Please merge 0.2.8.4-10.6 from Debian: for for allocating huge block of memory (CVE-2016-9011)

[Balint Reczey]

Debian's changes:

Changes:
 libwmf (0.2.8.4-10.6) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix allocating huge block of memory (CVE-2016-9011) (Closes: #842090)

[Mathieu Trudel-Lapierre (cyphermox)]

Is this fixing a current FTBFS? Do we have another bug for the memory usage issue in LP?

Furthermore, you may with to get rid of "[ Ubuntu Merge-o-Matic ]"; since you did the merge work yourself ;)

Finally, in this case there does not look to be any new features introduced with the merge. Am I correct in that assessment? This case is trivial here, but merges might otherwise require a Feature Freeze exception if merging introduces new features during a freeze period; see https://wiki.ubuntu.com/ZestyZapus/ReleaseSchedule.

[Mathieu Trudel-Lapierre (cyphermox)]

Subscribed ubuntu-sponsors too (see https://wiki.ubuntu.com/SponsorshipProcess); but I'll do the sponsoring myself once the question above is answered.

[Balint Reczey (rbalint)]

No, there is no FTBFS and there are no new features just a security fix.

[Mathieu Trudel-Lapierre (cyphermox)]

Can you please update the patch to also close this bug in changelog for the merge entry?

[Balint Reczey (rbalint)]

Sure, done. I wanted to ask earlier it this was preferred.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libwmf - 0.2.8.4-10.6ubuntu1

---------------
libwmf (0.2.8.4-10.6ubuntu1) zesty; urgency=low

  * Merge from Debian unstable. (LP: #1676958) Remaining changes:
    - Split out GTK plugin into separate package.

 -- Balint Reczey <email address hidden> Tue, 28 Mar 2017 15:37:26 +0000