From 990ff97c6d82eb27486ec8dc3e9dbc453da88aa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Sun, 14 Jan 2018 20:39:49 +0100 Subject: [PATCH] glibc: 2.26-115 -> 2.26-131 to fix CVE-2018-1000001 /cc https://github.com/NixOS/nixpkgs/issues/33826#issuecomment-357436030 --- .../libraries/glibc/2.26-115to131.diff.gz | Bin 0 -> 20022 bytes pkgs/development/libraries/glibc/common.nix | 7 +++++-- 2 files changed, 5 insertions(+), 2 deletions(-) create mode 100644 pkgs/development/libraries/glibc/2.26-115to131.diff.gz diff --git a/pkgs/development/libraries/glibc/2.26-115to131.diff.gz b/pkgs/development/libraries/glibc/2.26-115to131.diff.gz new file mode 100644 index 0000000000000000000000000000000000000000..3d866c567a790b088e2446bf2d4048710a19a9eb GIT binary patch literal 20022 zcmb2|=3oE;Cgwd+*~PcrHvP@H_E%8YQgrgO-I&Kv=ibWN*x13r zQt(mW=#D@4-@ly4$Pq9_Ieq&gekFtcdGqGg&B^O|Yt@%wmVd`(#@oX?U*11)`GMP+ zYv)C;Z-2U1g756RcMGfy($`)~(V6RcT(W1^qT4Tf*qXgI-_$v`{>tmGLcM=$FTOGR zwdh{1&#t8U{Xy?bcRfy9e*4Y07K^AIo?C?WZ#lAZPjRhc-Iq7JYcG4-T=#z;?O5`8 zSbHn#%YfEDMyR=M? zKX`Ru+tFz!RTy*1#f7rV)R_)HD^gr+eOdUwQSHl0wI^xMde_>AJhuCm@75^x$hdL; ze^YTIvG#eAcfCG7ejk|hwe0&<|I=JzsgdQsuB#s0^(^B;+=*7x{;1$d%c|7&y=S^E zc5rTwjD7^yoMed|bxO)-%yV!1-Z^l-?4bL7N&CMqC5P?ozf|kStEG09?e<#4o#CHg_vcZ!cHCudpKZ1pRvHq5nkHox9@avB0-QTJCX2555cX^13{Ml!#LF{xiM=@D zdF1!9JjM6Um-{`ZbA3L)&d=YtRM^timY-c>w{bqJ*U{osr)>+T8(v9h7FT?|=9bX0 zhMk`R>u#FP;9I+Lt-`_XTJZT-%;_sYPJjS?dE;EJ015N$zHp#%-XNVV(!t- z*#`_e4JIv=oarerQDx16X-vP{Kiy}YHgihl8>9aGy$VIX@qe^pEkrlG(D|8ZKgq15 z;H}QQjJYaTB|SxzR6n<9=`>yO=czxtQ|Rw9LHS9`doLUCEIKlwtU#=B;uJhr{wE5Hc zR$EKN*~e;WX$0_O)RqQ`XHV40ivy3&6Vu*v{flPpX|)V)jz>EeOu3aR z5~+H<*44LmQN^__=1)Jr*{`>2IhS@ypyq?+i&uDrDfZcOiHWTH({iO$jOE__qh~@h zW*5|#B{V9&Sovk`e-8of%l^LWdF8h-Z21(`xu@LqtBRPqL*t_$^Ubk)+E+Ji6If+o z^{-XgJ#F)os_V-+FDdo&HLF*}1qx=*X#3!xP;Db==C;UA^1Jlzmd&lpZqH;Ww4Irk zrZqQle|c}{HKud}mkg;6zKQ2JBLscR`HpL!+&XD`)0~r=gWj}$obS6_VPa(8ho%Q+ zypq+76-SaBH_ltoVX4fop;cz6YH9tiw9BWdu0-k5X12+3+tbgst-ZF+SnhP^n{w-? zE-me=Wm@DtjSeR=AAa@4xH08ONL1#NL-C2ZFWPlQI=a4VF*syvG@n^yFV(rza|esy zT^{EJYP%KFG&iI;eW+jPC#mx6f?k6`e(T0*GmlNm$o$Vf=@5&+&X1WjtJMTPczAL3 z{9)GG+LihH>!VjJOTHcH%x4W$S<901W83nlRUaQd_>|6MEgqi!Cxf*viHT>y@86%h zCzq?IyYx(X_u$eDIr+F)nadwuUOhQ+MqtIr{^r`I z^G*&48|Jy(&@*I~IhZ!(^X&Ab>PO43EbN%@=*Xv>1_wRmWig`DiaA1-2S+MjOy<#k z8=-SIMb6>esfibkE!Z8oZ0UpPbBq3X*E;ALxL%r4{P`U3r4EnGhw~?u3mD`+agpYX zSzRMge7X3|gErkylMaP3r0iR=H2tNoj!#&aK|%Y&BXTF4Sr<49Ngk2AIa^@sm$E9%7ltWqIP}m&2@IPP9CzaPnDn`jYxB z%`+>n`0xI+L?=|_jnK3cZK7u`?O0>J&3&g&Uc(u7o~(wS7yKm~Cu%Mb+?6Egb-Se~ zIw@1@=jO1@3m&nAIj{0jn9g?jVP@3ghg)~Z_s?3~cxy_r{Os~gu|M)JZsSeqIg&54UI zDGSULTC31g_31_N<9m*qAGA$Y2v{)vTyvt-29r!rzBP|~x*4|>cWo|kI<4&fY|V-E z4@)9nRTX^CdaH1xaaa9>f)n45ypx~QA%93#e?mz{k?oV78zDybh3zC}tmTkA@Koh< zt4izQm;>j69No_`^PjsvDN$`oocw1_4&m4ciIwp_J-at#*?)+=VYdGLP2=^Jl7$DJ zKF`a4b53lHfpC~a#oA*}>@Urz<3Gkczw`6YEd_@wOm>K!)=*HgXxP@ie3|SLkq6IW z8V)3SS zkxI8Ub9P*tUi!Cr^E0NMcOCOXF28c(Oc!(OnEKwozvuGg`FebMc2Y9A3azC@ohLSy z=*~QQcWz9!e)QYx3zpYCyEOm7#m=@9J5MEZZTo32`mx(8<6`z#x7h&;=SZGE^sk_G4TIAx$dfLe|4Co&6MYwB7u3zS0%r&_tu49d0Boz@vWwqxr=Cql92w- zrH-MEA{VWVl2+_8eV%f+flK$u>FF2NUGbJm`5yCRVdh32Y0-}}{lZKm9%@%9MjJga z%E;1*>pr*I%UF663){|#;aV)Z&trnuL@BmOhTLKB4g9N^?9sM$){l3ls~NH<1f0Hj zKYWMl7bf*m({)?c1#J1`cXkzf`+*v+M^pY?dpvXd`jAAItIZLI+Fo2M+Vpn%qx)IL z`Vs3-WKQA|<+kg1p?~`(%XPufj{a}I9&JCzz2f`k^D$3WKKdp$jC@s`PNd_-9fwH&b9bl``u zYlUZBUxNP9>`j+y)NV{yxH5U?;=lK2ey?ZXj^EO;^4Twj2#Sl}lu{M_Mk4nBXZvF-A` zm734K*yKJra$5SLsQn*?#@a>OmoX$URO{c;_jqzvO{#eBpKVJsE?vGBc>7Ye==U_;;8S|Z5xk1M*(92=xj3oCp-}5AT*m|yf zzZ1=w5%zS_tc9LeJFdRJV^M8ha-gx9seh|f`|`l`?ibRoyf@p$+~p^IH7D@ytEZ)p zPh0dz&r*%Q^qoccWZbdkmkP8w!r$<})@eAsbwPLON2jfE)~UA^c2&-|y3Sg@bnS`^ zm#iDNem1XuCe1O)DgJA=;a0U-cWb77+uZl^Xpni`!Z+)D{MQ~0414PqP}Cu-BY3Se z*CBDg^=0p+cFrlYg65mnC@tS1)%^6*Bi9h=V|&CBdiXNR%dfoPb*(L5q-DA&=A`=1 zbsrm^x0)`^TeC54Mr&SB>-1l-t>&_)W*-&kWpvx*@E|X2*7?}u)B0xot0^d~2{E{o z+!yvJqe^mmPhh(x_rJeeEv!rp4p`Xix7wXz7vhs+cjazOai-i)&rOkM+dr)=lbYp| z?CbETveE{^fl_W?bAXp*UT=)Ep@S-D@;mGU!OTg)7HydEN|J*n3Jw2 zUldB(O}G0{AUVg@YS)Y1eMZ+8c&SQT%zq@d$U5_A^bD>;HFa9WKW??YT(9+Lro!pP zi6O$wSpiI14?jOT{x0&PuJ#+ty%*0&_PvQ*{j?-)o9Vm$^vy}sRs z)t~lpKR2J)oL;^D=gOHuD;;fx7$WVzURnJ7NUQ(*N9H*_ckE4%u4Y~IRM&S=<7;=X zE!^w7qb)>i#GmWs{XKB*x9oM!FWzws%ThMKR5_iPIq%n}H#2ss+2u&{8Z4f9zF?BY z@3ZF4SLdlsao~J=(s}zGM}@V8vOnt={i+qcxcX#feem7rj5R4d?+@#rwU{!^d)NP{ znt0x{{q5&!d3QhV=0EXI?#0nm2%+a-qFTeT9cFEV~D;VxPisU&}`T7U%S&fr-9`4?(U8v!= zGiUbHRLicZRvBXL*CN(`@>MSbLGgJ^^8c>Kb85YGzjj>87kF9b;}Rl=U&kuHPf!B$6@D-@5ja4 z?UT4CyY`=4r(gTyyHVFK zr`%h5!tu1lzmDBcWBBWF{}J&L zg&Tv;Z%Pg24!SNakQNs>-);4>sY@&r$~HR1C~RNQA6#J9GUbql!k#)?TJLHnd|wbG58RpDj(e(f=-FJW906wY@^;m4Ws*Q;vu-z+awQc=z?WgjqS6Q!}>t^?7|AtwPu9bnQ&-RP(UH>}SD>gnb z(CD?c;+MmsL+<5n8>8(-UQZ8(EE4m>+HSpQBms}<}Zy&W(ADKV>qw%AX-8B=e zthJ^*m#EQSU@vm8%w(<4=G}9p#D6Tgd+TIYUr1nz>(zPEiYGr!_$8+Iw^QrTk(2h< zU6r<`DTXic&;Q~#b%zjhm&w&HsfQk}Wynh_Y8PH?qkmqQ!%Ii!Y~}jJLDPCa-z*AG z+O{=v{`mtF&uuW4ICpIAwF52Tay{vH4?g>uGjrbD^V9V9)!v!8BHwnh+xFSDZ*J~4 zUVQ$^o?OZLllh;H6*7F8l_Fo`GckB|N3D37VxQpK`?9O~j~IVl8J)h|NASE)uid(% zOAJGtdxg7>%-NOZ>bYw5Gx>KG7TKR_VwVKnKlSMG8^tsC6(?mq5t{t^d%?Y_RT8JK z@XfkuQCi+;|4ndG$n`+86-K%udA@n6dmzlq&p;5L!jW%qau&%Zo<)3rTYtJ^1sn_6U7 zUkKq6U)tw1=SBwq!mdp(cK=^;KcM{Ysl`U8S`TdadMvGSmK4)Zz2+C+HaZHNKIFr* z>#@UX>t~0)hV}C;%ocd@3A>Y*`j_uKa%8 zye9riOEpubQ8i!9`~tcBC-=U|cm1x7q4@2-r{K6tDXvmy27uRfs7rgE*VFJ$|F_ikL_Z`EtR`SI_7yS)pn zB_=X1pXG8eD_Z<&()O)~Z8Ya@dRD{Own{(RZNd3nPiOPr*1WSME#>vUU*>1#D|VMW zO|D7b8y#_e*EF^Al^qt#Ru_EDE5Grgcb?X^1KZ7Jc1^Qbd^>mbt9d7u&F2k#xi59e z?`>ziYww2tUsl;K8^2IoX`icy;h%zJpEvh(&Qwg!lVQ4)7ukQ?JH~C9bb9-&P`0m2 zcpj(bUz3eL9kAZeDMjdsevX3U3`zMNMpviq{4@8_Ub)_dMz>dMeNH<(>4g5CwMqM; zm)v{tIOv>Irt6DaH>GzfRfT0;x}W;MPW})mvv}|3x5wG`RG%v= zJi&ZEI{dGz_^v!%&Y#k&CvRzA>);a3&9%aDdxnJ3X5HPlXY*92tu~dJrM%p@kZtc< z1C`m4Zi=Ql?;|MUA6<0+HZUy9W%vd@g!XYTZHvExh?pPSQPanF-I z5pi8(X4=D|ygK&jq8CNnFBkv4x$4M~W1TCewC(@%(*MIUwrw4EYdjygxoxztt*bsc zeVv})y}xVbT{(4g)348Ox`acO9Mc`IZx)UXt>8Q1F<-Jv^ZWnp-=D_k#`rF>f4qOu zVVT>LCbpER2v_rM^gJXjUBhtv60 zwQu{oxX|s_4hh^iG0A<>&ZxB>tZ7pWTPGQpfhH>NE;Z`}A>z?TsIcIpsnk zB&O{9`uL|pUt5-5Vv2!@u*jz)D<-`D`r&rUh1Zp>y8UgDI){S)IIS;R|2C9QW1e=4 z>-}lW!V7xJo|cDI+X=_sj;&mGChaOeYmfEz-JiDXpSdt)>eSaIfs#Dxc6rZ?Ztl8h z=KQ?rMEZW_Fc-_JQm3Hla?yLLTAK_XEec;9@^RU`x*J+MtET?DeZ`+%S6+q3t&h05A#D4m%kS77We$lSn3u)c_K#;l=9Ws+mcdyw0@>a_AZ>MgoyfeOnz4*%~q2dn?M_DC7r_1wHO`+UN=`-|Nx*%NaE zeth5i{N8@o8>`nD7R{XFn5Oz-y*q8Y|MbRFkykExEijAiNP7~`Dbwt`pidz0xAB7QoDU6pxA^o;2vhZK z3ZL`MV(Si#?SAj)Of}@aWU!@p>W_&#How%7JAZSr+|oI3lBQlyWzAaYlWzOx`9qF+ zn~JUXUr$ZQS%@yMUAhR?5v(qw#V!X-}m}k*0v7qmL^wP|6PzhRAF=Z zUshX;>~+&b_3s%KOSjJb+gYF;z#jZr^NHA^`m^W6a*mlOeAPU#obT_Z@2_%qnSWVx zq;F1Jz431AGZ(WOzKQRhbKuE@j(O$c+7|>roILpd?)B{||2)56J~&n4@_yx&{nO_< z>*oCD+9ofp{J_tyU+=F#R_~3MtnY3V=W@*78@Q}IH}R%wk?5TqN$p4LoaS%1y6V+Q z^KEavOjmYCq|3}bSoUjAp6Q(1U)zu0{-gHTxc|~A+oxWy`zO49C=hx1*8$`Hg&QL; z3VY6aJVD55MO37K!z4CU_5{hkJ0?+Fj<3$hdFr2>#Fjs=wfn^X5T)ae3f>h_)raPp zuT|O7qGWq``WMdDuo&r}_@W{ZxAYZ=R48h?;Wcgp*6pl#xEg>6SK{(kcQRrQkWYkp^rB=!Ee zsh&UkO~69ckb9yYdVXEeCbKLPF8h4?6d)4x>(aUO6O6_&yM9iXG2PegqD1%#n+q{h z7EJI-GdQ5ldV2~}rtdnTE$@J)2bidt6#RZxpY!+ewgWldz`oazB=c({C1&K!E;A* zo*mJpnFsz_J$CH8THw|Y8{gypuY^n3q&0KZj<=i3-@V=Z{_W=flHYE=o{_#jB{5g_ zLg|_XjEQ;u4Aqu$k4@{ByjgrwJYbRTYTJs}Rcm-lxemqlyz@HrWZE;HiHvs_T(Ah! zIM2OzviM%}YWugBLv52k-gb75UcVsQZhF|M)4Nv8;Xf%Swm&TGqNEJZ&0jqH_mWP< z>b~p~-K+c8S&}7K^>J%R%z};!jB$HJ*$&&klijl@@XDS;&q|HIf4JZMC|LAU@#LkB zuGcM|HE{22OuwhP=0(V?U1`=KpYF-XFWi0ap7;CmfB)Y7cu-RD0)l`)-#rOMCj8 zT16|=l8Rgw?LXx8b>?%qYo7uSmTx`i;+gpF*O?keoz7dQQqG>0V|X zROSneV@>`2P6b?eOJ$ z=Wh)R%4;;4FXYgAHFbNno{rh=+4LwOw41r&plr@Q2MakIgz(rP8a=IyZ`R<@yT^E zxnPIx62vCKdHzab)Mgpd&(e&U;aX)`r*SoI(6;4_S$qD zny$^WD$zWLHE`)A9;?7BYfWF*ZddST-kzDmX0lu>W8xQv%pA#d*BO3Z3n$ng*{Cor zT1CXEJ%M?a_HK@x-Ft+lwwA5nf2;OB?wjDm!29`Ld-j@kY*+WXKda)h%(k1mWbC9= z{PqgI`WEJLSI*UJW5D;52mRZt*E6V2zibh`H}bRG?0Wa5dz+J@-?UXJmfb0Sz0gzW z6#pr+SNfOBHa`|PLkJUvJ4&LmT(^Dm(%r51CfZpPa~X-=fBA{r37FLH+98(NDf;|M{BW zy~8B1x;cRLjPP;CBPS-CGwykOYI4wlOOLh|}@K_%kPe|#qY9qC9_hmTReX{i=+hnu3Vnf z#n_>gzwFxdI;UxD%~Ry&i*Tu~4_ayQb@QKl+68wfg=<%SP4aBf*OGeB>fgvJlkUG? zF8$u=x=qVh>{Q*ev^cM7ZKP7l^J-6awz{qIW)H1GSC&ZkMlCjeQO53lU5WMhPQ8^z zEmy2wXzpN@pPLot{)9{8L9F=c1c9FChqs(!-w-h4s+nbyoJZ>AvxYODcUd~@UFHy| zAIJEg<;{WJ+tq&`?=rmlal)iZlcf@kJ93Xaoh}iYlKLRZS!Wra+G{Qeh8f9*Z*?DS zC};bxEZiQkwt@fIsUo)f)AtzvzB#jOQu-Oj>$P7T4{zSLv-d=v^}!2sx!bs(|6B3> z-H#U^uIAsWmD8$Sf1!=bL5=^)GLD)*AuOld*78;EOkJp)_S4{=Pjp5G$G1BRZ08oN z6y@|%S`q8hs%y+N&G7MGzO9zQ{p;plTEW3wmCVPnMciq*)gRrwDN1SVR{!tjNC)~rs>Yi+QJiy`h#Dn|}PP6&j54XDizmgDEbT*DFvU}a4y{UOI z#{S#7_x`{4N^iPIUa-rA442IwE$f8irm`-xOp>)!s$9%uBXs6aj*y;#jf`%hiT!L} zvEa0u1&$x~JoKF>b%ST|$E#}V%jcZfdLVSxf(J~OZ2~+WCh7Hw+%M=+t=?S!Cu(i* zyMuwXhJAfpdnVRbec*K$VVI=Tl>DM~L&oNuug#lp@?XgN`stzSpWg*a8QZH}jrV>| zQL%pz=lY<0%hcl;wHKFmm8JQc$xUKmRSy@bzh$hqxrEKN!>W42vqP63J!lKv`1Hx- zMenBWm4EZN)t#6`c3p1Xhjv(oE}@^qM#cz-aLUl0{M^O#%6SG@Gg9-WJiHkkf!J(6?s zl7U{4TK9YU|{3DdyDLtixjJo3r*!%W5bPxORBO{j4ypy3MioGfmm7-#*>5 ziuKspRZ*@drmYNXx^4cqyXIBZHV-rQ-FY55=Ea$@lVfd`7kZj0+I;XyyLg&cduz?y zX=^6#wQF`W$=I6pH*0lJX1Vm-sN@Up%+^QF&%SmnW_lVo?~-k^ltf&;tkip!%(L;Z z6?B|wbjjvtnUUO)^zNA{myR_r;*g)u9A9G>EGRZ5zpo1lvf3*KH-c{@_=6kQ|B-CryDiP~-?BAva@zRbZMQxD*qV^7}<;|X^ z-eYZ(`h0l9a;7aiXWzbBxZzTBjH*Id)s@*sCPG5uamGuo-M(nE;qVH<;&ZyLkI#S1 zIh5I$awTD(Yq3xAidi!YD`r@Kh`zi2?#Zt*Mt8z4s~#?mpIiK7=g!{L^ z7YnCK&y4SG6Z_3}JQv&S?mcIQnDH*{DNgPju4yl>DLrlr?tV7aWhH-MjraU&0&;YN9Jv`d>#VtxPj_yv-eI=6TVCGz<$+;Y@#cY4*6`bn!!ZsFW) z67}prgVU`gH(%U&DQ15COq|gAQ<3i?;)^!RmgFz?nJ*K*=CE+;q?B)$qV-z**}oJC zt@V*~bX=tICS3Yz*!HlME&mo=%-}6sw^$)EB2R0QuKJC4W*hHXYi_$e-}i6snTazF zwR@?&Su1s~%+mf{#cJksL#^11we_?Vm$Ru7`;6Nq$!2oz1$m^|M^<#Vx@*W>3m9E@f1>tDA7U#ijQR&-zyzZ@Rxq zyk!+EYPndd!bnI8VC&EjjnN{rs|vgdbpaj(nTb^E1Rw(o&0Zwpqwd}rD_Q_o8` z^JMiJrp-U^RTy@qO;O-oeXMih$G7*ozJpPD=yw%yw^I@xOL&A_<~W^R(3;m-w#BuJ zG4V*bfMZa=(YGDf9WDy-h%37;v{CT$-|Jg=`Rb}r&c!o!b=k`BInSPA`7V3Kre-HU z-PwVc1qE1n_b*xQ_waw{OTOQKc80&G@ZU1!2J5uBE-hw${p$kuww#L*EB6dop;1_O zevkW=cA=+J^>*2MzO(5%d6sF$9gVV+zY@K#bw?B(PEa-P4lZgIP+j>#Wu=Pv%Y?_)Z3q}C^gH_Qml{rqj=+QrM|{2Z32nDp-d z?Ej$j?}Fq7wc%R;-`B={(P|t`}3Hc8A=Uk?mqU zbH-D@y3>JPw*tx*`E9>?SJFglYFhg8i+QH2{${`V7IWdwn(3>Tl;-+&XUv&aq1{?s zuv%|@V6UBk)Y(5AAHc;-xf_wOr>g=el#vY9G%enWizyEi{-cZ6=4W&O46 zaK4MBl>g>!wy&Q_Yp*Ko4O%_h%4A`WvD>BZ6D1$NZ`m36DzYZQ!^Bxgr0UX(kl-en zr!i8yT#T#qHd}3N_jF5-{Ip`zAxAI9PJynOMzm z>EzrMO0k=*u9vGFb8>QeweIMIclIZ&+bu4?5%_xe-pPIHYra~9>pb(Bd2W$o%}U>0 z$3E^Co5(0KdpehZ@e!Fu!9q{1c{A69ZFpMZshm4$s$i_j^!U$DCb&+@J@_`Y_m}_o z`27z9+J2sMdTH>^Ea}vqn47cBR+(BQ7GL-{J?^9|uf+8a>xx$VJ?P&McR6vQcCzYU zsh@CKR_}=uiCF}{A zpQ*aXb#3mREsVzsq+7o81l%ZC9_C(O`KYB`d{ua z2yQA5c{p+A{HterI_n-43jNp|AhA(F=En54$7$>CusE-EQ}Wj6d@R=RjB9qriVq?c zx7FQ(B1|67)H`v#h^_U(QUfi?0#%(h&)u#Zl3#K-9xfO79Lqo5>6*t1&B=9!tOhd~ zV^;-cI9m)4Db8m5Phbk|#YV5^?e^*v7Oxd*T$fSciHyad|`x_QAOp)ub4_z5k z98&akQ}yMzYa8$G$`S~;aVhWG*}Sg(9_80#?_PZ9RvOv9S$2Zb*0RZYPQ6uyHy23V zINkOt?C~r|(;mmxRnwMD$tXI~mhCPH%0kd{n!3+! z{@(P=%dav|h|ZcQd7?Gtbyf@i$rskz_eApvYVrKOUx`5nWRGE}27_=jp@xw%RVuNgpHXKJ^&v ziJo(9p~BQ-CB;wk?-%Qr?Om(u{C8=}`E6MWZy!F+tu)mw3iCY@z^8ER&_cQzv988?4R>3$1cI(7^A^XM9v|kJtRPOtzD8J}={p z-v8cUZohP1ooW3oL9?ehC#EeeQn)-aq5_tc&gW+L`Y}=1hum zIvYHb*X*0OFdBNeJPk!r{HpFgG%(+r( z;Q#Qu_MSy&>oW5*-k1OQ^{Ar$y~y81PgjaB+-#)$@Htcc9ogdTvz(?D8?1ld{WPd$ zne8T#H*3Acf* z_UP$*cp|-J?21Jer@ol4I_X{UUIWIGcPCfvvJe+#=QXq!-4e1+Oi%Py7~2w_-b0G) zLE0i`Uq3WxTBrEhM_;(rxFqv;gY)HOs*@yia*Q+!?bwStmdQLj@vyYsXbXFHXu*b% z&@ds^-i1LMMccTZzN=WmFwsq`^w3l54gLpq3Z1wyNB7$?=LQjz!=DY9`R4MTRx&E) zN@Kfs<@TY33&kHB{v5c}==tKz$yQ}@^Xz$k_4?iDxW;X`(&694g{t{(4*z!R(yTz$e?a_x1VAAio<32?gcDf8Htr?DQW z-DLE9WA>GZ-kQ@=mL@!Bo8Rfwq^X5HDt&0YdHvI6k=iNmpC;Hfe?79{P`SXm>rKxN zEOs=0<<^_EdY77<>A`;s6RT3~|K&ASy{_Nyu=l%QWxmwJ@Z2KNsn<)&9n>y!ozU(+ zymEy){q>UE0?Wq2)b4ULCq0E%Z^M~$EXkC0(XX=S` zwe4#69$b!L^PMtr$En5Z?%vYAutoLMtBqxOYmXZpNDqyy6WL-_clZ14?O~})eHLB2 zoOY9A#ga+emrk6R^O!#%E156;M4D^+r2pYgr9ubi!Pq;CBz zxx2qX?ubFzxT;HQw;iy!QFkyN_qxk9IROTNI`+{pa*q3woAKJC<~5nX1;w?sxi(o8QI< z&2Ct$`a~^4b*ijMI;B?eY;)o3Sc98t zTXYuRy`RbUcAfo)>!DUN6aFtbv+dm@+rzcz3;y#;ylm;HFtXCT{rYSGTByX#vY`dz*sDSy`RjJ4B;x^?e{dr{@dS_|}6UOV+g#C**jBdgHfduKV{ z^)88;G-K;Or#rhem+#uhI79Hjn|c23|j8KuEjZg0sxsSvkaY~|rw$>-FUyX>vb?%dTjPjtogsJi`PS8qFhzQ$B~_e}27 zmuCNU5Bw8U`f_W2Xv@2vP4(uEyzc{w^hACpu}a!^9BBBS$6TMZoslO-=al|w6Wl9@P$N!%H;8WMJ14eV2d&=5>#%N~y zE6E%!R8i{q;IQL!^_>Nu3=a4*v$&|)KG-gEIMin4s}*j)Rw;d7P{z8Y=#G`>idB=$ zzF)YSn!QSYUA5P`kf?bU!i}fWnS9yrKJ%*=C}aEUwe%kE->lt&Pg;|&lm>f5+Aa_1 zc^h>6c2j+}mGj@HCi6atKCJz#eClHB$}dS#%a^C5HJ>lMr@vY4R!!Q}%CgR;u!36^ zg_$#c7l(^h@-|$5tM+{Hb1vp}if`*SJ!N@tQT>Z~xr5(#hm@D6v)+bGzV!KOXw$ce z%dm3~vFMh~D^*t?=?H z&$Sd-TgU%cbhq%rWlU4|w({;etFh{;)xm_b(KDKUs*7fI{kxl;`%d@nf3~REF<){s z5>h1le$R3Ln5wy5&d&GD`bh?})NXIQpO@FaNbthUQ=CbR*NYot50#lpy!mqYoZr$* zUsu=JXYjAe6!uB4ZA_f={zJ}|@&FFb|JPP|-1*KZ`akT&*Bv|scciEOQ`ysW{^FC* zY!lkF;@clK%C|{7+t2*WtP=XQxA$#s|GY$>ZuV&D-3EVp6HM0fJn!z!lzztYI+=6P zg+(rjxAcT+7}v!(e|TJwZ0F=x-F`|ar;cI&p7uC)F2xsxTMX|CPDsBh^vB(EzM$UQudp5?0TCOv36Iuk@%FoD|Q|&sEwX+Jd^w1+kiUbRhO*WnZ+5K z_qocf^V#lo|F6P?_=%MVtCxOfd{%Jya7D)lf#99|YN_>NbCh#U=U;U6I->3JP$o?@ z>fi(0f@p>#%lBRVdY!FS_D4gOA&dAwhOWsTLf;=cRyNE1%Ql?(`-|>QDfXJ(a~{5J zlF|~kj$LLc(Ax1+>-gmJdneX&&VFm9antKdj@|x67o6ldTvlmvb?Z90bM~0`SiXO8 zGGBeKx{SG1py5(WLCuF(k2Fs%t5|bNL|bxU(K(^{uAd($rDR?(bycaql)v>>^M;$N znCdUR*>Y&b<&V*;-&(U~{oEIPwBY{RErs_l?*Fj)`s3*mfzz3K^x3>#9J|<)(ljB1 z@4LlB@7eVSe%e^nlosr`-~6*?VSqOKkLRoo2qjlEBOBV{k?Mz zm2c1uv%12zDza+R+M?BMwK?UpWcSOOE!t)M=CN1q%$Kjr%2Gs5)VoY@S3aQZ7-fB8 zvGRe%l8GPePCTA(dt$MO*`;~4gyW&4VYAH@la zOiB_-`%*t+%9Fgs?pc0@pKGkRH*M6K*vj(eO-0Sa<1dd-v%gCXaWl zebmjt5jbhZQ5!Zkvp%7n_a1#Zzwigwl;`JmAH2`bHPiUxzKZStejhk8lV|--=cCb0 zpWZEqmf!N%-E5)$((uDqI;WKE+hV2h^ZMf&)4f79%KL=&{bg5|jS-#Vb*tnyW8L1_ zJAY~2)tPYBH}&KUf3bs=`wq;uTXI5K)G9FRT15A^-2od9K7V+z`|{=c5-x#Hvqa7s zWpneMe-!Bd#7bz5J|~yTYwP)6+b-S+V=gMpwRcnfsVMgBwEfB#E}ly#3qEMrZr;T# z-ZqJ+r`*%`^Xf@~E-t%$T!UM^7N30XamA_f@U+0?D!==rY`dgrK7@|&I{l8dt$kdjpfeICwVHe4rx4^xFyd)Zl5_vb>2!FyF}epGolxNx-y@c*BvGyB{06sNf~PEu$55OShpvD??@MjKYJUb>|rG)*t? zlNoon;TG=NxBQDAE#rK&S1-MFuIS{``Mo>m^3|sF9_g*yCc(T)>_y~?o(N9$T!$db zV(2@d`YC-=%BLbq zaN-0}k(G;%mIvIrRIhdSu}x{;@5!7o{EO;ep1X1Ow}DN4gjXq-K&A)-dsg(tf=I#U zubn!Vg@d)u7c_PkiqF>!__3QKJ#yaqL*XHrnCHAmi zTh=b5ppq*8_K3aEBcVH|ui3dJuUMcyb3UiJygc{85ZBr7b2=BRUEK9$@73zd6`ivS zZTIxm`tYCcy#4U!f3`C5qep&(8vgj}ufVi(LY@nE)n*>khRT|@I$_N#N%yrr37q7K z+*}>>@vJB7y6CoulrX*aj3;Xf_&zRBjh#B-$-4it6Q?E^y*j?4!#7Zrxv+KejSZiT zJh{8FcI>arSZ!Whd?`z4er0@y>-?8eOpXr{&Mr4#@O#z1S4eGMQgL+l>T@dJ_pOFgE2J=z;oF=k_jYa4-rw`}+v;h|`z-G*-_xA5Ch3xe^GegwTQcmMX9T7_x_tk_ zEdGDD?;KM$kaU~T+Z#OZ?9H@%qdFV+!v74Vf=iY?c-g?)5N0(egZ;(zd*AYfm!;|Z%w26xk$22@zudGb z#wMNHI!vJNq5QYl!*47vC(0c8{803bfsoVWr1W{O_D))}+=&0^W4ZI`>yJsV`k?Yc zT=ye~^qNz(Q|6EdD<=Cu7~O+OQQ< zFSX0Pm7nJ{k@wd9eE!y@SN?fRY`v-V_QM(9t5zaAkM5t9w4g~!sV{q;LDb`SV%^(L zWEjf%HThele7twUQ@N!!dD<(_8LAsa89tcFoXEQtaav9(^vg2OEgb5pi5twG|V)Fl}%Ikzi|qTO_kVD6kuR=Qai%v_$OIm6D^j-FM_2$rI`E_d3f*Smf2}n zyPFaudlho4!bDY8|GIkMW5=TGNlr%#Zl{WcOUXAe5H5_6GBt0iQiN0av9sj7#i0cV& zM)Ve?Xy>AkPjU0V)LB^6{Isr-d%s^GGP&4IMbUBgoh27{Rn6GEl=0ugizjb0XK{Ww zvi?GZ-$mbuRTVv+rp+r%=JxAluDW=8nallKU$fpVSuGPWyW+%#P4Cod&aZ2{kdot7 z5^uEd)O0ml4c(cN!o@E>U2|EU9wE>4P-;Wu#%)V=GyFHI+&Yq0Es$r=b1`0acfyl^ zWVLB3*E*DpAJwQHI`6l1$0e_aJCAvuONmoc__^%3)!GI5zP#lZ4?S;r(6CQWsH&>- zRE&#whq2c^<+`P5ao;}NJ=pJ|_hCmdC!I+k};?FN2+-~H~-)3DHd={D`z z_4jShuJg|7{~%DmNc_xit8DKU@1B}9D;fRPtX@*}PuG&uwf1_tW>=2&_TT&}k2VPH zSj%|KMsCrHi{_a@O*$`K)`^ri{q$SKSzxgJalLZO|7W6~&l%(<70B@)mJE4(b@FGI zW5RI{&lbK<`M>4+qvy@x`qk?B^%nQ;S8uNGv3#q`@@VN(|J{cpzwZX`zbCUtXBU%aTs_0Wv{yekJB!8s9#L6ue6jyc92aY9l3!XtUvJ2V z^T&>Nl=|kBzf*TfQQn+-G>|on$7`q3lU*qan_js;h-KowomQP8=3j1D%b~(PKk4ab zjtRdxK5U=}e+%zOP%S`5;`E&ph4v+56_FQv&niUNSyXxKe&9i2JD4nq+-Kf;RkiUQ8Lq*{SXB4-epM22NB26~jelLgRpSJ9Kn|kY;cOT~x@6G*k-BDTT zO!~a3=8F!*-m$sy|0JK;;_{7;5`wHai&FfbMeQ{BnetjJ!b9iF1KtO^>fM^r8-lBU zc1oZ|ZjU*gMa4 zlu>2kIG!qS=q^LWhL*i9jdS-3$L^`eU%1NIpNe7GxafCNih%tod!A)e$|i?NTDJJlGTnIe_4N%}t9g7Hqbg%w z>OC>Kz4LL@ipH4}E^QH+_9|G!H&VAr`rFx;`JD+C3D$?|cf{BD=X`r;pq9_KbJ3xH zX7$Dz*D`fG|CQc8BiEe#?f<;$SLgRGJoD$96t}U^FOhy{`GA;B60Qroa*ChMJ^Z05 z!_57V&;i|LKKDu%X&3mn9@=nwg&galNs5Ic-D)3F=T!7xRjc%QXu^~8cZRF-|EPeF zwGUhCrwSw{=G1OeJl+$K*!!L{vA0F|z=UuWz z;QY#ak$)s@cRsM#+IzPD3YVqfg2_=+uHDl)bYyR`pi+4EQAnTut^A(ahFVvDwYxR|cfrK5Ewwcw!WwN~?w4hJRNC9IhK zGT3&P85vEv-pkWxx^DWXGs{HhAG_;#=aH((VD>NTq;KFGH?&31RsVb6I#FUQWAoOqw#?ysWCi*xFKrTwl{6iwc_%a(tV zeYo1pX)|~;Lz9lo?S62n*mb+Iqm;hdX8+FeFYy*RGKmtWJBpbXynV9uFc;^eZF}lW z9QKEnIeq(cFlL7=_iH;XmK$#iiUKc%&nj^0ojzgG0@7YxB9^Cy_hXhNY#bo_>-&sF$O(J(S2-d>l<8RJbo+sZ*i9qlCJ&iD)M8&j~t%q zA@ko&>$1O8t0TDh^7I_;mxod72!az%_scigxfKIwA%_veu> zSkzuDYdA1x{)29=8>v&ii0{0-vA|yJ-0c^lGH2A^+~HMOZ-1pc{asfa%cq=v=7*{L z-b~T_&x)oz2s;>{Rl6fq{hxx@=70*>1CksYdf& zDa`+U`K9Q_qOOqJ>KpPT%=XyXyxn`p{%-ZhVkvpgnY%i-WGxH18@iw_wy{koVN>0~ z-^biL4>35hY~1wt`=06S$L~!RDCgiQXQB*KQn^c6b-{ z{iu^h%qxy9OhGzc1}_eA$o{^Uy<>;;LO0ci*%5VmXG_hm?wOhPL94GS?&GhjqtXF; zGCU_T1|LaIz3Dsxp5M z?{cvTF+as(JU;B($H(xPC3Ehq*8;kWkJt44>`?NIYv%e~5&k?_BSlY6%Pv^%ZNiTm zx1x?M@%ED4({Gg}>pR-P5U+p&K6U8w|y)eCNC@xEI7FN<-F z$(rm%cOxd|Nv#c9`!@F>yZVcSRTn2e`?8zghR>uUaF)*QvIOI)clT-jXl5B{9drG?G7k*go{^H5U_m!FnE50sV(WBcl z?^<5Lmo2;JG2im==TcI0zPPxc|8hc=>%^;POjSO7;b%8mv5-qVbf=Qj?2|{oR5kS< zob#N|&+SdZCl-}W{o5I*oeU^9WSSng?9ZYL`#*h7x#u1J(ahl4wC31@8_XY{eafoV z{nJ#n;YqHT<$>sQcIK0LrBU}YD$O)L-DY!JcfhoAO4O9^dt~H!-*N6MV&TeXR$qI4 zw}|wr3(l%(@5N12POn*eNg?1!6i=?(()xk!KX*hlWjhU z&Zyz~rnk1;?w0D`gkRHk2x-oVW0NQ5=56@ZB^iiCSI(=F}~P-(q53 z)j7t#ojUEHfqVEO@44>VtsM3h6wd$oXrK9Popa|3_aF1RnR&o`$gyJ{z`7%_MBu}|^ zOng%`y~{#5KEq_MoSRD;V|nAzBnj4HXTzd5LUH#3+>ENiul0CLUL^QEY1VhXz0-)1DGus(ahf8I*qBzxZCz)_q zZa$Rlb%tYU-Rf(GzGuSL25VoHem7a?`eW;=zKkgsPnSz5{Ji$L`g(Eo_0Lsz=d3fc zo_FUxli~HU|AoTS%C?%T^-N??wq{;`qwUd*7EPu7zGBY&kBq1E`fpLz;_B<1@9_7% ztBavU?G={aC+`RtbgXGSwDKT#a-x69(vT*H)fePCjSlUx{M);At0*&z=gYuz61~D+ z-Hi|3qDX z_*rz_GNZHJwprJr0*zm>P4(K$T(RWhieGoXt~>l(JFfkFs939;*6e#xg8H_`Z>Lyq zzGCCjyuGANtIzeE;U?Ml&%!UC_!`4D|A~vrajSnU^O`O5RBvVG^YhoeEwiy<@aa9t z)Em3Suun@iW!{A8lM@y?@#TAmW!71W8@5m7$n1D`SH*MJKD|svi>#mD<2DDaUSy=O zeUW_Mqr#s#g6)BP6P}-!=(=&LY`#WIlhyl`vvV#z|D7e*rn1muFU#x&7e#np7b_mFf1AnWt#6jSt$QB-b*kdhjO`BmS5pmZtEa4)r?+&S(k78lQ==;{Z=9MG zZYm=fWXM}LttQ(u3H+k*6pIg3ih=L zx@R0OgdLI%ne@%K_uZL4jW?XsNQ#bw6)~QX|_FWQ?e_iPcLb`*Y>bus{W6n&h1g9US5Iz zr~UKn5+*bJH*O8GF11RqF1K7MeQ=82Z>2TMwukIdS^x9D!o*8%ZQedN_D%S)G)r`; z&)sQ0jT1ZV)tzspTz?wfwLr#bIs2LC^B0}+u8Lj}!gC=1h;qW6jm?+XCiJGXeN>oK znDD5ONr#hv59{=(8(mwU^_^3p7wjVPm0<{ z`Nf^X}fAF+S67nQfomzfpO5@7a}t zod>3Ks`l)DRiqGA)Ua}1f$>uhef|KU6x0EPCQl z@voJ6)`WYxVu7nuCs>3Eh{i>qitqi~y7S9B^SCXawnsPazR7=Wk*&cd-gxD<=*nN$ zCtkl>umrYAhoI E0A|DcTL1t6 literal 0 HcmV?d00001 diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index cfec3209b98..f68970ae13e 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -20,7 +20,7 @@ let version = "2.26"; - patchSuffix = "-115"; + patchSuffix = "-131"; sha256 = "1ggnj1hzjym7sn93rbwydcqd562q73lsb7g7kd199g6j9j9hlkp5"; cross = if buildPlatform != hostPlatform then hostPlatform else null; in @@ -48,6 +48,9 @@ stdenv.mkDerivation ({ */ ./2.26-75.patch.gz ./2.26-75to115.diff.gz + # contains fix for CVE-2018-1000001 as the last commit: + # https://sourceware.org/git/?p=glibc.git;a=commit;h=fabef2edbc + ./2.26-115to131.diff.gz /* Have rpcgen(1) look for cpp(1) in $PATH. */ ./rpcgen-path.patch @@ -73,7 +76,7 @@ stdenv.mkDerivation ({ and we lose early mismatch detection on 2.6.32. On major glibc updates we should check that the patched kernel supports - all the required features. ATM it's verified up to glibc-2.26-115. + all the required features. ATM it's verified up to glibc-2.26-131. # HOWTO: check glibc sources for changes in kernel requirements git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h # get kernel sources (update the URL)