foomatic-filters: fix CVE-2015-8327 & CVE-2015-8560

(cherry picked from commit 4b756e4)
NixOS · Oct 24, 2017 · b869376 · b869376
1 parent a046655
commit b869376
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/pkgs/misc/drivers/foomatic-filters/default.nix b/pkgs/misc/drivers/foomatic-filters/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, perl, cups, dbus, enscript }:
+{ stdenv, fetchpatch, fetchurl, pkgconfig, perl, cups, dbus, enscript }:
 
 stdenv.mkDerivation rec {
   name = "foomatic-filters-4.0.17";
@@ -10,6 +10,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig perl cups dbus enscript ];
 
+  patches = [
+    # for CVE-2015-8327 & CVE-2015-8560
+    (fetchpatch {
+      url = "https://anonscm.debian.org/cgit/collab-maint/foomatic-filters.git/plain/debian/patches/0500-r7406_also_consider_the_back_tick_as_an_illegal_shell_escape_character.patch";
+      sha256 = "055nwi3sjf578nk40bqsch3wx8m2h65hdih0wmxflb6l0hwkq4p4";
+    })
+  ];
+
   preConfigure =
     ''
       substituteInPlace foomaticrip.c --replace /bin/bash /bin/sh