Bug#709145: marked as done ([CVE-2009-3546]: contains embedded (and outdated) copy of libgd2)
Your message dated Tue, 21 May 2013 18:24:06 +0900
with message-id <20130521092406.GB4885@gamma.logic.tuwien.ac.at>
and subject line Re: Bug#709145: [CVE-2009-3546]: contains embedded (and outdated) copy of libgd2
has caused the Debian Bug report #709145,
regarding [CVE-2009-3546]: contains embedded (and outdated) copy of libgd2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
709145: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=709145
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: texlive-bin
Version: 2013.20130521.30601-1
Severity: grave
Tags: security
The new upload of texlive-bin contains and uses an outdated embedded
copy of GD library and must not enter testing until texlive-bin is
using the system GD library again.
The embedded copy suffers from CVE-2009-3546 and maybe other issues
since 2.0.35 is really old copy of the library.
O.
-- System Information:
Debian Release: 7.0
APT prefers stable
APT policy: (500, 'stable'), (300, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
--- End Message ---
--- Begin Message ---
On Di, 21 Mai 2013, Ondřej Surý wrote:
> The new upload of texlive-bin contains and uses an outdated embedded
> copy of GD library and must not enter testing until texlive-bin is
> using the system GD library again.
Wrong. Containing an embedded copy that is even compiled,
but not linked against any program is not a reason for
a serious bug.
The only program in TeX Live that is linked against libgd is
dvipng and this is built outside of TeX live.
The TL infrastructure *needs* to build the library or use the
system library.
Since using the sys library is currently impossible, we include
a copy of the *not*used* libgd library.
Closing this bug.
Norbert
------------------------------------------------------------------------
PREINING, Norbert http://www.preining.info
JAIST, Japan TeX Live & Debian Developer
DSA: 0x09C5B094 fp: 14DF 2E6C 0307 BE6D AD76 A9C0 D2BF 4AA3 09C5 B094
------------------------------------------------------------------------
--- End Message ---
Reply to: