Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: ae9ab324b7b1
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: be7913f7ddb6
Choose a head ref
  • 2 commits
  • 1 file changed
  • 2 contributors

Commits on Aug 4, 2020

  1. synergy: Add patch to fix CVE-2020-15117 

    From the description of CVE-2020-15117:

> In Synergy before version 1.12.0, a Synergy server can be crashed by
> receiving a kMsgHelloBack packet with a client name length set to
> 0xffffffff (4294967295) if the servers memory is less than 4 GB. It
> was verified that this issue does not cause a crash through the
> exception handler if the available memory of the Server is more than
> 4GB.

While I personally would consider this a pretty low-priority issue since
Synergy usually is only used in local environment, it's nevertheless
better to patch known issues.

Since the fix is part of version 1.12, which doesn't have a stable
release yet, I'm including the fix as a patch cherry-picked from the
upstream commit.

I originally had the CVE number as a comment prior to the fetchpatch
call in question, but since @mweinelt mentioned that https://broken.sh/
uses the patch file name[1] to match whether the software in question
has been patched, I've removed my initial comment as it would be
redundant.

[1]: https://github.com/andir/nix-vulnerability-scanner/blob/fb63998885462/src/report/nix_patches.rs#L83-L95

Signed-off-by: aszlig <aszlig@nix.build>
Fixes: #94007
    @aszlig
    aszlig committed Aug 4, 2020
    Copy the full SHA
    9e476fe View commit details
    Browse the repository at this point in the history

  2. Merge pull request #94041 from aszlig/cve-2020-15117 

    synergy: Add patch to fix CVE-2020-15117
    @mweinelt
    mweinelt committed Aug 4, 2020
    Copy the full SHA
    be7913f View commit details
    Browse the repository at this point in the history