From 4fe1b2e69ee29f707b1b33957c570b515928c783 Mon Sep 17 00:00:00 2001
From: Mark H Weaver <mhw@netris.org>
Date: Mon, 3 Aug 2020 16:25:55 -0400
Subject: gnu: libjpeg-turbo: Replace with 2.0.5 [fixes CVE-2020-13790].

* gnu/packages/image.scm (libjpeg-turbo/fixed): New variable.
(libjpeg-turbo)[replacement]: New field.
---
 gnu/packages/image.scm | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 20dcfe1cf1..4d443f820f 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1580,6 +1580,7 @@ (define-public libjpeg-turbo
   (package
     (name "libjpeg-turbo")
     (version "2.0.4")
+    (replacement libjpeg-turbo/fixed)
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/libjpeg-turbo/"
@@ -1636,6 +1637,18 @@ (define-public libjpeg-turbo
                    license:ijg          ;the libjpeg library and associated tools
                    license:zlib))))     ;the libjpeg-turbo SIMD extensions
 
+(define libjpeg-turbo/fixed
+  (package
+    (inherit libjpeg-turbo)
+    (version "2.0.5")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/libjpeg-turbo/"
+                                  version "/libjpeg-turbo-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0pbv6pc97kbj7ib31qcwi7lnmm9xg5y3b11aasmkhfjvf7rgdy0n"))))))
+
 (define-deprecated libjpeg libjpeg-turbo)
 (export libjpeg)
 
-- 
cgit v1.2.3