GNU bug report logs

#27603 [PATCH] gnu: libtiff: Fix CVE-2017-{9936,10688}.

PackageSource(s)Maintainer(s)
guix-patches PTS Buildd Popcon
Full log

Message #16 received at 27603-done@debbugs.gnu.org (full text, mbox, reply):

Received: (at 27603-done) by debbugs.gnu.org; 7 Jul 2017 13:20:33 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Jul 07 09:20:33 2017
Received: from localhost ([127.0.0.1]:55852 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1dTTBR-0008Id-9q
	for submit@debbugs.gnu.org; Fri, 07 Jul 2017 09:20:33 -0400
Received: from mail-pf0-f196.google.com ([209.85.192.196]:34996)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <alexvong1995@gmail.com>) id 1dTTBM-0008IN-LH
 for 27603-done@debbugs.gnu.org; Fri, 07 Jul 2017 09:20:32 -0400
Received: by mail-pf0-f196.google.com with SMTP id q85so4623920pfq.2
 for <27603-done@debbugs.gnu.org>; Fri, 07 Jul 2017 06:20:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=from:to:cc:subject:references:date:in-reply-to:message-id
 :user-agent:mime-version;
 bh=R3weYqrPF1FoAsGCmBgOfEhgs+ylR/TpueTuOyQ4axU=;
 b=QrDrhERpbrTg+v/Dqd0TZpnvthzOv0ED0qAb5ANAWkbfB2Mi3RLnV8VV57neX3zxCc
 KVoqg2kF+Jdyjto+BeB5yOci9lUwv52Q6fg0x+pmxzP1kxYWMcfh/O4WfUZ5X2Eb2FFH
 hAhW0v0tpfazZpMhbt1c+DrtH7Ji5S562qaoee85Xu1z3eVLBWyYL6fV8HcERtjtdL8f
 PLHibMTXJtjO/GNcO9FOOvxAsUYFitpjgn20oG2LLgKTW44dunZhxcC1vt+HHjX2JGgG
 SQJ2MLwUbvy4i0vh44eTwBEeyMtEh6izHA9W/0HZBUtB9e7G8JaqBR5Fhnxc3TFN/XSx
 tDEg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to
 :message-id:user-agent:mime-version;
 bh=R3weYqrPF1FoAsGCmBgOfEhgs+ylR/TpueTuOyQ4axU=;
 b=AIJY+o5QuWZ6scjX6z7Jh837ztu7mVRW+rkBpPNXjv8fewcxS1iOrwwJwIZp6q5joz
 i/HEGdsmQOXH+IlfYByRQdriqkHWPVSQq1NMRT7/Dewr0gXLP7PYwrdMreKqJlkFC5BX
 W9/0A/CGdGx9eKeM1kT2Y17tTSbAVTE94WUVC9055dE202AITJeU1O0Y51UWMbBZvYEF
 9iCI2l6itto0QBo6RcTAOypFA4Y+flcJ4CBMT9iO3NFw6t9Lu+qafhJIy+6VP++uzVB/
 Tzp9kkEDB5/wqsPdKmwXlGPW7yWcVjipAziW36nxvC/3oNkNj6lpq2dcedWwnX/hH2Cr
 9SPQ==
X-Gm-Message-State: AIVw112aO+3ihawCdT3nkdL616RSUqGEIRhGPqEqvL3Dh4W80BOZpFGR
 o8Xi0U6/2qoPRQ==
X-Received: by 10.99.122.81 with SMTP id j17mr1439480pgn.97.1499433622700;
 Fri, 07 Jul 2017 06:20:22 -0700 (PDT)
Received: from debian (pcd372176.netvigator.com. [203.218.162.176])
 by smtp.gmail.com with ESMTPSA id x25sm7522425pfi.58.2017.07.07.06.20.20
 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);
 Fri, 07 Jul 2017 06:20:21 -0700 (PDT)
From: Alex Vong <alexvong1995@gmail.com>
To: Leo Famulari <leo@famulari.name>
Subject: Re: [bug#27603] [PATCH] gnu: libtiff: Fix CVE-2017-{9936,10688}.
References: <87r2xti4dz.fsf@gmail.com> <20170706234038.GB1280@jasmine.lan>
 <20170707040726.GA2920@jasmine.lan>
Date: Fri, 07 Jul 2017 21:20:07 +0800
In-Reply-To: <20170707040726.GA2920@jasmine.lan> (Leo Famulari's message of
 "Fri, 7 Jul 2017 00:07:26 -0400")
Message-ID: <87tw2o1j08.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
X-Spam-Score: -2.0 (--)
X-Debbugs-Envelope-To: 27603-done
Cc: 27603-done@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -2.0 (--)
[Message part 1 (text/plain, inline)]
Leo Famulari <leo@famulari.name> writes:

> On Thu, Jul 06, 2017 at 07:40:38PM -0400, Leo Famulari wrote:
>> On Fri, Jul 07, 2017 at 06:31:36AM +0800, Alex Vong wrote:
>> > * gnu/packages/patches/libtiff-CVE-2017-9936.patch,
>> >   gnu/packages/patches/libtiff-CVE-2017-10688.patch: New files.
>> > * gnu/packages/image.scm (libtiff-4.0.8)[source]: Add patches.
>> > * gnu/local.mk (dist_patch_DATA): Add them.
>> 
>> > +Patch lifted from upstream source repository (the changes to 'ChangeLog'
>> > +don't apply to the libtiff 4.0.8 release tarball):
>> > +
>> > +https://github.com/vadz/libtiff/commit/6173a57d39e04d68b139f8c1aa499a24dbe74ba1
>> 
>> This is actually not the upstream source repository. It's a 3rd party
>> unofficial mirror.
>>
Ahhh, I blindly used the links from debian security tracker. Should have
been more careful. I wonder why they use links from an unofficial mirror.

>> To the chagrin of young packagers everywhere, libtiff is still using
>> CVS. Unless somebody beats me to it, I'll extract the patches from their
>> CVS repo later tonight.
>
:)

> I pushed this as dab536fe1ae5a8775a2b50fa50556445b6ac7818. Thanks for
> getting it started Alex!

You're welcomed!
[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 02:57:23 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.