From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: [PATCH 0/1] libpng security update (CVE-2015-8126) Date: Mon, 16 Nov 2015 09:56:21 +0100 Message-ID: <878u5ycoga.fsf@gnu.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:34016) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZyFaM-0005So-SI for guix-devel@gnu.org; Mon, 16 Nov 2015 03:56:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZyFaJ-0004jy-MJ for guix-devel@gnu.org; Mon, 16 Nov 2015 03:56:26 -0500 In-Reply-To: (Leo Famulari's message of "Sat, 14 Nov 2015 19:12:54 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari skribis: > These buffer overflows in libpng were announced today: > https://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2015-8126 > > This patch updates libpng to 1.5.24, which is claimed to be free of the b= ugs. In commit 1b076e6 on =E2=80=98master=E2=80=99, I made 1.5.24 a replacement = for the current libpng (info "(guix) Security Updates"), and in =E2=80=98tk-update= =E2=80=99, I upgraded libpng for good; we=E2=80=99ll starting building that branch hopef= ully very soon. Thanks for the heads-up! Ludo=E2=80=99.