(define-public gd
(package
(name "gd")
+ (replacement gd/fixed)
;; Note: With libgd.org now pointing to github.com, genuine old
;; tarballs are no longer available. Notably, versions 2.0.x are
;; missing.
"See COPYING file in the distribution."))
(properties '((cpe-name . "libgd")))))
+(define-public gd/fixed
+ (hidden-package
+ (package
+ (inherit gd)
+ (source (origin
+ (inherit (package-source gd))
+ (patches (append (origin-patches (package-source gd))
+ (search-patches "gd-CVE-2018-5711.patch"
+ "gd-CVE-2018-1000222.patch"))))))))
+
(define-public perl-gd
(package
(name "perl-gd")
- (version "2.68")
+ (version "2.69")
(source
(origin
(method url-fetch)
"GD-" version ".tar.gz"))
(sha256
(base32
- "0p2ya641nl5cvcqgw829xgabh835qijfd6vq2ba12862946xx8va"))))
+ "0palmq7l42fibqxhrabnjm7di4q8kciq9323902d717x3i4jvc6x"))))
(build-system perl-build-system)
(inputs
`(("fontconfig" ,fontconfig)