From a18581a02da0b5ca1c99f2114129513cdf5fa05d Mon Sep 17 00:00:00 2001 From: Marius Bakke Date: Wed, 17 Apr 2019 22:36:47 +0200 Subject: gnu: libpng: Replace with 1.6.37 [security fixes]. This fixes CVE-2018-14048, CVE-2018-14550, and CVE-2019-7317. * gnu/packages/image.scm (libpng)[replacement]: New field. (libpng-1.6.37): New public variable. --- gnu/packages/image.scm | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'gnu') diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 4010fd0ace..4443e1c83d 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -87,6 +87,7 @@ (define-public libpng (package (name "libpng") (version "1.6.34") + (replacement libpng-1.6.37) (source (origin (method url-fetch) (uri (list (string-append "mirror://sourceforge/libpng/libpng16/" @@ -112,6 +113,25 @@ (define-public libpng (license license:zlib) (home-page "http://www.libpng.org/pub/png/libpng.html"))) +;; This graft exists to fix CVE-2018-14048, CVE-2018-14550, and CVE-2019-7317. +(define-public libpng-1.6.37 + (package + (inherit libpng) + (version "1.6.37") + (source (origin + (method url-fetch) + (uri (list (string-append "mirror://sourceforge/libpng/libpng16/" + version "/libpng-" version ".tar.xz") + (string-append + "ftp://ftp.simplesystems.org/pub/libpng/png/src" + "/libpng16/libpng-" version ".tar.xz") + (string-append + "ftp://ftp.simplesystems.org/pub/libpng/png/src/history" + "/libpng16/libpng-" version ".tar.xz"))) + (sha256 + (base32 + "1jl8in381z0128vgxnvn33nln6hzckl7l7j9nqvkaf1m9n1p0pjh")))))) + ;; libpng-apng should be updated when the APNG patch is released: ;; (define-public libpng-apng -- cgit v1.2.3