Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1018851 > unrolled thread
| Started by | Emilio Pozuelo Monfort <pochu@debian.org> |
|---|---|
| First post | 2020-07-22 13:30 +0200 |
| Last post | 2020-07-25 12:10 +0200 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#966028: buster-pu: package librsvg/2.44.10-2.1+deb10u1 Emilio Pozuelo Monfort <pochu@debian.org> - 2020-07-22 13:30 +0200
Bug#966028: librsvg 2.44.10-2.1+deb10u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2020-07-23 23:10 +0200
Bug#966028: buster-pu: package librsvg/2.44.10-2.1+deb10u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2020-07-25 12:10 +0200
| From | Emilio Pozuelo Monfort <pochu@debian.org> |
|---|---|
| Date | 2020-07-22 13:30 +0200 |
| Subject | Bug#966028: buster-pu: package librsvg/2.44.10-2.1+deb10u1 |
| Message-ID | <Avl6G-4m3-7@gated-at.bofh.it> |
Package: release.debian.org Severity: normal Tags: buster User: release.debian.org@packages.debian.org Usertags: pu Hi, This update fixes CVE-2019-20446, which the Security Team marked as no-dsa. I considered updating to 2.44.16, which has a sensible set of changes to the librsvg code. Unfortunately the newer tarball also updates all of the vendored rust modules (which we do use, see #907629) and although I have been using that newer version in buster for over a week, I don't really feel confortable with that change (and I don't think you'd have approved it either). So I have gone with the minimal backport to 2.44.10 instead (which I've also tested) and it's already uploaded. debdiff attached. Let me know if there are any problems. Thanks, Emilio
[toc] | [next] | [standalone]
| From | Adam D Barratt <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2020-07-23 23:10 +0200 |
| Subject | Bug#966028: librsvg 2.44.10-2.1+deb10u1 flagged for acceptance |
| Message-ID | <AvQDw-6RH-29@gated-at.bofh.it> |
| In reply to | #1018851 |
package release.debian.org tags 966028 = buster pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian buster. Thanks for your contribution! Upload details ============== Package: librsvg Version: 2.44.10-2.1+deb10u1 Explanation: fix denial of service via "billion laughs" attack [CVE-2019-20446]
[toc] | [prev] | [next] | [standalone]
| From | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2020-07-25 12:10 +0200 |
| Message-ID | <AwphU-2O5-3@gated-at.bofh.it> |
| In reply to | #1018851 |
Hi, On Wed, 2020-07-22 at 13:26 +0200, Emilio Pozuelo Monfort wrote: > On 22/07/2020 13:19, Emilio Pozuelo Monfort wrote: > > So I have gone with the minimal backport to 2.44.10 instead (which > > I've also tested) and it's already uploaded. debdiff attached. > > Attached for real now. Unfortunately it appears that this FTBFS on ppc64el and s390x, with a segmentation fault in the tests. Regards, Adam
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web