dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

texlive.bin.core-big: LuaTeX 1.16.0 -> 1.17.0 (#296742)

Browse Source 
TeX Live released an exceptional binary update to fix CVEs 2023-32688
and 2023-32700 affecting LuaTeX. This change implements the same LuaTeX
upgrade to version 1.17.0.
This commit is contained in:
Vincenzo Mantova 2024-03-18 21:16:56 +00:00 committed by GitHub
parent 0e2e771744
commit f2ac62404a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
pkgs/tools/typesetting/tex/texlive/bin.nix
View File

@ -212,14 +212,18 @@ core-big = stdenv.mkDerivation {
url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1009196;filename=lua_fixed_hash.patch;msg=45";
sha256 = "sha256-FTu1eRd3AUU7IRs2/7e7uwHuvZsrzTBPypbcEZkU7y4=";
})
# fixes a security-issue in luatex that allows arbitrary code execution even with shell-escape disabled, see https://tug.org/~mseven/luatex.html
# fixed in LuaTeX 1.17.0, remove patch when upgrading to TL 2024
# update to LuaTeX 1.16.1 to prepare for 1.17.0 below
(fetchpatch {
name = "CVE-2023-32700.patch";
url = "https://tug.org/~mseven/luatex-files/2023/patch";
hash = "sha256-AvMedFkZJAFsCJ51eQqBQM4MpzLzn+GeBrzuTzISVkk=";
excludes = [ "build.sh" ];
stripLen = 1;
name = "luatex-1.16.1.patch";
url = "https://github.com/TeX-Live/texlive-source/commit/ad8702a45e317fa9d396ef4d50467c37964a9543.patch";
hash = "sha256-qfzUfkJUfW285w+fnbpO8JLArM7/uj3yb9PONgZrJLE=";
})
# fixes security issues in luatex that allows arbitrary code execution even with shell-escape disabled and network requests, see https://tug.org/~mseven/luatex.html
# fixed in LuaTeX 1.17.0, shipped as a rare binary update in TL 2023
(fetchpatch {
name = "luatex-1.17.0.patch";
url = "https://github.com/TeX-Live/texlive-source/commit/6ace460233115bd42b36e63c7ddce11cc92a1ebd.patch";
hash = "sha256-2fbIdwnw/XQXci9OqRrb6B5tHiSR0co08NyFgMyXCvc=";
})
# Fixes texluajitc crashes on aarch64, backport of the upstream fix
# https://github.com/LuaJIT/LuaJIT/commit/e9af1abec542e6f9851ff2368e7f196b6382a44c