This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: [PATCH v1.1] __gconv_translit_find: Actually append ".so" to module name [BZ #17187]

From: Florian Weimer <fweimer at redhat dot com>
To: GNU C Library <libc-alpha at sourceware dot org>
Date: Tue, 26 Aug 2014 20:45:47 +0200
Subject: Re: [PATCH v1.1] __gconv_translit_find: Actually append ".so" to module name [BZ #17187]
Authentication-results: sourceware.org; auth=none
References: <53CD0F15 dot 3030806 at redhat dot com> <53F62D4F dot 3040702 at redhat dot com> <53FCB9A9 dot 7050406 at redhat dot com> <53FCBBF1 dot 4020101 at redhat dot com>

On 08/26/2014 06:55 PM, Florian Weimer wrote:

The internal transliteration code only supports TRANSLIT and IGNORE, so
I suggest this NEWS entry:

* Support for loadable gconv transliteration modules has been removed.
   The support for transliteration modules has been non-functional for
   over a decade, and the removal is prompted by security defects.  The
   normal gconv conversion modules are still supported.  Transliteration
   with //TRANSLIT is still possible, and the //IGNORE specifier
   continues to be  supported. (CVE-2014-5119)

I'm afraid I had to fix a typo in the CVE ID in a separate commit. Theabove NEWS entry contains the corrected ID.


--
Florian Weimer / Red Hat Product Security

References:
- [PATCH v1.1] __gconv_translit_find: Actually append ".so" to module name [BZ #17187]
  - From: Florian Weimer
- Re: [PATCH v1.1] __gconv_translit_find: Actually append ".so" to module name [BZ #17187]
  - From: Carlos O'Donell
- Re: [PATCH v1.1] __gconv_translit_find: Actually append ".so" to module name [BZ #17187]
  - From: Florian Weimer

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]