Luigi Auriemma discovered * a buffer overflow in the handle_rtsp_pkt() and other functions via long version strings ("HTTP/1.0") in a server reply, * buffer-overflows in the send_*_request functions via Content-Base values, * buffer-overflow in get_transport_str_*
Luca and media-video, please advise.
should be removed and fenice as well...
I'll add libnemesi and feng once they are a bit more stable
Luca, I created bug 203536 to keep tracking of the fenice/feng bugs. I did not notice the name change that had taken place between the versions here. What do you advise how to go ahead with the existing nemesi ebuild? For a clean transition, we could introduce libnemesi sooner than you intended. Or mask nemesi until you feel the new libnemesi is ready. I should also check if the nemesi versions in our tree are actually affected.
nemesi is deprecated in itself so it's a good time to clean up the tree.
Let me know when you masked, removed or updated it.
# Luca Barbato <lu_zero@gentoo.org> (05 Jan 2008) # Security issues spotted # Superceeded by feng and libnemesi # Pending removal media-video/fenice media-video/nemesi
(In reply to comment #7) > # Superceeded by feng and libnemesi > # Pending removal Where is feng and libnemsi? mplayer has the nemesi USE flag. Would be nice to explain where one can find it in the masking comments sense it is missing from portage.
libnemesi is available currently as live git from my overlay, sadly some issues made us (I'm upstream for it) not release the library since we focused more on the server, soonish we'll release and I'll put it on gentoo.
It been several months no activity. However, for those of you that found this bug wondering where the ebuild is, it in one of the layman overlays. layman -a lu_zero That little piece of info was missing in this bug, so I'me putting it here for future reference.
I'me getting an error emerging this: * bootstrap with commands: NOCONFIGURE=1 ./autogen.sh /var/tmp/portage/media-video/libnemesi-git-0.1/temp/environment: line 1577: ./autogen.sh: No such file or directory
the ebuild has to be updated...
Security, these pkgs are no longer in portage tree. Please close this bug the way you want. + 12 Dec 2008; <ssuominen@gentoo.org> package.mask: + Removing nemesi and fenice, masked since 05 Jan 2008 for security issues. + They are also deprecated and replaced by libnemesi and feng.
thanks, closing.
