[SM-Grimoire-Bugs] [Bug 10885] poppler needs security update

bugzilla-daemon at bugs.sourcemage.org bugzilla-daemon at bugs.sourcemage.org
Sun Jun 4 14:51:13 EDT 2006


------- Additional Comments From jblosser-smgl at firinn.org  2006-06-04 13:51 -------
(In reply to comment #13)
> If I'm not mistaken, this security problem is only in the splash output code. So
> we could disable that with --disable-splash-output. At least evince should be
> fine with that as it needs the cairo output anyway.

Yeah, as noted there's at least 4 more vulnerabilities related to stream.cc that
have been fixed in the 4.x series, see http://poppler.freedesktop.org/releases.html.

It sounds like our only short-term option for stable is to put a SECURITY
warning in place and then send out a ML announcement (so those that have it
installed already get a warning).  I don't like this, but given that a new
stable is really supposed to be close, and that ledger says only 3 people have
the 0.3.x version installed, we can probably do it here.

We should also verify explicitly that the 0.5.0 version in stable-rc isn't
missing any of these fixes.

Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

More information about the SM-Grimoire-Bugs mailing list