Bug 218771 - graphics/graphite2: Add patch for current version - it is vulnerable
Summary: graphics/graphite2: Add patch for current version - it is vulnerable
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Jung-uk Kim
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-04-20 09:10 UTC by Dani I.
Modified: 2017-04-21 04:33 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (office)

Attachments
patch-CVE-2017-5436 (417 bytes, patch)
2017-04-20 15:00 UTC, Dani I. 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dani I. 2017-04-20 09:10:00 UTC 
The current version avilable for FreeBSD is vulnerable since 19.04.2017 and has already been patched upstream.

See here: https://github.com/silnrsi/graphite/commit/1ce331d5548b

Vulnerabilities see here: https://vuxml.freebsd.org/freebsd/cf133acc-82e7-4755-a66a-5ddf90dacbe6.html

Is it possible to import the patch and bump portrevision globaly?

Thanks for taking a look at it.
Comment 1 Dani I. 2017-04-20 15:00:23 UTC 
Created attachment 181938 [details]
patch-CVE-2017-5436

Here is the proposed patch.
Comment 2 Jung-uk Kim freebsd_committer freebsd_triage 2017-04-20 18:24:14 UTC 
I'll take it.
Comment 3 commit-hook freebsd_committer freebsd_triage 2017-04-20 18:40:56 UTC 
A commit references this bug:

Author: jkim
Date: Thu Apr 20 18:40:09 UTC 2017
New revision: 438984
URL: https://svnweb.freebsd.org/changeset/ports/438984

Log:
  Add two upstream patches to fix CVE-2017-5436.

  https://github.com/silnrsi/graphite/commit/1ce331d
  https://github.com/silnrsi/graphite/commit/b23d7b9

  PR:		218771
  MFH:		2017Q2

Changes:
  head/graphics/graphite2/Makefile
  head/graphics/graphite2/files/
  head/graphics/graphite2/files/patch-src_FeatureMap.cpp
Comment 4 Jung-uk Kim freebsd_committer freebsd_triage 2017-04-20 18:57:30 UTC 
A revised patch was committed.  Thanks!
Comment 5 commit-hook freebsd_committer freebsd_triage 2017-04-21 04:33:47 UTC 
A commit references this bug:

Author: jkim
Date: Fri Apr 21 04:33:10 UTC 2017
New revision: 439002
URL: https://svnweb.freebsd.org/changeset/ports/439002

Log:
  MFH: r438984

  Add two upstream patches to fix CVE-2017-5436.

  https://github.com/silnrsi/graphite/commit/1ce331d
  https://github.com/silnrsi/graphite/commit/b23d7b9

  PR:		218771
  Approved by:	ports-secteam (junovitch)

Changes:
_U  branches/2017Q2/
  branches/2017Q2/graphics/graphite2/Makefile
  branches/2017Q2/graphics/graphite2/files/