Created attachment 557364 [details] emerge --info media-libs/libmp3splt runtime links against dev-libs/libltdl, as demonstrated by portage's output when unmerging the latter: !!! existing preserved libs: >>> package: dev-libs/libltdl-2.4.6 * - /usr/lib64/libltdl.so.7 * - /usr/lib64/libltdl.so.7.3.1 * used by /usr/lib64/libmp3splt.so.0.0.9 (media-libs/libmp3splt-0.9.2-r1) * used by /usr/lib64/libmp3splt0/libsplt_mp3.so.0.0.0 (media-libs/libmp3splt-0.9.2-r1) * used by /usr/lib64/libmp3splt0/libsplt_ogg.so.0.0.0 (media-libs/libmp3splt-0.9.2-r1) $ ldd /usr/lib64/libmp3splt.so.0.0.9 linux-vdso.so.1 (0x00007ffd90539000) libc.so.6 => /lib64/libc.so.6 (0x00007fa004f0d000) libm.so.6 => /lib64/libm.so.6 (0x00007fa004d85000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fa004d2d000) libltdl.so.7 => /usr/lib64/libltdl.so.7 (0x00007fa004d1f000) /lib64/ld-linux-x86-64.so.2 (0x00007fa00511d000) libdl.so.2 => /lib64/libdl.so.2 (0x00007fa004d19000) Arch also lists libltdl as a runtime dep: https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/libmp3splt Please add to RDEPEND.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1e9a6c2c0f49cf5ba42be787eb12a7d725c49915 commit 1e9a6c2c0f49cf5ba42be787eb12a7d725c49915 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2021-01-23 19:25:16 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2021-01-23 21:11:56 +0000 media-libs/libmp3splt: Add missing DEPEND, EAPI-7 bump Bug: https://bugs.gentoo.org/672784 Package-Manager: Portage-3.0.14, Repoman-3.0.2 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> media-libs/libmp3splt/files/CVE-2017-15185.patch | 6 +- .../libmp3splt/files/libmp3splt-0.7-libltdl.patch | 4 +- media-libs/libmp3splt/libmp3splt-0.9.2-r2.ebuild | 64 ++++++++++++++++++++++ 3 files changed, 69 insertions(+), 5 deletions(-)
Let's give it a few days.
amd64 done
x86 done
sparc done all arches done