From b5f90159aff36d07099e8311f265f46b1d2adf7a Mon Sep 17 00:00:00 2001 From: David Anderson Date: Sat, 14 Mar 2020 00:34:13 -0700 Subject: [PATCH] libvorbis: document that patch for CVE-2017-14160 also fixes CVE-2018-10393. Fixes #57159. Signed-off-by: David Anderson --- pkgs/development/libraries/libvorbis/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/libraries/libvorbis/default.nix b/pkgs/development/libraries/libvorbis/default.nix index 263fa0a5216..40d21b58b55 100644 --- a/pkgs/development/libraries/libvorbis/default.nix +++ b/pkgs/development/libraries/libvorbis/default.nix @@ -14,7 +14,7 @@ stdenv.mkDerivation rec { (fetchpatch { url = "https://gitlab.xiph.org/xiph/vorbis/uploads/a68cf70fa10c8081a633f77b5c6576b7/0001-CVE-2017-14160-make-sure-we-don-t-overflow.patch"; sha256 = "0v21p59cb3z77ch1v6q5dcrd733h91f3m8ifnd7kkkr8gzn17d5x"; - name = "CVE-2017-14160"; + name = "CVE-2017-14160+CVE-2018-10393.patch"; }) (fetchpatch { url = "https://gitlab.xiph.org/xiph/vorbis/commit/112d3bd0aaa.diff";