Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 273105 - media-gfx/megapov affected by bundled libpng-1.2.8 (CVE-2008-5907, ...)
Summary: media-gfx/megapov affected by bundled libpng-1.2.8 (CVE-2008-5907, ...)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~2 [noglsa]
Keywords:
Depends on:
Blocks: bundled-libs
  Show dependency tree
 
Reported: 2009-06-07 20:25 UTC by Diego Elio Pettenò (RETIRED)
Modified: 2009-11-07 08:58 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Diego Elio Pettenò (RETIRED) gentoo-dev 2009-06-07 20:25:43 UTC 
check ${S}/libraries/png.
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-07 21:10:26 UTC 
megapov is at least affected by CVE-2008-5709 (c.f. bug 255231).
For susceptibility to CVE-2008-5907, only 2 out of 3 needed requirements are met.

I didn't check for other issues, but the one hit is enough for me to take action:

Graphics, can you rip out libpng? If not, as upstream development seems to have stopped and no package RDPENEDS on it, we'd have to consider megapov as a candidate for removal.
Comment 2 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-23 23:41:36 UTC 
No response from maintainers.
Treecleaners, please proceed to last rites.
Comment 3 Jeremy Olexa (darkside) (RETIRED) archtester gentoo-dev Security 2009-07-03 16:21:22 UTC 
# Jeremy Olexa <darkside@gentoo.org> (3 Jul 2009)
# Security issue, dead upstream. Removal in 60 days, bug 273105
media-gfx/megapov
Comment 4 Jeremy Olexa (darkside) (RETIRED) archtester gentoo-dev Security 2009-09-04 01:45:40 UTC 
removed from tree, security team: all yours.
Comment 5 Stefan Behte (RETIRED) gentoo-dev Security 2009-11-07 01:47:38 UTC 
libpng was rated B2 in bug #255231
Comment 6 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-11-07 08:58:26 UTC 
megapov was never stable from what I see. → noglsa