Re: package with security hole not flagged at build time

To: "Steven M. Bellovin" <smb%cs.columbia.edu@localhost>
Subject: Re: package with security hole not flagged at build time
From: Geert Hendrickx <ghen%telenet.be@localhost>
Date: Tue, 9 Jan 2007 18:35:43 +0100

On Tue, Jan 09, 2007 at 10:38:34AM -0500, Steven M. Bellovin wrote:
> According to audit-packages, fetchmail-6.2.5.5nb1 has a security hole.
> When I go to its directory and do a 'make', it builds it without
> noticing the problem.  My pkgsrc is up-to-date (HEAD), as is my
> audit-packages and the vulnerabilities file it uses.  (This is on
> -current from about two weeks ago.)

Do you have ALLOW_VULNERABLE_PACKAGES set in your environment or in mk.conf?

        Geert

Follow-Ups:
- Re: package with security hole not flagged at build time
  - From: Steven M. Bellovin

References:
- package with security hole not flagged at build time
  - From: Steven M. Bellovin

Prev by Date: package with security hole not flagged at build time
Next by Date: Re: package with security hole not flagged at build time
Previous by Thread: package with security hole not flagged at build time
Next by Thread: Re: package with security hole not flagged at build time
Indexes:

Home | Main Index | Thread Index | Old Index