This fixes CVE-2018-14599, CVE-2018-14600, and CVE-2018-14598.
* gnu/packages/xorg.scm (libx11)[replacement]: New field.
(libx11-1.6.6): New public variable.
(package
(name "libx11")
(version "1.6.5")
+ (replacement libx11-1.6.6)
(source
(origin
(method url-fetch)
(description "Xorg Core X11 protocol client library.")
(license license:x11)))
+;; Replacement package to fix multiple security bugs:
+;; <http://seclists.org/oss-sec/2018/q3/146>.
+(define-public libx11-1.6.6
+ (package
+ (inherit libx11)
+ (version "1.6.6")
+ (source (origin
+ (method url-fetch)
+ (uri (string-append "mirror://xorg/individual/lib/libX11-"
+ version ".tar.bz2"))
+ (sha256
+ (base32
+ "0ks1mxlda7nxfmffihi15ljsn50q8dknl33i2xag8xzc80fiizk5"))))))
+
;; packages of height 5 in the propagated-inputs tree
(define-public libxcursor