This update bumps the package to the latest stable version containing a
few security fixes:
- CVE-2018-12392: Crash with nested event loops
When manipulating user events in nested loops while opening a document
through script, it is possible to trigger a potentially exploitable
crash due to poor event handling.
- CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript
A potential vulnerability was found in 32-bit builds where an integer
overflow during the conversion of scripts to an internal UTF-16
representation could result in allocating a buffer too small for the
conversion. This leads to a possible out-of-bounds write.
Note: 64-bit builds are not vulnerable to this issue.
- CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting
By rewriting the Host request headers using the webRequest API, a
WebExtension can bypass domain restrictions through domain fronting.
This would allow access to domains that share a host that are
otherwise restricted.
- CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts
A vulnerability where a WebExtension can run content scripts in
disallowed contexts following navigation or other events. This allows
for potential privilege escalation by the WebExtension on sites where
content scripts should not be run.
- CVE-2018-12397: Missing warning prompt when WebExtension requests local file access
A WebExtension can request access to local files without the warning
prompt stating that the extension will "Access your data for all
websites" being displayed to the user. This allows extensions to run
content scripts in local pages without permission warnings when a
local file is opened.
- CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3
Mozilla developers and community members Daniel Veditz and Philipp
reported memory safety bugs present in Firefox ESR 60.2. Some of these
bugs showed evidence of memory corruption and we presume that with
enough effort that some of these could be exploited to run arbitrary
code.
- CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
Mozilla developers and community members Christian Holler, Bob Owen,
Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee,
Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond
Forbes, and Bogdan Tara reported memory safety bugs present in Firefox
62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory
corruption and we presume that with enough effort that some of these
could be exploited to run arbitrary code.
Source: https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/
This commit renames the pythondaemon module to match its module name, github
name, and pypi name, which makes it easier to find and reference. In order to
avoid breaking any external users, I've left an alias with a deprecated warning.
* znc: add option to disable IPv6
* znc: add option to enable debugging
* znc: add option to enable zlib support
* zncModules: match znc build inputs
znc-buildmod expects modules to be aware of the same libs znc itself is linked to.
Before this: znc-buildmod was passing -lz but zlib was not in the include path
'cloudflared' is a multi-purpose client-side tool for CloudFlare Argo
Tunnel, CloudFlare Access, as well as including a simple DNS-over-HTTP
(DoH) proxy tool as well.
However, 'cloudflared' is NOT available under an open source license.
Furthermore, the exact terms of redistribution (namely, if we are able
to redistribute binaries at all) are not entirely clear to me. As a
result, I have filed the following bug report concerning the terms of
redistribution for the source code and binaries:
https://github.com/cloudflare/cloudflared/issues/53
'cloudflared' does have source code available, however, and it
encourages users to use 'go install' in order to set it up, in fact (or
download their prebuilt, compiled binaries). So using the source seems
to be encouraged. Even then, I'm still not sure if Hydra can serve these
binaries.
In lieu of a more pointed answer regarding source/binary licensing, and
to avoid keeping this expression in my private tree, I've marked it as
'unfree' (to avoid Hydra serving it in any way) as well as compiled from
source (to avoid any 'redistribution allowed while unmodified' terms
that may crop up).
The dependencies for this build were generated using 'dep2nix'.
Signed-off-by: Austin Seipp <aseipp@pobox.com>
Allows for adding Perl libraries in the same way as for Python. Doesn't
really need to be a function, since there's only one perlPackages in
nixpkgs, but I went for consistency with the python plugin.
