NixOS · Aug 4, 2018 · Aug 5, 2018 · Aug 5, 2018 · Aug 5, 2018 · Aug 5, 2018
diff --git a/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix b/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
@@ -3,13 +3,13 @@
 pythonPackages.buildPythonApplication rec {
   name = "pybitmessage-${version}";
 
-  version = "0.6.2";
+  version = "0.6.3.2";
 
   src = fetchFromGitHub {
     owner = "bitmessage";
     repo = "PyBitmessage";
-    rev = "v${version}";
-    sha256 = "04sgns9qczzw2152gqdr6bjyy4fmgs26cz8n3qck94l0j51rxhz8";
+    rev = version;
+    sha256 = "1lmhbpwsqh1v93krlqqhafw2pc3y0qp8zby186yllbph6s8kdp35";
   };
 
   propagatedBuildInputs = with pythonPackages; [ msgpack-python pyqt4 numpy pyopencl ] ++ [ openssl ];

diff --git a/pkgs/applications/version-management/git-and-tools/cgit/default.nix b/pkgs/applications/version-management/git-and-tools/cgit/default.nix
@@ -6,19 +6,19 @@
 
 stdenv.mkDerivation rec {
   name = "cgit-${version}";
-  version = "1.1";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "http://git.zx2c4.com/cgit/snapshot/${name}.tar.xz";
-    sha256 = "142qcgs8dwnzhymn0a7xx47p9fc2z5wrb86ah4a9iz0mpqlsz288";
+    sha256 = "1gw2j5xc5qdx2hwiwkr8h6kgya7v9d9ff9j32ga1dys0cca7qm1w";
   };
 
   # cgit is tightly coupled with git and needs a git source tree to build.
   # IMPORTANT: Remember to check which git version cgit needs on every version
   # bump (look for "GIT_VER" in the top-level Makefile).
   gitSrc = fetchurl {
-    url    = "mirror://kernel/software/scm/git/git-2.10.2.tar.xz";
-    sha256 = "0wc64dzcxrzgi6kwcljz6y3cwm3ajdgf6aws7g58azbhvl1jk04l";
+    url    = "mirror://kernel/software/scm/git/git-2.18.0.tar.xz";
+    sha256 = "14hfwfkrci829a9316hnvkglnqqw1p03cw9k56p4fcb078wbwh4b";
   };
 
   nativeBuildInputs = [ pkgconfig ] ++ [ python wrapPython ];

diff --git a/pkgs/desktops/gnome-3/core/gdm/sessions_dir.patch b/pkgs/desktops/gnome-3/core/gdm/sessions_dir.patch
@@ -1,17 +1,25 @@
-diff --git a/daemon/gdm-session.c b/daemon/gdm-session.c
-index ff3a1acb..b8705d8f 100644
+--- a/daemon/gdm-launch-environment.c
++++ b/daemon/gdm-launch-environment.c
+@@ -126,7 +126,7 @@
+                 "LC_COLLATE", "LC_MONETARY", "LC_MESSAGES", "LC_PAPER",
+                 "LC_NAME", "LC_ADDRESS", "LC_TELEPHONE", "LC_MEASUREMENT",
+                 "LC_IDENTIFICATION", "LC_ALL", "WINDOWPATH", "XCURSOR_PATH",
+-                "XDG_CONFIG_DIRS", NULL
++                "XDG_CONFIG_DIRS", "GDM_SESSIONS_DIR", NULL
+         };
+         char *system_data_dirs;
+         int i;
 --- a/daemon/gdm-session.c
 +++ b/daemon/gdm-session.c
-@@ -344,6 +344,7 @@ get_system_session_dirs (GdmSession *self)
+@@ -345,12 +345,17 @@
          char **search_dirs;
 
          static const char *x_search_dirs[] = {
 +                "/var/empty",
                  "/etc/X11/sessions/",
                  DMCONFDIR "/Sessions/",
                  DATADIR "/gdm/BuiltInSessions/",
-@@ -351,6 +352,10 @@ get_system_session_dirs (GdmSession *self)
-                 NULL
+                 DATADIR "/xsessions/",
          };
 
 +        if (getenv("GDM_SESSIONS_DIR") != NULL) {
@@ -21,3 +29,24 @@ index ff3a1acb..b8705d8f 100644
          static const char *wayland_search_dir = DATADIR "/wayland-sessions/";
 
          search_array = g_array_new (TRUE, TRUE, sizeof (char *));
+--- a/libgdm/gdm-sessions.c
++++ b/libgdm/gdm-sessions.c
+@@ -217,6 +217,7 @@
+ {
+         int         i;
+         const char *xorg_search_dirs[] = {
++                "/var/empty/",
+                 "/etc/X11/sessions/",
+                 DMCONFDIR "/Sessions/",
+                 DATADIR "/gdm/BuiltInSessions/",
+@@ -224,6 +225,10 @@
+                 NULL
+         };
+
++        if (g_getenv("GDM_SESSIONS_DIR") != NULL) {
++                xorg_search_dirs[0] = g_getenv("GDM_SESSIONS_DIR");
++        };
++
+ #ifdef ENABLE_WAYLAND_SUPPORT
+         const char *wayland_search_dirs[] = {
+                 DATADIR "/wayland-sessions/",
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
@@ -338,13 +338,13 @@ let
 
 in {
   php56 = generic {
-    version = "5.6.36";
-    sha256 = "0ahp9vk33dpsqgld0gg4npff67v0l39hs3wk5dm6h3lablzhwsk2";
+    version = "5.6.37";
+    sha256 = "08wbg1qbbr80wcpv0l24vfyd9w8cxanils928gjs6knr0lyxcsl8";
   };
 
   php70 = generic {
-    version = "7.0.30";
-    sha256 = "0l0bhnlgxmfl7mrdykmxfl53simxsksdcnbg5ymqz6r31i03hgr1";
+    version = "7.0.31";
+    sha256 = "14bb230qip62cn7k6hvgr18kxj76zvl735fkg6hpkrnnrqzdg2vy";
   };
 
   php71 = generic {

diff --git a/pkgs/development/libraries/exiv2/default.nix b/pkgs/development/libraries/exiv2/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, zlib, expat, gettext }:
+{ stdenv, fetchurl, fetchpatch, runCommand, zlib, expat, gettext }:
 
 stdenv.mkDerivation rec {
   name = "exiv2-0.26";
@@ -17,13 +17,31 @@ stdenv.mkDerivation rec {
       sha512 = "3f9242dbd4bfa9dcdf8c9820243b13dc14990373a800c4ebb6cf7eac5653cfef"
              + "e6f2c47a94fbee4ed24f0d8c2842729d721f6100a2b215e0f663c89bfefe9e32";
      })
-     (fetchpatch {
-       # many CVEs - see https://github.com/Exiv2/exiv2/pull/120
-       url = "https://patch-diff.githubusercontent.com/raw/Exiv2/exiv2/pull/120.patch";
-       sha256 = "1szl22xmh12hibzaqf2zi8zl377x841m52x4jm5lziw6j8g81sj8";
-       excludes = [ "test/bugfixes-test.sh" ];
-     })
-  ];
+    (fetchpatch {
+      # many CVEs - see https://github.com/Exiv2/exiv2/pull/120
+      url = "https://patch-diff.githubusercontent.com/raw/Exiv2/exiv2/pull/120.patch";
+      sha256 = "1szl22xmh12hibzaqf2zi8zl377x841m52x4jm5lziw6j8g81sj8";
+      excludes = [ "test/bugfixes-test.sh" ];
+    })
+  ] ++
+  (let
+    debian = fetchurl {
+      url = http://http.debian.net/debian/pool/main/e/exiv2/exiv2_0.25-4.debian.tar.xz;
+      sha256 = "0dp9y0d8pbsys5r4j1xyhn5liv6x0p4gncf90bcgnsp5shipzsr1";
+    };
+    patches = runCommand "exiv2-debian-patches" {} ''
+      mkdir $out
+      tar xf ${debian} -C $out --strip-components=2 debian/patches
+    '';
+  in [
+    "${patches}/CVE-2018-10998.patch"
+    "${patches}/CVE-2018-11531_1_of_3.patch"
+    "${patches}/CVE-2018-11531_2_of_3.patch"
+    "${patches}/CVE-2018-11531_3_of_3.patch"
+    "${patches}/CVE-2018-12264.patch"
+    "${patches}/CVE-2018-12265_prereq.patch"
+    "${patches}/CVE-2018-12265.patch"
+  ]);
 
   postPatch = "patchShebangs ./src/svn_version.sh";
 
@@ -32,9 +50,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ gettext ];
   propagatedBuildInputs = [ zlib expat ];
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.exiv2.org/;
     description = "A library and command-line utility to manage image metadata";
-    platforms = stdenv.lib.platforms.all;
+    platforms = platforms.all;
+    license = licenses.gpl2;
   };
 }
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "sbt-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     urls = [
       "https://dl.bintray.com/sbt/native-packages/sbt/${version}/${name}.tgz"
       "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz"
       "https://cocl.us/sbt-${version}.tgz"
     ];
-    sha256 = "1rrn0v4bhgar3mrgs931ifggb8kfg23fv5cgvskrdd7iyvg0z9wc";
+    sha256 = "1pyp98svh5x8b6yp5vfl0jhz8aysjm0dqvqf7znyb3l7knfqk726";
   };
 
   patchPhase = ''

diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.60";
+  version = "4.14.62";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15djfcl4m388vm3wkfa6yx0sglyp8zh04s7m7xa1ybmsiwjl7qbc";
+    sha256 = "1ar29ikway5im17iw9ag1fxivr7sbj8nhxxw347xqmp1irz4vjji";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.17.nix b/pkgs/os-specific/linux/kernel/linux-4.17.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.17.12";
+  version = "4.17.14";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "18xmkj1bmfrmvx6p8cl5l7pyv0zk5y3mxhyfnlzqwkxnvkjf5660";
+    sha256 = "1bxsiishhw6ichifqglkbcmgc0518ih396yi23clvrsfyj6h6in8";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.145";
+  version = "4.4.147";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1max0d1b1y1ndrfprrcyb7c9y12pkx2whxzlr70qypcb5jz0v7ff";
+    sha256 = "06mcilxd5qi8snycb5bhy52icbbwfl056xwmra66yknmpycyad67";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.117";
+  version = "4.9.119";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1c3r0a4fchg358zff2ww8kw789kah3bhr750p9qlsy65d8rflcl2";
+    sha256 = "0d8bwsma9j7dhgymcfbchr8k3503w5vp3p18mfqv81x6l40pzqa9";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -80,7 +80,8 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./build-fix.patch
-    #KRACKAttack.com
+
+    # KRACKAttack.com
     (fetchurl {
       url = "http://w1.fi/security/2017-1/rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch";
       sha256 = "02zl2x4pxay666yq18g4f3byccrzipfjbky1ydw62v15h76174aj";
@@ -113,6 +114,12 @@ stdenv.mkDerivation rec {
       url = "http://w1.fi/security/2017-1/rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch";
       sha256 = "1ca312cixbld70rp12q7h66lnjjxzz0qag0ii2sg6cllgf2hv168";
     })
+
+    # Unauthenticated EAPOL-Key decryption (CVE-2018-14526)
+    (fetchurl {
+      url = "https://w1.fi/security/2018-1/rebased-v2.6-0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch";
+      sha256 = "0z0zxc9wrikmvciyqpdhx0l5v7qsd8c6b5ph9h5rniqllpr3q34n";
+    })
   ];
 
   postInstall = ''

diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
@@ -19,7 +19,15 @@ stdenv.mkDerivation rec {
   # remaps /etc/passwd to a trivial file, but we can't do that on Darwin so I do this
   # instead. In this case, I pass in the very imaginative "submitter" as the submitter name
 
-  patchPhase = let
+  patches = [
+    # CVE-2018-1000097
+    (fetchurl {
+      url = "https://sources.debian.org/data/main/s/sharutils/1:4.15.2-2+deb9u1/debian/patches/01-fix-heap-buffer-overflow-cve-2018-1000097.patch";
+      sha256 = "19g0sxc8g79aj5gd5idz5409311253jf2q8wqkasf0handdvsbxx";
+    })
+  ];
+
+  postPatch = let
       # This evaluates to a string containing:
       #
       #     substituteInPlace tests/shar-2 --replace '${SHAR}' '${SHAR} -s submitter'

diff --git a/pkgs/tools/networking/lftp/default.nix b/pkgs/tools/networking/lftp/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "lftp-${version}";
-  version = "4.8.3";
+  version = "4.8.4";
 
   src = fetchurl {
     urls = [
       "https://lftp.tech/ftp/${name}.tar.xz"
       "https://ftp.st.ryukoku.ac.jp/pub/network/ftp/lftp/${name}.tar.xz"
       "http://lftp.yar.ru/ftp/${name}.tar.xz"
       ];
-    sha256 = "12y77jlfs4x4zvcah92mw2h2sb4j0bvbaxkh3wwsm8gs392ywyny";
+    sha256 = "0qks22357xv9y6ripmf5j2n5svh8j5z0yniphfk89sjwkqg2gg2f";
   };
 
   nativeBuildInputs = [ pkgconfig ];

diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
@@ -70,7 +70,9 @@ let
     doInstallCheck = true; # not cross
 
     # socket path becomes too long otherwise
-    preInstallCheck = lib.optional stdenv.isDarwin "export TMPDIR=/tmp";
+    preInstallCheck = lib.optional stdenv.isDarwin ''
+      export TMPDIR=$NIX_BUILD_TOP
+    '';
 
     separateDebugInfo = stdenv.isLinux;