From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: [PATCH 0/1] Update harfbuzz to 1.0.6 (CVE-2016-2052) Date: Fri, 29 Jan 2016 03:04:44 -0500 Message-ID: <20160129080444.GA5847@jasmine> References: <20160129094145.76c50cce@debian-netbook> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45791) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aP434-0006R1-EC for guix-devel@gnu.org; Fri, 29 Jan 2016 03:04:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aP42z-00041B-Ll for guix-devel@gnu.org; Fri, 29 Jan 2016 03:04:54 -0500 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:52406) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aP42z-000410-8K for guix-devel@gnu.org; Fri, 29 Jan 2016 03:04:49 -0500 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id AFFA7207CC for ; Fri, 29 Jan 2016 03:04:45 -0500 (EST) Content-Disposition: inline In-Reply-To: <20160129094145.76c50cce@debian-netbook> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Efraim Flashner Cc: guix-devel@gnu.org On Fri, Jan 29, 2016 at 09:41:45AM +0200, Efraim Flashner wrote: > On Fri, 29 Jan 2016 01:01:19 -0500 > Leo Famulari wrote: > > > This patch updates harfbuzz to 1.0.6, fixing CVE-2016-2052 [0]. > > > > However, 587 packages depend on harfbuzz [1]. Where should the patch be > > applied? > > > > [0] > > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2052 > > > > [1] > > Building the following 199 packages would ensure 388 dependent packages > > are rebuilt: avidemux-2.6.10 python-pyqt-5.5 pumpa-0.9.1 > [snip] > > Leo Famulari (1): > > gnu: harfbuzz: Update to 1.0.6 [fixes CVE-2016-2052]. > > > > gnu/packages/gtk.scm | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > how about the security-updates branch? I'm not sure of the status of the branch with respect to Hydra. That is, is it currently building the branch? If so, is it bad to push to the branch? I wouldn't mind a little education on this topic! Other can feel free to push this if appropriate. > > -- > Efraim Flashner אפרים פלשנר > GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 > Confidentiality cannot be guaranteed on emails sent or received unencrypted