Bug 846778 - syslinux-3.11-7.i386 contains embedded copies of libpng, libgcc, and zlib libraries
syslinux-3.11-7.i386 contains embedded copies of libpng, libgcc, and zlib lib...
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: syslinux (Show other bugs)
5.10
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Peter Jones
Release Test Team
http://bugs.debian.org/cgi-bin/bugrep...
:
Depends On:
Blocks: 846781 846782 846783
  Show dependency treegraph
 
Reported: 2012-08-08 12:37 EDT by Jan Lieskovsky
Modified: 2013-03-19 14:46 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 846781 846783 (view as bug list)
Environment:
Last Closed: 2013-03-19 14:46:50 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-08-08 12:37:45 EDT
Description of problem:
syslinux-3.11-7.i386 as shipped with Red Hat Enterprise Linux 5 contains own / embedded copies of libpng, libgcc and zlib libraries. All of these libraries have their system equivalents. It is not a good practice to embed hard coded library version copy into additional source, since once security issue is found (like for example CVE-2010-0205, CVE-2010-1205 for libpng were to mention some), the package embedding vulnerable library copy would need to be updated too.

Version-Release number of selected component (if applicable):
syslinux-3.11-7.i386

How reproducible:
Always

Steps to Reproduce:
1. Look into BUILD/syslinux-3.11/com32/lib/libpng or check:

# rpm -q --requires syslinux

output. 
  
Actual results:
libpng.so isn't listed in rpm output

Expected results:
libpng.so should be listed in requirements (IOW syslinux should use system version of the libpng, libgcc, and zlib libraries instead of the embedded copies)
Comment 1 David Cantrell 2013-03-19 14:46:50 EDT
This is deliberate.  Here's why:

1) these are actually versions of the libraries hacked up to run in a
   COM32 (i.e. BIOS) environment, so that's a pretty steep order
2) nobody's going to try to root a system by replacing the png parser in
   the boot loader and then replacing the boot background image in /boot
   and using that to exploit the boot loader.  Because that's insane.
   Likewise for e.g. changing the kernel image to break the boot
   loader's zlib, or its soft float support from libgcc...
3) since we recently rebased syslinux to 4.x in RHEL 5, the rhel 5
   libpng is based on version 1.2.1 with backported fixes, while syslinux's
   version is based on 1.2.37.

Note You need to log in before you can comment on or make changes to this bug.