Your message dated Tue, 19 Apr 2011 22:13:33 -0400
with message-id <[email protected]>
and subject line fixed in racket 5.0.2-1
has caused the Debian Bug report #601525,
regarding plt-scheme embeds a vulnerable version of libgd 2.x
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
601525: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601525
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: plt-scheme
Version: 4.0.1-2
Severity: important
Tags: security
plt-scheme embeds a vulnerable version of libgd 2.x and appears to have the
following present
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546. I have looked
at gd_gd.c and it appears the following patch has not been applied
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/gd/libgd/gd_gd.c?r1=289557&r2=289556&pathrev=289557.
There might be other CVEs which are relevant, but I have not investigated
further.
Ideally, plt-scheme could use the system wide gd library and not link in the
embedded copy.
--- End Message ---
--- Begin Message ---
Source: racket
Source-Version: 5.0.2-1
This bug was closed by the recent upload, but we forgot to add the closes to
the changelog (or use the proper -v flag when building). Below are the
changelogs for the uploads.
racket (5.1+dfsg1-1) unstable; urgency=low
* New upstream version, plus DFSG compliance modifications.
+ Thanks to Eli Barzilay of the PLT Scheme team for making a big effort
of contacting people and updating licensing.
* Build with HOME=/nonexistant. This prevents collects installed in user
home directories from interfering with the build.
* Use parallel=n to control collects build parallelism.
-- David Bremner <[email protected]> Thu, 31 Mar 2011 19:34:19 -0300
racket (5.0.2-1) experimental; urgency=low
[ David Bremner ]
* New Upsteam version (Closes: #592688)
+ Fix FTBFS on mips with recent GCC. (Closes: #598615)
[ James Vega ]
* Update watch file with new upstream URL.
* debian/rules:
+ Show which garbage collector the racket package was built with.
+ Use correct name for mzdyn based on which garbage collector was used.
-- James Vega <[email protected]> Fri, 19 Nov 2010 21:22:13 -0500
--
James
GPG Key: 1024D/61326D40 2003-09-02 James Vega <[email protected]>
signature.asc
Description: Digital signature
--- End Message ---
