[Pkg-telepathy-maintainers] Bug#847418: depends on gstreamer-plugins-bad, which is an ongoing source of security holes

[Joey Hess]

Package: libfarstream-0.2-5
Version: 0.2.8-1
Severity: normal

gstreamer-plugins-bad has been in the news at least twice recently for
security holes.

http://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html
https://scarybeastsecurity.blogspot.dk/2016/11/0day-poc-risky-design-decisions-in.html

It seems likely that it will continue to be a source of such security
holes.

I wanted to remove gstreamer-plugins-bad from my system, but this would
remove libfarstream-0.2-5, which would remove pidgin.

I doubt that pidgin needs a ton of insecurely implemented codecs for
playing Nintendo games etc in order to do video/audio chat. Could this
dependency please be lessened to a Suggests? Or even better, don't
depend on codecs from a library package; let the packages for programs
that actually need to codecs depend on the codec packages.

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.8.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libfarstream-0.2-5 depends on:
ii  gstreamer1.0-nice               0.1.13-2
ii  gstreamer1.0-plugins-bad        1.10.0-1
ii  gstreamer1.0-plugins-base       1.10.0-1
ii  gstreamer1.0-plugins-good       1.10.0-1
ii  libc6                           2.24-5
ii  libglib2.0-0                    2.50.2-1
ii  libgstreamer-plugins-base1.0-0  1.10.0-1
ii  libgstreamer1.0-0               1.10.0-2
ii  libgupnp-1.0-4                  1.0.1-1
ii  libgupnp-igd-1.0-4              0.2.4-1
ii  libnice10                       0.1.13-2

libfarstream-0.2-5 recommends no packages.

libfarstream-0.2-5 suggests no packages.

-- no debconf information

-- 
see shy jo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-telepathy-maintainers/attachments/20161207/3df1ec04/attachment.sig>