Re: TortoiseSVN bundles vulnerable copy of Expat - please update to 2.2.3
Stefan Küng <[email protected]>
| Newsgroups | gmane.comp.version-control.subversion.tortoisesvn.devel |
|---|---|
| Message-ID | <[email protected]> |
On 05.08.2017 00:04, Sebastian Pipping wrote:
> Hi!
>
>
> Just a quick note that Expat 2.2.3 has been released, including a fix to
> DLL hijacking (CVE-2017-11742 [1]). For more details, please check the
> change log [2].
that problem doesn't apply here:
* we link expat not as a dll but link statically
* TSVN changes the dll search path at start so these kind of hijackings
can't work
but thanks for the info.
Stefan
--
___
oo // \\ "De Chelonian Mobile"
(_,\/ \_/ \ TortoiseSVN
\ \_/_\_/> The coolest interface to (Sub)version control
/_/ \_\ http://tortoisesvn.net
------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=757&dsMessageId=3280995
To unsubscribe from this discussion, e-mail: [[email protected]].