Bug 296839

Summary:	sci-libs/udunits bundles a copy of expat
Product:	Gentoo Linux	Reporter:	Diego Elio Pettenò (RETIRED) <flameeyes>
Component:	New packages	Assignee:	Steve Arnold <nerdboy>
Status:	RESOLVED FIXED
Severity:	normal	CC:	sci, security
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	251464

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2009-12-14 09:11:16 UTC

And expat has been recently found vulnerable, not sure if that makes udunits vulnerable but it's something to look at.

Comment 1 Sébastien Fabbro (RETIRED) gentoo-dev

2009-12-14 17:46:34 UTC

which version of udunits?

Comment 2 Kevin Pyle 2009-12-15 00:01:08 UTC

This is probably from Diego's tinderbox work, in which case it will have pulled the latest ~arch unmasked version.  sci-libs/udunits-2.1.11 has a subdirectory named expat/, which at first glance appears to be a bundled copy of Expat.

Comment 3 Sébastien Fabbro (RETIRED) gentoo-dev

2009-12-15 06:13:50 UTC

Fixed in 2.1.11-r1