#27519 Podofo security bugs

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: bug-guix@gnu.org

Subject: Podofo security bugs

Date: Wed, 28 Jun 2017 11:49:23 -0400

[Message part 1 (text/plain, inline)]

There were some bugs with security implications reported in Podofo
recently:

http://seclists.org/oss-sec/2017/q2/0
http://seclists.org/oss-sec/2017/q2/1
http://seclists.org/oss-sec/2017/q2/2

I noticed some fixes committed to the Podofo SVN repo:

https://sourceforge.net/p/podofo/mailman/podofo-svn/?viewmonth=201706

We need to try to cherry-pick these fixes.

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 27519-done@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: 27519-done@debbugs.gnu.org

Subject: Re: Podofo security bugs

Date: Tue, 5 Feb 2019 00:34:01 +0100

[Message part 1 (text/plain, inline)]

We have since packaged a new release of PoDoFo (0.9.6) which apparently
fixed many bugs.

The PoDoFo team does not write changelogs or any sort of release
announcement file. Their SVN repo includes several commits like "Fix
CVE-XXX" followed by "Really fix CVE-XXX".

Since PoDoFo is not widely used in Guix (only by calibre and Scribus),
I'm not going to dig in to whether or not these bugs are really fixed or
not in the current Guix package.

At this point, this bug report is not helping us much, so I am closing
it :)

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.