Subject: Re: [bug#32508] [PATCH] gnu: libx11: Replace with 1.6.6 [security fixes].

From: [email-masked] (Ludovic Courtès)
Date: Fri, 24 Aug 2018 11:37:38 +0200

Hello!

Leo Famulari <[email-masked]> skribis:

> On Thu, Aug 23, 2018 at 04:59:47PM +0200, Marius Bakke wrote:
>> This fixes CVE-2018-14599, CVE-2018-14600, and CVE-2018-14598.
>> 
>> * gnu/packages/xorg.scm (libx11)[replacement]: New field.
>> (libx11-1.6.6): New public variable.
>
> Thanks!

+1

>> +;; Replacement package to fix multiple security bugs:
>> +;; <http://seclists.org/oss-sec/2018/q3/146>.
>> +(define-public libx11-1.6.6
>> +  (package/inherit libx11
>
> Does it need to use package/inherit? My understanding is that procedure
> is primarily useful for packages that inherit from another package foo,
> when foo is being grafted. For example, the current situation with
> cups-minimal and cups.

Correct, it’s not required in this case but it doesn’t hurt.

Ludo’.