ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-10-13 16:07:30 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #308781 from LeSuisse/R-CVE-2024-27322

Browse Source 
R: apply patch for CVE-2024-27322
This commit is contained in:
Mauricio Collares 2024-05-03 10:53:58 -03:00 committed by GitHub
commit b2c5e1e439
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkgs/applications/science/math/R/default.nix
View File

@ -1,4 +1,4 @@
{ lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
{ lib, stdenv, fetchurl, fetchpatch, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
, libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib
, less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack
, curl, Cocoa, Foundation, libobjc, libcxx, tzdata
@ -37,6 +37,12 @@ stdenv.mkDerivation (finalAttrs: {
patches = [
./no-usr-local-search-paths.patch
(fetchpatch {
# https://hiddenlayer.com/research/r-bitrary-code-execution/
name = "CVE-2024-27322.patch";
url = "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch";
hash = "sha256-CH2mMmie9E96JeGSC7UGm7/roUNhK5xv6HO53N2ixEI=";
})
];
# Test of the examples for package 'tcltk' fails in Darwin sandbox. See: