From ${URL} : A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. References Graphite2 lz4::decompress out of bounds write (CVE-2017-7778) Graphite2 out of bounds read [@ graphite2::Pass::readPass] (CVE-2017-7771) Graphite2 heap-buffer-overflow write [@ lz4::decompress] (CVE-2017-7772) Graphite2 heap-buffer-overflow write [@ lz4::decompress] src/Decompressor (CVE-2017-7773) Graphite2 out of bounds read [@ graphite2::Silf::readGraphite] (CVE-2017-7774) Graphite2 Assertion 'size() > n' failed (CVE-2017-7775) Graphite2 heap-buffer-overflow read [@ graphite2::Silf::getClassGlyph] (CVE-2017-7776) Graphite2 use of uninitialized memory [@ graphite2::GlyphCache::Loader::read_glyph] (CVE-2017-7777) @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
@ Arches, please test and mark stable: =media-gfx/graphite2-1.3.10
amd64 stable
x86 stable
Stable on alpha.
ppc stable
ppc64 stable
arm stable
ia64 stable
sparc stable
Arches, please finish stabilizing hppa Gentoo Security Padawan ChrisADR
Vulnerable version dropped in git commit 13cc021ade3a4a769c1ad789fb73f351fbd45a54, hppa destabilised.
GLSA Request filed. Gentoo Security Padawan ChrisADR
This issue was resolved and addressed in GLSA 201710-13 at https://security.gentoo.org/glsa/201710-13 by GLSA coordinator Aaron Bauman (b-man).
hppa stable
