Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] current cvs version broken?

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] current cvs version broken?
  • Date: Tue, 14 Mar 2006 20:28:30 +0100

On Tue, Mar 14, 2006 at 10:37:28AM -0800, Seth Woolley wrote:
> David Brown wrote:
> >>there have been several reports about current cvs version hanging on
> >>checkouts of various stuff, among other nss and nspr which have been
> >>switched to using snapshots instead of direct cvs checkouts because of
> >>that.
> >
> >
> > I've seen this with the e17 packages and ffmpeg-cvs as well.
> >
> >
> >>Apparently this is not caused by the cvs server as I thought but by our
> >>version of the client. Downgrading to 1.12.12 or to the stable cvs tree
> >>(1.11.21) fixes this.
> >>Since 1.12.13 was a security update from 1.12.12, we can't just
> >>downgrade, so we can either backport the security fixes from 1.12.13 to
> >>1.12.12 (unless those are causing the problem of course ;) or switch our
> >>spell to use the stable cvs tree. Switching to stable is what I would
> >>prefer, but that will remove some features from our cvs version.
> >>What do you think?
> >
> >
> > What were the security fixes? What are the set of conditions to
> > exploit the security hole? If they are really obscure we probably
> > could do a straight downgrade.
> >
>
> The vulns fixed were to use a new (more secure) internal zlib version.
> If we use the system zlib, we fix the issues and can keep the old
> version around. I suggest we remove the option to use the internal zlib
> version in the spell, use the system one, and merely downgrade it.

If this is indeed the only security fix in there, removing that option
won't hurt anyone.

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org




Archive powered by MHonArc 2.6.24.

Top of Page