Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 355739 - <media-gfx/optipng-0.7 ship internal copy of =media-libs/libpng-1.4.5
Summary: <media-gfx/optipng-0.7 ship internal copy of =media-libs/libpng-1.4.5
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://sourceforge.net/tracker/?func...
Whiteboard:
Keywords:
Depends on:
Blocks: 386851 CVE-2011-3026
  Show dependency tree
 
Reported: 2011-02-20 21:25 UTC by Hanno Böck
Modified: 2012-03-17 14:07 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hanno Böck gentoo-dev 2011-02-20 21:25:43 UTC
(there's an upstream release 0.6.5, but that doesn't work either)

compile error:
make -C src -f scripts/gcc.mak CC=x86_64-pc-linux-gnu-gcc 'GENTOO_CFLAGS=-O2 -march=core2 -pipe' 'GENTOO_LDFLAGS=-Wl,-O1 -Wl,--as-needed -Wl,-O1,--sort-common,--hash-style=gnu' 
make: Entering directory `/var/tmp/portage/media-gfx/optipng-0.6.4/work/optipng-0.6.4/src'
x86_64-pc-linux-gnu-gcc -c -O2 -march=core2 -pipe -Wall -I../lib/pngxtern optipng.c
x86_64-pc-linux-gnu-gcc -c -O2 -march=core2 -pipe -Wall -I../lib/pngxtern opngoptim.c
In file included from opngoptim.c:20:0:
../lib/pngxtern/pngx.h:36:50: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngx.h:36:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngx.h:38:45: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngx.h:38:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngx.h:40:48: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngx.h:40:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngx.h:58:47: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngx.h:58:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngx.h:60:56: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngx.h:60:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngx.h:60:8: error: conflicting types for 'PNG_EXPORT'
../lib/pngxtern/pngx.h:58:8: note: previous declaration of 'PNG_EXPORT' was here
In file included from opngoptim.c:21:0:
../lib/pngxtern/pngxtern.h:49:39: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
../lib/pngxtern/pngxtern.h:49:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
../lib/pngxtern/pngxtern.h:49:8: error: conflicting types for 'PNG_EXPORT'
../lib/pngxtern/pngx.h:58:8: note: previous declaration of 'PNG_EXPORT' was here
In file included from opngoptim.c:22:0:
opngreduc.h:55:42: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
opngreduc.h:55:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
opngreduc.h:55:8: error: conflicting types for 'PNG_EXPORT'
../lib/pngxtern/pngx.h:58:8: note: previous declaration of 'PNG_EXPORT' was here
opngreduc.h:67:48: error: macro "PNG_EXPORT" requires 4 arguments, but only 2 given
opngreduc.h:67:8: warning: type defaults to 'int' in declaration of 'PNG_EXPORT'
opngreduc.h:67:8: error: conflicting types for 'PNG_EXPORT'
../lib/pngxtern/pngx.h:58:8: note: previous declaration of 'PNG_EXPORT' was here
opngoptim.c: In function 'opng_read_data':
opngoptim.c:682:13: warning: implicit declaration of function 'pngx_malloc_rows'
opngoptim.c:682:13: warning: comparison between pointer and integer
opngoptim.c: In function 'opng_write_data':
opngoptim.c:791:16: warning: implicit declaration of function 'crc32'
opngoptim.c: In function 'opng_read_file':
opngoptim.c:1026:7: warning: implicit declaration of function 'pngx_read_image'
opngoptim.c:1059:7: warning: implicit declaration of function 'opng_validate_image'
opngoptim.c:1118:10: warning: implicit declaration of function 'opng_reduce_image'
opngoptim.c: In function 'opng_write_file':
opngoptim.c:1203:35: error: 'Z_HUFFMAN_ONLY' undeclared (first use in this function)
opngoptim.c:1203:35: note: each undeclared identifier is reported only once for each function it appears in
opngoptim.c:1204:35: error: 'Z_RLE' undeclared (first use in this function)
opngoptim.c: In function 'opng_init_iterations':
opngoptim.c:1385:7: error: 'Z_BEST_COMPRESSION' undeclared (first use in this function)
opngoptim.c:1391:10: error: 'Z_DEFAULT_STRATEGY' undeclared (first use in this function)
opngoptim.c:1398:10: error: 'Z_FILTERED' undeclared (first use in this function)
opngoptim.c:1409:45: error: 'Z_HUFFMAN_ONLY' undeclared (first use in this function)
opngoptim.c:1409:69: error: 'Z_RLE' undeclared (first use in this function)
opngoptim.c: In function 'opng_iterate':
opngoptim.c:1468:32: error: 'Z_HUFFMAN_ONLY' undeclared (first use in this function)
opngoptim.c:1473:37: error: 'Z_RLE' undeclared (first use in this function)
make: *** [opngoptim.o] Error 1
Comment 1 renato gallo 2011-05-06 13:10:40 UTC
same here

emerge --info
Portage 2.1.9.42 (default/linux/amd64/10.0, gcc-4.4.5, libc-0-r0, 2.6.38-gentoo-r3 x86_64)
=================================================================
System uname: Linux-2.6.38-gentoo-r3-x86_64-Intel-R-_Core-TM-_i5_CPU_760_@_2.80GHz-with-gentoo-2.0.2
Timestamp of tree: Fri, 06 May 2011 11:45:01 +0000
app-shells/bash:     4.1_p9
dev-java/java-config: 2.1.11-r3
dev-lang/python:     2.7.1-r1, 3.1.3-r1
dev-util/cmake:      2.8.4-r1
sys-apps/baselayout: 2.0.2
sys-apps/openrc:     0.8.2-r1::poly-c
sys-apps/sandbox:    2.4
sys-devel/autoconf:  2.13, 2.65-r1
sys-devel/automake:  1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.4.5
sys-devel/gcc-config: 1.4.1-r1
sys-devel/libtool:   2.2.10
sys-devel/make:      3.81-r2
sys-kernel/linux-headers: 2.6.36.1
sys-libs/glibc:      2.11.3
virtual/os-headers:  0
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=native"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distlocks fixlafiles fixpackages news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="http://mirror.switch.ch/ftp/mirror/gentoo/"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="nb"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/var/lib/layman/luksans-arduino /var/lib/layman /var/lib/layman/vmware /var/lib/layman/zugaina /var/lib/layman/wirelay /var/lib/layman/stuff /var/lib/layman/sabayon /var/lib/layman/nikai /var/lib/layman/dev-zero /var/lib/layman/pentoo /var/lib/layman/damex-overlay /var/lib/layman/nelchael /var/lib/layman/pcsx2 /var/lib/layman/poly-c /var/lib/layman/sunrise /var/lib/layman/amielke-overlay /var/lib/layman/benf"
SYNC="rsync://rsync.de.gentoo.org/gentoo-portage"
USE="3dnow X a52 aac aacs aalib acl alsa amd64 apng ares atmo auto-hinter bash-completion berkdb bidi bittorrent bl bluetooth bluray bs2b bzip2 cairo cdda cddb cdparanoia cdr cjk cli cracklib crypt cups curl cxx dbus dc1394 desktopglobe devfs-compat device-mapper dga dirac directfb dri dts dv dvb dvd dvdr eds encode examples exif expat extras faac fbcon ffmpeg flac fluidsynth fontconfig fontforge foomaticdb fortran frei0r ftp gd gdbm gdu ggi gif gimp gles glsl gme gnome gnome-keyring gphoto2 gpm gsm gstreamer gtk httpd iconv id3tag ieee1394 imagemagick ipod ipv6 java jce jpeg jpeg2k kate kde kdrive ladspa lame lapack lcms ldap libass libcaca libmpeg2 libnotify libproxy libtiger libv4l2 lirc live lua lzma lzo mad matroska md5sum metalink mjpeg mmx mng modplug modules mp3 mpeg mpg123 mtp mudflap multilib musepack musicbrainz nas nautilus ncurses network nls nptl nptlonly nsplugin nspluginwrapper nut nuv odbc odk ogg openexr opengl openmp openvg optimisememory oss pam pango pasteafter pcre pdf perl phonon php plasma playlist png pnm postproc ppds pppd projectm ps pvr python qalculate qt-faststart qt4 quicktime qwt radio raw readline reiserfs remoteosd rtmp rtsp run-as-root samba schroedinger scim screensaver script scripts sdk sdl sdl-image semantic-desktop session shine shout skins smp sqlite sse sse2 ssl ssse3 startup-notification stream svg sysfs system-libvncserver taglib tcpd templates tga theora threads tiff tilepath tk tools truetype truetype-debugger twolame type3 udev unicode upnp usb utils v4l2 vaapi vcdx vdpau vix vlm vmware_guest_freebsd vmware_guest_linux vmware_guest_netware vmware_guest_solaris vmware_guest_winPre2k vmware_guest_windows vorbis vpx webkit wma-fixed wmf x264 xanim xcb xine xinerama xml xmlrpc xmp xorg xosd xv xvid xvmc yv12 zlib zvbi" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2 adc65 agfa_cl20 aox ax203 barbie canon casio_qv clicksmart310 digigr8 digita dimagev dimera3500 directory enigma13 fuji gsmart300 hp215 iclick jamcam jd11 jl2005a kodak_dc120 kodak_dc210 kodak_dc240 kodak_dc3200 kodak_ez200 konica konica_qm150 largan lg_gsm mars mustek panasonic_coolshot panasonic_dc1000 panasonic_dc1580 panasonic_l859 pccam300 pccam600 polaroid_pdc320 polaroid_pdc640 polaroid_pdc700 ricoh ricoh_g3 samsung sierra sipix_blink sipix_blink2 sipix_web2 smal sonix sony_dscf1 sony_dscf55 soundvision spca50x sq905 st2205 stv0674 stv0680 sx330z template topfield toshiba_pdrm11" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="nb" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, MAKEOPTS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 2 Martin Fernau 2011-05-19 08:27:38 UTC
I can confirm this here too

emerge --info
Portage 2.2.0_alpha32 (default/linux/amd64/10.0/desktop/kde, gcc-4.4.5, glibc-2.11.3-r0, 2.6.38-gentoo-r1 x86_64)
=================================================================
System uname: Linux-2.6.38-gentoo-r1-x86_64-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_6000+-with-gentoo-1.12.14
Timestamp of tree: Thu, 12 May 2011 07:15:01 +0000
app-shells/bash:          4.1_p9
dev-java/java-config:     2.1.11-r3
dev-lang/python:          2.6.6-r2, 2.7.1-r1, 3.1.3-r1
dev-util/cmake:           2.8.4
sys-apps/baselayout:      1.12.14-r1
sys-apps/sandbox:         2.4
sys-devel/autoconf:       2.13, 2.65-r1
sys-devel/automake:       1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:       2.20.1-r1
sys-devel/gcc:            4.4.5
sys-devel/gcc-config:     1.4.1-r1
sys-devel/libtool:        2.2.10
sys-devel/make:           3.81-r2
sys-kernel/linux-headers: 2.6.36.1 (virtual/os-headers)
sys-libs/glibc:           2.11.3
Repositories: gentoo personal kde-sunset dev-jokey sunrise
Installed sets: @kdeadmin-4.6, @kdeartwork-4.6, @kdebase-4.6, @kdegraphics-4.6, @kdemultimedia-4.6, @kdenetwork-4.6, @kdepim-4.6, @kdesdk-4.6, @kdeutils-4.6
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/openvpn/easy-rsa /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/eselect/postgresql /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distlocks ebuild-locks fixlafiles fixpackages news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="ftp://ftp.mesh-solutions.com/gentoo ftp://ftp6.uni-muenster.de/pub/linux/distributions/gentoo http://distfiles.gentoo.org"
LANG="de_DE.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="de en"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/opt/personal-portage /var/lib/layman/kde-sunset /var/lib/layman/jokey /var/lib/layman/sunrise"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="7zip X a52 aac acl acpi alsa amd64 berkdb bluetooth branding bzip2 cairo cdr cli consolekit cracklib crypt cups cxx dbus dri dts dvd dvdr emboss encode exif fam firefox flac fortran gdbm gdu gif gpm gtk iconv ipv6 java jpeg jpeg2k kde lcms ldap libnotify mad mmx mmxext mng modules mp3 mp4 mpeg mudflap multilib ncurses nls nptl nptlonly nsplugin ogg oggvorbis opengl openmp pam pango pcre pdf perl png policykit ppds pppd python qt3support qt4 readline samba sdl semantic-desktop session spell sse sse2 ssl startup-notification svg sysfs tcpd tiff truetype udev unicode usb vorbis x264 xcb xml xorg xulrunner xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="canon ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="de en" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="nvidia vesa fbdev nv" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 3 Sebastian Pipping gentoo-dev 2011-08-02 15:20:55 UTC
optipng 0.6.5 adds a configure check against libpng 1.5 and throws an error that this version is not supported.  So all we could do is fix the dependencies of the 0.6.4 ebuild.  Would that help?
Comment 4 Samuli Suominen (RETIRED) gentoo-dev 2011-09-17 18:43:27 UTC
+  17 Sep 2011; Samuli Suominen <ssuominen@gentoo.org> optipng-0.6.5.ebuild:
+  Use internal copy of libpng14 with system libpng15 wrt #355739 by Hanno
+  Boeck. This is a temporary solution until upstream has migrated.
Comment 5 Sebastian Pipping gentoo-dev 2011-10-10 00:19:30 UTC
I opened a related bug upstream now:

  Please add support for libpng 1.5.5
  https://sourceforge.net/tracker/?func=detail&aid=3421002&group_id=151404&atid=780913
Comment 6 Samuli Suominen (RETIRED) gentoo-dev 2011-12-02 19:20:53 UTC
Still no update for optipng. I suppose it's time to lastrite this as "replaced by pngcrush"
Comment 7 Sebastian Pipping gentoo-dev 2011-12-03 02:57:04 UTC
(In reply to comment #6)
> Still no update for optipng. I suppose it's time to lastrite this as "replaced
> by pngcrush"

Besides the lack of a release since

  OptiPNG 0.6.5 (released on 2011-Jan-24)

is there any related information about upstream or documented contact with it that suggest this direction?

As of now, I would like to oppose to such move.  I use OptiPNG on a regular basis.  I may look closer into the issue myself but time constraints do not allow me to do before January, maybe February 2012.  Please do not pull this away from under my feet just yet.
Comment 8 Sebastian Pipping gentoo-dev 2012-03-02 12:18:48 UTC
The bundling issues is fixed for optipng 0.7:

+*optipng-0.7 (02 Mar 2012)
+
+  02 Mar 2012; Sebastian Pipping <sping@gentoo.org> +optipng-0.7.ebuild:
+  Bump to 0.7 (which now compiles against libpng 1.5.9)
+

As the copy of libpng 1.4.x bundled (and used) by optipng-0.6.5.ebuild may be affected by CVE-2011-3026, further inspection and/or action is needed.  I am therefore updating blockers of this bug (remove bundled-libs, add CVE-2011-3026) and hand over to the security team.
Comment 9 Tim Sammut (RETIRED) gentoo-dev 2012-03-02 22:39:46 UTC
Thanks, Sebastian. Can we move forward and stabilize =media-gfx/optipng-0.7?
Comment 10 Sebastian Pipping gentoo-dev 2012-03-03 00:18:43 UTC
(In reply to comment #9)
> Can we move forward and stabilize =media-gfx/optipng-0.7?

If that's directed at me too: no objections.
Comment 11 Tim Sammut (RETIRED) gentoo-dev 2012-03-03 00:21:36 UTC
(In reply to comment #10)
> (In reply to comment #9)
> > Can we move forward and stabilize =media-gfx/optipng-0.7?
> 
> If that's directed at me too: no objections.

Great, thanks.

Arches, please test and mark stable:
=media-gfx/optipng-0.7
Target keywords : "amd64 ppc x86"
Comment 12 Agostino Sarubbo gentoo-dev 2012-03-03 09:22:36 UTC
@sping:

missing zlib as RDEPEND


amd64 stable
Comment 13 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2012-03-03 12:53:21 UTC
x86 stable
Comment 14 Sebastian Pipping gentoo-dev 2012-03-03 13:18:19 UTC
(In reply to comment #12)
> @sping:
> 
> missing zlib as RDEPEND

Good catch.  Thanks!


+  03 Mar 2012; Sebastian Pipping <sping@gentoo.org> optipng-0.7.ebuild:
+  Add zlib dependency, reported by Agostino Sarubbo
+
Comment 15 Samuli Suominen (RETIRED) gentoo-dev 2012-03-08 12:47:13 UTC
ppc* stable, all arches done
Comment 16 Sean Amoss (RETIRED) gentoo-dev Security 2012-03-08 15:56:03 UTC
Thanks, everyone. New GLSA request filed.
Comment 17 Sean Amoss (RETIRED) gentoo-dev Security 2012-03-11 21:44:27 UTC
(In reply to comment #8)
> The bundling issues is fixed for optipng 0.7:
> 
> +*optipng-0.7 (02 Mar 2012)
> +
> +  02 Mar 2012; Sebastian Pipping <sping@gentoo.org> +optipng-0.7.ebuild:
> +  Bump to 0.7 (which now compiles against libpng 1.5.9)
> +
> 
> As the copy of libpng 1.4.x bundled (and used) by optipng-0.6.5.ebuild may
> be affected by CVE-2011-3026, further inspection and/or action is needed.  I
> am therefore updating blockers of this bug (remove bundled-libs, add
> CVE-2011-3026) and hand over to the security team.

Looking at the upstream website, I see the following:

"The CVE-2011-3026 vulnerability, affecting the libpng versions up to 1.4.8/1.5.8, does not affect OptiPNG, because the decompression of deflate-compressed ancillary chunks, done inside libpng, is bypassed in OptiPNG."

@sping: Do you see any evidence of other vulnerabilities in optipng? If not, then security will hand the bug back over.
Comment 18 Sebastian Pipping gentoo-dev 2012-03-12 00:23:02 UTC
(In reply to comment #17)
> "The CVE-2011-3026 vulnerability, affecting the libpng versions up to
> 1.4.8/1.5.8, does not affect OptiPNG, because the decompression of
> deflate-compressed ancillary chunks, done inside libpng, is bypassed in
> OptiPNG."
> 
> @sping: Do you see any evidence of other vulnerabilities in optipng? If not,
> then security will hand the bug back over.

No idea, no.
Comment 19 Sean Amoss (RETIRED) gentoo-dev Security 2012-03-17 14:07:00 UTC
(In reply to comment #18)
> No idea, no.

Ok, then closing since it is not a vulnerability and no GLSA will be issued.