Re: fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-18 Thread Alexander Leidinger
Quoting Jan Henrik Sylvester m...@janh.de (from Mon, 14 Feb 2011 10:35:05 +0100): There is one more problem to solve: http://lists.freebsd.org/pipermail/freebsd-emulation/2010-December/008264.html That mail go unanswered (at least as far as the mailing list archive goes). Probably, the

Re: fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-14 Thread Tom Uffner
Jan Henrik Sylvester wrote: The easiest way would probably be: - Take the src-rpm of the pango version in RHEL 5. - Extract the patch from it: pango-glyphstring.patch-1.14.9-5.el5_3 - Extract the src-rpm of pango-1.22.3 from Fedora 10. - Apply the RHEL 5 patch with --ignore-whitespace. - Diff

Re: fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-14 Thread Rob Farmer
On Mon, Feb 14, 2011 at 8:45 AM, Tom Uffner t...@uffner.com wrote: would a src-rpm verifiably generated from the Fedora 10 src-rpm (or the pango project tarball) and the RHEL 5 patch solve this? I may not have a Reputation, but I've been around since 4.1BSD and a search of the tree and the PRs

Re: fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-14 Thread Luchesar V. ILIEV
On Mon, Feb 14, 2011 at 18:45, Tom Uffner t...@uffner.com wrote: Jan Henrik Sylvester wrote: The easiest way would probably be: - Take the src-rpm of the pango version in RHEL 5. - Extract the patch from it: pango-glyphstring.patch-1.14.9-5.el5_3 - Extract the src-rpm of pango-1.22.3 from

fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-13 Thread Tom Uffner
is there any point in trying to update linux-f10-pango to address this vulnerability? Affected package: linux-f10-pango-1.22.3_1 Type of problem: pango -- integer overflow. Reference: http://portaudit.FreeBSD.org/4b172278-3f46-11de-becb-001cc0377035.html I realize that I can install it w/

Re: fixing the vulnerability in linux-f10-pango-1.22.3_1

2011-02-13 Thread Matthias Andree
Am 13.02.2011 22:53, schrieb Tom Uffner: is there any point in trying to update linux-f10-pango to address this vulnerability? Affected package: linux-f10-pango-1.22.3_1 Type of problem: pango -- integer overflow. Reference: