Re: [buster] CVE-2022-46871: libusrsctp maybe backporting a new version ?
On Mon, Jun 19, 2023 at 07:40:30PM +0200, Ben Hutchings wrote:
> On Mon, 2023-06-19 at 11:02 +0000, roucaries bastien wrote:
> > Le dim. 18 juin 2023 à 19:16, Ola Lundqvist <ola@inguza.com> a écrit :
> > [adding security team]
> [...]
> >
> > > You mention rebuild all reverse dependencies. Well I do not find any
> > > within Debian.
> > > This makes it even less important to fix it.
> >
> > Yes, but for firefox it is embeded (code duplication not nice). May be
> > (so copy security team) deemded it and link to the lib. Less work
>
> So we can expect Firefox upstream to update their copy.
Firefox has updated their copy about half year ago, this is how this
issue become publicly known in the first place.
Cheers,
Moritz
Reply to: