from home page : Version 0.38 is a miscellaneous bits-n-pieces release. First, it includes a bugfix to allow successful reading of more chm files. Second, it includes an update to allow use of "automake", thanks to Matthew Daniel. Third, it includes a quick fix for a security hazard Sven Tantau located in one of the example programs (extract_chmLib would extract filenames containing ".." as a path element, allowing overwriting of any file to which the user has write access). It also contains the following minor additions ... related links http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3178 http://www.debian.org/security/2006/dsa-1144
Merci Aur
Merci Aurélien ! This package has no maintainer, it may be hard to correct it. CCing for information chriswhite@ who has just made the last security cleanup. I'll call for a maintainer on -dev, we'll see.
Created attachment 93735 [details, diff] chmlib-0.38.ebuild de rien Raphael ;) please find attached a chmlib ebuild updated to version 0.38 with fixes for fetch url and compilation of examples. Tested and works for me on x86 (embedded webserver example), I will also test on amd64 later ... cheers Aur
Created attachment 93735 [details, diff] chmlib-0.38.ebuild de rien Raphael ;) please find attached a chmlib ebuild updated to version 0.38 with fixes for fetch url and compilation of examples. Tested and works for me on x86 (embedded webserver example), I will also test on amd64 later ... cheers Aurélien
Created attachment 93746 [details, diff] HPPA patch to chm_lib.c The 0.38 ebuild works fine here on x86; with this one-line patch to chm_lib.c it also compiles on HPPA.
Created attachment 93754 [details] chmlib-0.38.ebuild this is an updated ebuild for chmlib-0.38, i included the changes for hppa and keyworded ~hppa, Mathias can you test this ebuild on hppa ? the change should be similar than the one you provided but using sed instead of a patch. I also removed the sed line for amd64 as it's not needed anymore in 0.38 Builds and works on amd64. Right now it's keyworded "~x86 ~mad64 ~ppc ~hppa" but only ppc isn't tested ... Thanks Aurl
Created attachment 93754 [details] chmlib-0.38.ebuild this is an updated ebuild for chmlib-0.38, i included the changes for hppa and keyworded ~hppa, Mathias can you test this ebuild on hppa ? the change should be similar than the one you provided but using sed instead of a patch. I also removed the sed line for amd64 as it's not needed anymore in 0.38 Builds and works on amd64. Right now it's keyworded "~x86 ~mad64 ~ppc ~hppa" but only ppc isn't tested ... Thanks Aurléien
Yup, works fine here, thanks Aur
Yup, works fine here, thanks Aurélien!
Works fine on amd64 (tested with xchm-1.9). Many thanks Aur
Works fine on amd64 (tested with xchm-1.9). Many thanks Aurélien!
This works fine on ppc as well, but we should have approval of the hppa porting team before committing anything with ~hppa keyword added
Jer from hppa team gave the go-ahead, so 0.38 is now committed to the tree.
arches, please test and stable chmlib-0.38, thanks
1) emerges fine 2) passes collision test 3) tested it on the wordpad chm file and the utilities seem to work fine Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.17-gentoo-r4 i686) ================================================================= System uname: 2.6.17-gentoo-r4 i686 AMD Athlon(tm) XP 2500+ Gentoo Base System version 1.6.15 app-admin/eselect-compiler: [Not Present] dev-lang/python: 2.4.3-r1 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: [Not Present] dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r3 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb" CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo" CXXFLAGS="-O2" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test" GENTOO_MIRRORS="ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo/" LANG="de_DE@euro" LC_ALL="de_DE@euro" LINGUAS="de" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.informatik.rwth-aachen.de/gentoo-portage" USE="x86 3dnow 3dnowext X Xaw3d a52 alsa arts artworkextra asf audiofile avi bash-completion beagle berkdb bidi bitmap-fonts bootsplash branding bzip2 cairo cdda cddb cdparanoia cdr cli cracklib crypt css cups curl custom-cflags dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread dvi eds emacs emboss encode esd evo exif expat fam fat fbcon fdftk ffmpeg firefox foomaticdb fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2 gtkhtml hal icq idn imagemagick imap imlib ipv6 isdnlog java javascript jikes jpeg jpeg2k ldap leim libg++ libwww lm_sensors mad maildir matroska mbox mikmod mime mmx mmxext mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses nforce2 nls nocardbus nptl nptlonly nsplugin nvidia objc ogg opengl pam pcre pdf pdflib perl plotutils pmu png ppds pppd preview-latex print python qt qt3 qt4 quicktime readline reflection reiserfs samba sdk session slang spell spl sse ssl svg svga t1lib tcltk tcpd theora thunderbird tiff truetype truetype-fonts type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows xine xml xorg xosd xv xvid zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_radeon video_cards_vesa video_cards_fbdev" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS
amd64/x86 done
ppc stable, ready for glsa voting.
GLSA Voting: I currently tend to a no, altough we issued GLSAs for directory traversals in the past. But it would be easy to convince me to send one.
I tend to vote NO as well.
Hm. I think this is ugly, but I don't really see a 'security' impact. Of course you can make it one by playing it carelessly, but I tend to vote NO, too.
NEEDS_PEBKAC and dubious impact --> NO and closing. Thanks everyone.
