Motivation for this change

Close #70104, #57153, #56361.

Things done

Patch for CVE-2018-20030. As the fix in libexif/libexif@6aa11df seems to depend on libexif/libexif@5d28011, I also pulled that commit in. The fix itself alters ./NEWS in the source tree and causes a patch failure when directly applied, so I edited that part out and saved it as ./CVE-2018-20030-2.patch. That is a bit hacky, but the best I could come up with.

Also:

• Use libexif/libexif@c39acd1 as source for the old CVE-2017-7544.patch. The resulting patch is identical, but comes in a different format. Therefore we can skip the patchFlags.

• Update the website, as http://libexif.sourceforge.net/ shows only a move notice.

• Add erictapen as maintainer.

This needs to be backported to release-19.09.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @