Red Hat Bugzilla – Bug 846778
syslinux-3.11-7.i386 contains embedded copies of libpng, libgcc, and zlib libraries
Last modified: 2013-03-19 14:46:50 EDT
Description of problem:
syslinux-3.11-7.i386 as shipped with Red Hat Enterprise Linux 5 contains own / embedded copies of libpng, libgcc and zlib libraries. All of these libraries have their system equivalents. It is not a good practice to embed hard coded library version copy into additional source, since once security issue is found (like for example CVE-2010-0205, CVE-2010-1205 for libpng were to mention some), the package embedding vulnerable library copy would need to be updated too.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Look into BUILD/syslinux-3.11/com32/lib/libpng or check:
# rpm -q --requires syslinux
libpng.so isn't listed in rpm output
libpng.so should be listed in requirements (IOW syslinux should use system version of the libpng, libgcc, and zlib libraries instead of the embedded copies)
This is deliberate. Here's why:
1) these are actually versions of the libraries hacked up to run in a
COM32 (i.e. BIOS) environment, so that's a pretty steep order
2) nobody's going to try to root a system by replacing the png parser in
the boot loader and then replacing the boot background image in /boot
and using that to exploit the boot loader. Because that's insane.
Likewise for e.g. changing the kernel image to break the boot
loader's zlib, or its soft float support from libgcc...
3) since we recently rebased syslinux to 4.x in RHEL 5, the rhel 5
libpng is based on version 1.2.1 with backported fixes, while syslinux's
version is based on 1.2.37.