Bug 923035

Summary:	<www-client/httrack-3.49.5 httrack's bundle of zlib Minizip affected by CVE-2023-45853
Product:	Gentoo Security	Reporter:	Sebastian Pipping <sping>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	hanno, sping
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/xroche/httrack/commit/70d43d42b5bef9057b5387c0d80556ecb9045779#diff-93467241211d3f9d253fb8ad341738fbda5e5d3ade4721326f2bba82525fbaee
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=916484
Whiteboard:	B2 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	923034
Bug Blocks:

Description Sebastian Pipping gentoo-dev

2024-01-27 15:20:49 UTC

Best fix would be unbundling of course, stabilization seems second-best…

Comment 1 Larry the Git Cow gentoo-dev

2024-01-27 18:43:01 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84265ce42f30769958eea8699e807ed307a2864b

commit 84265ce42f30769958eea8699e807ed307a2864b
Author:     Sebastian Pipping <sping@gentoo.org>
AuthorDate: 2024-01-27 18:41:35 +0000
Commit:     Sebastian Pipping <sping@gentoo.org>
CommitDate: 2024-01-27 18:41:41 +0000

    www-client/httrack: Drop vulnerable
    
    Bug: https://bugs.gentoo.org/923035
    Signed-off-by: Sebastian Pipping <sping@gentoo.org>

 www-client/httrack/Manifest                 |  3 --
 www-client/httrack/httrack-3.49.2-r2.ebuild | 70 ------------------------
 www-client/httrack/httrack-3.49.4-r1.ebuild | 83 -----------------------------
 3 files changed, 156 deletions(-)

Comment 2 Hanno Böck gentoo-dev

2024-01-28 10:31:58 UTC

Sorry for the confusion, I thought there was a tracker bug for that vulnerability, but that was for some old vulnerability.