Subject: bug#26009: libpng-apng

From: [email-masked] (Ludovic Courtès)
Date: Mon, 13 Mar 2017 14:25:23 +0100

ng0 <[email-masked]> skribis:

>> That said, please make sure the security issues fixed in ‘libpng/fixed’
>> are also fixed in libpng-apng!

[...]

> Do you have any advice how this could be achieved?

I’d check whether libpng-CVE-2016-10087.patch applies to libpng-apng
(it’s the patch that ‘libpng/fixed’ applies.)

Going forward, if the code bases are similar enough, we may have to add
a (cpe-name . "libpng") property to libpng-apng so that ‘guix lint -c
cve’ would report libpng’s vulnerabilities.

HTH!

Ludo’.