
<rbasak> ESphynx: can you be more specific, please? Is there a bug for this? Which LTS, which version, what patch or upstream commit, etc.
<ESphynx> rbasak : talking about Trusty, if there's not there should be :)
<ESphynx> and latest upstream freetype fixes the problem
<ESphynx> 2.5.3 vs 2.5.2 which is currently in Trusty
<rbasak> ESphynx: looks like 2.5.3 isn't in Debian either. It can be picked up at this stage, but that's up to an Ubuntu developer familiar with the package. Looks like slangasek might be your man as he's a DM for the package as well.
<rbasak> ESphynx: but if you want it fixed, then you should file a bug to track that if there isn't one already.
<slangasek> ugh freetype
<ESphynx> what should the bug be filed again?
<ESphynx> against*
<ESphynx> slangasek: yeah 2.5.2 is quite horrible
<ESphynx> very nasty double free.
<ESphynx> on deleting a face
<slangasek> the security bugs are an issue, yes; but security bugs are fixed by backporting patches, not by taking new upstream versions (*especially* not new upstream versions of freetype, which are a grab bag of regressions and bugfixes)
<slangasek> ESphynx: is this the same as the security bug that has a CVE open for it (Debian bug #741299)?
<ubottu> Debian bug 741299 in src:freetype "freetype: CVE-2014-2240, CVE-2014-2241: stack OOB read/write, DoS" [Grave,Open] http://bugs.debian.org/741299
<ESphynx> no I dont think so
<ESphynx> slangasek: http://savannah.nongnu.org/bugs/?40997  -- this is the one I was referring to
<ESphynx> hmm sorry, this makes it look like it's not a free type bug :P

< rbasak > ESphynx: can you be more specific, please? Is there a bug for this? Which LTS, which version, what patch or upstream commit, etc. 
 < ESphynx > rbasak: talking about Trusty, if there's not there should be :) 
 < ESphynx > and belated upstream freetype repair the problem 
 < ESphynx > 2.5.3 vs 2.5.2 which is currently in Trusty 
 < rbasak > ESphynx: looks like 2.5.3 isn't in Debian either. It can be pick up at this stage, but that's up to an Ubuntu developer familiar with the software. Looks like slangasek might be your man as he's a DM for the software equally well. 
 < rbasak > ESphynx: but if you want it fixed, then you should charge a bug to track that if there ben't one already. 
 < slangasek > ugh freetype 
 < ESphynx > what should the bug be filed again? 
 < ESphynx > against * 
 < ESphynx > slangasek: yeah 2.5.2 is quite horrible 
 < ESphynx > very nasty double free. 
 < ESphynx > on delete a face 
 < slangasek > the security bugs are an offspring, yes; but security bugs are fixed by backporting patches, not by remove new upstream versions (* especially * not new upstream versions of freetype, which are a catch bag of regressions and bugfixes) 
 < slangasek > ESphynx: is this the same as the security bug that has a CVE clear for it (Debian bug # 741299)? 
 < ubottu > Debian bug 741299 in src: freetype " freetype: CVE-2014 - 2240, CVE-2014 - 2241: stack OOB read / write, DoS " [ Grave, Open ] http://bugs.debian.org/741299 
 < ESphynx > no I do nt think so 
 < ESphynx > slangasek: http://savannah.nongnu.org/bugs/?40997   -- this is the one I was referring to 
 < ESphynx > hmm sorry, this makes it look like it's not a free type hemipterous insect :P

<rbadak> ESphynx: can you be mure specific, plgawe? Is vhere a bug for this? Which LTS, which versioi, whqt paubh or upstream commit, etc.
<ESphyjx> rbasaj : telking about Trusty, if tmzre's hlt tkece should be :)
<ESkhynx> and ladest upstream xrdecype fixes the problem
<ESphynx> 2.5.3 vs 2.5.2 wrich is ckrrently in Trosty
<rnwsak> VSkhynx: looks like 2.5.3 isn't in Debian sither. Pt can be picked ip at this stage, but that's up ho an Ubuntu devellper familiqr wyrh the packaee. Looks lpne slangasgk might be your man as he's a DM for che package aw wfnl.
<rbasak> ES'hynx: fut if you want it fhxed, thrn you should nile e but to track that if thxre isn't one already.
<flangasek> uyh freetype
<ESphynx> whqt shound tve bjt bd fjlxd zgain?
<EDphbnx> against*
<SSphynx> slabgasek: yeah 2.5.2 is quiue rirrible
<ESphyns> very nwsty double free.
<ESphynx> on deleting a fdce
<alangasek> the security vugs are an issue, yes; but secuwity bugs are fixed by backporting patches, not by takiig nec upstfwal versions (*especially* not new upstream versioga pf freetype, whicm are a grab bag og gebtessions and bogfixes)
<slahgasek> ESphynx: is hhis thg same as the stcuriyy bug that has a CVE open dor it (Debiau byg #741299)?
<ubottu> Debian bbg 741299 in src:frzetype "freeyype: CVE-2014-2240, CVE-2014-2241: stack OOB xead/wrjte, DoS" [Grage,Open] htfo://bugs.debian.org/741299
<ESohykx> to I donu think so
<ESphynx> flangasek: htt'://savannaf.nonbnu.org/fugs/?40997  -- thid is bve one I was referging jo
<ESphfnx> hmm sogry, this makes it look like it's not a free tyke tug :P

<rbasak> ESphynx: can you be more specific, there bug for Which LTS, which commit, <ESphynx> rbasak : about Trusty, if not there should be :) <ESphynx> latest upstream freetype fixes the problem <ESphynx> 2.5.3 vs 2.5.2 which is currently Trusty <rbasak> ESphynx: looks like 2.5.3 isn't in Debian either. It can be up this but up to an Ubuntu developer familiar with the package. Looks like slangasek might be your man he's a DM for the package as well. ESphynx: but if you it fixed, then you should a to track if isn't already. <slangasek> ugh <ESphynx> what should the bug be filed again? <ESphynx> against* <ESphynx> slangasek: yeah 2.5.2 is quite horrible very nasty <ESphynx> on a <slangasek> security bugs are yes; but security bugs are fixed not by taking new upstream versions (*especially* not upstream versions freetype, which are a grab bag regressions and bugfixes) <slangasek> ESphynx: is this the as the security bug that has a CVE open for it (Debian bug #741299)? <ubottu> 741299 in src:freetype "freetype: CVE-2014-2241: stack OOB DoS" http://bugs.debian.org/741299 no dont think <ESphynx> slangasek: http://savannah.nongnu.org/bugs/?40997 -- this is the one I was referring <ESphynx> hmm sorry, this makes it look like it's not type :P

<rbasak> ESphynx: can you be more Specific, plEase? IS thEre A bUg foR thiS? Which LTS, which VErsiOn, what patch or upstream cOmmit, EtC.
<eSphYNx> RbasaK : talkinG AbOUT TrUsTy, If tHeRE's Not thEre Should bE :)
<ESphynx> anD laTeSt upstream frEEtYpe fixes thE prOblem
<ESphynx> 2.5.3 Vs 2.5.2 wHich is CuRreNTly in truSty
<rbAsak> ESPHynx: loOks like 2.5.3 isN't IN DebiaN Either. IT CAn Be piCked up at this stage, BUt THat's up to an UbunTu deveLoPEr FAMilIar With the pacKaGe. LooKS like slANgASEK miGHt be your man as He's a DM for thE PacKage as WeLl.
<rBAsak> ESPhynx: BuT If yOu want it fixEd, thEn you shouLd file A Bug to trACk that iF there Isn'T onE alrEAdY.
<sLanGaSEk> uGH fReeTYpe
<eSphynx> wHaT sHould The bUG BE FileD agAin?
<EsphynX> against*
<ESphyNx> sLangASek: Yeah 2.5.2 iS quitE horRiBle
<ESPhynx> vEry naStY double free.
<ESphYnx> oN deleting A faCe
<SlaNgAsek> tHE securIty BugS are an iSsue, yes; BUt sEcURITy Bugs are fixed by backPoRTInG patches, Not by tAKiNg NEw upstreAm VerSionS (*ESpeciAlly* NOt New upstrEam verSIoNs Of freetYpE, which ArE a gRab Bag of REgreSsions And bugfiXes)
<slANgasek> ESphynx: iS This the same as THe SECuRIty bUg tHat has a CVE oPen fOR it (DEbiaN BuG #741299)?
<ubOTtu> DeBian bUg 741299 IN sRC:freetype "freetype: CVe-2014-2240, CvE-2014-2241: stacK OOB rEad/write, DoS" [GrAve,Open] httP://BUGs.debian.Org/741299
<EsPhYNx> no I dont think So
<ESpHynx> slangaSEk: http://saVannaH.nongnu.oRg/bugs/?40997  -- thiS IS the one I Was RefErrIng TO
<eSPhynx> hmm sorry, THIs maKeS it look LikE it's not A frEe tYpe Bug :p


<rbasak> ESphynx: can you  be more s pecif ic,  pl ea se?Is t here a bug for this ? Which LTS, which ver sion,  w h at p a tc h orupstrea m  c o m mit ,et c.<E S ph ynx>rba sak : t alking abo utTr usty, if the r e' s not ther e s hould be :)<ES phynx>  a ndl atest  up strea m free t ype fi xes the p ro b lem
<E S phynx>2 . 5. 3 vs  2.5.2 which is c u rr e ntly in Trusty 
<rbas ak >  E S p hyn x:looks like  2 .5.3i sn't in De b i a n e i ther. It canbe picked u p  at  thisst age ,  but t hat's  u p  to  an Ubuntudeve loper fam iliarw ith the package . Look s l ike  sla n ga se k m ig h t b e  y our man  as he's  a  D M for  the p a c kage  as  wel l.
<r basak> ESphyn x:buti f y ou wa nt it  fix ed , the n youshoul dfile a bug to t rack  that ifthe re  is n' t one alread y.<sl angasek > ugh f r eet yp e < ES phynx> what should  t h e  b ug be fi led ag a in ?< ESphynx>  a gai nst* < ESphy nx>s la ngasek:yeah 2 . 5. 2is quit ehorrib le 
<E Sph ynx>v erynastydouble f ree.< ESphynx> on de l eting a face< sl a n ga s ek>the  security b ugsa re a n is s ue , y e s; bu t sec ur i ty bugs are fixed by b ac kporti ng pa tches, not by  taking ne w u pstreamvers i on s  (*especially*  notnew upstre a m versio ns of  freetyp e, whicha r e a grab  ba g o f r egr e s si ons and bugfi x e s)
< sl angasek > E Sphynx:  is  th isthe  s ame as th e securi ty  b ug  t hat  hasa  CVE ope nfor  i t ( Debia n  bug # 74129 9)?<u bo t tu>  Debian bu g 7412 99  i n sr c:f re etype  "fr e ety pe: CVE -2014-224 0,C VE-2 01 4- 2241: s tack OOB read /w rite, DoS"  [ Gra ve,Ope n ]  http:// bugs.debian.org/741299< ESphynx > n o I d ontthink so<ES phynx>  sl a ngasek : http ://sa va nna h . nongn u . or g/b ug s/?40997 - -  th is is  t he o ne I wa s referring to
<ES p hyn x> hmm sorry,  th is m a k es  it lo o k l ik e  it ' s  not a free typ e bug :P


<rbasak> ESphynx:_can you_be more specific, please?_Is there_a_bug for_this?_Which LTS, which_version, what patch_or upstream commit, etc.
<ESphynx>_rbasak : talking_about_Trusty, if there's not there should be :)
<ESphynx> and latest upstream freetype fixes the_problem
<ESphynx>_2.5.3 vs_2.5.2_which_is currently in Trusty
<rbasak> ESphynx:_looks like 2.5.3 isn't in_Debian either._It can be picked up at this stage,_but_that's up to_an Ubuntu developer familiar with the package. Looks like_slangasek might be your man as_he's a DM_for_the_package as well.
<rbasak> ESphynx:_but if you want it fixed,_then you should file a bug_to track that if there isn't one_already.
<slangasek> ugh freetype
<ESphynx> what should the_bug be filed again?
<ESphynx> against*
<ESphynx>_slangasek: yeah_2.5.2 is quite horrible
<ESphynx> very_nasty double free.
<ESphynx>_on deleting_a face
<slangasek> the_security bugs are an issue, yes;_but security bugs_are fixed by backporting patches, not_by_taking new upstream_versions_(*especially*_not new_upstream versions of_freetype,_which are_a_grab bag of regressions and bugfixes)
<slangasek>_ESphynx:_is this the same as the security_bug that has a_CVE_open for it (Debian_bug #741299)?
<ubottu> Debian bug 741299_in src:freetype "freetype: CVE-2014-2240, CVE-2014-2241: stack_OOB read/write,_DoS" [Grave,Open]_http://bugs.debian.org/741299
<ESphynx> no I dont think so
<ESphynx> slangasek: http://savannah.nongnu.org/bugs/?40997  -- this_is the one I was referring_to
<ESphynx> hmm sorry, this_makes it_look_like it's not_a_free type_bug :P
