Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: b96fa84bbfc3
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: 65cf33571557
Choose a head ref
  • 4 commits
  • 3 files changed
  • 2 contributors

Commits on Mar 17, 2018

  1. libvorbis: 1.3.5 -> 1.3.6 

    This update includes the removed patches (CVE-2017-14632,
CVE-2017-14633) and additionally fixes CVE-2018-5146 [1].

The changelog:

libvorbis 1.3.6 (2018-03-16) -- "Xiph.Org libVorbis I 20180316 (Now 100% fewer shells)"

* Fix CVE-2018-5146 - out-of-bounds write on codebook decoding.
* Fix CVE-2017-14632 - free() on unitialized data
* Fix CVE-2017-14633 - out-of-bounds read
* Fix bitrate metadata parsing.
* Fix out-of-bounds read in codebook parsing.
* Fix residue vector size in Vorbis I spec.
* Appveyor support
* Travis CI support
* Add secondary CMake build system.
* Build system fixes

[1] http://seclists.org/oss-sec/2018/q1/243
    @andir
    andir committed Mar 17, 2018
    Configuration menu
    Copy the full SHA
    879ffc0 View commit details
    Browse the repository at this point in the history

  2. tremor: svn-17866 -> git-562307a 

    This updates tremor to a newer version and it's new home in a git
repository. It hasn't been updated since 2011 and is used as a build
input for other packages.

Also fixes CVE-2018-5146 [1].

[1] http://seclists.org/oss-sec/2018/q1/243
    @andir
    andir committed Mar 17, 2018
    Configuration menu
    Copy the full SHA
    c89ec02 View commit details
    Browse the repository at this point in the history

Commits on Mar 18, 2018

  1. SDL: avoid cryptic error from /bin/sh impurity

    @vcunat
    vcunat committed Mar 18, 2018
    Configuration menu
    Copy the full SHA
    488ef9a View commit details
    Browse the repository at this point in the history

  2. Merge #37267: libvorbis, tremor: CVE-2018-5146 updates + SDL build im… 

    …purity.
    @vcunat
    vcunat committed Mar 18, 2018
    Configuration menu
    Copy the full SHA
    65cf335 View commit details
    Browse the repository at this point in the history