calibre: Security issues in WOFF code

Debian Bug report logs - #787085
calibre: Security issues in WOFF code

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dmitry Shachnev <mitya57@debian.org>

To: submit@bugs.debian.org

Subject: calibre: Security issues in WOFF code

Date: Thu, 28 May 2015 15:15:44 +0300

[Message part 1 (text/plain, inline)]

Source: calibre
Version: 2.24.0+dfsg-1
Tags: security

Dear Maintainer,

Calibre contains an embedded copy of outdated Mozilla's WOFF code (in
src/calibre/utils/fonts/woff/), which is known to have some security issues.

In particular:

1) https://bugzilla.mozilla.org/show_bug.cgi?id=552216 (aka CVE-2010-1028)

Cherry-picking https://hg.mozilla.org/releases/mozilla-1.9.2/rev/827a6883442f
will fix it.

2) https://bugzilla.mozilla.org/show_bug.cgi?id=522308

Cherry-picking https://hg.mozilla.org/mozilla-central/rev/69eb050f2c0a will
fix it.

Note: new Mozilla's releases do not contain the code in question anymore.

--
Dmitry Shachnev

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 787085-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 787085-submitter@bugs.debian.org

Subject: closing 787085

Date: Sun, 29 Jan 2017 17:51:46 +0100

close 787085 2.38.0+dfsg-1
thanks

2.38.0+dfsg-1 removed the code below src/calibre/utils/fonts/woff/

Send a report that this bug log contains spam.