all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Andreas Enge <andreas@enge.fr>
To: Felix Lechner <felix.lechner@lease-up.com>
Cc: Leo Famulari <leo@famulari.name>,
	guix-devel@gnu.org, 49817@debbugs.gnu.org
Subject: Re: [core-updates] It would be nice to fix libsndfile CVE-2021-3246 (arbitrary code execution via crafted WAV file)
Date: Wed, 5 Apr 2023 10:46:05 +0200	[thread overview]
Message-ID: <ZC01TQBgDyWGOCLA@jurong> (raw)
In-Reply-To: <CAFHYt54bMuO58B7jHLDP-w+=JkgvkGN3e914dHvC3F9OO_zOmw@mail.gmail.com>

Am Tue, Apr 04, 2023 at 08:13:19PM -0700 schrieb Felix Lechner via Development of GNU Guix and the GNU System distribution.:
> On Tue, Apr 4, 2023 at 7:49 PM Leo Famulari <leo@famulari.name> wrote:
> > See <https://issues.guix.gnu.org/issue/49817>, which was never applied
> > anywhere.
> > I guess it's enough to update libsndfile to 1.1.0 on core-updates.
> The upstream commit [2] shows that the issue was fixed in libsndfile's
> master branch as part of their merge request #713, which made it into
> these versions:
> 1.2.0
> 1.1.0
> 1.1.0beta2
> 1.1.0beta1
> It may therefore be better to upgrade directly to 1.2.0, except I
> think there was an understanding that no new features should be
> allowed on our core-updates branch at this time.

Well, an update causes a lot of rebuilds anyway. The NEWS of 1.2.0 look
like it is in fact only a bugfix release, so I took the risk to update to
this latest version. pulseaudio still compiles, and pavucontrol still works
on my machine.

The update is pushed to core-updates, but I would suggest to keep the bug
open until it is merged to master.

Thanks for the heads-up!

Andreas



  parent reply	other threads:[~2023-04-05  8:47 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-04-05  2:48 [core-updates] It would be nice to fix libsndfile CVE-2021-3246 (arbitrary code execution via crafted WAV file) Leo Famulari
2023-04-05  3:13 ` Felix Lechner via Development of GNU Guix and the GNU System distribution.
2023-04-05  8:06   ` Josselin Poiret
2023-04-05  8:46   ` Andreas Enge [this message]
2023-04-05 15:54     ` Leo Famulari
2023-04-05 16:19     ` Felix Lechner via Development of GNU Guix and the GNU System distribution.
2023-04-06 19:11       ` Commits and bug closing (was: something else) Andreas Enge
2023-04-07 10:27         ` Simon Tournier
2023-04-13  2:22           ` Commits and bug closing Maxim Cournoyer
2023-04-25 13:50     ` bug#49817: [core-updates] It would be nice to fix libsndfile CVE-2021-3246 (arbitrary code execution via crafted WAV file) Andreas Enge

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZC01TQBgDyWGOCLA@jurong \
    --to=andreas@enge.fr \
    --cc=49817@debbugs.gnu.org \
    --cc=felix.lechner@lease-up.com \
    --cc=guix-devel@gnu.org \
    --cc=leo@famulari.name \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.