From mboxrd@z Thu Jan  1 00:00:00 1970
From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=)
Subject: Re: libgd security update
Date: Sat, 16 Jul 2016 14:36:27 +0200
Message-ID: <87wpklahf8.fsf@gnu.org>
References: <20160715203212.GA10916@jasmine>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([2001:4830:134:3::10]:59998)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1bOOpg-0004Lc-BD
	for guix-devel@gnu.org; Sat, 16 Jul 2016 08:36:37 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1bOOpb-0007tf-Jb
	for guix-devel@gnu.org; Sat, 16 Jul 2016 08:36:35 -0400
In-Reply-To: <20160715203212.GA10916@jasmine> (Leo Famulari's message of "Fri,
	15 Jul 2016 16:32:12 -0400")
List-Id: "Development of GNU Guix and the GNU System distribution."
	<guix-devel.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/guix-devel/>
List-Post: <mailto:guix-devel@gnu.org>
List-Help: <mailto:guix-devel-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/guix-devel>,
	<mailto:guix-devel-request@gnu.org?subject=subscribe>
Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org
Sender: "Guix-devel" <guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org>
To: Leo Famulari <leo@famulari.name>
Cc: guix-devel@gnu.org

Leo Famulari <leo@famulari.name> skribis:

> Several security vulnerabilities in libgd have been discovered recently,
> and today Debian issued a security update:
> https://lists.debian.org/debian-security-announce/2016/msg00197.html
>
> The first patch updates libgd to the latest release, 2.2.2, fixing some
> of the bugs.
>
> For the remaining bugs, I've taken patches from the master branch of the
> libgd Git repo.
>
> Two of the patches included binary files to be used in tests, which
> `patch` cannot handle, so I've removed those parts of the patches.
>
> This patch series was not trivial to create; removing the binary diffs
> required some care, some of the patches depended on changes associated
> with the removed binary diffs, and some upstream fixes were reverted and
> re-committed with changes. Will someone double-check this patch series
> for mistakes?

I am not familiar with neither gd nor this CVE, but at first sight the
changes make sense to me.  AIUI they are mostly those in upstream=E2=80=99s
repo, minus the binary test data, so that should be fine.

> From a27a22635f0615495d18b2d78eb90745d5989a0e Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Fri, 15 Jul 2016 14:47:47 -0400
> Subject: [PATCH 1/2] gnu: gd: Update to 2.2.2 [fixes CVE-2016-{5767,6161}=
].
>
> * gnu/packages/gd.scm (gd): Update to 2.2.2.

[...]

> From 2840ecffd86395bd63734406f924905bac727104 Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Fri, 15 Jul 2016 14:48:09 -0400
> Subject: [PATCH 2/2] gnu: gd: Fix CVE-2016-{5766,6128,6132,6214}.
>
> * gnu/packages/patches/gd-CVE-2016-5766.patch,
> gnu/packages/patches/gd-CVE-2016-6128.patch,
> gnu/packages/patches/gd-CVE-2016-6132.patch,
> gnu/packages/patches/gd-CVE-2016-6214.patch: New files.
> * gnu/local.mk (dist_patch_DATA): Add them.
> * gnu/packages/gd.scm (gd): Use patches.

I=E2=80=99d say OK for both.

Thanks!

Ludo=E2=80=99.