diff options
| author | Niklas Hambüchen <mail@nh2.me> | 2022-05-04 10:25:17 +0000 |
|---|---|---|
| committer | Niklas Hambüchen <mail@nh2.me> | 2022-05-04 10:25:17 +0000 |
| commit | 61220008cb18c3e5286b3e833825556691e438ba (patch) | |
| tree | c0ce60363f6a4185fba01d031f580a3e2f56f9c2 | |
| parent | haproxy: 2.3.14 -> 2.3.18 (diff) | |
| download | nixpkgs-61220008cb18c3e5286b3e833825556691e438ba.tar.gz | |
[21.11] libxml2: Backport CVE fixes from v2.9.13 and v2.9.14
* https://nvd.nist.gov/vuln/detail/CVE-2022-29824
* https://nvd.nist.gov/vuln/detail/CVE-2022-23308
See also:
* https://github.com/NixOS/nixpkgs/pull/161071#issuecomment-1047881082
* https://github.com/NixOS/nixpkgs/pull/171461#issuecomment-1116928872
| -rw-r--r-- | pkgs/development/libraries/libxml2/default.nix | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix index bc11c9cfea1f..17ae7514a2b4 100644 --- a/pkgs/development/libraries/libxml2/default.nix +++ b/pkgs/development/libraries/libxml2/default.nix @@ -35,6 +35,26 @@ stdenv.mkDerivation rec { url = "https://gitlab.gnome.org/GNOME/libxml2/commit/85b1792e37b131e7a51af98a37f92472e8de5f3f.patch"; sha256 = "epqlNs2S0Zczox3KyCB6R2aJKh87lXydlZ0x6tLHweE="; }) + + # Fix [CVE-2022-23308] Use-after-free of ID and IDREF attributes + # See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.13 + # TODO: Remove once this package is >= v2.9.13 + (fetchpatch { + name = "libxml2-CVE-2022-23308-Use-after-free-of-ID-and-IDREF-attributes.patch"; + url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12a858989b14eed4e84e453059cd3ba340e.patch"; + sha256 = "1rwb2xbvddkqgigdq9vjzqqaj6hhrhzk8m6hkcicqrc4ik9d636r"; + }) + + # Fix [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + # See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14 + # Page https://nvd.nist.gov/vuln/detail/CVE-2022-29824 links the fix commits for + # `libxml2` master and the 2.9.14 backport we use here. + # TODO: Remove once this package is >= v2.9.14 + (fetchpatch { + name = "libxml2-CVE-2022-29824-Fix-integer-overflows-in-xmlBuf-and-xmlBuffer.patch"; + url = "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab.patch"; + sha256 = "1kyzxh8fp5sfyqi9zghd7c2d32ld0mvp8hrk55mnvkg7aq42j0nz"; + }) ]; outputs = [ "bin" "dev" "out" "man" "doc" ] |