[Issue] Dependency on deprecated library libgstinterfaces

Issues with installing under all Linux Distributions

[Issue] Dependency on deprecated library libgstinterfaces

Postby ShadowCat8 » Fri Aug 03, 2018 3:04 am

Greetings,

I'm currently running AOO 4.1.5 on Gentoo Linux, and have found an issue with clearing a Security Advisory from my system (namely GLSA 201705-10) due to OpenOffice's dependency on /usr/lib64/libgstinterfaces-0.10.so.0 by /usr/lib64/openoffice/program/libavmediagst.so. That library is provided by media-libs/gst-plugins-base-0.10.36-r2 which was deprecated due to vulnerabilities, and the current version of gst-plugins-base is 1.14.1, but unfortunately doesn't provide an updated version of libgstinterfaces.

The following is the list of CVEs that deprecated all versions of gst-plugins-base up through 1.10.2:

CVE-2016-10198, CVE-2016-10199, CVE-2016-9445, CVE-2016-9446, CVE-2016-9447, CVE-2016-9634, CVE-2016-9635, CVE-2016-9636, CVE-2016-9807,
CVE-2016-9808, CVE-2016-9809, CVE-2016-9810, CVE-2016-9811, CVE-2016-9812, CVE-2016-9813, CVE-2017-5837, CVE-2016-10198, CVE-2016-10199, CVE-2016-9445, CVE-2016-9446, CVE-2016-9447, CVE-2016-9634, CVE-2016-9635, CVE-2016-9636, CVE-2016-9807, CVE-2016-9808, CVE-2016-9809, CVE-2016-9810, CVE-2016-9811, CVE-2016-9812, CVE-2016-9813, CVE-2017-5837, CVE-2017-5838, CVE-2017-5839, CVE-2017-5840, CVE-2017-5841,
CVE-2017-5842, CVE-2017-5843, CVE-2017-5844, CVE-2017-5845, CVE-2017-5846, CVE-2017-5847, CVE-2017-5848, CVE-2017-5838, CVE-2017-5839,
CVE-2017-5840, CVE-2017-5841, CVE-2017-5842, CVE-2017-5843, CVE-2017-5844, CVE-2017-5845, CVE-2017-5846, CVE-2017-5847, CVE-2017-5848

Any ideas on how to proceed from here?

TIA for your help.
Last edited by Hagar Delest on Sun Aug 05, 2018 11:40 am, edited 2 times in total.
Reason: Tagged issue.
"Let's think the unthinkable, let's do the undoable, let's prepare to grapple
with the ineffable itself, and see if we may not eff it after all." -- Douglas Adams
-----
Apache OpenOffice 4.1.5 on personal build of Gentoo Linux
User avatar
ShadowCat8
 
Posts: 3
Joined: Tue Sep 26, 2017 11:56 pm

Re: AOO dependency on deprecated library libgstinterfaces

Postby John_Ha » Fri Aug 03, 2018 4:44 pm

The only thing you can do is raise a bug report at https://bz.apache.org/ooo/.

I don't think it will be fixed any time soon.
AOO 4.1.5, Windows 7 Home 64 bit

See the Writer Manual, the Writer FAQ, the Writer Tutorials and the Writer guide.

Remember: Always save your Writer files as .odt files. - see here for the many reasons why.
John_Ha
Volunteer
 
Posts: 5689
Joined: Fri Sep 18, 2009 5:51 pm
Location: UK

Re: AOO dependency on deprecated library libgstinterfaces

Postby Bill » Fri Aug 03, 2018 6:35 pm

This may be a topic for the development mailing list. A search for "libavmediagst.so" found that AOO 4.2.0 will use gstreamer 1.0 instead of gstreamer 0.1, but I don't know if that would fix the problem.

Issue 127722 - Update gstreamer support from 0.1 to 1.0

Openoffice and unsupported gstreamer 0.10 branch (for openoffice libavmediagst.so library)
AOO 4.1.5 and LO 6.0.3.2 on Manjaro MATE
Bill
Volunteer
 
Posts: 6765
Joined: Sat Nov 24, 2007 6:48 am

AOO dependency on deprecated library libgstinterfaces

Postby ShadowCat8 » Sat Aug 04, 2018 1:07 am

Greetings again and thanks for the responses,

@Bill: Thanks for the links. After reading the discussion on the dev mailing list from the link you provided, it seems others have also had concerns regarding AOO's dependency on the deprecated version of the gstreamer libs. At this point, support for linking against the 1.0 versions of gstreamer and the plugins will be available in AOO 4.2.0, and there is a patch available right now for those who want to build from source. I will likely try a direct-source build on my home system to see if it will work against the latest versions of the libs, too, and will report my findings.

And, at this time, I'd like to add an extra thanks and a "Good job!" to Damjan Jovanovic for his time and efforts on this issue, as well as for providing the patch. :super: :bravo:

Lastly, @robleyd, thanks for correcting my header on the OP of this thread. Since you get no descriptions of the icons on a mouseover, I took that symbol to mean "Danger" as opposed to "Toxic".

Thanks again.
"Let's think the unthinkable, let's do the undoable, let's prepare to grapple
with the ineffable itself, and see if we may not eff it after all." -- Douglas Adams
-----
Apache OpenOffice 4.1.5 on personal build of Gentoo Linux
User avatar
ShadowCat8
 
Posts: 3
Joined: Tue Sep 26, 2017 11:56 pm


Return to Linux

Who is online

Users browsing this forum: No registered users and 1 guest