Bug 846781 - syslinux-4.02-7.el6.i686 contains embedded copies of libpng, libgcc, and zlib libraries
syslinux-4.02-7.el6.i686 contains embedded copies of libpng, libgcc, and zlib...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: syslinux (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Peter Jones
Release Test Team
Depends On: 846778 846783
Blocks: 846782
  Show dependency treegraph
Reported: 2012-08-08 12:43 EDT by Jan Lieskovsky
Modified: 2013-04-01 15:55 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 846778
: 846782 (view as bug list)
Last Closed: 2013-04-01 15:55:13 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-08-08 12:43:55 EDT
+++ This bug was initially created as a clone of Bug #846778 +++

Description of problem:
syslinux-4.02-7.el6.i686 as shipped with Red Hat Enterprise Linux 6 contains own / embedded copies of libpng, libgcc and zlib libraries. All of these libraries have their system equivalents. It is not a good practice to embed hard coded library version copy into additional source, since once security issue is found (like for example CVE-2010-0205, CVE-2010-1205 for libpng were to mention some), the package embedding vulnerable library copy would need to be updated too.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Look into BUILD/syslinux-3.11/com32/lib/libpng or check:

# rpm -q --requires syslinux

Actual results:
libpng.so isn't listed in rpm output

Expected results:
libpng.so should be listed in requirements (IOW syslinux should use system version of the libpng, libgcc, and zlib libraries instead of the embedded copies)
Comment 3 David Cantrell 2013-04-01 15:55:13 EDT
This is deliberate.  Here's why:

1) these are actually versions of the libraries hacked up to run in a
   COM32 (i.e. BIOS) environment, so that's a pretty steep order.

2) nobody's going to try to root a system by replacing the png parser in
   the boot loader and then replacing the boot background image in /boot
   and using that to exploit the boot loader.  Because that's insane.
   Likewise for e.g. changing the kernel image to break the boot
   loader's zlib, or its soft float support from libgcc.

Note You need to log in before you can comment on or make changes to this bug.