Changeset 11f671c8

Timestamp:

09/13/2023 02:46:56 AM (9 months ago)

Author:

Ken Moffat <ken@…>

Branches:

12.1, ken/TL2024, ken/tuningfonts, lazarus, plabs/newcss, python3.11, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/llvm18

Children:

5e3a62df

Parents:

fbd6311

git-author:

Ken Moffat <ken@…> (09/13/2023 02:46:08 AM)

git-committer:

Ken Moffat <ken@…> (09/13/2023 02:46:56 AM)

Message:

Patch libwebp, using patch from firefox.

Files:

• general/graphlib/libwebp.xml (modified) (4 diffs)
• introduction/welcome/changelog.xml (modified) (1 diff)

general/graphlib/libwebp.xml

@@ -9 +9 @@
   <!ENTITY libwebp-md5sum        "0ff59e5598753f47519e3e61c12f8cfd">
   <!ENTITY libwebp-size          "4.0 MB">
-  <!ENTITY libwebp-buildsize     "39 MB">
+  <!ENTITY libwebp-buildsize     "44 MB">
   <!ENTITY libwebp-time          "0.3 SBU">
 ]>
@@ -66 +66 @@
       </listitem>
     </itemizedlist>
-<!--
+
     <bridgehead renderas="sect3">Additional Downloads</bridgehead>
     <itemizedlist spacing="compact">
@@ -72 +72 @@
         <para>
           Required patch:
-          <ulink url="&patch-root;/libwebp-&libwebp-version;-upstream_fix-1.patch"/>
+          <ulink url="&patch-root;/libwebp-&libwebp-version;-security_update-1.patch"/>
         </para>
       </listitem>
     </itemizedlist>
--->
+
     <bridgehead renderas="sect3">libwebp Dependencies</bridgehead>
 
@@ -98 +98 @@
     <title>Installation of libwebp</title>
 
-    <!-- https://bugs.chromium.org/p/webp/issues/detail?id=603
-         but not public yet
-         Fixed in version 1.3.1.
+    <!-- CVE-2023-4863, critical, extracted from firefox-115.2.1 in the hope
+         it will be sufficient -->
     <para>
       Fix a security issue identified upstream:
     </para>
 
-<screen><userinput>patch -Np1 -i ../libwebp-&libwebp-version;-upstream_fix-1.patch</userinput></screen>
--->
+<screen><userinput>patch -Np1 -i ../libwebp-&libwebp-version;-security_update-1.patch</userinput></screen>
+
     <para>
       Install <application>libwebp</application> by running the following

introduction/welcome/changelog.xml

@@ -41 +41 @@
 
     <listitem>
+      <para>September 13th, 2023</para>
+      <itemizedlist>
+        <listitem>
+          <para>[ken] - Patch libwebp-1.3.1 for a critical vulnerability.
+          This is not the official fix, which is not yet public, but was
+          taken from firefox's fix for its shipped libwebp in the hope it
+          will be adequate.
+          <ulink url="&blfs-ticket-root;18544">#18544</ulink>.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
+    <listitem>
       <para>September 12th, 2023</para>
       <itemizedlist>