Re: freetype vulns

2015-03-07 Thread Stefan Sperling
On Sun, Mar 08, 2015 at 12:19:08AM +0600, Артур Истомин wrote: > No. I wouldn't lift a finger. It is your duty as a developer of "most secure > OS". > Do it! Or shut up and stop pretending that OpenBSD in any way secure to use. Battle rap is off-topic on this mailing list...

Re: freetype vulns

2015-03-07 Thread Артур Истомин
On Sat, Mar 07, 2015 at 01:14:32AM -0700, Theo de Raadt wrote: > > On Thu, Mar 05, 2015 at 05:52:12PM +, Stuart Henderson wrote: > > > On 2015/03/05 12:41, Ted Unangst wrote: > > > > Boudewijn Dijkstra wrote: > > > > > Op Wed, 04 Mar 2015 23:12:07 +0100 schreef Ted Unangst > > > > > : > > > >

Re: freetype vulns

2015-03-07 Thread David Coppa
On Sat, Mar 7, 2015 at 7:28 PM, Ted Unangst wrote: > Or you could start with the linked Ubuntu advisory and try to discover where > they hide the relevant patches. Heaven forbid they directly link to them, > somebody might discover Ubuntu is based on open source software. Here are the patches Ub

Re: freetype vulns

2015-03-07 Thread Ted Unangst
Артур Истомин wrote: > > > > Moving to -current is considerably easier. > > So, in fact all 5.6's users sitting with vuln freetype in base now. Excellent! Perhaps I was unclear, so here's a few suggestions, but far be it for me to tell anyone else what to do. You could go through FreeType's com

Re: freetype vulns

2015-03-07 Thread Theo de Raadt
> On Thu, Mar 05, 2015 at 05:52:12PM +, Stuart Henderson wrote: > > On 2015/03/05 12:41, Ted Unangst wrote: > > > Boudewijn Dijkstra wrote: > > > > Op Wed, 04 Mar 2015 23:12:07 +0100 schreef Ted Unangst > > > > : > > > > > Freetype (http://www.freetype.org/) 2.5.5 was released a little while

Re: freetype vulns

2015-03-07 Thread Артур Истомин
On Thu, Mar 05, 2015 at 05:52:12PM +, Stuart Henderson wrote: > On 2015/03/05 12:41, Ted Unangst wrote: > > Boudewijn Dijkstra wrote: > > > Op Wed, 04 Mar 2015 23:12:07 +0100 schreef Ted Unangst > > > : > > > > Freetype (http://www.freetype.org/) 2.5.5 was released a little while > > > > ago,