Date: Wed, 7 Nov 2007 19:16:13 -0500 From: Wesley Shields <wxs@atarininja.org> To: Andy Greenwood <greenwood.andy@gmail.com> Cc: freebsd-ports@freebsd.org Subject: Re: perl vunlnerabilities Message-ID: <20071108001613.GA21994@atarininja.org> In-Reply-To: <20071107195508.GY21994@atarininja.org> References: <4731BC0F.2060005@gmail.com> <20071107195508.GY21994@atarininja.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 07, 2007 at 02:55:08PM -0500, Wesley Shields wrote:
> On Wed, Nov 07, 2007 at 08:22:23AM -0500, Andy Greenwood wrote:
> > I got the notice this morning like I'm sure a lot of others did, but I had
> > a question. My home computer didn't show anything even after running
> > portaudit -Fa, and I wondered if this is because I'm running perl-threaded
> > on that box. It seems that I should have been notified, since I find it
> > rather unlikely that defining WITH_THREADS changes the regex engine it
> > uses. I have not looked at any code, so this is a wild guess. I'm updating
> > all my perls just in case, but I thought someone should know in case the
> > portaudit db needs to be updated.
>
> The package name changes if you're using threads...
>
> 92 .if defined(WITH_THREADS)
> 93 #XXX .if ${ARCH} == "amd64"
> 94 #XXX IGNORE= Threaded perl does not pass tests on ${ARCH}
> 95 #XXX .endif
> 96 CONFIGURE_ARGS+= -Dusethreads=y
> 97 PKGNAMESUFFIX= -threaded
> 98 # it seems perl malloc has problems with threaded perl on FreeBSD
> 99 .undef WITH_PERL_MALLOC
> 100 .else
> 101 CONFIGURE_ARGS+= -Dusethreads=n
> 102 .endif
>
> Not knowing how portaudit, vuxml, and friends work... Could this be the
> cause?
I just noticed this was addressed:
http://cvsweb.FreeBSD.org/ports/security/vuxml/vuln.xml.diff?r1=1.1468&r2=1.1469
-- WXS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20071108001613.GA21994>