Bug 2934

Summary:	New libxulrunner package should obsolete older versions of libxulrunner
Product:	Mageia	Reporter:	Nicolas Vigier <boklm>
Component:	Security	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED INVALID	QA Contact:
Severity:	major
Priority:	Normal	CC:	LpSolit, davidwhodgins, dmorganec, fundawang, thierry.vignaud, tmb
Version:	1
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	xulrunner	CVE:
Status comment:

Description Nicolas Vigier 2011-10-04 20:07:16 CEST

xulrunner and libxulrunner have been updated on Mageia 1 to some fix security issues. The new version of libxulrunner should obsolete the previous versions to avoid vulnerable versions staying installed.

And all packages depending on a specific version of libxulrunner need to be rebuilt.

Frédéric "LpSolit" Buclin 2011-10-04 20:15:15 CEST

CC: (none) => LpSolit

Comment 1 Manuel Hiebel 2011-10-04 20:25:28 CEST

(add the three more commiter of xulrunner)

CC: (none) => dmorganec, fundawang, thierry.vignaud

Comment 2 Nicolas Vigier 2011-10-25 11:13:38 CEST

Still not fixed

Nicolas Vigier 2011-10-25 11:34:41 CEST

Depends on: (none) => 3177

Comment 3 D Morgan 2011-10-31 15:08:44 CET

do you have a list of the packages to rebuild ?

Comment 4 Dave Hodgins 2011-11-01 05:24:56 CET

Using the following script ...
#!/bin/bash
for package in $(urpmq --whatrequires xulrunner) ; do 
    echo $package
    urpmq --requires $package 2>/dev/null|grep xul|grep ==
done

The package list is eclipse-swt and vuze.

CC: (none) => davidwhodgins

Comment 5 D Morgan 2011-11-06 14:28:47 CET

there is more, for ex gnome-shell needs to be rebuilded too.

so i hope we find a complete list

Comment 6 Manuel Hiebel 2011-11-20 20:40:57 CET

I won more than 400MB by removing old libxulrunner-* ...

Comment 7 Thomas Backlund 2011-12-25 13:33:53 CET

We dont obsolete libs by policy.

The correct way is to rebuild packages built against the newer libs, and urpmi will suggest to remove the older libs when nothing depends on them anymore.

CC: (none) => tmb

Comment 8 Thierry Vignaud 2012-01-01 18:15:55 CET

In the past there were issues in the way requires were used which makes rpm/urpmi unable to track unused old libxulrunner and there was a bug where apps could load older lib through /etc/gre.d

This looks fixed now so yes the orphan packages feature is the solution

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Manuel Hiebel 2012-02-12 14:22:38 CET

Depends on: 3177 => (none)