From owner-freebsd-security  Sun Jun  1 23:20:21 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id XAA29905
          for security-outgoing; Sun, 1 Jun 1997 23:20:21 -0700 (PDT)
Received: from bitbox.follo.net (bitbox.follo.net [194.198.43.36])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id XAA29900
          for <security@FreeBSD.ORG>; Sun, 1 Jun 1997 23:20:15 -0700 (PDT)
Received: (from eivind@localhost) by bitbox.follo.net (8.7.6/8.7.3) id IAA18628; Mon, 2 Jun 1997 08:19:32 +0200 (MET DST)
Date: Mon, 2 Jun 1997 08:19:32 +0200 (MET DST)
Message-Id: <199706020619.IAA18628@bitbox.follo.net>
From: Eivind Eklund <perhaps@yes.no>
To: rich@rich.isdn.bcm.tmc.edu
CC: perhaps@yes.no, security@FreeBSD.ORG
In-reply-to: Rich Murphey's message of Fri, 30 May 1997 18:41:27 -0500 (CDT)
Subject: Re: X libraries
References: <199705301538.RAA08714@bitbox.follo.net>
	<199705302341.SAA08966@rich.isdn.bcm.tmc.edu>
Sender: owner-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> 
> |Hopefully XFree will provide replacement libraries soon; if not, I'll
> |try to do it, but I'm not presently equipped to compile new libraries
> |for all FreeBSD versions.  (The XFree liason is Cc:'ed - can you
> |comment on this, Rich?)
> 
> I guess I've missed other discussions about the bug.
> We can include the patch for freebsd untill XFree86
> picks it up if that's the consensus.  

I don't know how quickly we feel we need to react - if XFree 3.3 come
in two weeks (as the rumors say), then we can depend on that and
still have as quick response as most commercial vendors.  However, Red
Hat has already provided a binary patch for _their_ systems.

Depends on how people feel; I'm not quite certain how I we should
react to bugs in bundled software.

> Have you talked to anyone else with XFree86 about it?

No.  However, it is all over bugtraq, so I guess they should know.

Eivind.