First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 189954
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Juan Aguado <juantxorena@gmail.com>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 189954 depends on: Show dependency tree
Bug 189954 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug


Description:   Opened: 2007-08-23 17:16 0000
www-client/elinks-0.11.3 is in portage for +30 days, 0 bugs, stable upstream
and in some arches. Please stabilize in the rest.

Target archs: amd64, hppa, mips, ppc64

Reproducible: Always

------- Comment #1 From Jeroen Roovers 2007-08-23 17:47:44 0000 -------
Stable for HPPA.

------- Comment #2 From Jonas Pedersen 2007-08-23 17:56:40 0000 -------
www-client/elinks-0.11.3  USE="X ftp gpm ipv6 nls perl ssl unicode zlib
-bittorrent -bzip2 -debug -finger -gopher -guile -idn -javascript -lua -nntp
-ruby"

1. compiles on AMD64. 
2. No Collisions etc. 
3. Works. 

Please mark stable on AMD64. 

Portage 2.1.2.11 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.5-r4,
2.6.22-gentoo-r2 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r2 x86_64 Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz
Gentoo Base System release 1.12.9
Timestamp of tree: Mon, 20 Aug 2007 21:50:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[enabled]
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.21
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -O2 -msse3 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/
/etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-march=nocona -O2 -msse3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache collision-protect distcc distlocks metadata-transfer
multilib-strict parallel-fetch sandbox sfperms strict test"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/
http://ftp.du.se/pub/os/gentoo http://trumpetti.atm.tut.fi/gentoo/
http://ftp.snt.utwente.nl/pub/os/linux/gentoo
http://ds.thn.htu.se/linux/gentoo"
LC_ALL="en_DK.utf8"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/php-testing /usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi aiglx alsa amd64 apache2 arts atk berkdb bitmap-fonts
cairo cdr cli cracklib crypt cups dbus dga directfb dri dts dvd dvdr dvdread
eds emboss encode evo fam fbcn ffmpeg firefox fortran ftp gd gdbm gif gphoto2
gpm gstreamer gtk hal iconv icq ieee1394 ipv6 isdnlog java jpeg kde kerberos
lm_sensors mad midi mikmod mjpeg mmx mozilla mp3 mpeg mplayer msn mudflap
ncurses nls nptl nptlonly ogg oggvorbis opengl openmp pam pcre pda pdf perl png
ppds pppd python qt qt3 qt3support qt4 quicktime readline reflection samba sdl
session spell spl sse sse2 sse3 ssl svg tcpd test threads tiff truetype
truetype-fonts type1-fonts unicode vorbis xcomposite xml xorg xscreensaver xv
xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci
emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m
maestro3 trident usb-audio via82xx via82xx-modem ymfpci"
ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file
hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route
share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux"
LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses
text" USERLAND="GNU" VIDEO_CARDS="radeon"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LDFLAGS, LINGUAS,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

------- Comment #3 From Michal Januszewski 2007-08-23 19:41:21 0000 -------
ACK-ed, please mark stable at your own discretion.

------- Comment #4 From Wulf Krueger (RETIRED) 2007-08-24 19:07:12 0000 -------
Marked stable on amd64. 

------- Comment #5 From Robert Buchholz 2007-09-20 13:44:12 0000 -------
0.11.3 fixed a security issue.
See [1] and [2] for details. Quoting [1]:
  If ELinks is making a POST request to an https URL, and a proxy has been
  defined for https, ELinks takes the body and Content-* headers of the
  POST request and adds them to the CONNECT request in cleartext.  So
  the proxy can now snoop all the data that was supposed to be hidden by
  TLS, as can anyone between ELinks and the proxy.  Apparently some
  proxies also entirely refuse such requests.

[1] http://bugzilla.elinks.cz/show_bug.cgi?id=937
[2] https://bugzilla.redhat.com/297611

------- Comment #6 From Brent Baude 2007-09-20 20:54:25 0000 -------
ppc64 stable

------- Comment #7 From Robert Buchholz 2007-09-20 21:28:34 0000 -------
last supported arch, this one needs decisions.

------- Comment #8 From Robert Buchholz 2007-09-21 22:25:45 0000 -------
This is CVE-2007-5034.

------- Comment #9 From Sune Kloppenborg Jeppesen 2007-09-24 17:26:44 0000 -------
I vote NO.

------- Comment #10 From Pierre-Yves Rofes 2007-09-24 17:59:20 0000 -------
voting NO too and closing. feel free to reopen if you disagree.

------- Comment #11 From Joshua Kinard 2007-09-27 01:34:25 0000 -------
mips stable.

First Last Prev Next    No search results available      Search page      Enter new bug