Re: pkg/44936: devel/automake14 has an unreported vulerability

[David Holland <dholland-pbugs%netbsd.org@localhost>]

The following reply was made to PR pkg/44936; it has been noted by GNATS.

From: David Holland <dholland-pbugs%netbsd.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: pkg/44936: devel/automake14 has an unreported vulerability
Date: Sat, 7 May 2011 00:32:44 +0000

 On Thu, May 05, 2011 at 05:30:01PM +0000, jwbiagio%gmail.com@localhost wrote:
  > Building automake14 (required by libwww) fails when security
  > auditing is installed. CVE-2009-4029.
 
 That sounds like a *reported* vulnerability.
 
 Anyhow, it's not going to get fixed; if you find it unacceptable to
 build and install the package with this vulnerability, the way forward
 is to fix the small number of packages that still require automake14
 so automake14 can be removed.
 
 I see only two such packages - audio/tremor-tools and www/libwww.
 
 (and note that libwww itself has an outstanding vulnerability)
 
 -- 
 David A. Holland
 dholland%netbsd.org@localhost