News for hackers. Stuff that matters.

A comment on CVE-2015-8126: Multiple buffer overflows in libpng. Parent comment

Re:CVE-2015-8126: Multiple buffer overflows in libpng by legulere on Saturday November 14, 2015 @04:27PM (#10567338)
The problem is that it only works with system libraries and when you have a central software repository. You couldn't even do it with an appstore, as you can possibly break tons of software that you can't patch yourself. So what actually happens with dynamic linking there is that old .dll/.dylib files (with vulnerabilities) get copied around.

With zlib I agree though. Static linking doesn't make sense with such a standard library, at least under unix systems.

[ Parent | on HN ]
Re:CVE-2015-8126: Multiple buffer overflows in libpng by noobermin on Saturday November 14, 2015 @04:32PM (#10567357)
So do a mix? Make system libs shared and apps bundled when they are needed? Can't the app store work like your package manager anyway? Speaking from ignorance here, I want to know if it's possible.
[ Parent | on HN ]
Re:CVE-2015-8126: Multiple buffer overflows in libpng by nitrogen on Saturday November 14, 2015 @05:18PM (#10567511)
The Click-n-Run app store from LindowsOS back in 2002 was based on apt and dpkg. So yes, it is possible, especially if there are automated tests that can tell when a dependency update breaks something.
[ Parent | on HN ]