Re: Liblouis CVE's in stretch

[Samuel Thibault <sthibault@debian.org>]

Hello,

Andreas Rönnquist, le lun. 30 mai 2022 13:10:37 +0200, a ecrit:
> I am looking at fixing CVE-2022-26981 [1] in Stretch,

This CVE is about table compilation. Tables are basically never coming
from outside sources, so this is not really a security issue, I dont
think we want to spend time on backporting a fix.

> Also - I am looking at fixing CVE-2018-17294 [3],

This one however is about input indeed. Perhaps it'd be worth checking
against the latest upstream master branch of liblouis, since there have
been various fixes there recently.

samuel