FreeBSD cURL CVE修复

Question

有几天，我收到每日安全邮件的输出，指出curl有一个漏洞(curl-7.50.1)。所以像往常一样，我更新了我的系统，但在某些情况下，我无法修复这个问题：

vulnxml file up-to-date
curl-7.50.1 is vulnerable:
cURL -- Escape and unescape integer overflows
CVE: CVE-2016-7167
WWW: https://vuxml.FreeBSD.org/freebsd/b018121b-7a4b-11e6-bf52-b499baebfeaf.html

所以git需要这个端口，如果我尝试更新这个端口

portupgrade -r git
[Reading data from pkg(8) ... - 221 packages found - done]
...
...
./sobin/libgs.so: undefined reference to `gdev_prn_set_procs_planar'
./sobin/libgs.so: undefined reference to `gdev_prn_set_procs_planar' 
cc: error: linker command failed with exit code 1 (use -v to see invocation)
gmake[13]: *** [base/unix-dll.mak:97: sobin/gsx] Error 1
gmake[13]: *** Waiting for unfinished jobs....
cc: error: linker command failed with exit code 1 (use -v to see invocation)
gmake[13]: *** [base/unix-dll.mak:93: sobin/gsc] Error 1
gmake[13]: Leaving directory '/usr/ports/print/ghostscript9-agpl-base/work/ghostscript-9.16'
gmake[12]: *** [base/unix-dll.mak:135: so-subtarget] Error 2
gmake[12]: Leaving directory '/usr/ports/print/ghostscript9-agpl-base/work/ghostscript-9.16'
gmake[11]: *** [base/unix-dll.mak:120: so] Error 2
gmake[11]: Leaving directory '/usr/ports/print/ghostscript9-agpl-base/work/ghostscript-9.16'
===> Compilation failed unexpectedly.
Try to set MAKE_JOBS_UNSAFE=yes and rebuild before reporting the failure to
the maintainer.
*** Error code 1

Stop.
make[10]: stopped in /usr/ports/print/ghostscript9-agpl-base
*** Error code 1

Stop.
make[9]: stopped in /usr/ports/print/ghostscript9-agpl-base
*** Error code 1

Stop.
make[8]: stopped in /usr/ports/print/texlive-base
*** Error code 1

Stop.
make[7]: stopped in /usr/ports/print/texlive-base
*** Error code 1

Stop.
make[6]: stopped in /usr/ports/print/texlive-texmf
*** Error code 1

Stop.
make[5]: stopped in /usr/ports/textproc/dblatex
*** Error code 1

Stop.
make[4]: stopped in /usr/ports/textproc/dblatex
*** Error code 1

Stop.
make[3]: stopped in /usr/ports/textproc/xmlto
*** Error code 1

Stop.
make[2]: stopped in /usr/ports/textproc/xmlto
*** Error code 1

Stop.
make[1]: stopped in /usr/ports/devel/git
*** Error code 1

Stop.
make: stopped in /usr/ports/devel/git
** Command failed [exit code 1]: /usr/bin/script -qa /tmp/portupgrade20160923-99621-1ufvjqw env UPGRADE_TOOL=portupgrade UPGRADE_PORT=git-2.9.0 UPGRADE_PORT_VER=2.9.0 make
** Fix the problem and try again.
** Listing the failed packages (-:ignored / *:skipped / !:failed)
! devel/git (git-2.9.0) (linker error)

有没有办法解决这个问题？

Answer 1

我建议先尝试运行pkgdb -F来扫描端口中的不一致。

然后尝试运行portupgrade -ai，看看是否需要先构建其他依赖项。

来源：https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ports-using.html