This update bumps the package to the latest stable version containing a
few security fixes:
- CVE-2018-12392: Crash with nested event loops
When manipulating user events in nested loops while opening a document
through script, it is possible to trigger a potentially exploitable
crash due to poor event handling.
- CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript
A potential vulnerability was found in 32-bit builds where an integer
overflow during the conversion of scripts to an internal UTF-16
representation could result in allocating a buffer too small for the
conversion. This leads to a possible out-of-bounds write.
Note: 64-bit builds are not vulnerable to this issue.
- CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting
By rewriting the Host request headers using the webRequest API, a
WebExtension can bypass domain restrictions through domain fronting.
This would allow access to domains that share a host that are
otherwise restricted.
- CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts
A vulnerability where a WebExtension can run content scripts in
disallowed contexts following navigation or other events. This allows
for potential privilege escalation by the WebExtension on sites where
content scripts should not be run.
- CVE-2018-12397: Missing warning prompt when WebExtension requests local file access
A WebExtension can request access to local files without the warning
prompt stating that the extension will "Access your data for all
websites" being displayed to the user. This allows extensions to run
content scripts in local pages without permission warnings when a
local file is opened.
- CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3
Mozilla developers and community members Daniel Veditz and Philipp
reported memory safety bugs present in Firefox ESR 60.2. Some of these
bugs showed evidence of memory corruption and we presume that with
enough effort that some of these could be exploited to run arbitrary
code.
- CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
Mozilla developers and community members Christian Holler, Bob Owen,
Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee,
Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond
Forbes, and Bogdan Tara reported memory safety bugs present in Firefox
62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory
corruption and we presume that with enough effort that some of these
could be exploited to run arbitrary code.
Source: https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/
Merging staging into staging-next even though we haven't merged staging-next into master yet.
The motivation for this merge is that it's been a while since we merged into master causing
the 3 branches to diverge too much.
This commit renames the pythondaemon module to match its module name, github
name, and pypi name, which makes it easier to find and reference. In order to
avoid breaking any external users, I've left an alias with a deprecated warning.
* znc: add option to disable IPv6
* znc: add option to enable debugging
* znc: add option to enable zlib support
* zncModules: match znc build inputs
znc-buildmod expects modules to be aware of the same libs znc itself is linked to.
Before this: znc-buildmod was passing -lz but zlib was not in the include path
'cloudflared' is a multi-purpose client-side tool for CloudFlare Argo
Tunnel, CloudFlare Access, as well as including a simple DNS-over-HTTP
(DoH) proxy tool as well.
However, 'cloudflared' is NOT available under an open source license.
Furthermore, the exact terms of redistribution (namely, if we are able
to redistribute binaries at all) are not entirely clear to me. As a
result, I have filed the following bug report concerning the terms of
redistribution for the source code and binaries:
https://github.com/cloudflare/cloudflared/issues/53
'cloudflared' does have source code available, however, and it
encourages users to use 'go install' in order to set it up, in fact (or
download their prebuilt, compiled binaries). So using the source seems
to be encouraged. Even then, I'm still not sure if Hydra can serve these
binaries.
In lieu of a more pointed answer regarding source/binary licensing, and
to avoid keeping this expression in my private tree, I've marked it as
'unfree' (to avoid Hydra serving it in any way) as well as compiled from
source (to avoid any 'redistribution allowed while unmodified' terms
that may crop up).
The dependencies for this build were generated using 'dep2nix'.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
Allows for adding Perl libraries in the same way as for Python. Doesn't
really need to be a function, since there's only one perlPackages in
nixpkgs, but I went for consistency with the python plugin.
It was used by "survey" module which was removed in revision
d97920eb9b32dbe17b85f8eff12928d26c19fd3d of their repository
on 2016-12-13.
Meanwhile, WebKit plugin is a separate package
https://aur.archlinux.org/packages/remmina-plugin-webkit/
not packaged in nixpkgs.
Misc cleanups, but mainly this:
Before:
- `version` could mean either Firefox or TorBrowser version,
- `configureFlags` was hacky.
Now:
- `ffversion` is Firefox version, `tbversion` is TorBrowser version,
- `configureFlags` is much less hacky.
Vladimír Čunát
Matthew Harm Bekkema
Frederik Rietdijk
taku0
Will Dietz
zimbatm
Arian van Putten
Cole Mickens
Domen Kožar
Will Dietz
Michael Weiss
Arnaud
leenaars
Ales Huzik
Jan Tojnar
Benjamin Hipple
adisbladis
Jörg Thalheim
Robert Schütz
Jörg Thalheim
Joachim F
Herwig Hochleitner
volth
R. RyanTM
Yurii Izorkin
Michael Bishop
Michael Bishop
Silvan Mosberger
SLNOS
José Romildo Malaquias
Alyssa Ross
Andreas Rammhold
Austin Seipp
隠岐奈
Andrew Childs
Renaud
Jaka Hudoklin
Franz Pletz
Renato Alves
worldofpeace
Jan Malakhovski
Drakonis
volth
Linus Heckemann
Anatolii Prylutskyi
Mateusz Kowalczyk
sjau
Urban Skudnik
Michael Raskin