From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Security bugs in freeimage bundled libraries [was Re: 01/02: gnu: freeimage: Fix CVE-2016-5684.] Date: Sat, 15 Oct 2016 15:50:05 -0400 Message-ID: <20161015195005.GC8809@jasmine> References: <20161014104404.22087.86582@vcs.savannah.gnu.org> <20161014104405.901E322012A@vcs.savannah.gnu.org> <20161014174820.GA30644@jasmine> <87mvi6xyl7.fsf@openmailbox.org> <20161015180335.GC14171@macbook42.flashner.co.il> <87instcue6.fsf@openmailbox.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="7ZAtKRhVyVSsbBD2" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39505) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bvUyA-0006J0-F0 for guix-devel@gnu.org; Sat, 15 Oct 2016 15:50:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bvUy7-00012n-D7 for guix-devel@gnu.org; Sat, 15 Oct 2016 15:50:10 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:58838) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1bvUy7-00012I-99 for guix-devel@gnu.org; Sat, 15 Oct 2016 15:50:07 -0400 Content-Disposition: inline In-Reply-To: <87instcue6.fsf@openmailbox.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Kei Kebreau Cc: guix-devel@gnu.org --7ZAtKRhVyVSsbBD2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Oct 15, 2016 at 02:57:37PM -0400, Kei Kebreau wrote: > Efraim Flashner writes: > > On Fri, Oct 14, 2016 at 08:09:08PM -0400, Kei Kebreau wrote: > >> Leo Famulari writes: > >> > Debian has a patch to make it use "system" copies of the libraries: > >> > > >> > https://anonscm.debian.org/cgit/debian-science/packages/freeimage.gi= t/tree/debian/patches/Disable-vendored-dependencies.patch?h=3Ddebian/sid > >> > > >> > For now, our freeimage package is probably vulnerable to many public= ly > >> > disclosed security bugs. > >> > > >> > Who volunteers to try fixing this? > >>=20 > >> The patch is attached. I've removed the bit from Debian that disables = JPEG > >> transformation functions, as seen below. JPEGTransform.cpp (in > >> Source/FreeImageToolkit) gave me some trouble when I left that part of > >> the patch alone. > > > I was looking at it and I thought it was going to be much more than 400 > > lines in the end. > > > > Did we also need the other patch? > > https://sources.debian.net/src/freeimage/3.17.0%2Bds1-3/debian/patches/= Use-system-dependencies.patch/ > > > > On one hand we could carry a modified version of Debian's patch, on the > > other hand some of these look like they could be a series of substitute* > > commands. I started looking through the patch and thinking how to > > convert them from "../path/to/header.h" to and realizing I > > myself wouldn't want to do that, so that could easily be an option for > > another time :). >=20 > Looking at its contents, adding that patch would make a lot of sense. :-) Yes, I think we need to use both patches. Will you submit an updated version of your patch? --7ZAtKRhVyVSsbBD2 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJYAohtAAoJECZG+jC6yn8IOZYQAM4pdyo3VrTnM7YxQr5sT7vF LnqLKnIcpcMZLePXXa+lefqaYANWi6O1u5DxVBzZyer4i/bpbCYWTfMLN+xizMBA ZwHuNddfbh19wcIwv7YIEmsJ1fhh3EG13wa/jU1U/0E0qLqnzdWyk8uuZk1eUBE9 hsmwKybQsFGbSwGGG9ej5//QZ8Hrrvx4pA5atCA0twAAZwEZdVTzxyvy/Sfx7YKm s6+kVj4lHgkZkq3ZAzF6PIMF/FrYuGjy+fT3mDr+lyY8Ga5FTgoUkxaNVrDoN3Jt C3sISVNsTr9q0aN9jchLIwqylwxFzu2ocXs5zoZhRdcNW3iXwio+A2FT0fMeBlJq JGrisrwG3YGNZO6xFMoo4qHfjI39xTkCp5YQyoiEzbrZ9tLFmMvRpLXQxJZqd/cz lIiDHlUf6yv58Wu6N+ZNOMVhBordJ20UJtLizBw5y9KEUlIZ7SEJKqRxFhfrpUle Zv6ohBquvV5w9L0/Jq3JkD5fjiPt7mlQdiLTvQ48RTkf9//zccQRbBx/6J84mFCx GrDpfVhe3f/bvceVCsIs9dmL/+pEswmdgp1DeLLKDc4nZi4c3a/AyE2YXRFogMW2 AsM06lNTMDtauHdi/wzOpFwbfGRHywDN3A9VCuJ/xZn1FVZ0sy9kDwJHXytOQUcl dfglAL9WRseX1IXdUKRl =M92k -----END PGP SIGNATURE----- --7ZAtKRhVyVSsbBD2--