Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 196865 - app-emulation/emul-linux-x86-baselibs: Multiple issues
Summary: app-emulation/emul-linux-x86-baselibs: Multiple issues
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
Whiteboard: B1 [glsa]
: 197467 (view as bug list)
Depends on: CVE-2007-5707
  Show dependency tree
Reported: 2007-10-24 02:25 UTC by Robert Buchholz (RETIRED)
Modified: 2014-12-12 01:08 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2007-10-24 02:25:33 UTC
emul-linux-x86-baselibs-10.2 contains these files which are vulnerable to security bugs fixed in their source packages:

* cups-1.2.6:          bug 170881, GLSA 200703-28
* file-4.18.tbz2:      bug 171452, bug 174217, GLSA 200704-13
* lcms-1.14-r1.tbz2:   bug 179156
* libpng-1.2.15.tbz2:  bug 178004, bug 195261
* openssl-0.9.8d.tbz2: bug 188799, bug 194039, bug 195634
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2007-10-24 02:27:26 UTC
amd64, please advise.
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2007-11-08 03:22:55 UTC
* sys-auth/nss_ldap should be upgraded to 257.2 or later, see bug 198390.
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2007-11-08 03:24:50 UTC
*** Bug 197467 has been marked as a duplicate of this bug. ***
Comment 4 Mike Doty (RETIRED) gentoo-dev 2007-11-14 07:24:48 UTC
app-emulation/emul-linux-x86-qtlibs-20071114 in tree ~amd64 + p.masked.  This was produced with a new build system.  We intend for these ebuilds to go stable in time for releng(really soon)
Comment 5 Mike Doty (RETIRED) gentoo-dev 2007-11-14 07:25:42 UTC
s/qtlibs/baselibs (my copypasta fails)
Comment 6 Togge 2007-11-14 19:40:02 UTC
Might not be anything rellevant, but emerge gives this:

 * Messages for package app-emulation/emul-linux-x86-baselibs-20071114:

 * QA Notice: The following shared libraries lack a SONAME
 *  /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20071114/image/lib32/
 * QA Notice: Found an absolute symlink in a library directory:
 *            usr/lib32/ -> /usr/lib32/
 *            It should be a relative symlink if in the same directory
 *            or a linker script if it crosses the /usr boundary.
 * QA Notice: Found an absolute symlink in a library directory:
 *            usr/lib32/ -> /usr/lib32/
 *            It should be a relative symlink if in the same directory
 *            or a linker script if it crosses the /usr boundary.
 * QA Notice: Found an absolute symlink in a library directory:
 *            usr/lib32/ -> /usr/lib32/
 *            It should be a relative symlink if in the same directory
 *            or a linker script if it crosses the /usr boundary.
Comment 7 Togge 2007-11-16 19:34:12 UTC
--- amd64 ---
app-emulation/emul-linux-x86-baselibs-20071114 - USE:

1: emerges
2: passes collision-protect, (multilib-)strict, test
3: works (tested with mozilla-*-bin, acroread, googleearth, acroread has multiple font issues but that is for another bug I guess)

Portage (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.22-gentoo-r9 x86_64)
System uname: 2.6.22-gentoo-r9 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 4200+
Timestamp of tree: Unknown
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.9-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
CFLAGS="-O2 -ggdb -march=athlon64 -pipe"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/init.d /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -ggdb -march=athlon64 -pipe"
FEATURES="ccache collision-protect distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms splitdebug strict unmerge-orphans userfetch"
GENTOO_MIRRORS="         "
LINGUAS="en sv"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
USE="3dnow 3dnowext X a52 aac acpi aiglx alsa amd64 apache2 arts asf avi bash-completion berkdb bitmap-fonts branding browserplugin cairo ccache cdr cli cpudetection cracklib crypt cscope css cups cvs dbus divx divx4linux dlloader dri dvd dvdr dvdread eds emboss encode esd evo fam ffmpeg firefox flac foomaticdb fortran freetype gdbm geoip gif gimp gmedia gnokii gnome gpm gstreamer gtk hal http iconv ieee1394 imap imlib ipv6 isdnlog java javascript jfs jpeg kde kdeenablefinal kdehiddenvisibility kdepim kerberos logitech-mouse mad madwifi maildir midi mikmod mmx mmx2 mmxext mono mozbranding moznopango mozsvg mp3 mpeg mplayer msn mudflap mysql ncurses nls nptl nptlonly nsplugin ntfs nvidia obex ogg oggvorbis opengl openmp oss pam pcre pdf pdflib perl png pppd python qt qt3 qt3support qt4 quicktime readline realmedia reflection reiserfs samba scanner sdl session spell spl sse sse2 ssl subversion svg symlink tcpd tetex theora threads tiff truetype truetype-fonts type1-fonts udev unicode usb v4l v4l2 vim-syntax vim-with-x visualization vorbis wifi wmf wmp wxwindows xcomposite xface xfs xine xinerama xml xorg xosd xpm xprint xv xvid zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="mouse keyboard evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en sv" USERLAND="GNU" VIDEO_CARDS="nv nvidia"
Comment 8 Chris Gianelloni (RETIRED) gentoo-dev 2007-11-24 05:13:07 UTC
These are stable in the tree now...
Comment 9 Chris Gianelloni (RETIRED) gentoo-dev 2007-11-24 05:25:02 UTC
Sorry, I should have mentioned, removing amd64 now... add us back if we need to do anything further...
Comment 10 Mike Doty (RETIRED) gentoo-dev 2007-11-28 06:41:23 UTC
emul-linux-x86-baselibs-20071128 is most current.  will go stable shortly.
Comment 11 Robert Buchholz (RETIRED) gentoo-dev 2007-12-02 12:30:08 UTC
request filed
Comment 12 Robert Buchholz (RETIRED) gentoo-dev 2007-12-10 16:29:10 UTC
please merge e2fs >=1.40.3 for bug 201546, we'd include it in this glsa.
Comment 13 Robert Buchholz (RETIRED) gentoo-dev 2008-01-03 19:10:45 UTC
latest baselibs fixes CUPS GLSA 200712-14 (bug 201570)

Arches, please test and mark stable app-emulation/emul-linux-x86-baselibs-20071230.
Target keywords : "amd64"
Comment 14 Peter Weller (RETIRED) gentoo-dev 2008-01-03 19:41:31 UTC
All done at our end
Comment 15 Robert Buchholz (RETIRED) gentoo-dev 2008-03-18 17:36:32 UTC
and perl, bug 198196
Comment 16 Pacho Ramos gentoo-dev 2009-09-14 08:14:12 UTC
I am not sure if this is still valid with app-emulation/emul-linux-x86-baselibs-20081109 :-/
Comment 17 Pacho Ramos gentoo-dev 2009-12-31 16:55:40 UTC
What is pending here that is preventing this old bug from being closed? Thanks a lot for the info :-)
Comment 18 Stefan Behte (RETIRED) gentoo-dev Security 2010-03-06 16:39:06 UTC
A GLSA needs to be written. Unfortunately, no one had time/was willing to do that. You're welcome to join the security team and help out! :)
Comment 19 Pacho Ramos gentoo-dev 2010-03-06 17:14:06 UTC
I am not sure if GLSA should be written for emul-linux-x86 packages since every update on them fixes all bugs (including security ones) solved by package updated between each emul version :-/
Comment 20 PetaMem R&D 2012-12-13 18:22:29 UTC

 * Package:    app-emulation/emul-linux-x86-baselibs-20121202
 * Repository: gentoo
 * Maintainer:
 * USE:        elibc_glibc kernel_linux userland_GNU x86
 * FEATURES:   distcc sandbox
>>> Unpacking source...
>>> Unpacking emul-linux-x86-baselibs-20121202.tar.xz to /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/work
>>> Source unpacked in /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/work
>>> Preparing source in /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/work ...
>>> Source prepared.
>>> Configuring source in /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/work ...
>>> Source configured.
>>> Compiling source in /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/work ...
>>> Source compiled.
>>> Test phase [not enabled]: app-emulation/emul-linux-x86-baselibs-20121202

>>> Install emul-linux-x86-baselibs-20121202 into /var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/image/ category app-emulation
 * Moving lib32/ to /; some libs might not work
mv: ‘/var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/image//usr/lib32’ and ‘/var/tmp/portage/app-emulation/emul-linux-x86-baselibs-20121202/image//usr/lib32’ are the same file
 * ERROR: app-emulation/emul-linux-x86-baselibs-20121202 failed (install phase):
 *   (no error message)
 * Call stack:
 *, line   93:  Called src_install
 *   environment, line 2198:  Called emul-linux-x86_src_install
 *   environment, line  589:  Called die
 * The specific snippet of code:
 *           mv "${D}"/usr/lib32 "${D}"/usr/${x86_libdir} || die;
Comment 21 Alex Legler (RETIRED) archtester gentoo-dev Security 2012-12-13 23:45:41 UTC
(In reply to comment #20)
> dafuq?

exactly. Don't hijack bugs pertaining to other issues. Create new ones after reading through our elaborate explanations on how to file a bug.
Comment 22 GLSAMaker/CVETool Bot gentoo-dev 2014-12-12 01:08:55 UTC
This issue was resolved and addressed in
 GLSA 201412-11 at
by GLSA coordinator Sean Amoss (ackle).