[SM-Discuss] current cvs version broken?

Arwed von Merkatz v.merkatz at gmx.net
Tue Mar 14 14:28:30 EST 2006


On Tue, Mar 14, 2006 at 10:37:28AM -0800, Seth Woolley wrote:
> David Brown wrote:
> >>there have been several reports about current cvs version hanging on
> >>checkouts of various stuff, among other nss and nspr which have been
> >>switched to using snapshots instead of direct cvs checkouts because of
> >>that.
> > 
> > 
> > I've seen this with the e17 packages and ffmpeg-cvs as well.
> > 
> > 
> >>Apparently this is not caused by the cvs server as I thought but by our
> >>version of the client. Downgrading to 1.12.12 or to the stable cvs tree
> >>(1.11.21) fixes this.
> >>Since 1.12.13 was a security update from 1.12.12, we can't just
> >>downgrade, so we can either backport the security fixes from 1.12.13 to
> >>1.12.12 (unless those are causing the problem of course ;) or switch our
> >>spell to use the stable cvs tree. Switching to stable is what I would
> >>prefer, but that will remove some features from our cvs version.
> >>What do you think?
> > 
> > 
> > What were the security fixes? What are the set of conditions to
> > exploit the security hole? If they are really obscure we probably
> > could do a straight downgrade.
> > 
> 
> The vulns fixed were to use a new (more secure) internal zlib version. 
> If we use the system zlib, we fix the issues and can keep the old 
> version around.  I suggest we remove the option to use the internal zlib 
> version in the spell, use the system one, and merely downgrade it.
 
If this is indeed the only security fix in there, removing that option
won't hurt anyone.

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org



More information about the SM-Discuss mailing list