Re: dangerous handling of security bugs

Am 12.07.2010 18:47, schrieb sean finney: > On Mon, Jul 12, 2010 at 03:50:19PM +0200, Reindl Harald wrote: >> It would be really relaxter if there are easy patches >> available which i could use in rpm-spec-file in a way >> like the following - the orinial source-tarball is >> unchanged and rpmbuild applys the patches diectly before >> build > > while a bit tedious and sometimes error-prone, it's already possible to > find your way from the CVE to the relevant commits in svn.php.net. this > is how the distros usually get the fixes. I'm not distro nor a c-developer I am just simply php-enduser So what should i do with svn-commits? I'm not stupid enough to patch code i do not understand by myself and hope it will work anyway Do you really think it is the same if a enduser is pacthing the sources instead a code-developer who is knowing much more about the whole internals?