| Summary: | <media-plugins/audacious-plugins-3.1 Multiple vulnerabilities (CVE-2011-{2911,2912,2913,2914,2915}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | chainsaw, jdhore, n0idx80, sound |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://jira.atheme.org/browse/AUDPLUG-394 | ||
| See Also: | https://bugs.gentoo.org/show_bug.cgi?id=379557 | ||
| Whiteboard: | B2 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 395213 | ||
| Bug Blocks: | |||
|
Description
Agostino Sarubbo
2011-09-21 17:32:26 UTC
+*audacious-3.0.3 (22 Sep 2011) + + 22 Sep 2011; Tony Vroon <chainsaw@gentoo.org> -audacious-3.0.2.ebuild, + +audacious-3.0.3.ebuild: + Version bump. Ebuild improvements by Agostino "ago" Sarubbo close bugs + #380577, #383357 & #383649. Remove vulnerable version for security bug + #383991. +*audacious-plugins-3.0.3 (22 Sep 2011) + + 22 Sep 2011; Tony Vroon <chainsaw@gentoo.org> + -audacious-plugins-3.0.2.ebuild, +audacious-plugins-3.0.3.ebuild, + metadata.xml: + Version bump. Ebuild improvements by Agostino "ago" Sarubbo close bugs + #380577, #383357 & #383649. Remove vulnerable version for security bug + #383991. Security, please proceed to GLSA voting. (In reply to comment #1) > Security, please proceed to GLSA voting. ~3 is noglsa, resolved as fixed. Thanks. *** Bug 390319 has been marked as a duplicate of this bug. *** (In reply to comment #0) > From original advisory, only 3.x version is affected, so there is nothing to > stabilize. > Agostino, are you sure only 3.x is affected? Oftentimes what is listed as "Affected" in bugs is simply the version it was first found in... And what is "Affected" in advisories is what is "Supported" by upstream. (In reply to comment #4) > Agostino, are you sure only 3.x is affected? Sorry for this, after mail upstream I understood that is mentioned only 3.0.1 because 2.x is no longer supported but is always vulnerable. Maintainer approves stabilization so I'll add arches. Arches, please test and mark stable: =media-sound/audacious-3.0.3-r1 =media-plugins/audacious-plugins-3.0.3 Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86" amd64 ok Depends on: Required use [...]: x11-libs/gtk+-3.0.12-r1 [test] media-libs/libcanberra-0.28-r5 [gtk3] x11-misc/notification-daemon-0.5.0 [gnome] virtual/notification-daemon-0 [gnome] x11-libs/libnotify-0.7.4 [libnotify] x11-base/xorg-server-1.10.4-r1 [xvfb] media-plugins/audacious-plugins-3.0.3 [libnotify] media-sound/audacious-3.0.3-r1 [xvfb] ~amd64 ok amd64: pass + 15 Nov 2011; Tony Vroon <chainsaw@gentoo.org> audacious-3.1.ebuild: + Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & + Elijah "Armageddon" El Lazkani in security bug #383991. + 15 Nov 2011; Tony Vroon <chainsaw@gentoo.org> audacious-plugins-3.1.ebuild: + Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & + Elijah "Armageddon" El Lazkani in security bug #383991. (In reply to comment #10) > + 15 Nov 2011; Tony Vroon <chainsaw@gentoo.org> audacious-3.1.ebuild: > + 15 Nov 2011; Tony Vroon <chainsaw@gentoo.org> audacious-plugins-3.1.ebuild: So we're going for 3.1 now? no, already 3.0.3 is unaffected (In reply to comment #12) > no, already 3.0.3 is unaffected Then why were both 3.1s marked stable for amd64? (In reply to comment #13) > Then why were both 3.1s marked stable for amd64? Because of a significant amount of bug & stability fixes that have gone in since the 3.0 branch was closed. I do not believe that the modplug vulnerabilities in question were ever relevant to our in-tree copy, which had additional fixes applied and diverted from what upstream had put out. However, if I am forced into an update, it might as well be one that benefits users. You are free to mark 3.0.3 instead if you disagree. So we should do this. Arch teams, please test and mark stable: =media-sound/audacious-3.1 =media-plugins/audacious-plugins-3.1 Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86" Stable for HPPA. x86 stable Fails to build on ppc/ppc64; bug #383991 (In reply to comment #18) > Fails to build on ppc/ppc64; bug #383991 ITYM bug 395213 Also happens on Alpha, btw. Added code to fix the linker flag bug, stable on alpha. sparc stable ppc done ppc64 done Thanks, everyone. Created new GLSA request. This issue was resolved and addressed in GLSA 201203-14 at http://security.gentoo.org/glsa/glsa-201203-14.xml by GLSA coordinator Sean Amoss (ackle). |
