SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=10885





------- Additional Comments From jblosser-smgl AT firinn.org  2006-06-04 13:51 
-------
(In reply to comment #13)
> If I'm not mistaken, this security problem is only in the splash output 
> code. So
> we could disable that with --disable-splash-output. At least evince should 
> be
> fine with that as it needs the cairo output anyway.

Yeah, as noted there's at least 4 more vulnerabilities related to stream.cc 
that
have been fixed in the 4.x series, see 
http://poppler.freedesktop.org/releases.html.

It sounds like our only short-term option for stable is to put a SECURITY
warning in place and then send out a ML announcement (so those that have it
installed already get a warning).  I don't like this, but given that a new
stable is really supposed to be close, and that ledger says only 3 people have
the 0.3.x version installed, we can probably do it here.

We should also verify explicitly that the 0.5.0 version in stable-rc isn't
missing any of these fixes.


-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.