4 ms·
> maybe ask Ubuntu to cease shipping "VLC" I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it
by tgragnato 7y ago
> maybe ask Ubuntu to cease shipping "VLC"
I want applications to be packaged by my distribution. Updates are up to maintainers (dependencies included), as it has always been.
If MITRE wants to assign a CVE, warning people that they need an updated lib, that's fine. The issue is the trustworthy and handling of CVEs (... plus reporters).
- jakear 7y agoMy impression is that VLC did issue an update to use a more recent version of libebml, but Ubuntu/Debian maintainers patched it to use universe’s outdated version (which they don’t even maintain!)
- tgragnato 7y agoYes! A glaring example of dependency hell (in Debian words "incompatible library changes with reverse dependencies"). Patching for an older version of libebml is not an issue if that library is not vulnerable (that's why folks use LTS and stable). Want maintainers to know there's a vulnerability? Publish a CVE _for libebml_.