Bug 233962 – app-text/texlive-2007-r3 depends on =media-libs/freetype-1* which has security vulnerability

• Product: Gentoo Linux
• Status: RESOLVED DUPLICATE

[Description Qian Qiao 2008-08-05 11:26:55 UTC]

app-text/texlive-2007-r3 depends on =media-libs/freetype-1* which has a security vulnerability[1].

A quick look on all textlive's dependencies seem to suggest that the dependency on =freetype-1* is redundant.

1. http://www.gentoo.org/security/en/glsa/glsa-200806-10.xml

Reproducible: Always

Steps to Reproduce:

[Comment 1 Rafał Mużyło 2008-08-05 14:58:39 UTC]

It's not quite redundant,
there a certain tool, that has never been ported to
freetype 2.
It's ttf2tfm.

[Comment 2 Qian Qiao 2008-08-05 15:35:03 UTC]

(In reply to comment #1)
> It's not quite redundant,
> there a certain tool, that has never been ported to
> freetype 2.
> It's ttf2tfm.
> 

It doesn't look like the author is having much time to port it to freetype 2[1].

So it looks like unless the fix for glsa-200806-10[2] is ported to freetype 1, we are pretty stuck.

1. http://groups.google.com/group/comp.text.tex/browse_thread/thread/3b41b0176fe8de6b/39fa200217617ac1
2. http://www.gentoo.org/security/en/glsa/glsa-200806-10.xml

[Comment 3 David Leverton 2008-08-05 16:22:00 UTC]

(In reply to comment #2)
> So it looks like unless the fix for glsa-200806-10[2] is ported to freetype 1,
> we are pretty stuck.

The ChangeLog entry for freetype-1.4_pre20080316-r1 claims that it fixes the 3 CVEs referenced by that GLSA.  If you think it doesn't, I'm sure the fonts team would like to know, otherwise the GLSA should be updated to mark that version as unaffected.

[Comment 4 Jeroen Roovers (RETIRED) 2008-08-05 16:29:32 UTC]

Please refer to the last few comments in the bug I reference. AFAIK this is a known issue.

*** This bug has been marked as a duplicate of bug 225851 ***