JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
72691e14ec
nixpkgs/pkgs/development/libraries/openjpeg/2.x.nix

22 lines
660 B
Nix
Raw Normal View History

openjpeg2: patch for multiple CVEs - Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2. (CVE-2016-9112) - There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service. (CVE-2016-9114) - NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. (CVE-2016-9116) - Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2. (CVE-2016-9118)
2017-01-07 11:50:02 +00:00
{ callPackage, fetchpatch, ... } @ args:
Resurrect openjpeg 2.0.x and use it for mupdf mupdf doesn't compile with 2.1 due to API changes cc @codyopel who made the openjpeg update
2015-02-25 01:50:06 +00:00
callPackage ./generic.nix (args // rec {
openjpeg: 2.3.1 -> 2.4.0 https://github.com/uclouvain/openjpeg/blob/v2.4.0/CHANGELOG.md Fixes CVE-2020-15389, CVE-2020-27841, CVE-2020-27842, CVE-2020-27843, CVE-2020-27844, and CVE-2020-27845.
2021-01-09 05:41:01 +00:00
version = "2.4.0";
branch = "2.4";
openjpeg: 2.1.2 -> 2.3.0 for multiple CVEs Fixes: * CVE-2016-10504 * CVE-2016-10505 * CVE-2016-10506 * CVE-2016-10507 * CVE-2016-9112 * CVE-2016-9113 * CVE-2016-9114 * CVE-2016-9115 * CVE-2016-9116 * CVE-2016-9117 * CVE-2016-9118 cc #30959
2017-11-19 18:32:17 +00:00
revision = "v${version}";
openjpeg: 2.3.1 -> 2.4.0 https://github.com/uclouvain/openjpeg/blob/v2.4.0/CHANGELOG.md Fixes CVE-2020-15389, CVE-2020-27841, CVE-2020-27842, CVE-2020-27843, CVE-2020-27844, and CVE-2020-27845.
2021-01-09 05:41:01 +00:00
sha256 = "143dvy5g6v6129lzvl0r8mrgva2fppkn0zl099qmi9yi9l9h7yyf";
openjpeg: adding patch for CVE-2018-7648 (cherry picked from commit 3dc0838450ad5ec8c25adcd1c7bfe3b8b630b7e5) Forward-picking from staging-next. The CVE is marked as critical, and the amount of rebuilds isn't that high (~500 linux, ~100 darwin).
2018-10-27 14:25:52 +01:00
openjpeg: fix includedir in cmake config files
2018-12-23 01:01:49 +00:00
extraFlags = [
"-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/openjpeg-${branch}"
"-DOPENJPEG_INSTALL_PACKAGE_DIR=${placeholder "dev"}/lib/openjpeg-${branch}"
];
openjpeg: adding patch for CVE-2018-7648 (cherry picked from commit 3dc0838450ad5ec8c25adcd1c7bfe3b8b630b7e5) Forward-picking from staging-next. The CVE is marked as critical, and the amount of rebuilds isn't that high (~500 linux, ~100 darwin).
2018-10-27 14:25:52 +01:00
patches = [
openjpeg: fix includedir in cmake config files
2018-12-23 01:01:49 +00:00
./fix-cmake-config-includedir.patch
openjpeg: CVE-2019-12973
2019-07-06 09:40:29 +01:00
(fetchpatch {
openjpeg: 2.3.1 -> 2.4.0 https://github.com/uclouvain/openjpeg/blob/v2.4.0/CHANGELOG.md Fixes CVE-2020-15389, CVE-2020-27841, CVE-2020-27842, CVE-2020-27843, CVE-2020-27844, and CVE-2020-27845.
2021-01-09 05:41:01 +00:00
url = "https://patch-diff.githubusercontent.com/raw/uclouvain/openjpeg/pull/1321.patch";
sha256 = "1cjpr76nf9g65nqkfnxnjzi3bv7ifbxpc74kxxibh58pzjlp6al8";
openjpeg: add patch for CVE-2020-8112
2020-03-12 17:37:41 +00:00
})
openjpeg: adding patch for CVE-2018-7648 (cherry picked from commit 3dc0838450ad5ec8c25adcd1c7bfe3b8b630b7e5) Forward-picking from staging-next. The CVE is marked as critical, and the amount of rebuilds isn't that high (~500 linux, ~100 darwin).
2018-10-27 14:25:52 +01:00
];
Resurrect openjpeg 2.0.x and use it for mupdf mupdf doesn't compile with 2.1 due to API changes cc @codyopel who made the openjpeg update
2015-02-25 01:50:06 +00:00
})
Reference in New Issue Copy Permalink