GNU bug report logs - #74060
[PATCH] gnu: Remove allegro-5.0. [security fixes]

Previous Next

Package: guix-patches;

Reported by: Nicolas Graves <ngraves <at> ngraves.fr>

Date: Mon, 28 Oct 2024 11:29:01 UTC

Severity: normal

Tags: easy, patch

Done: Nicolas Graves <ngraves <at> ngraves.fr>

Bug is archived. No further changes may be made.

Full log

View this message in rfc822 format

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: Nicolas Graves <ngraves <at> ngraves.fr>
Cc: 74060 <at> debbugs.gnu.org
Subject: [bug#74060] [PATCH] gnu: Remove allegro-5.0. [security fixes]
Date: Mon, 11 Nov 2024 21:37:31 +0900

Hi!

Nicolas Graves <ngraves <at> ngraves.fr> writes:

> This package has no dependencies in Guix, is unsupported (see
> https://liballeg.org/old.html) and is vulnerable to CVE-2021-36489.
>
> * gnu/packages/game-development.scm (allegro-5.0): Delete variable.
> * gnu/local.mk: Deregister patch.
> * gnu/packages/patches/allegro-mesa-18.2.5-and-later.patch: Delete file.

We also have an allegro-4.0 variable; is this one not vulnerable?
https://nvd.nist.gov/vuln/detail/CVE-2021-36489 suggest it is (up to
5.2.6).

-- 
Thanks,
Maxim
This bug report was last modified 193 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.