Merge pull request #13513 from grahamc/omnibus-cves

Several CVEs

nixos/modules/services/web-servers/apache-httpd/moodle.nix

···
     '';
   # Unpack Moodle and put the config file in its root directory.
   moodleRoot = pkgs.stdenv.mkDerivation rec {
-    name= "moodle-2.8.5";
+    name= "moodle-2.8.10";
 
     src = pkgs.fetchurl {
       url = "https://download.moodle.org/stable28/${name}.tgz";
-      sha256 = "1a159a193010cddedce10ee009184502e6f732e4d7c85167d8597fe5dff9e190";
+      sha256 = "0c3r5081ipcwc9s6shakllnrkd589y2ln5z5m1q09l4h6a7cy4z2";
     };
 
     buildPhase =
       ''
-      ''; 
+      '';
 
     installPhase =
       ''
···
         cleartext in the Nix store!
       '';
     };
-    
+
     dbPrefix = mkOption {
       default = "mdl_";
       example = "my_other_mdl_";
···
       type = types.path;
       };
 
-    
+
     extraConfig = mkOption {
       default = "";
       example =

pkgs/applications/graphics/PythonMagick/default.nix

···
 
 let
 
-  version = "0.9.11";
+  version = "0.9.12";
 
 in
 
···
   name = "pythonmagick-${version}";
 
   src = fetchurl {
-    url = "http://www.imagemagick.org/download/python/releases/PythonMagick-${version}.tar.gz";
-    sha256 = "01z01mlqkk0lvrh2jsmf84qjw29sq4rpj0653x7nqy7mrszwwp2v";
+    url = "http://www.imagemagick.org/download/python/releases/PythonMagick-${version}.tar.xz";
+    sha256 = "1l1kr3d7l40fkxgs6mrlxj65alv2jizm9hhgg9i9g90a8qj8642b";
   };
 
   buildInputs = [python boost pkgconfig imagemagick];

pkgs/applications/graphics/xara/default.nix

···
     url = http://downloads2.xara.com/opensource/XaraLX-0.7r1785.tar.bz2;
     sha256 = "05xbzq1i1vw2mdsv7zjqfpxfv3g1j0g5kks0gq6sh373xd6y8lyh";
   };
-    
+
   nativeBuildInputs = [ automake pkgconfig gettext perl zip ];
   buildInputs = [ wxGTK gtk libxml2 freetype pango ];
 
···
   patches = map fetchurl (import ./debian-patches.nix);
 
   prePatch = "patchShebangs Scripts";
+
+  meta.broken = true;
 }

pkgs/applications/networking/mailreaders/thunderbird/default.nix

···
   enableOfficialBranding ? false
 }:
 
-let version = "38.3.0"; in
+let version = "38.6.0"; in
 let verName = "${version}"; in
 
 stdenv.mkDerivation rec {

pkgs/applications/version-management/git-and-tools/cgit/default.nix

···
 
 stdenv.mkDerivation rec {
   name = "cgit-${version}";
-  version = "0.11.2";
+  version = "0.12";
 
   src = fetchurl {
     url = "http://git.zx2c4.com/cgit/snapshot/${name}.tar.xz";
-    sha256 = "0fryh56kyah7v9a8zzhbhwlyy2j116w87sxmgrn2kmwk0rvnw4if";
+    sha256 = "1dx54hgfyabmg9nm5qp6d01f54nlbqbbdwhwl0llb9imjf237qif";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
···
   # NOTE: as of 0.10.1, the git version is compatible from 1.9.0 to
   # 1.9.2 (see the repository history)
   gitSrc = fetchurl {
-    url    = "mirror://kernel/software/scm/git/git-2.3.2.tar.xz";
-    sha256 = "09gqijsjfnxlbsxbxzlvllg37bfs9f4jwa2plqsanmba09i89sqq";
+    url    = "mirror://kernel/software/scm/git/git-2.7.0.tar.xz";
+    sha256 = "03bvb8s5j8i54qbi3yayl42bv0wf2fpgnh1a2lkhbj79zi7b77zs";
   };
 
   buildInputs = [

pkgs/development/libraries/jasper/default.nix

···
   };
 
   patches = [
+    ./jasper-CVE-2016-1867.diff
     ./jasper-CVE-2014-8137-variant2.diff
     ./jasper-CVE-2014-8137-noabort.diff
     ./jasper-CVE-2014-8138.diff
···
   propagatedBuildInputs = [ libjpeg ];
 
   configureFlags = "--enable-shared";
-  
+
   meta = {
     homepage = https://www.ece.uvic.ca/~frodo/jasper/;
     description = "JPEG2000 Library";

pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff

···
+--- jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c	2007-01-19 22:43:07.000000000 +0100
++++ jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c	2016-01-14 14:22:24.569056412 +0100
+@@ -429,7 +429,7 @@
+ 	}
+
+ 	for (pi->compno = pchg->compnostart, pi->picomp =
+-	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
++	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
+ 	  ++pi->picomp) {
+ 		pirlvl = pi->picomp->pirlvls;
+ 		pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +

pkgs/development/libraries/libbsd/default.nix

···
 { stdenv, fetchurl }:
 
-let name = "libbsd-0.7.0";
+let name = "libbsd-0.8.2";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "http://libbsd.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1fqhbi0vd6xjxazf633x388cc8qyn58l78704s0h6k63wlbhwfqg";
+    sha256 = "02i5brb2007sxq3mn862mr7yxxm0g6nj172417hjyvjax7549xmj";
   };
 
   patchPhase = ''
···
       --replace "{exec_prefix}" "{prefix}"
   '';
 
-  meta = { 
+  meta = {
     description = "Common functions found on BSD systems";
     homepage = http://libbsd.freedesktop.org/;
     license = stdenv.lib.licenses.bsd3;

pkgs/development/libraries/mbedtls/default.nix

···
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  name = "mbedtls-1.3.14";
+  name = "mbedtls-1.3.16";
 
   src = fetchurl {
     url = "https://polarssl.org/download/${name}-gpl.tgz";
-    sha256 = "1y3gr3kfai3d13j08r4pv42sh47nbfm4nqi9jq8c9d06qidr2xmy";
+    sha256 = "f413146c177c52d4ad8f48015e2fb21dd3a029ca30a2ea000cbc4f9bd092c933";
   };
 
   nativeBuildInputs = [ perl ];

pkgs/servers/sql/mysql/5.5.x.nix

···
 
 stdenv.mkDerivation rec {
   name = "mysql-${version}";
-  version = "5.5.45";
+  version = "5.5.48";
 
   src = fetchurl {
     url = "mirror://mysql/MySQL-5.5/${name}.tar.gz";
-    sha256 = "0clkr3r44j8nsgmjzv6r09pb0vjangn5hpyjxgg5ynr674ygskkl";
+    sha256 = "10fpzvf6hxvqgaq8paiz8fvhcbbs4qnzqw0svq40bvlyhx2qfgyc";
   };
 
   patches = if stdenv.isCygwin then [