[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Secure-testing-team] CVE-2007-1253: blender: eval injection vulnerability in kmz_ImportWithMesh.py



On Wed, Apr 04, 2007 at 11:12:50PM +0200, Luk Claes wrote:
> Florian Ernst wrote:
> > I'd very much like to see a build log from an *updated* testing system
> > on sparc and mips. If it still FTBFS I'll start to investigate asap.
> 
> So you did try to build it on mips and sparc on testing and the builds succeeded?

No builds of blender_2.42a-5etch1 on mips and sparc on testing have been
attempted so far, unless you count those listing
| Toolchain package versions: libc6-dev_2.3.5-8 linux-kernel-headers_2.6.13+0rc3-2 gcc-4.1_4.1.1-13 binutils_2.17-2 libstdc++6_4.1.1-13
and
| Toolchain package versions: libc6-dev_2.3.6-15 linux-kernel-headers_2.6.13+0rc3-2 gcc-4.1_4.1.1-21 binutils_2.17-1 libstdc++6_4.1.1-21
i.e. listing some somewhat outdated packages within the build
environment.
When looking at the full build logs I find lines like
| In file included from /usr/lib/gcc/mips-linux-gnu/4.0.3/../../../../include/c++/4.0.3/mips-linux-gnu/bits/os_defines.h:39,
                                                    ^^^^^                         ^^^^^
and
| In file included from /usr/lib/gcc/sparc-linux-gnu/4.0.4/../../../../include/c++/4.0.4/sparc-linux-gnu/bits/os_defines.h:39,
                                                     ^^^^^                         ^^^^^
which I understand to indicate something's broken on the hosts.

On the other hand, the toolchain is frozen for quite some time and
identical both in testing and unstable, and blender_2.42a-6 which is
identical code-wise to -5etch1 has built on all archs, including mips
and sparc, without any problems.
Incidentally, -5etch1 previously FTBFS on arm as well with the same
symptoms and error, but since then the build environment has been
(sufficiently) fixed and blender has been requeued and built just fine.

So, up to now, I assume the blender package to be innocent until proven
guilty. Furthermore, I believe simply updating the testing environments
on mips and sparc will allow the package to build just fine.

As I don't have access to any updated Etch environment on mips or sparc
with all B-Ds installed I didn't try manually building the package, but
even if I did and it succeeded I'd still prefer seeing the package built
reliably on the autobuilders.
In my view, it simply hasn't been tried to build blender_2.42a-5etch1 in
an Etch environment on mips and sparc, that's why I'd very much like to
see a build log from an *updated* system.

Cheers,
Flo

Attachment: signature.asc
Description: Digital signature


Reply to: