| Summary: | app-sci/gimps,setiathome,chessbrain: insecure installation | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Ulrich Müller <ulm> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | sci, spock |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | x86 | ||
| OS: | Linux | ||
| Whiteboard: | B2 [glsa] jaervosz | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Ulrich Müller
2004-11-02 12:09:53 UTC
Hi Michal, Please commit a fixed version. sci please fix setiathome,chessbrain and any other applications with similar issues. Gimps is now fixed. sci please fix this ASAP. Fixed for "app-sci/chessbrain". "app-sci/foldingathome" is also affected. Thanks Olivier. sci please fix foldingathome also. Fixed "app-sci/setiathome-3.08" (the version for x86 and amd64). Could someone with access to either ppc, sparc, hppa or ia64 please do the same for version 3.03? This seems to be the last affected package. "app-sci/foldingathome" is not affected. (That was my mistake.) Olivier just update the ebuilds and mark stable on the arches you have access to. Security will handle stable marking for other arches. Fixed "app-sci/setiathome-3.03". All four supported arches are marked unstable. Arches please mark setiathome stable. Fixed versions are 3.03-r2 and 3.08-r4. Combined target keywords for setiathome: x86 amd64 ppc sparc -alpha hppa ia64 sparc has following problems with setiathome-3.03-r2: 1) If you happen to have USE='X', installation fails because there is no xsetiathome; 2) If you do not have USE='X', the program installed at /opt/setiathome/setiathome is not made executable: You need to do 'chmod +x /opt/setiathome/setihome' by hand. (Previous 3.03-r1 ebuild takes care of this, but I do not know if the deletion was intentional or not. In any event, as it stands, what is installed for -r2 cannot be used but -r1 can be.) ======================== setiathome-3.08 is a nonstarter for sparc, since it does not actually exist. Regards, Ferris Back to ebuild status. Olivier please fix. Should be fixed in CVS, but I cannot test it. setiathome-3.03-r2 now installs and runs for sparc; sparc done. Back to stable marking. Thx Olivier. setiathome stable on ppc Thx Ferris. Please remember to remove arch from CC when you mark stable. Sorry. It wasn't completely clear to me that setiathome was the only thing that needed looking at. (Although I guess Comment 7 gives a pretty good indication.) GLSA drafted Security please review. GLSA 200411-26 sci please remember to remove old vulnerable ebuilds that are no longer needed. Removed insecure versions for "app-sci/{gimp,chessbrain}". Must hppa and ia64
mark "app-sci/setiathome-3.03-r2" stable before I remove r1, or should I remove
it immediately?
Yes, you should remove r1 only when hppa and ia64 mark "app-sci/setiathome-3.03-r2" stable. Removed hppa keyword because the tarball is not available |