Vulnerability question

[Harald Weis]

On Wed, Jul 01, 2009 at 06:01:01AM +0200, Roland Smith wrote:
> On Tue, Jun 30, 2009 at 06:35:04PM -0400, Gary Palmer wrote:
 
> > I am not the OP, however I also ran into warnings about mplayer and
> > linux-pango.  I believe the problem comes from linux-realplayer
> > 
> > # cd /usr/ports/multimedia/mplayer
> > # make run-depends-list
> <snip>
> > /usr/ports/multimedia/linux-realplayer
> > /usr/ports/multimedia/mplayer-skins
> > /usr/ports/multimedia/win32-codecs
> <snip>
> > # grep REAL /var/db/ports/mplayer/options 
> > WITH_REALPLAYER=true
> 
> Good catch! I think that is indeed the problem. I disabled realplayer
> support for mplayer ages ago, so it doesn't show up in my list. 
> 
> Harald, re-build mplayer with realplayer support disabled (if you can do
> without it), and you should probably loose the dependency on
> linux-pango.
> 
> > There may be more than one path to the linux-pango dependency however
> > :-(
> 
> I don't think so, looking at the Makefiles of the other dependencies of
> lxdvdrip. 

Yes, it is the ``real player plugin'' option for mplayer which
was responsible for linux-pango (and probably for all other linux stuff)
requested during the reinstallation of lxdvdrip a week ago using
DISABLE_VULNERABILITIES=yes .

I've found this 5 minutes after my reply to Roland yesterday when trying
to reinstall first just mplayer alone, and then lxdvdrip.
But, I had absolutely no time to signal this to the list before now.

Many thanks to all of you. It's a great relief that I have finally
recuperated lxdvdrip.

Harald