Red Hat Bugzilla – Bug 846781
syslinux-4.02-7.el6.i686 contains embedded copies of libpng, libgcc, and zlib libraries
Last modified: 2013-04-01 15:55:13 EDT
+++ This bug was initially created as a clone of Bug #846778 +++ Description of problem: syslinux-4.02-7.el6.i686 as shipped with Red Hat Enterprise Linux 6 contains own / embedded copies of libpng, libgcc and zlib libraries. All of these libraries have their system equivalents. It is not a good practice to embed hard coded library version copy into additional source, since once security issue is found (like for example CVE-2010-0205, CVE-2010-1205 for libpng were to mention some), the package embedding vulnerable library copy would need to be updated too. Version-Release number of selected component (if applicable): syslinux-4.02-7.el6.i686 How reproducible: Always Steps to Reproduce: 1. Look into BUILD/syslinux-3.11/com32/lib/libpng or check: # rpm -q --requires syslinux output. Actual results: libpng.so isn't listed in rpm output Expected results: libpng.so should be listed in requirements (IOW syslinux should use system version of the libpng, libgcc, and zlib libraries instead of the embedded copies)
This is deliberate. Here's why: 1) these are actually versions of the libraries hacked up to run in a COM32 (i.e. BIOS) environment, so that's a pretty steep order. 2) nobody's going to try to root a system by replacing the png parser in the boot loader and then replacing the boot background image in /boot and using that to exploit the boot loader. Because that's insane. Likewise for e.g. changing the kernel image to break the boot loader's zlib, or its soft float support from libgcc.