GNU bug report logs

#27603 [PATCH] gnu: libtiff: Fix CVE-2017-{9936,10688}.

PackageSource(s)Maintainer(s)
guix-patches PTS Buildd Popcon
Full log

Message #19 received at 27603-done@debbugs.gnu.org (full text, mbox, reply):

Received: (at 27603-done) by debbugs.gnu.org; 7 Jul 2017 16:30:54 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Jul 07 12:30:54 2017
Received: from localhost ([127.0.0.1]:56976 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1dTW9e-0006Ng-8Z
	for submit@debbugs.gnu.org; Fri, 07 Jul 2017 12:30:54 -0400
Received: from out2-smtp.messagingengine.com ([66.111.4.26]:43251)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <leo@famulari.name>) id 1dTW9a-0006NW-JB
 for 27603-done@debbugs.gnu.org; Fri, 07 Jul 2017 12:30:51 -0400
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44])
 by mailout.nyi.internal (Postfix) with ESMTP id 6302820B44;
 Fri,  7 Jul 2017 12:30:50 -0400 (EDT)
Received: from frontend1 ([10.202.2.160])
 by compute4.internal (MEProxy); Fri, 07 Jul 2017 12:30:50 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name;
 h=cc:content-type:date:from:in-reply-to:message-id:mime-version
 :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc
 :x-sasl-enc; s=mesmtp; bh=njYMQRcsfX2Z7QmQ0cRy+Gur4Q3smQcEp3oSqw
 QqNtE=; b=Psrcll5cB9QRPnYsow21esiqKKMx4qbpqR0NOZ5rhPouifCaLqt7Mo
 pR7gqL6qYiUmIyMfsTXLKig6uQ+6fO5DFAUhpMB/Z44RSnZW0o143pJT7DRncaxC
 +IM4j3hdgnAOrlM0VGpnQE01ExHiLY0iNAy7cOUWx/b32i++KGg94=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
 messagingengine.com; h=cc:content-type:date:from:in-reply-to
 :message-id:mime-version:references:subject:to:x-me-sender
 :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=njYMQRcsfX2Z7QmQ0c
 Ry+Gur4Q3smQcEp3oSqwQqNtE=; b=Tu4tXfXNkcAk3Lo5e66bpVRmfHMnDms4el
 9Fgc37B4puhoxbz5t4IzOxZoQ+IUp8wM8avwh3AIrZKQr8pMzrrasxb66vWd/G9o
 Ut9UG6Y9hwyx8tVr7LEBmbbUtefEgcaDtUgF5jfWQQoYz8SuNd0CkLZwRrkOJIwh
 giyrCXiIJXI5WkihPCq/BAR01dO39Ycx12DYGzLjHso5H2ti5rgQf0w/00mdKC4F
 3j+90JohVlo4VIDJ9zvtAVLhWUhoONmfIH33uBcBSopd66rAgF2jNWuP+BExnELw
 dsCSWq2kIPMhmqS8uDRa6CGECc0Uyr8GOb/lVtjctPJyXlYbUjvg==
X-ME-Sender: <xms:OrdfWSu-AUBQk1K54VENgPncIh5eRZh7gnfXuvrWuYX1H0ESBSXvUw>
X-Sasl-enc: T0A3fJXmFGyFYDZw9Ix1f1IXgDsrmzd38RfnUg+mKfBC 1499445050
Received: from localhost (unknown [172.58.217.92])
 by mail.messagingengine.com (Postfix) with ESMTPA id 02D987E2C1;
 Fri,  7 Jul 2017 12:30:49 -0400 (EDT)
Date: Fri, 7 Jul 2017 12:30:47 -0400
From: Leo Famulari <leo@famulari.name>
To: Alex Vong <alexvong1995@gmail.com>
Subject: Re: [bug#27603] [PATCH] gnu: libtiff: Fix CVE-2017-{9936,10688}.
Message-ID: <20170707163047.GA18417@jasmine.lan>
References: <87r2xti4dz.fsf@gmail.com> <20170706234038.GB1280@jasmine.lan>
 <20170707040726.GA2920@jasmine.lan> <87tw2o1j08.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature"; boundary="OgqxwSJOaUobr8KG"
Content-Disposition: inline
In-Reply-To: <87tw2o1j08.fsf@gmail.com>
User-Agent: Mutt/1.8.3 (2017-05-23)
X-Spam-Score: 0.6 (/)
X-Debbugs-Envelope-To: 27603-done
Cc: 27603-done@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: 0.6 (/)
[Message part 1 (text/plain, inline)]
On Fri, Jul 07, 2017 at 09:20:07PM +0800, Alex Vong wrote:
> Ahhh, I blindly used the links from debian security tracker. Should have
> been more careful. I wonder why they use links from an unofficial mirror.

I noticed they were doing that, and I don't understand why. It *is*
convenient to have a relatively stable changeset ID in the form of Git
commit hashes.

I asked about it on oss-security and the repo was confirmed to be
unofficial:

http://seclists.org/oss-sec/2017/q1/15

It has been acknowledged by the libtiff maintainer:

http://maptools-org.996276.n3.nabble.com/git-version-control-td13746.html
[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 03:01:24 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.