From mboxrd@z Thu Jan 1 00:00:00 1970 From: Efraim Flashner Subject: Re: [PATCH 0/6] Libreoffice CVE and update Date: Mon, 7 Mar 2016 22:03:17 +0200 Message-ID: <20160307220317.22cc1c34@debian-netbook> References: <1457347327-13748-1-git-send-email-efraim@flashner.co.il> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; boundary="Sig_/zQ7YFxIXs__ERHSlxqSyUO1"; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55408) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ad1NJ-0003fA-29 for guix-devel@gnu.org; Mon, 07 Mar 2016 15:03:30 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ad1NF-0004yJ-Sf for guix-devel@gnu.org; Mon, 07 Mar 2016 15:03:29 -0500 Received: from flashner.co.il ([178.62.234.194]:40149) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ad1NF-0004yD-MQ for guix-devel@gnu.org; Mon, 07 Mar 2016 15:03:25 -0500 Received: from debian-netbook (85.65.229.31.dynamic.barak-online.net [85.65.229.31]) by flashner.co.il (Postfix) with ESMTPSA id 63A9440132 for ; Mon, 7 Mar 2016 20:03:24 +0000 (UTC) In-Reply-To: <1457347327-13748-1-git-send-email-efraim@flashner.co.il> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: guix-devel@gnu.org --Sig_/zQ7YFxIXs__ERHSlxqSyUO1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Mon, 7 Mar 2016 12:42:01 +0200 Efraim Flashner wrote: > Now that vigra is building again, I've put together a patch to update > libreoffice to address CVE-2016-0794 and CVE-2016-0795. Currently its > building on my machine, but hydra says the last successful build took > 7 hours and I'm currently ~5.5 into my build, but I'm expecting close > to 20 hours for a complete build. So in addition to checking over the > patches (notably liblangtag which is new, mdds which has a second version > and libreoffice with several changes), if someone with a fast computer > wants to see if they can finish building before me that'd be great. >=20 > Efraim Flashner (6): > gnu: Add liblangtag. > gnu: mdds: Update to 1.1.0. > gnu: orcus: Update to 0.11.0. > gnu: ixion: Update to 0.11.0. > gnu: libetonyek: Update to 0.1.6. > gnu: libreoffice: Update to 5.1.1.3. [Fixes CVE-2016-{0794, 0795}]. >=20 > gnu/packages/boost.scm | 26 +++++++++++++---- > gnu/packages/libreoffice.scm | 67 ++++++++++++++++++++++++++++++++++----= ------ > 2 files changed, 73 insertions(+), 20 deletions(-) >=20 It turns out libreoffice fails to build with this patch set. After discussi= ng it with Andreas and Leo on irc we've decided on trying 5.0.5.2 as per https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795/ and we'll work on the rest later. If anyone wants to work on the update now, mdds stays at 0.12.2, orcus to 0.9.2, ixion to 0.9.1, and that's a good starting point. --=20 Efraim Flashner =D7=90=D7=A4=D7=A8=D7=99=D7=9D = =D7=A4=D7=9C=D7=A9=D7=A0=D7=A8 GPG key =3D A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351 Confidentiality cannot be guaranteed on emails sent or received unencrypted --Sig_/zQ7YFxIXs__ERHSlxqSyUO1 Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJW3d6GAAoJEPTB05F+rO6T7cwP/iH/d/WXqyZxGMXEIYN88nIx j4941Yhh9iUs4t1fi/5EGjdBIuMeAX7O8/AD+oAyw3Sm0JrtOrwmRlKeEXukWTqs 0OXH2nKkwdp5I/Qz5uq1qlYwM5jIUOKxuTKbh8E4dzjiHBveWVFwj8aVNRNXe9At 0ejq6iqaDQN/MEFX7TnMUuKBjpKM7+6/OqmC16NWl+prjhxFF4+qxaqvAbVwAYNS EqSCyyhlaec85FxfOR1w3xuAmbwFpfSW7/FiA5m2vMkP+l/3tknbkR5Ll6rOFk/s rTdLCr3U08ABIDhub/KAu3t3dyzLUllSj3M1D0pesOiKubmftHCapeETKiJ+m14o mWydLY2PGRQhyrEyfXC8yllbMufWCgYBgpYlaEmeE386AghY7F/76Lrs+GtTPZ49 72FVNbGJCTZ7i/19UTNhyvurpVOHXFwF2i/xQkQQbOV3Px14S8Byhpgb4AqapDXL eDHL/ABxQ4l4sdjocsblbOacXB/83q988gP7S3mbP2z7RJvVy+vaKQzrMwcWfEIU 8jvVqRJFJFdPC5EdMp6BqySj/CZXvuUV3fgu4g6Dw1Y145peHI0+RUvYl9NHBCPj 419oD15/osArgJ8F1VoLtQlPgJXbUhSNjLFLyIslhdPfhME1nvGJ3pgWaR4y3pd3 usjJupWvg7NYMksPQ480 =Rxsd -----END PGP SIGNATURE----- --Sig_/zQ7YFxIXs__ERHSlxqSyUO1--