Merge branch 'master' into core-updates

22 files changed, 932 insertions, 134 deletions

diff --git a/gnu/packages/autotools.scm b/gnu/packages/autotools.scm
index a3afcdcfff..427c6e3113 100644
--- a/gnu/packages/autotools.scm
+++ b/gnu/packages/autotools.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
-;;; Copyright © 2012, 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -161,14 +161,14 @@ exec ~a --no-auto-compile \"$0\" \"$@\"
 (define-public automake
   (package
     (name "automake")
-    (version "1.14.1")
+    (version "1.15")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/automake/automake-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0s86rzdayj1licgj35q0mnynv5xa8f4p32m36blc5jk9id5z1d59"))
+               "0dl6vfi2lzz8alnklwxzfz624b95hb1ipjvd3mk177flmddcf24r"))
              (patches
               (list (search-patch "automake-skip-amhello-tests.patch")))))
     (build-system gnu-build-system)
@@ -291,3 +291,29 @@ presenting a single consistent, portable interface that hides the usual
 complexity of working with shared libraries across platforms.")
     (license gpl3+)
     (home-page "http://www.gnu.org/software/libtool/")))
+
+(define-public libtool-2.4.4
+  (package (inherit libtool)
+    (version "2.4.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/libtool/libtool-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "0v3zq08qxv7k5067mpqrkjkjl3wphhg06i696mka90mzadc5nad8"))
+              (patches
+               (list (search-patch "libtool-2.4-skip-tests.patch")))))
+
+    (native-inputs `(("automake" ,automake)      ;some tests rely on 'aclocal'
+                     ("autoconf" ,(autoconf-wrapper)) ;others on 'autom4te'
+                     ,@(package-native-inputs libtool)))
+
+    (arguments
+     ;; XXX: There are test failures on mips64el-linux starting from 2.4.4:
+     ;; <http://hydra.gnu.org/build/181662>.
+     (if (string-prefix? "mips64el"
+                         (or (%current-target-system) (%current-system)))
+         `(#:tests? #f
+           ,@(package-arguments libtool))
+         (package-arguments libtool)))))
diff --git a/gnu/packages/cpio.scm b/gnu/packages/cpio.scm
index eff146ded5..87f85d00e8 100644
--- a/gnu/packages/cpio.scm
+++ b/gnu/packages/cpio.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
+;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -19,6 +20,7 @@
 (define-module (gnu packages cpio)
   #:use-module (guix licenses)
   #:use-module (gnu packages)
+  #:use-module (gnu packages autotools)
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix build-system gnu))
@@ -34,8 +36,19 @@
              (sha256
               (base32
                "1gavgpzqwgkpagjxw72xgxz52y1ifgz0ckqh8g7cckz7jvyhp0mv"))
-             (patches (list (search-patch "cpio-gets-undeclared.patch")))))
+             (patches (list (search-patch "cpio-CVE-2014-9112-pt1.patch")
+                            (search-patch "cpio-CVE-2014-9112-pt2.patch")
+                            (search-patch "cpio-CVE-2014-9112-pt3.patch")
+                            (search-patch "cpio-CVE-2014-9112-pt4.patch")
+                            (search-patch "cpio-CVE-2014-9112-pt5.patch")
+                            (search-patch "cpio-gets-undeclared.patch")))))
     (build-system gnu-build-system)
+
+    ;; FIXME: autoconf is needed to run autom4te, to update to test suite
+    ;;        after the CVE-2014-9112 patches.  Remove this when cpio is
+    ;;        updated to post-2.11.
+    (native-inputs `(("autoconf" ,autoconf)))
+
     (home-page "https://www.gnu.org/software/cpio/")
     (synopsis "Manage cpio and tar file archives")
     (description
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index 5261c192eb..b1a68a72c7 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -638,7 +638,7 @@ for common mesh file formats, and collision detection.")
 (define minetest-data
   (package
     (name "minetest-data")
-    (version "0.4.10")
+    (version "0.4.11")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -646,7 +646,7 @@ for common mesh file formats, and collision detection.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "09mr71kl7mf4ihszqz1vnwk814p7fvqknad150iic2340a7qzf0i"))))
+                "0hzb27srv6f2j84dpxx2p0p0aaq9vdp5jvbrfpklb5q5ssdjxvc6"))))
     (build-system trivial-build-system)
     (native-inputs
      `(("source" ,source)
@@ -678,7 +678,7 @@ for common mesh file formats, and collision detection.")
 (define-public minetest
   (package
     (name "minetest")
-    (version "0.4.10")
+    (version "0.4.11")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -686,10 +686,7 @@ for common mesh file formats, and collision detection.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "1xxv0g83iqszjgwnbdcbsprqg76cb6jnbsh5qhm7lcwx4wy2y2k2"))
-              ;; This patch will be included in future upstream releases.
-              ;; See: https://github.com/minetest/minetest/commit/fd5eaae2babb322f8a3e2acab55a12e218814c8e
-              (patches (list (search-patch "minetest-subgame-env-var.patch")))))
+                "0h223svzkvp63b77nqfxy7k8whw4543gahs3kxd3x4myi5ax5z5f"))))
     (build-system cmake-build-system)
     (arguments
      '(#:modules ((guix build utils)
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index e795f9749f..4733fc1af6 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -279,7 +279,29 @@ Go.  It also includes runtime support libraries for these languages.")
                                  version "/gcc-" version ".tar.bz2"))
              (sha256
               (base32
-               "1pbjp4blk2ycaa6r3jmw4ky5f1s9ji3klbqgv8zs2sl5jn1cj810"))))))
+               "1pbjp4blk2ycaa6r3jmw4ky5f1s9ji3klbqgv8zs2sl5jn1cj810"))))
+
+    ;; TODO: In core-updates, improve the 'pre-configure phase of the main
+    ;; 'gcc' package so that the 'join-two-line-dynamic-linker-defns phase is
+    ;; no longer needed here.  Then the entire 'arguments' override below can
+    ;; be removed.
+    (arguments
+     (substitute-keyword-arguments (package-arguments gcc-4.7)
+       ((#:phases phases)
+        `(alist-cons-before
+          'pre-configure 'join-two-line-dynamic-linker-defns
+          (lambda* (#:key inputs outputs #:allow-other-keys)
+            (let ((libc (assoc-ref inputs "libc")))
+              (when libc
+                ;; Join two-line definitions of GLIBC_DYNAMIC_LINKER* into a
+                ;; single line, to allow the 'pre-configure phase to work
+                ;; properly.
+                (substitute* (find-files "gcc/config"
+                                         "^linux(64|-elf)?\\.h$")
+                  (("(#define GLIBC_DYNAMIC_LINKER[^ ]*.*)\\\\\n$" _ line)
+                   line)))
+              #t))
+          ,phases))))))
 
 (define* (custom-gcc gcc name languages #:key (separate-lib-output? #t))
   "Return a custom version of GCC that supports LANGUAGES."
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index 791b413da6..aa90c7e214 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -20,6 +20,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu packages gl)
+  #:use-module (ice-9 match)
   #:use-module ((guix licenses) #:prefix l:)
   #:use-module (guix packages)
   #:use-module (guix download)
@@ -161,9 +162,17 @@ Polygon meshes, and Extruded polygon meshes")
         ("python" ,python-2))) ; incompatible with Python 3 (print syntax)
     (arguments
      `(#:configure-flags
-       `(;; drop r300 from default gallium drivers, as it requires llvm
+       '(;; drop r300 from default gallium drivers, as it requires llvm
          "--with-gallium-drivers=r600,svga,swrast"
-         "--enable-xa")
+         "--enable-xa"
+
+         ;; on non-intel systems, drop i915 and i965
+         ;; from the default dri drivers
+         ,@(match (%current-system)
+             ((or "x86_64-linux" "i686-linux")
+              '())
+             (_
+              '("--with-dri-drivers=nouveau,r200,radeon,swrast"))))
        #:phases (alist-cons-after
                  'unpack 'add-missing-m4-files
                  (lambda _
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index ab988cd70d..61260557e3 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -301,6 +301,18 @@ for settings shared by various components of the GNOME desktop.")
     (inputs
      `(("perl" ,perl)
        ("perl-xml-simple" ,perl-xml-simple)))
+    (arguments
+     '(#:phases
+       (alist-cons-after
+        'install 'set-load-paths
+        ;; Tell 'icon-name-mapping' where XML::Simple is.
+        (lambda* (#:key outputs #:allow-other-keys)
+          (let* ((out  (assoc-ref outputs "out"))
+                 (prog (string-append out "/libexec/icon-name-mapping")))
+            (wrap-program
+             prog
+             `("PERL5LIB" = ,(list (getenv "PERL5LIB"))))))
+        %standard-phases)))
     (home-page "http://tango.freedesktop.org/Standard_Icon_Naming_Specification")
     (synopsis
      "Utility to implement the Freedesktop Icon Naming Specification")
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index 534476f7d1..8424d8ccbe 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -174,7 +174,8 @@ aliasing facilities to work just as they would on normal mail.")
                                        version ".tar.gz")))
              (sha256
               (base32
-               "0dzx4qk50pjfsb6cs5jahng96a52k12f7pm0sc78iqdrawg71w1s"))))
+               "0dzx4qk50pjfsb6cs5jahng96a52k12f7pm0sc78iqdrawg71w1s"))
+             (patches (list (search-patch "mutt-CVE-2014-9116.patch")))))
     (build-system gnu-build-system)
     (inputs
      `(("cyrus-sasl" ,cyrus-sasl)
diff --git a/gnu/packages/patches/cpio-CVE-2014-9112-pt1.patch b/gnu/packages/patches/cpio-CVE-2014-9112-pt1.patch
new file mode 100644
index 0000000000..1224c6c22d
--- /dev/null
+++ b/gnu/packages/patches/cpio-CVE-2014-9112-pt1.patch
@@ -0,0 +1,231 @@
+Partially fix CVE-2014-9112, part 1/5.  Backported to 2.11.
+
+From 746f3ff670dcfcdd28fcc990e79cd6fccc7ae48d Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org.ua>
+Date: Mon, 01 Dec 2014 13:15:28 +0000
+Subject: Fix memory overrun on reading improperly created link records.
+
+See http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
+
+* src/copyin.c (get_link_name): New function.
+(list_file, copyin_link): use get_link_name
+
+* tests/symlink-bad-length.at: New file.
+* tests/symlink-long.at: New file.
+* tests/Makefile.am: Add new files.
+* tests/testsuite.at: Likewise.
+---
+diff --git a/src/copyin.c b/src/copyin.c
+index 38d809f..c502c7d 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -124,10 +124,30 @@ tape_skip_padding (int in_file_des, off_t offset)
+   if (pad != 0)
+     tape_toss_input (in_file_des, pad);
+ }
+-
++
++static char *
++get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
++{
++  off_t n = file_hdr->c_filesize + 1;
++  char *link_name;
++  
++  if (n == 0 || n > SIZE_MAX)
++    {
++      error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
++      link_name = NULL;
++    }
++  else
++    {
++      link_name = xmalloc (n);
++      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
++      link_name[file_hdr->c_filesize] = '\0';
++      tape_skip_padding (in_file_des, file_hdr->c_filesize);
++    }
++  return link_name;
++}
+ 
+ static void
+-list_file(struct cpio_file_stat* file_hdr, int in_file_des)
++list_file (struct cpio_file_stat* file_hdr, int in_file_des)
+ {
+   if (verbose_flag)
+     {
+@@ -136,21 +156,16 @@ list_file(struct cpio_file_stat* file_hdr, int in_file_des)
+ 	{
+ 	  if (archive_format != arf_tar && archive_format != arf_ustar)
+ 	    {
+-	      char *link_name = NULL;	/* Name of hard and symbolic links.  */
+-
+-	      link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
+-	      link_name[file_hdr->c_filesize] = '\0';
+-	      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+-	      long_format (file_hdr, link_name);
+-	      free (link_name);
+-	      tape_skip_padding (in_file_des, file_hdr->c_filesize);
+-	      return;
++	      char *link_name = get_link_name (file_hdr, in_file_des);
++	      if (link_name)
++		{
++		  long_format (file_hdr, link_name);
++		  free (link_name);
++		}
+ 	    }
+ 	  else
+-	    {
+-	      long_format (file_hdr, file_hdr->c_tar_linkname);
+-	      return;
+-	    }
++	    long_format (file_hdr, file_hdr->c_tar_linkname);
++	  return;
+ 	}
+       else
+ #endif
+@@ -650,10 +665,7 @@ copyin_link(struct cpio_file_stat *file_
+ 
+   if (archive_format != arf_tar && archive_format != arf_ustar)
+     {
+-      link_name = (char *) xmalloc ((unsigned int) file_hdr->c_filesize + 1);
+-      link_name[file_hdr->c_filesize] = '\0';
+-      tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+-      tape_skip_padding (in_file_des, file_hdr->c_filesize);
++      link_name = get_link_name (file_hdr, in_file_des);
+     }
+   else
+     {
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 3f714d1..b4ca92d 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -52,6 +52,8 @@ TESTSUITE_AT = \
+  setstat04.at\
+  setstat05.at\
+  symlink.at\
++ symlink-bad-length.at\
++ symlink-long.at\
+  version.at
+ 
+ TESTSUITE = $(srcdir)/testsuite
+diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
+new file mode 100644
+index 0000000..6f804b1
+--- a/dev/null
++++ b/tests/symlink-bad-length.at
+@@ -0,0 +1,49 @@
++# Process this file with autom4te to create testsuite.  -*- Autotest -*-
++# Copyright (C) 2014 Free Software Foundation, Inc.
++
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 3, or (at your option)
++# any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++# 02110-1301 USA.
++
++# Cpio v2.11 did segfault with badly set symlink length.
++# References:
++# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
++
++AT_SETUP([symlink-bad-length])
++AT_KEYWORDS([symlink-long copyout])
++
++AT_DATA([ARCHIVE.base64],
++[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
++JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
++UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
++])
++
++AT_CHECK([
++base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
++cpio -ntv < ARCHIVE
++test $? -eq 2
++],
++[0],
++[-rw-rw-r--   1 10029    10031          13 Nov 25 13:52 FILE
++],[cpio: LINK: stored filename length too big
++cpio: premature end of file
++])
++
++AT_CLEANUP
+diff --git a/tests/symlink-long.at b/tests/symlink-long.at
+new file mode 100644
+index 0000000..d3def2d
+--- a/dev/null
++++ b/tests/symlink-long.at
+@@ -0,0 +1,46 @@
++# Process this file with autom4te to create testsuite.  -*- Autotest -*-
++# Copyright (C) 2014 Free Software Foundation, Inc.
++
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 3, or (at your option)
++# any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
++# 02110-1301 USA.
++
++# Cpio v2.11.90 changed the way symlink name is read from archive.
++# References:
++# http://lists.gnu.org/archive/html/bug-cpio/2014-11/msg00007.html
++
++AT_SETUP([symlink-long])
++AT_KEYWORDS([symlink-long copyout])
++
++AT_CHECK([
++
++# len(dirname) > READBUFSIZE
++dirname=
++for i in {1..52}; do
++    dirname="xxxxxxxxx/$dirname"
++    mkdir "$dirname"
++done
++ln -s "$dirname" x || AT_SKIP_TEST
++
++echo x | cpio -o > ar
++list=`cpio -tv < ar | sed 's|.*-> ||'`
++test "$list" = "$dirname" && echo success || echo fail
++],
++[0],
++[success
++],[2 blocks
++2 blocks
++])
++
++AT_CLEANUP
+diff --git a/tests/testsuite.at b/tests/testsuite.at
+index e67689f..3b5377e 100644
+--- a/tests/testsuite.at
++++ b/tests/testsuite.at
+@@ -31,6 +31,8 @@ m4_include([version.at])
+ 
+ m4_include([inout.at])
+ m4_include([symlink.at])
++m4_include([symlink-bad-length.at])
++m4_include([symlink-long.at])
+ m4_include([interdir.at])
+ 
+ m4_include([setstat01.at])
+--
+cgit v0.9.0.2
diff --git a/gnu/packages/patches/cpio-CVE-2014-9112-pt2.patch b/gnu/packages/patches/cpio-CVE-2014-9112-pt2.patch
new file mode 100644
index 0000000000..77c531cb54
--- /dev/null
+++ b/gnu/packages/patches/cpio-CVE-2014-9112-pt2.patch
@@ -0,0 +1,51 @@
+Partially fix CVE-2014-9112, part 2/5.
+
+From 54d1c42ac2cb91389fca04a5018ad573e4ae265a Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org.ua>
+Date: Mon, 01 Dec 2014 19:10:39 +0000
+Subject: Bugfix
+
+* src/copyin.c (get_link_name): Fix range checking.
+* tests/symlink-bad-length.at: Change expected error message.
+---
+diff --git a/src/copyin.c b/src/copyin.c
+index c502c7d..042cc41 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -128,17 +128,17 @@ tape_skip_padding (int in_file_des, off_t offset)
+ static char *
+ get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
+ {
+-  off_t n = file_hdr->c_filesize + 1;
+   char *link_name;
+   
+-  if (n == 0 || n > SIZE_MAX)
++  if (file_hdr->c_filesize < 0 || file_hdr->c_filesize > SIZE_MAX-1)
+     {
+-      error (0, 0, _("%s: stored filename length too big"), file_hdr->c_name);
++      error (0, 0, _("%s: stored filename length is out of range"),
++	     file_hdr->c_name);
+       link_name = NULL;
+     }
+   else
+     {
+-      link_name = xmalloc (n);
++      link_name = xmalloc (file_hdr->c_filesize);
+       tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+       link_name[file_hdr->c_filesize] = '\0';
+       tape_skip_padding (in_file_des, file_hdr->c_filesize);
+diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
+index 6f804b1..cbf4aa7 100644
+--- a/tests/symlink-bad-length.at
++++ b/tests/symlink-bad-length.at
+@@ -42,7 +42,7 @@ test $? -eq 2
+ ],
+ [0],
+ [-rw-rw-r--   1 10029    10031          13 Nov 25 13:52 FILE
+-],[cpio: LINK: stored filename length too big
++],[cpio: LINK: stored filename length is out of range
+ cpio: premature end of file
+ ])
+ 
+--
+cgit v0.9.0.2
diff --git a/gnu/packages/patches/cpio-CVE-2014-9112-pt3.patch b/gnu/packages/patches/cpio-CVE-2014-9112-pt3.patch
new file mode 100644
index 0000000000..644dc6f9ef
--- /dev/null
+++ b/gnu/packages/patches/cpio-CVE-2014-9112-pt3.patch
@@ -0,0 +1,23 @@
+Partially fix CVE-2014-9112, part 3/5.
+
+From 58df4f1b44a1142bba500f980fd26806413b1728 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org.ua>
+Date: Tue, 02 Dec 2014 09:33:29 +0000
+Subject: Fix typo
+
+---
+diff --git a/src/copyin.c b/src/copyin.c
+index 042cc41..264bfcb 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -138,7 +138,7 @@ get_link_name (struct cpio_file_stat *file_hdr, int in_file_des)
+     }
+   else
+     {
+-      link_name = xmalloc (file_hdr->c_filesize);
++      link_name = xmalloc (file_hdr->c_filesize + 1);
+       tape_buffered_read (link_name, in_file_des, file_hdr->c_filesize);
+       link_name[file_hdr->c_filesize] = '\0';
+       tape_skip_padding (in_file_des, file_hdr->c_filesize);
+--
+cgit v0.9.0.2
diff --git a/gnu/packages/patches/cpio-CVE-2014-9112-pt4.patch b/gnu/packages/patches/cpio-CVE-2014-9112-pt4.patch
new file mode 100644
index 0000000000..fa2e8530b2
--- /dev/null
+++ b/gnu/packages/patches/cpio-CVE-2014-9112-pt4.patch
@@ -0,0 +1,105 @@
+Partially fix CVE-2014-9112, part 4/5.  Backported to 2.11.
+
+From fd262d116c4564c1796be9be2799619cf7785d07 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org.ua>
+Date: Thu, 11 Dec 2014 10:51:21 +0000
+Subject: Fix error recovery in copy-in mode
+
+* src/copyin.c (copyin_link): Fix null dereference.
+(read_in_header): Fix error recovery (bug introduced by
+27e0ae55).
+* tests/symlink-bad-length.at: Test error recovery.
+Catch various architecture-dependent error messages (suggested
+by Pavel Raiskup).
+---
+diff --git a/src/copyin.c b/src/copyin.c
+index 264bfcb..ca12356 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -655,7 +655,7 @@ copyin_device (struct cpio_file_stat* file_hdr)
+ }
+ 
+ static void
+-copyin_link(struct cpio_file_stat *file_hdr, int in_file_des)
++copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+ {
+   char *link_name = NULL;	/* Name of hard and symbolic links.  */
+   int res;			/* Result of various function calls.  */
+@@ -666,6 +666,8 @@ copyin_link(struct cpio_file_stat *file_
+   if (archive_format != arf_tar && archive_format != arf_ustar)
+     {
+       link_name = get_link_name (file_hdr, in_file_des);
++      if (!link_name)
++	return;
+     }
+   else
+     {
+@@ -1017,7 +1019,7 @@ read_in_header (struct cpio_file_stat *file_hdr, int in_des)
+ 
+   file_hdr->c_tar_linkname = NULL;
+ 
+-  tape_buffered_read (magic.str, in_des, 6L);
++  tape_buffered_read (magic.str, in_des, sizeof (magic.str));
+   while (1)
+     {
+       if (append_flag)
+@@ -1062,8 +1064,8 @@ read_in_header (struct cpio_file_stat *file_hdr, int in_des)
+ 	  break;
+ 	}
+       bytes_skipped++;
+-      memmove (magic.str, magic.str + 1, 5);
+-      tape_buffered_read (magic.str, in_des, 1L);
++      memmove (magic.str, magic.str + 1, sizeof (magic.str) - 1);
++      tape_buffered_read (magic.str + sizeof (magic.str) - 1, in_des, 1L);
+     }
+ }
+ 
+diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
+index cbf4aa7..4dbeaa3 100644
+--- a/tests/symlink-bad-length.at
++++ b/tests/symlink-bad-length.at
+@@ -24,9 +24,9 @@ AT_SETUP([symlink-bad-length])
+ AT_KEYWORDS([symlink-long copyout])
+ 
+ AT_DATA([ARCHIVE.base64],
+-[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
+-JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
+-UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
++[x3ECCJ1jtIHoA2QAAQAAAIlUwl0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxAgidHv+h6ANk
++AAEAAACJVHFtBQD/////TElOSwAARklMRcdxAgieHqSB6ANkAAEAAACJVDJuBgAAABIARklMRTIA
++c29tZSBtb3JlIGNvbnRlbnQKx3EAAAAAAAAAAAAAAQAAAAAAAAALAAAAAABUUkFJTEVSISEhAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+@@ -37,13 +37,23 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+ 
+ AT_CHECK([
+ base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
+-cpio -ntv < ARCHIVE
+-test $? -eq 2
++TZ=UTC cpio -ntv < ARCHIVE 2>stderr
++rc=$?
++cat stderr | grep -v \
++    -e 'stored filename length is out of range' \
++    -e 'premature end of file' \
++    -e 'archive header has reverse byte-order' \
++    -e 'memory exhausted' \
++    >&2
++echo >&2 STDERR
++test "$rc" -ne 0
+ ],
+-[0],
+-[-rw-rw-r--   1 10029    10031          13 Nov 25 13:52 FILE
+-],[cpio: LINK: stored filename length is out of range
+-cpio: premature end of file
++[1],
++[-rw-rw-r--   1 1000     100            13 Dec 11 09:02 FILE
++-rw-r--r--   1 1000     100            18 Dec 11 10:13 FILE2
++],[cpio: warning: skipped 4 bytes of junk
++1 block
++STDERR
+ ])
+ 
+ AT_CLEANUP
+--
+cgit v0.9.0.2
diff --git a/gnu/packages/patches/cpio-CVE-2014-9112-pt5.patch b/gnu/packages/patches/cpio-CVE-2014-9112-pt5.patch
new file mode 100644
index 0000000000..75313cbefa
--- /dev/null
+++ b/gnu/packages/patches/cpio-CVE-2014-9112-pt5.patch
@@ -0,0 +1,88 @@
+Partially fix CVE-2014-9112, part 5/5.  Backported to 2.11.
+
+From f6a8a2cbd2d5ca40ea94900b55b845dd5ca87328 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org.ua>
+Date: Thu, 11 Dec 2014 13:21:40 +0000
+Subject: Fix symlink-bad-length test for 64-bit architectures.
+
+* src/util.c: Return non-zero exit code if EOF is hit prematurely.
+* tests/symlink-bad-length.at: Revert to original archive: there's
+no use testing for recovery, because that depends on the host
+architecture.  Don't test for exit code as well (same reason).
+Account for eventual warning messages.
+---
+diff --git a/src/util.c b/src/util.c
+index 6c483f8..39c9813 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -206,10 +206,7 @@ tape_fill_input_buffer (int in_des, int
+   if (input_size < 0)
+     error (1, errno, _("read error"));
+   if (input_size == 0)
+-    {
+-      error (0, 0, _("premature end of file"));
+-      exit (1);
+-    }
++    error (PAXEXIT_FAILURE, 0, _("premature end of file"));
+   input_bytes += input_size;
+ }
+ 
+diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
+index 4dbeaa3..e1a7093 100644
+--- a/tests/symlink-bad-length.at
++++ b/tests/symlink-bad-length.at
+@@ -24,9 +24,9 @@ AT_SETUP([symlink-bad-length])
+ AT_KEYWORDS([symlink-long copyout])
+ 
+ AT_DATA([ARCHIVE.base64],
+-[x3ECCJ1jtIHoA2QAAQAAAIlUwl0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxAgidHv+h6ANk
+-AAEAAACJVHFtBQD/////TElOSwAARklMRcdxAgieHqSB6ANkAAEAAACJVDJuBgAAABIARklMRTIA
+-c29tZSBtb3JlIGNvbnRlbnQKx3EAAAAAAAAAAAAAAQAAAAAAAAALAAAAAABUUkFJTEVSISEhAAAA
++[x3EjAIBAtIEtJy8nAQAAAHRUYW0FAAAADQBGSUxFAABzb21lIGNvbnRlbnQKAMdxIwBgQ/+hLScv
++JwEAAAB0VEhuBQD/////TElOSwAARklMRcdxAAAAAAAAAAAAAAEAAAAAAAAACwAAAAAAVFJBSUxF
++UiEhIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+@@ -35,25 +35,30 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+ ])
+ 
++# The exact error message and exit status depend on the host architecture,
++# therefore strderr is filtered out and error code is not checked.
++
++# So far the only case when cpio would exit with code 0 is when it skips
++# several bytes and encounters a valid record header.  Perhaps it should
++# exit with code 2 (non-critical error), if at least one byte was skipped,
++# but that could hurt backward compatibility.
++
+ AT_CHECK([
+ base64 -d ARCHIVE.base64 > ARCHIVE || AT_SKIP_TEST
+-TZ=UTC cpio -ntv < ARCHIVE 2>stderr
+-rc=$?
++TZ=UTC cpio -ntv < ARCHIVE 2>stderr 
+ cat stderr | grep -v \
+     -e 'stored filename length is out of range' \
+     -e 'premature end of file' \
+     -e 'archive header has reverse byte-order' \
+     -e 'memory exhausted' \
++    -e 'skipped [[0-9][0-9]*] bytes of junk' \
++    -e '[[0-9][0-9]*] block' \
+     >&2
+ echo >&2 STDERR
+-test "$rc" -ne 0
+ ],
+-[1],
+-[-rw-rw-r--   1 1000     100            13 Dec 11 09:02 FILE
+--rw-r--r--   1 1000     100            18 Dec 11 10:13 FILE2
+-],[cpio: warning: skipped 4 bytes of junk
+-1 block
+-STDERR
++[0],
++[-rw-rw-r--   1 10029    10031          13 Nov 25 11:52 FILE
++],[STDERR
+ ])
+ 
+ AT_CLEANUP
+--
+cgit v0.9.0.2
diff --git a/gnu/packages/patches/libtool-2.4-skip-tests.patch b/gnu/packages/patches/libtool-2.4-skip-tests.patch
new file mode 100644
index 0000000000..95747dfef0
--- /dev/null
+++ b/gnu/packages/patches/libtool-2.4-skip-tests.patch
@@ -0,0 +1,24 @@
+Because our GCC 'lib' spec automatically adds '-rpath' for each '-L'
+and a couple more '-rpath, there are two test failures:
+one in demo.test, and one in destdir.at.  Disable these.
+
+--- libtool-2.4.4/tests/testsuite	2014-11-29 17:43:11.000000000 +0100
++++ libtool-2.4.4/tests/testsuite	2015-01-03 23:00:09.367775122 +0100
+@@ -9185,7 +9185,7 @@ read at_status <"$at_status_file"
+ #AT_START_33
+ at_fn_group_banner 33 'demo.at:548' \
+   "hardcoding library path" "                        " 3
+-at_xfail=no
++at_xfail=yes
+       test no = "$ACLOCAL" && at_xfail=yes
+       test no = "$AUTOHEADER" && at_xfail=yes
+       test no = "$AUTOMAKE" && at_xfail=yes
+@@ -27052,7 +27052,7 @@ read at_status <"$at_status_file"
+ #AT_START_97
+ at_fn_group_banner 97 'destdir.at:75' \
+   "DESTDIR with in-package deplibs" "                " 7
+-at_xfail=no
++at_xfail=yes
+       eval `$LIBTOOL --config | $GREP '^fast_install='`
+            case $fast_install in no) :;; *) false;; esac && at_xfail=yes
+ (
diff --git a/gnu/packages/patches/minetest-subgame-env-var.patch b/gnu/packages/patches/minetest-subgame-env-var.patch
deleted file mode 100644
index de782284c9..0000000000
--- a/gnu/packages/patches/minetest-subgame-env-var.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From fd5eaae2babb322f8a3e2acab55a12e218814c8e Mon Sep 17 00:00:00 2001
-From: David Thompson <dthompson2@worcester.edu>
-Date: Sat, 6 Sep 2014 13:21:46 -0400
-Subject: [PATCH] Search for subgames using $MINETEST_SUBGAME_PATH.
-
----
- doc/minetest.6  |  6 ++++++
- src/subgame.cpp | 30 ++++++++++++++++++++++++++++++
- 2 files changed, 36 insertions(+)
-
-diff --git a/doc/minetest.6 b/doc/minetest.6
-index d94c12c..ff54520 100644
---- a/doc/minetest.6
-+++ b/doc/minetest.6
-@@ -83,6 +83,12 @@ Set world path
- Migrate from current map backend to another. Possible values are sqlite3
- and leveldb. Only works when using --server.
- 
-+.SH ENVIRONMENT VARIABLES
-+
-+.TP
-+MINETEST_SUBGAME_PATH
-+Colon delimited list of directories to search for subgames.
-+
- .SH BUGS
- Please report all bugs to Perttu Ahola <celeron55@gmail.com>.
- 
-diff --git a/src/subgame.cpp b/src/subgame.cpp
-index f2465c9..e86655b 100644
---- a/src/subgame.cpp
-+++ b/src/subgame.cpp
-@@ -22,6 +22,7 @@ with this program; if not, write to the Free Software Foundation, Inc.,
- #include "filesys.h"
- #include "settings.h"
- #include "log.h"
-+#include "strfnd.h"
- #ifndef SERVER
- #include "tile.h" // getImagePath
- #endif
-@@ -59,6 +60,17 @@ struct GameFindPath
- 	{}
- };
- 
-+Strfnd getSubgamePathEnv() {
-+  std::string sp;
-+  char *subgame_path = getenv("MINETEST_SUBGAME_PATH");
-+
-+  if(subgame_path) {
-+    sp = std::string(subgame_path);
-+  }
-+
-+  return Strfnd(sp);
-+}
-+
- SubgameSpec findSubgame(const std::string &id)
- {
- 	if(id == "")
-@@ -66,6 +78,17 @@ SubgameSpec findSubgame(const std::string &id)
- 	std::string share = porting::path_share;
- 	std::string user = porting::path_user;
- 	std::vector<GameFindPath> find_paths;
-+
-+        Strfnd search_paths = getSubgamePathEnv();
-+
-+        while(!search_paths.atend()) {
-+                std::string path = search_paths.next(":");
-+                find_paths.push_back(GameFindPath(
-+                                       path + DIR_DELIM + id, false));
-+                find_paths.push_back(GameFindPath(
-+                                       path + DIR_DELIM + id + "_game", false));
-+        }
-+
- 	find_paths.push_back(GameFindPath(
- 			user + DIR_DELIM + "games" + DIR_DELIM + id + "_game", true));
- 	find_paths.push_back(GameFindPath(
-@@ -129,6 +152,13 @@ std::set<std::string> getAvailableGameIds()
- 	std::set<std::string> gamespaths;
- 	gamespaths.insert(porting::path_share + DIR_DELIM + "games");
- 	gamespaths.insert(porting::path_user + DIR_DELIM + "games");
-+
-+        Strfnd search_paths = getSubgamePathEnv();
-+
-+        while(!search_paths.atend()) {
-+                gamespaths.insert(search_paths.next(":"));
-+        }
-+
- 	for(std::set<std::string>::const_iterator i = gamespaths.begin();
- 			i != gamespaths.end(); i++){
- 		std::vector<fs::DirListNode> dirlist = fs::GetDirListing(*i);
--- 
-2.1.1
-
diff --git a/gnu/packages/patches/mutt-CVE-2014-9116.patch b/gnu/packages/patches/mutt-CVE-2014-9116.patch
new file mode 100644
index 0000000000..91e17ecbe0
--- /dev/null
+++ b/gnu/packages/patches/mutt-CVE-2014-9116.patch
@@ -0,0 +1,46 @@
+Fix CVE-2014-9116.  Copied from Debian:
+
+This patch solves the issue raised by CVE-2014-9116 in bug 771125.
+
+We correctly redefine what are the whitespace characters as per RFC5322; by
+doing so we prevent mutt_substrdup from being used in a way that could lead to
+a segfault.
+
+The lib.c part was written by Antonio Radici <antonio@debian.org> to prevent
+crashes due to this kind of bugs from happening again.
+
+The wheezy version of this patch is slightly different, therefore this patch
+has -jessie prefixed in its name.
+
+The sendlib.c part was provided by Salvatore Bonaccorso and it is the same as
+the upstream patch reported here:
+http://dev.mutt.org/trac/attachment/ticket/3716/ticket-3716-stable.patch
+
+--- a/lib.c
++++ b/lib.c
+@@ -815,6 +815,9 @@ char *mutt_substrdup (const char *begin,
+   size_t len;
+   char *p;
+ 
++  if (end != NULL && end < begin)
++    return NULL;
++
+   if (end)
+     len = end - begin;
+   else
+--- a/sendlib.c
++++ b/sendlib.c
+@@ -1814,7 +1814,12 @@ static int write_one_header (FILE *fp, i
+     {
+       tagbuf = mutt_substrdup (start, t);
+       /* skip over the colon separating the header field name and value */
+-      t = skip_email_wsp(t + 1);
++      ++t;
++
++      /* skip over any leading whitespace (WSP, as defined in RFC5322) */
++      while (*t == ' ' || *t == '\t')
++        t++;
++
+       valbuf = mutt_substrdup (t, end);
+     }
+     dprint(4,(debugfile,"mwoh: buf[%s%s] too long, "
diff --git a/gnu/packages/patches/unzip-CVE-2014-8139.patch b/gnu/packages/patches/unzip-CVE-2014-8139.patch
new file mode 100644
index 0000000000..433efd1aaf
--- /dev/null
+++ b/gnu/packages/patches/unzip-CVE-2014-8139.patch
@@ -0,0 +1,49 @@
+From: sms
+Subject: Fix CVE-2014-8139: CRC32 verification heap-based overflow
+Bug-Debian: http://bugs.debian.org/773722
+
+--- a/extract.c
++++ b/extract.c
+@@ -1,5 +1,5 @@
+ /*
+-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
++  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
+ 
+   See the accompanying file LICENSE, version 2009-Jan-02 or later
+   (the contents of which are also included in unzip.h) for terms of use.
+@@ -298,6 +298,8 @@
+ #ifndef SFX
+    static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
+      EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
++   static ZCONST char Far TooSmallEFlength[] = "bad extra-field entry:\n \
++     EF block length (%u bytes) invalid (< %d)\n";
+    static ZCONST char Far InvalidComprDataEAs[] =
+      " invalid compressed data for EAs\n";
+ #  if (defined(WIN32) && defined(NTSD_EAS))
+@@ -2023,7 +2025,8 @@
+         ebID = makeword(ef);
+         ebLen = (unsigned)makeword(ef+EB_LEN);
+ 
+-        if (ebLen > (ef_len - EB_HEADSIZE)) {
++        if (ebLen > (ef_len - EB_HEADSIZE))
++        {
+            /* Discovered some extra field inconsistency! */
+             if (uO.qflag)
+                 Info(slide, 1, ((char *)slide, "%-22s ",
+@@ -2032,6 +2035,16 @@
+               ebLen, (ef_len - EB_HEADSIZE)));
+             return PK_ERR;
+         }
++        else if (ebLen < EB_HEADSIZE)
++        {
++            /* Extra block length smaller than header length. */
++            if (uO.qflag)
++                Info(slide, 1, ((char *)slide, "%-22s ",
++                  FnFilter1(G.filename)));
++            Info(slide, 1, ((char *)slide, LoadFarString(TooSmallEFlength),
++              ebLen, EB_HEADSIZE));
++            return PK_ERR;
++        }
+ 
+         switch (ebID) {
+             case EF_OS2:
diff --git a/gnu/packages/patches/unzip-CVE-2014-8140.patch b/gnu/packages/patches/unzip-CVE-2014-8140.patch
new file mode 100644
index 0000000000..595d8d5bcd
--- /dev/null
+++ b/gnu/packages/patches/unzip-CVE-2014-8140.patch
@@ -0,0 +1,27 @@
+From: sms
+Subject: Fix CVE-2014-8140: out-of-bounds write issue in test_compr_eb()
+Bug-Debian: http://bugs.debian.org/773722
+
+--- a/extract.c
++++ b/extract.c
+@@ -2234,10 +2234,17 @@
+     if (compr_offset < 4)                /* field is not compressed: */
+         return PK_OK;                    /* do nothing and signal OK */
+ 
++    /* Return no/bad-data error status if any problem is found:
++     *    1. eb_size is too small to hold the uncompressed size
++     *       (eb_ucsize).  (Else extract eb_ucsize.)
++     *    2. eb_ucsize is zero (invalid).  2014-12-04 SMS.
++     *    3. eb_ucsize is positive, but eb_size is too small to hold
++     *       the compressed data header.
++     */
+     if ((eb_size < (EB_UCSIZE_P + 4)) ||
+-        ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
+-         eb_size <= (compr_offset + EB_CMPRHEADLEN)))
+-        return IZ_EF_TRUNC;               /* no compressed data! */
++     ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
++     ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
++        return IZ_EF_TRUNC;             /* no/bad compressed data! */
+ 
+     if (
+ #ifdef INT_16BIT
diff --git a/gnu/packages/patches/unzip-CVE-2014-8141.patch b/gnu/packages/patches/unzip-CVE-2014-8141.patch
new file mode 100644
index 0000000000..283925fc34
--- /dev/null
+++ b/gnu/packages/patches/unzip-CVE-2014-8141.patch
@@ -0,0 +1,137 @@
+From: sms
+Subject: Fix CVE-2014-8141: out-of-bounds read issues in getZip64Data()
+Bug-Debian: http://bugs.debian.org/773722
+
+--- a/fileio.c
++++ b/fileio.c
+@@ -176,6 +176,8 @@
+ #endif
+ static ZCONST char Far ExtraFieldTooLong[] =
+   "warning:  extra field too long (%d).  Ignoring...\n";
++static ZCONST char Far ExtraFieldCorrupt[] =
++  "warning:  extra field (type: 0x%04x) corrupt.  Continuing...\n";
+ 
+ #ifdef WINDLL
+    static ZCONST char Far DiskFullQuery[] =
+@@ -2295,7 +2297,12 @@
+             if (readbuf(__G__ (char *)G.extra_field, length) == 0)
+                 return PK_EOF;
+             /* Looks like here is where extra fields are read */
+-            getZip64Data(__G__ G.extra_field, length);
++            if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
++            {
++                Info(slide, 0x401, ((char *)slide,
++                 LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
++                error = PK_WARN;
++            }
+ #ifdef UNICODE_SUPPORT
+             G.unipath_filename = NULL;
+             if (G.UzO.U_flag < 2) {
+--- a/process.c
++++ b/process.c
+@@ -1,5 +1,5 @@
+ /*
+-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
++  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
+ 
+   See the accompanying file LICENSE, version 2009-Jan-02 or later
+   (the contents of which are also included in unzip.h) for terms of use.
+@@ -1901,48 +1901,82 @@
+     and a 4-byte version of disk start number.
+     Sets both local header and central header fields.  Not terribly clever,
+     but it means that this procedure is only called in one place.
++
++    2014-12-05 SMS.
++    Added checks to ensure that enough data are available before calling
++    makeint64() or makelong().  Replaced various sizeof() values with
++    simple ("4" or "8") constants.  (The Zip64 structures do not depend
++    on our variable sizes.)  Error handling is crude, but we should now
++    stay within the buffer.
+   ---------------------------------------------------------------------------*/
+ 
++#define Z64FLGS 0xffff
++#define Z64FLGL 0xffffffff
++
+     if (ef_len == 0 || ef_buf == NULL)
+         return PK_COOL;
+ 
+     Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
+       ef_len));
+ 
+-    while (ef_len >= EB_HEADSIZE) {
++    while (ef_len >= EB_HEADSIZE)
++    {
+         eb_id = makeword(EB_ID + ef_buf);
+         eb_len = makeword(EB_LEN + ef_buf);
+ 
+-        if (eb_len > (ef_len - EB_HEADSIZE)) {
+-            /* discovered some extra field inconsistency! */
++        if (eb_len > (ef_len - EB_HEADSIZE))
++        {
++            /* Extra block length exceeds remaining extra field length. */
+             Trace((stderr,
+               "getZip64Data: block length %u > rest ef_size %u\n", eb_len,
+               ef_len - EB_HEADSIZE));
+             break;
+         }
+-        if (eb_id == EF_PKSZ64) {
+-
++        if (eb_id == EF_PKSZ64)
++        {
+           int offset = EB_HEADSIZE;
+ 
+-          if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
+-            G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.ucsize);
++          if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
++            G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
++            offset += 8;
+           }
+-          if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
+-            G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.csize);
++
++          if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
++            G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
++            offset += 8;
+           }
+-          if (G.crec.relative_offset_local_header == 0xffffffff){
++
++          if (G.crec.relative_offset_local_header == Z64FLGL)
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
+             G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.relative_offset_local_header);
++            offset += 8;
+           }
+-          if (G.crec.disk_number_start == 0xffff){
++
++          if (G.crec.disk_number_start == Z64FLGS)
++          {
++            if (offset+ 4 > ef_len)
++              return PK_ERR;
++
+             G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
+-            offset += sizeof(G.crec.disk_number_start);
++            offset += 4;
+           }
++#if 0
++          break;                /* Expect only one EF_PKSZ64 block. */
++#endif /* 0 */
+         }
+ 
+-        /* Skip this extra field block */
++        /* Skip this extra field block. */
+         ef_buf += (eb_len + EB_HEADSIZE);
+         ef_len -= (eb_len + EB_HEADSIZE);
+     }
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 4f9ed54d56..47b4692d7c 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
-;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Eric Bavier <bavier@member.fsf.org>
@@ -95,16 +95,17 @@ as well as the classic centralized workflow.")
     (license gpl2+)))
 
 (define-public git
+  ;; Keep in sync with 'git-manpages'!
   (package
    (name "git")
-   (version "2.1.2")
+   (version "2.2.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://kernel.org/software/scm/git/git-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "12x1qycc0rii6fqpiizp9v9ysdmj6lpi9imqqbrkdx6cifbwh9vv"))))
+              "0l7l9rv1ww474rm4whj7dhjjacgdw5qlqqxqsnyzdpdxl34jshh9"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("native-perl" ,perl)
@@ -210,6 +211,52 @@ everything from small to very large projects with speed and efficiency.")
    (license gpl2)
    (home-page "http://git-scm.com/")))
 
+(define-public git-manpages
+  ;; Keep in sync with 'git'!
+
+  ;; Granted, we could build the man pages from the 'git' package itself,
+  ;; which contains the real source.  However, it would add a dependency on a
+  ;; full XML tool chain, and building it actually takes ages.  So we use this
+  ;; lazy approach.
+  (package
+    (name "git-manpages")
+    (version (package-version git))
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://kernel.org/software/scm/git/git-manpages-"
+                    version ".tar.xz"))
+              (sha256
+               (base32
+                "0f75n5yfrzb55qbg5wq4bmv43lay806v51yhglwkp7mbv1zkby00"))))
+    (build-system trivial-build-system)
+    (arguments
+     '(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+
+         (let* ((xz  (assoc-ref %build-inputs "xz"))
+                (tar (assoc-ref %build-inputs "tar"))
+                (out (assoc-ref %outputs "out"))
+                (man (string-append out "/share/man")))
+           (setenv "PATH" (string-append tar "/bin:" xz "/bin"))
+
+           (mkdir-p man)
+           (with-directory-excursion man
+             (zero? (system* "tar" "xvf"
+                             (assoc-ref %build-inputs "source"))))))))
+
+    (native-inputs `(("tar" ,tar)
+                     ("xz" ,xz)))
+    (home-page (package-home-page git))
+    (license (package-license git))
+    (synopsis "Man pages of the Git version control system")
+    (description
+     "This package provides the man pages of the Git version control system.
+This is the documentation displayed when using the '--help' option of a 'git'
+command.")))
+
 (define-public shflags
   (package
     (name "shflags")
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index d44b6a6246..2052f7b9be 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -189,28 +189,6 @@ and Matrox.")
     (license license:x11)))
 
 
-;; old version, required by old mesa, see
-;; http://www.mail-archive.com/nouveau@lists.freedesktop.org/msg10098.html
-(define-public libdrm-2.4.33
-  (package (inherit libdrm)
-    (version "2.4.33")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (string-append
-               "http://dri.freedesktop.org/libdrm/libdrm-"
-               version
-               ".tar.bz2"))
-        (sha256
-          (base32
-            "1slgi61n4dlsfli47ql354fd1ppj7n40jd94wvnsdqx0mna9syrd"))))
-    (arguments
-      `(#:configure-flags
-         ;; create libdrm_nouveau.so, needed by mesa, see
-         ;; http://comments.gmane.org/gmane.linux.lfs.beyond.support/43261
-         `("--enable-nouveau-experimental-api")))))
-
-
 (define-public mtdev
   (package
     (name "mtdev")
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index b4b91408af..f2b3baa418 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -191,7 +191,7 @@ module.")
               (base32
                "0jj3jiray1l4pi9wkjcpxjc3v431whdwx5aqnhgdm4i7h3817zsw"))))
     (build-system perl-build-system)
-    (inputs
+    (propagated-inputs
      `(("perl-xml-parser" ,perl-xml-parser)))
     (license (package-license perl))
     (synopsis "Perl module for easy reading/writing of XML files")
diff --git a/gnu/packages/zip.scm b/gnu/packages/zip.scm
index 29ab555ae4..f9eeb5c32c 100644
--- a/gnu/packages/zip.scm
+++ b/gnu/packages/zip.scm
@@ -22,6 +22,7 @@
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
+  #:use-module (gnu packages)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages perl)
   #:use-module (guix build-system perl)
@@ -79,7 +80,10 @@ Compression ratios of 2:1 to 3:1 are common for text files.")
       (uri (string-append "mirror://sourceforge/infozip/UnZip%206.x%20%28latest%29/UnZip%206.0/unzip60.tar.gz"))
       (sha256
        (base32
-        "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83"))))
+        "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83"))
+      (patches (list (search-patch "unzip-CVE-2014-8139.patch")
+                     (search-patch "unzip-CVE-2014-8140.patch")
+                     (search-patch "unzip-CVE-2014-8141.patch")))))
     (build-system gnu-build-system)
     ;; no inputs; bzip2 is not supported, since not compiled with BZ_NO_STDIO
     (arguments