diff options
| author | Liliana Marie Prikler <liliana.prikler@gmail.com> | 2024-11-09 15:27:49 +0100 |
|---|---|---|
| committer | Maxim Cournoyer <maxim.cournoyer@gmail.com> | 2024-11-12 17:41:14 +0900 |
| commit | a6dab6e9156db469c65fb5334df8cc8735ca6897 (patch) | |
| tree | 6435e90fde80b69046a7c95d2c52a8e8b4bca1c6 /gnu/packages/backup.scm | |
| parent | 0cbd830ebb8ce802afe99c439ce7fdee448074be (diff) | |
| download | guix-a6dab6e9156db469c65fb5334df8cc8735ca6897.tar.gz guix-a6dab6e9156db469c65fb5334df8cc8735ca6897.zip | |
gnu: libarchive: Graft to 3.7.7. [security fixes]
* gnu/packages/backup.scm (libarchive): Add replacement with libarchive/fixed.
(libarchive/fixed): New variable.
Fixes: Out of bounds access in ZIP files [CVE-2024-37407].
Fixes: Out of bounds access in RAR files [CVE-2024-48957, CVE-2024-48958].
Fixes: Race condition in multi-threaded systems [CVE-2023-30571].
Fixes: NULL pointer dereference [CVE-2022-36227].
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Diffstat (limited to 'gnu/packages/backup.scm')
| -rw-r--r-- | gnu/packages/backup.scm | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm index 0973c5ddca..22c1ef64e9 100644 --- a/gnu/packages/backup.scm +++ b/gnu/packages/backup.scm @@ -262,6 +262,7 @@ backups (called chunks) to allow easy burning to CD/DVD.") (define-public libarchive (package (name "libarchive") + (replacement libarchive/fixed) (version "3.6.1") (source (origin @@ -351,6 +352,22 @@ random access nor for in-place modification. This package provides the @command{bsdcat}, @command{bsdcpio} and @command{bsdtar} commands.") (license license:bsd-2))) +(define-public libarchive/fixed + (package + (inherit libarchive) + (version "3.7.7") + (source + (origin + (method url-fetch) + (uri (list (string-append "https://libarchive.org/downloads/libarchive-" + version ".tar.xz") + (string-append "https://github.com/libarchive/libarchive" + "/releases/download/v" version "/libarchive-" + version ".tar.xz"))) + (sha256 + (base32 + "1vps57mrpqmrk4zayh5g5amqfq7031s5zzkkxsm7r71rqf1wv6l7")))))) + (define-public rdup (package (name "rdup") |