -r 33200fc645f6 magick/blob.c
---- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
-@@ -68,6 +68,7 @@
- */
- #define DefaultBlobQuantum 65541
-
-+#undef HAVE_POPEN
-
- /*
- Enum declarations.