]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/commit
lame: 3.99.5 -> 3.100
authorTanu Kaskinen <tanuk@iki.fi>
Mon, 27 Nov 2017 16:39:30 +0000 (18:39 +0200)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Sat, 9 Dec 2017 14:36:57 +0000 (14:36 +0000)
commit930f8873e0e180da7242f65bfd5c60f9d6c19424
tree87de543a4f471b3b47801682dfaefad7b07415c5
parentc6d7d89d9a6bbe2de62fa1a91b833bf1c03693ac
lame: 3.99.5 -> 3.100

Release notes:
http://lame.cvs.sourceforge.net/viewvc/lame/lame/doc/html/history.html?revision=1.154

Dropped patches that are included in the release:
 - lame-3.99.5_fix_for_automake-1.12.x.patch
 - CVE-2017-13712.patch

The CACHED_CONFIGUREVARS thing to disable SSE code on x86 isn't needed
anymore. The build system now correctly detects when SSE isn't
available.

Note for stable branch maintainers: This release includes several fixes
for bugs that have a CVE number associated with them. The bugs (or at
least most of them) are crashes that seem to be considered "remote DoS"
vulnerabilities, probably because it's easy to imagine lame being used
with untrusted audio files from remote sources. If you want to backport
"all sercurity fixes" to the stable brances, that task seems pretty
difficult. The release notes explicitly mention three CVE numbers, but
there are more: for example, OE had a fix for CVE-2017-13712, which is
not mentioned in the release notes but is fixed in the release. The
commit log doesn't keep any track of CVE numbers either. Maybe it would
be best to just upgrade lame to 3.100 also in the stable branches.

Signed-off-by: Tanu Kaskinen <tanuk@iki.fi>
Signed-off-by: Ross Burton <ross.burton@intel.com>
meta/recipes-multimedia/lame/lame/CVE-2017-13712.patch [deleted file]
meta/recipes-multimedia/lame/lame/lame-3.99.5_fix_for_automake-1.12.x.patch [deleted file]
meta/recipes-multimedia/lame/lame_3.100.bb [moved from meta/recipes-multimedia/lame/lame_3.99.5.bb with 69% similarity]