[gentoo-user] Re: Difficulty fixing GLSA 201512-07 (gstreamer-0.10)

[»Q«]

On Thu, 7 Jan 2016 23:45:38 +0100
David Haller <gentoo@×××××××.de> wrote:

> On Wed, 06 Jan 2016, »Q« wrote:
> >On Tue, 5 Jan 2016 08:26:42 -0800
> >Grant <emailgrant@×××××.com> wrote:
> >
> >> > AFAICT, details of the gstreamer bug itself haven't been made
> >> > public yet, and nobody is sure whether the unmaintained 0.10
> >> > branch needs a patch.  See
> >> > <https://bugs.gentoo.org/show_bug.cgi?id=553742#c11> and the
> >> > following comment.
> >>
> >> So everyone is just living with the supposed security
> >> vulnerability on their system?
> >
> >Not everyone.  SUSE and Debian seem to have patches for this for
> >0.10.
> >
> ><https://www.suse.com/security/cve/CVE-2015-0797.html>
> >
> ><https://www.debian.org/security/2015/dsa-3225>
>
> https://build.opensuse.org/package/view_file/multimedia:libs/gstreamer-0_10-plugins-bad/gstreamer-0_10-plugins-bad-mp4-overflow.patch?expand=1

The bug is fixed -- that patch is applied in gst-plugins-bad-0.10.23-r3.

I understand there's effectively no longer an upstream for 0.10, but
still it's disconcerting that a patch made it from Mozilla to Debian
and SUSE (and who knows who else) months ago without other distros
finding out about it.  Maybe that's why access to Mozilla's bug entry
is still restricted.  

I guess there's nothing to do but for us be vigilant until eventually
all the things that depend on 0.10 are gone and we no longer need it.