[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#650601: [png-mng-implement] Lack of security in libpng 1.2



On 22.03.2012 11:21, Adam D. Barratt wrote:
On 22.03.2012 11:00, Aníbal Monsalve Salazar wrote:
So, the message is to move away from libpng 1.2 in Debian as soon as we
can.

In that case, maybe someone could address some of the issues we
raised when the transition was first proposed? e.g. the "requirement"
for changing the development page name and thus needing otherwise
unneccessary source uploads of a bunch of packages

As a concrete example, running "dak rm -b libpng12-dev" on ftp-master a short while ago suggests that there are currently over two hundred source packages in unstable with a build-dependency either on "libpng12{,-0}-dev" with no alternative or with the 1.2 package as the first in an alternative list. If the libpng 1.5 packages from experimental were to transition to unstable right now, we'd be unable to binNMU any of those packages; they would all require source uploads to change the build-dependency. It may be that some of these can be explained by multiple source versions where the newer source has migrated to use libpng-dev, but I suspect those are a minority.

fwiw, there are also still six packages in unstable with libpng3-dev as the only png-related build dependency. It may be that those packages have other issues, fo course.

Regards,

Adam



Reply to: