Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 253263 - media-libs/pdflib bundles a copy of zlib-1.2.3, libpng-1.2.7, tiff, jpeg, freetype
Summary: media-libs/pdflib bundles a copy of zlib-1.2.3, libpng-1.2.7, tiff, jpeg, fre...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: bundled-libs 355971
  Show dependency tree
 
Reported: 2008-12-31 17:13 UTC by Diego Elio Pettenò (RETIRED)
Modified: 2011-04-28 15:42 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Diego Elio Pettenò (RETIRED) gentoo-dev 2008-12-31 17:13:17 UTC
And renames the symbols, thus why I missed it the first time around.
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2009-01-14 17:58:22 UTC
Multiple copies actually since the perl and python bindings don't link to the shared object but rather to the static one.
Comment 2 Rafał Mużyło 2009-05-02 03:59:18 UTC
To make this even more funny - a "gem" from configure.in:
#  PDFlib/PLOP auxiliary libraries:
#  We support only our own copy of tifflib, libpng and zlib
#  pdcore is needed in all configurations
Comment 3 Rafał Mużyło 2009-05-02 04:01:26 UTC
Though, on the other hand, they claim:
Due to custom function name prefixes an application can link against both
PDFlib (including all auxiliary libraries) and standard versions of these
libs without any naming conflicts.
Comment 4 Samuli Suominen (RETIRED) gentoo-dev 2010-03-03 08:35:11 UTC
libpng

- GLSA 200711-08
- GLSA 200804-15
- GLSA 200903-28
- GLSA 200906-01

jpeg

- GLSA 200606-11

tiff

- At least CVE-2009-2347 (bug 307001)
Comment 5 SpanKY gentoo-dev 2010-03-05 18:04:40 UTC
it's my understanding that this is kind of an important lib ...
Comment 6 Ben de Groot (RETIRED) gentoo-dev 2010-03-05 21:30:17 UTC
(In reply to comment #5)
> it's my understanding that this is kind of an important lib ...
 
How so? The only reverse dep that looks vaguely interesting is gnuplot.

Anyway, if anyone wants to fix this, feel free, as the PHP herd is virtually dead.
Comment 7 Matti Bickel (RETIRED) gentoo-dev 2010-04-01 00:10:09 UTC
It seems you can still use the external libraries by passing some configure parameters. Also, there's a new version out. I'll try to do an update.

But after it's out, i'll assign that stuff to maintainer-needed, this has zero relevance to the php herd.
Comment 8 Matti Bickel (RETIRED) gentoo-dev 2010-04-02 21:46:44 UTC
I've looked into it, but couldn't come up with a patch. It doesn't seem to accept configure switches to use shared libraries anymore. Can somebody help here?
Comment 9 Matti Bickel (RETIRED) gentoo-dev 2010-04-02 21:50:23 UTC
Also in the mix: expat. Dunno which version.
Comment 10 Rafał Mużyło 2010-04-03 00:44:22 UTC
@comment 8:I wonder just where did you see those
"configure switches to use shared libraries".
In configure.in, lines after "PDFlib/PLOP auxiliary libraries"
make it rather clear, that without hacking it away,
it's either bundled or none.
Comment 11 Jeroen Roovers (RETIRED) gentoo-dev 2011-01-30 19:01:43 UTC
Maybe it's time to move on. I think the answer to comment #5 is that someone should by now have come up with a fixed ebuild, preferably in a version bump - pdflib 8 was released in December 2009 and nobody cared.
Comment 12 Ulrich Müller gentoo-dev 2011-02-22 09:37:39 UTC
(In reply to comment #6)
> > it's my understanding that this is kind of an important lib ...
> 
> How so? The only reverse dep that looks vaguely interesting is gnuplot.

gnuplot no longer depends on pdflib, see my message in -dev. Gnuplot's "pdfcairo" terminal (available with USE=cairo) can be used as a replacement.
Comment 13 Tomáš Chvátal (RETIRED) gentoo-dev 2011-04-28 15:42:55 UTC
Removed from main tree.