Date: Mon, 14 Feb 2011 19:21:40 +0200 From: "Luchesar V. ILIEV" <luchesar.iliev@gmail.com> To: Tom Uffner <tom@uffner.com> Cc: Jan Henrik Sylvester <me@janh.de>, freebsd-ports@freebsd.org Subject: Re: fixing the vulnerability in linux-f10-pango-1.22.3_1 Message-ID: <AANLkTimn_akSYv3h7FGcFC69fx84hNdwYtxeT%2B3g%2Btst@mail.gmail.com> In-Reply-To: <4D595C3A.3060808@uffner.com> References: <4D5852F7.2010106@uffner.com> <4D5880EF.4020002@gmx.de> <4D58F749.1000106@janh.de> <4D595C3A.3060808@uffner.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Feb 14, 2011 at 18:45, Tom Uffner <tom@uffner.com> wrote: > Jan Henrik Sylvester wrote: > >> The easiest way would probably be: >> >> - Take the src-rpm of the pango version in RHEL 5. >> - Extract the patch from it: pango-glyphstring.patch-1.14.9-5.el5_3 >> - Extract the src-rpm of pango-1.22.3 from Fedora 10. >> - Apply the RHEL 5 patch with --ignore-whitespace. >> - Diff for creating a patch that applies without --ignore-whitespace. >> - Bump version number and repackge a src-rpm for Fedora 10 with the new >> patch. >> - Build it on a clean Fedora 10 system. >> >> There is one more problem to solve: >> >> http://lists.freebsd.org/pipermail/freebsd-emulation/2010-December/00826= 4.html >> >> That mail go unanswered (at least as far as the mailing list archive >> goes). Probably, the procedure above would have to be put into a shell >> script for a willing commiter to repeat. Every time this vulnerability >> comes up at ports@ or emulation@, some commitor ask for a (trusted) rpm >> to fix it. Thus, there might be one. > > Peter Littmann's RPMs probably won't work for me since i'm looking for > 9-current amd64. > > would a src-rpm verifiably generated from the Fedora 10 src-rpm (or > the pango project tarball) and the RHEL 5 patch solve this? I may not > have a "Reputation", but I've been around since 4.1BSD and a search > of the tree and the PRs will turn up a few bugfixes that I've submitted. > > tom Most likely you've already noticed my efforts in this matter, but let me still mention them: http://lists.freebsd.org/pipermail/freebsd-emulation/2010-December/008285.h= tml http://lists.freebsd.org/pipermail/freebsd-emulation/2010-December/008295.h= tml http://lists.freebsd.org/pipermail/freebsd-emulation/2010-December/008296.h= tml Sadly, I'm still struggling to find enough time to prepare for and apply for ports committer (I'm afraid that while I might be known around the academic security community and projects like the European G=C3=89ANT, that's not the case with FreeBSD), but that's irrelevant now, anyway. Of course, anyone who feels not particularly security concerned could still use the patches for the ports tree provided in the first mail (I do keep the relevant distfiles online). The step-by-step description in the second set of mails could hopefully be helpful for someone whom the community would trust to build an RPM. I do realize it's way too detailed and long, so I was indeed thinking about preparing a shorter version these days -- especially now that the Flash update brings the issue with linux-pango again. Please let me know if I could be of help somehow. Cheers, Luchesar
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?AANLkTimn_akSYv3h7FGcFC69fx84hNdwYtxeT%2B3g%2Btst>