Your message dated Tue, 21 Oct 2008 16:02:05 +0000 with message-id <[EMAIL PROTECTED]> and subject line Bug#502441: fixed in cmake 2.6.0-6 has caused the Debian Bug report #502441, regarding CMake includes static copy of libraries available in Debian to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [EMAIL PROTECTED] immediately.) -- 502441: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502441 Debian Bug Tracking System Contact [EMAIL PROTECTED] with problems
--- Begin Message ---Package: cmake Version: 2.6.0-5 Severity: important Tags: patch security -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi it looks like cmake on Debian does not use system libraries much. Is there any specific reason for this? Currently curl, expat, zlib and xmlrpc libraries are included in CMake sources and they are used instead of system ones. This can lead to problems in case of security problem in one of them. Looking at curl, bundled version is 7.16.1 and it is affected at least by CVE-2007-3564. I did not investigate other embedded libraries... Using --system-libs parameter to bootstrap seems to fix this issue and cmake seems to work fine. In this case you also need to add build depends for used libraries. Hopefully I did not miss any in attached patch. CC to security team as version which includes old curl is already in testing. - -- Michal Čihař | http://cihar.com | http://blog.cihar.com - -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.25.16-0.1-default (SMP w/2 CPU cores) Locale: LANG=cs_CZ.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages cmake depends on: ii libc6 2.7-15 GNU C Library: Shared libraries ii libgcc1 1:4.3.2-1 GCC support library ii libidn11 1.10-2.1 GNU libidn library, implementation ii libncurses5 5.6+20081004-1 shared libraries for terminal hand ii libssl0.9.8 0.9.8g-13 SSL shared libraries ii libstdc++6 4.3.2-1 The GNU Standard C++ Library v3 cmake recommends no packages. cmake suggests no packages. - -- no debconf information -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkj3SdcACgkQ3DVS6DbnVgRFBACg6W4oF4uEoYMmnIDrolJnS22z 3YsAoOlvpNHG5Wv16OF1BKkSh9CIHG/L =6LYo -----END PGP SIGNATURE-----diff -u cmake-2.6.2/debian/control cmake-2.6.2/debian/control --- cmake-2.6.2/debian/control +++ cmake-2.6.2/debian/control @@ -4,7 +4,7 @@ Maintainer: A. Maitland Bottoms <[EMAIL PROTECTED]> Uploaders: Pierre Habouzit <[EMAIL PROTECTED]>, Modestas Vainius <[EMAIL PROTECTED]> DM-Upload-Allowed: yes -Build-Depends: debhelper (>= 6.0.7~), libncurses5-dev, tcl8.4, quilt, libcurl4-gnutls-dev +Build-Depends: debhelper (>= 6.0.7~), libncurses5-dev, tcl8.4, quilt, libcurl4-gnutls-dev, libxmlrpc-c3-dev, libexpat1-dev, zlib1g-dev Standards-Version: 3.8.0 Package: cmake diff -u cmake-2.6.2/debian/rules cmake-2.6.2/debian/rules --- cmake-2.6.2/debian/rules +++ cmake-2.6.2/debian/rules @@ -38,7 +38,7 @@ echo CMAKE_CXX_FLAGS:STRING=$(CFLAGS) >> Build/CMakeCache.txt $(if $(USE_DARTP),echo DART_ROOT:PATH=/usr/share/Dart >> Build/CMakeCache.txt) $(if $(USE_DARTP),echo BUILDNAME:STRING=cmake_2.2.3-1_$(DARCH).deb >> Build/CMakeCache.txt) - cd Build && ../bootstrap --prefix=/usr --docdir=/share/doc/cmake --mandir=/share/man + cd Build && ../bootstrap --prefix=/usr --docdir=/share/doc/cmake --mandir=/share/man --system-libs chmod -x ChangeLog.manual chmod -x Modules/*.cmake Modules/*.cmake.in Modules/*.cxx Modules/Platform/* touch $@
--- End Message ---
--- Begin Message ---Source: cmake Source-Version: 2.6.0-6 We believe that the bug you reported is fixed in the latest version of cmake, which is due to be installed in the Debian FTP archive: cmake_2.6.0-6.diff.gz to pool/main/c/cmake/cmake_2.6.0-6.diff.gz cmake_2.6.0-6.dsc to pool/main/c/cmake/cmake_2.6.0-6.dsc cmake_2.6.0-6_amd64.deb to pool/main/c/cmake/cmake_2.6.0-6_amd64.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Modestas Vainius <[EMAIL PROTECTED]> (supplier of updated cmake package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Thu, 16 Oct 2008 22:18:14 +0300 Source: cmake Binary: cmake Architecture: source amd64 Version: 2.6.0-6 Distribution: unstable Urgency: medium Maintainer: A. Maitland Bottoms <[EMAIL PROTECTED]> Changed-By: Modestas Vainius <[EMAIL PROTECTED]> Description: cmake - A cross-platform, open-source make system Closes: 502441 Changes: cmake (2.6.0-6) unstable; urgency=medium . * Dynamically link against system libraries available in Debian. Thanks to Michal Čihař (Closes: #502441). * Urgency medium due to security issue above. * Add Vcs fields. * Add myself to Uploaders. Checksums-Sha1: 5989d923e68643e879606cd69cde24aeb479d9c4 1251 cmake_2.6.0-6.dsc 779a9e6a527f2a8a7c9edceac75c385e74b68455 154577 cmake_2.6.0-6.diff.gz 282bed9a9f7dce659ceffd873cd6f73ac058fc9b 6992030 cmake_2.6.0-6_amd64.deb Checksums-Sha256: 7588401ac141fdd779b073e39aa20f04978b1dc11fb1e8a09fcd4f4cc1394c5a 1251 cmake_2.6.0-6.dsc daf3bbd889fa0aceefeb9b01aec9122acfe93df9104b05da34925d07e9df9dd9 154577 cmake_2.6.0-6.diff.gz ead9ada64b91f314e8133eff14f77eb3a3e801be1656603d4541309080de82bd 6992030 cmake_2.6.0-6_amd64.deb Files: f87a8d2696df1ea6a821118912388485 1251 devel optional cmake_2.6.0-6.dsc ec68469da52f2db291c2a1f853ba663e 154577 devel optional cmake_2.6.0-6.diff.gz f1b32f088a948df5d083c3b228b5e3a9 6992030 devel optional cmake_2.6.0-6_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkj99O4ACgkQvGr7W6HudhxsvQCcDJG/0cQy8wWKlvJiWiImOux0 LzQAn2UqFQcF6JLqTafm1BvmpDCfe/0K =85Fs -----END PGP SIGNATURE-----
--- End Message ---
