GNU bug report logs - #29487
[PATCH] gnu: libxcursor: Replace with 1.1.15 [fixes CVE-2017-16612].

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 29487 in the body.
You can then email your comments to 29487 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Marius Bakke <mbakke <at> fastmail.com>
To: guix-patches <at> gnu.org
Cc: Marius Bakke <mbakke <at> fastmail.com>
Subject: [PATCH] gnu: libxcursor: Replace with 1.1.15 [fixes CVE-2017-16612].
Date: Tue, 28 Nov 2017 18:02:05 +0100

* gnu/packages/xorg.scm (libxcursor-1.1.15): New public variable.
(libxcursor)[replacement]: New field.
---
 gnu/packages/xorg.scm | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 994476ed6..1c1ddd4bf 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5307,6 +5307,7 @@ draggable titlebars and borders.")
   (package
     (name "libxcursor")
     (version "1.1.14")
+    (replacement libxcursor-1.1.15)
     (source
       (origin
         (method url-fetch)
@@ -5339,6 +5340,18 @@ draggable titlebars and borders.")
     (description "Xorg Cursor management library.")
     (license license:x11)))
 
+;; For CVE-2017-16612.
+(define-public libxcursor-1.1.15
+  (package
+    (inherit libxcursor)
+    (version "1.1.15")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://xorg/individual/lib/libXcursor-"
+                                  version ".tar.bz2"))
+              (sha256
+               (base32
+                "0syzlfvh29037p0vnlc8f3jxz8nl55k65blswsakklkwsc6nfki9"))))))
 
 (define-public libxt
   (package
-- 
2.15.0

Message #8 received at 29487 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Marius Bakke <mbakke <at> fastmail.com>
Cc: 29487 <at> debbugs.gnu.org
Subject: Re: [bug#29487] [PATCH] gnu: libxcursor: Replace with 1.1.15 [fixes
 CVE-2017-16612].
Date: Tue, 28 Nov 2017 13:16:42 -0500

[Message part 1 (text/plain, inline)]

On Tue, Nov 28, 2017 at 06:02:05PM +0100, Marius Bakke wrote:
> * gnu/packages/xorg.scm (libxcursor-1.1.15): New public variable.
> (libxcursor)[replacement]: New field.

LGTM, thanks!

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.