488194 – <dev-perl/perl-tk-804.32.0: bundling and statically linking vulnerable libraries

Bug 488194 - <dev-perl/perl-tk-804.32.0: bundling and statically linking vulnerable libraries

Summary: <dev-perl/perl-tk-804.32.0: bundling and statically linking vulnerable libraries

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	Highest critical
Assignee:	Gentoo Security

URL:
Whiteboard:	C3 [noglsa]
Keywords:

Depends on:
Blocks:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Justin Lecher (RETIRED) gentoo-dev

2013-10-16 10:08:45 UTC

At least following versions are bundled

zlib: 1.2.3 (18 July 2005)
libpng: 1.2.12 - June 27, 2006

There maybe more.

Comment 1 Vladimir Smirnov (RETIRED) gentoo-dev

2014-01-21 13:41:51 UTC

Fixed in perl-tk-804.31.0-r1.
I've removed bundled libjpeg, libpng, zlib, and fixed one of makefiles to properly use pkg-config.

Comment 2 Justin Lecher (RETIRED) gentoo-dev

2014-01-21 14:05:57 UTC

Reopen this bug as security might want to take action.

Comment 3 Andreas K. Hüttel archtester

2014-11-30 21:54:14 UTC

Newest version in the tree is 804.32.0
Perl out.

Comment 4 Yury German Gentoo Infrastructure

2015-02-22 14:00:53 UTC

The only versions in the tree do not contain these files. 

Closing as resolved noglsa