[SM-Discuss] current cvs version broken?
Arwed von Merkatz
v.merkatz at gmx.net
Tue Mar 14 14:28:30 EST 2006
On Tue, Mar 14, 2006 at 10:37:28AM -0800, Seth Woolley wrote:
> David Brown wrote:
> >>there have been several reports about current cvs version hanging on
> >>checkouts of various stuff, among other nss and nspr which have been
> >>switched to using snapshots instead of direct cvs checkouts because of
> > I've seen this with the e17 packages and ffmpeg-cvs as well.
> >>Apparently this is not caused by the cvs server as I thought but by our
> >>version of the client. Downgrading to 1.12.12 or to the stable cvs tree
> >>(1.11.21) fixes this.
> >>Since 1.12.13 was a security update from 1.12.12, we can't just
> >>downgrade, so we can either backport the security fixes from 1.12.13 to
> >>1.12.12 (unless those are causing the problem of course ;) or switch our
> >>spell to use the stable cvs tree. Switching to stable is what I would
> >>prefer, but that will remove some features from our cvs version.
> >>What do you think?
> > What were the security fixes? What are the set of conditions to
> > exploit the security hole? If they are really obscure we probably
> > could do a straight downgrade.
> The vulns fixed were to use a new (more secure) internal zlib version.
> If we use the system zlib, we fix the issues and can keep the old
> version around. I suggest we remove the option to use the internal zlib
> version in the spell, use the system one, and merely downgrade it.
If this is indeed the only security fix in there, removing that option
won't hurt anyone.
Arwed v. Merkatz Source Mage GNU/Linux developer
More information about the SM-Discuss