Depends: Update FreeType package (CVE-2020-15999) #20319

pull mammix2 wants to merge 1 commits into bitcoin:master from mammix2:master changing 1 files +4 −4

mammix2 commented at 5:08 PM on November 5, 2020: contributor

Update FreeType package to v2.10.4 in Depends to help mitigate against recent 0 day flaw found. See CVE-2020-15999
Depends: Update FreeType package (CVE-2020-15999) 905225dfab

in depends/packages/freetype.mk:3 in 905225dfab

   0 | @@ -1,8 +1,8 @@
   1 |  package=freetype
   2 | -$(package)_version=2.7.1
   3 | -$(package)_download_path=https://download.savannah.gnu.org/releases/$(package)
   4 | -$(package)_file_name=$(package)-$($(package)_version).tar.bz2
   5 | -$(package)_sha256_hash=3a3bb2c4e15ffb433f2032f50a5b5a92558206822e22bfe8cbe339af4aa82f88
   6 | +$(package)_version=2.10.4
   7 | +$(package)_download_path=http://download.savannah.gnu.org/releases/$(package)

luke-jr commented at 5:21 PM on November 5, 2020:

No opinion on whether to use http vs https

MarcoFalke commented at 5:26 PM on November 5, 2020:

Indeed. Also, please update the docs as done in commit 83582dcf23c23326fcb648b436d51469e66db5d5

mammix2 commented at 6:03 PM on November 5, 2020:

No probs, i'll test with https and update the docs too. Closing

in depends/packages/freetype.mk:5 in 905225dfab

   0 | @@ -1,8 +1,8 @@
   1 |  package=freetype
   2 | -$(package)_version=2.7.1
   3 | -$(package)_download_path=https://download.savannah.gnu.org/releases/$(package)
   4 | -$(package)_file_name=$(package)-$($(package)_version).tar.bz2
   5 | -$(package)_sha256_hash=3a3bb2c4e15ffb433f2032f50a5b5a92558206822e22bfe8cbe339af4aa82f88
   6 | +$(package)_version=2.10.4
   7 | +$(package)_download_path=http://download.savannah.gnu.org/releases/$(package)
   8 | +$(package)_file_name=$(package)-$($(package)_version).tar.xz
   9 | +$(package)_sha256_hash=86a854d8905b19698bbc8f23b860bc104246ce4854dcea8e3b0fb21284f75784

luke-jr commented at 5:21 PM on November 5, 2020:

This matches what I've had on my system since 2020-10-20

luke-jr approved
luke-jr commented at 5:22 PM on November 5, 2020: member

utACK
mammix2 closed this on Nov 5, 2020
fanquake locked this on Nov 6, 2020

Contributors

mammix2

luke-jr

MarcoFalke