[Bug 1831] New: [IcedTea6] Drop version requirement for LCMS 2

[bugzilla-daemon at icedtea.classpath.org]

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1831

            Bug ID: 1831
           Summary: [IcedTea6] Drop version requirement for LCMS 2
           Product: IcedTea
           Version: 6-hg
          Hardware: all
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: IcedTea
          Assignee: gnu.andrew at redhat.com
          Reporter: gnu.andrew at redhat.com
                CC: unassigned at icedtea.classpath.org

The requirement for version 2.5 of LCMS was introduced before 2.5 was released
to ensure that the updated in-tree version with security fixes was used in
preference to the system version while the security fixes rolled out to the
system version.

However, since that time, some distributions have backported the security fixes
to older releases which now fail this test, despite being secure. Also, with
more recent security updates, we've adopted a policy of leaving security
updates to system libraries down to the distribution to fix. With 2.4.7 [0],
there were further updates to LCMS and also libjpeg & libpng that were either
already present in distros or left to them to handle.

[0]
http://blog.fuseyism.com/index.php/2014/04/16/security-icedtea-2-4-7-for-openjdk-7-released/

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20140604/cdf8823e/attachment.html>