247754 – media-libs/clibpdf has an internal copy of zlib-1.1.3 (!)

Bug 247754 - media-libs/clibpdf has an internal copy of zlib-1.1.3 (!)

Summary: media-libs/clibpdf has an internal copy of zlib-1.1.3 (!)

Status:	RESOLVED WONTFIX

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	New packages (show other bugs)
Hardware:	All Linux

Importance:	High normal (vote)
Assignee:	Robin Johnson

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:	bundled-libs
	Show dependency tree

Reported:	2008-11-20 14:41 UTC by Diego Elio Pettenò (RETIRED)
Modified:	2010-01-05 15:15 UTC (History)
CC List:	4 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2008-11-20 14:41:53 UTC

Have fun, I'm almost certain that's a vulnerable version...

And just so you know, since the symbols are exported, it should be possible to use LD_PRELOAD to get that version of zlib loaded in any other non-suid program.

Nice, ain't it?

[And the license is not funny either]

Comment 1 Samuli Suominen (RETIRED) gentoo-dev

2009-09-22 16:47:55 UTC

Removed from portage.