Re: Bug#851612: CVE-2017-0381
On 06/02/17 02:45 PM, Julien Cristau wrote:
> On Tue, Jan 31, 2017 at 15:32:13 +1030, Ron wrote:
>
>> I've CC'd -release, to see what they'd prefer we do for Jessie.
>> It might be that the best option here is to just put something later
>> in -bpo, and if people are paranoid, they can choose to use that?
>>
> I'd prefer to review patches rather than walls of text that refer to
> changes in the abstract, since that makes it easier to know what you're
> talking about. But based on what I've read it doesn't sound like jessie
> needs an update?
This is the commit (along with the analysis):
https://git.xiph.org/?p=opus.git;a=commitdiff;h=70a3d641b
That being said, the change itself will not help you much unless you
pull out the full source, since the illegal read occurs in a different file.
Cheers,
Jean-Marc
Reply to: