Re: [gentoo-user] GLSA management

[Urs Schutz <u.schutz@bluewin.ch>]

On Tue, 6 Mar 2012 10:32:35 -0800
Grant <emailgrant@gmail.com> wrote:

> I've been checking this daily for a while:
> 
> http://www.gentoo.org/security/en/glsa/index.xml
> 
> but every time there's a vulnerability in a package I
> know I have installed, my installed version is
> unaffected.  If I emerge world daily, do I need to check
> on GLSA's?
> 
> - Grant
> 

I run a cron job that does glsa-check -t all daily, and had
one glsa showing up lately (201201-09). This was an old
slot of media-libs/freetype, pulled in by emerge because of
obscure useflags in luatex. This was with stable packages.
Another one showed up because of app-text/acroread, and
was resolved by replacing acroread with evince.

So in my opinion it is necessary to run glsa-check
regularly to show the detected problems within the system.
Run as a cron job there is little work to do, checking the
mail takes less than 10 seconds.

And: A big thanks to the people who invest their time and
use their brains to write the Gentoo Linux Security Advices!

Urs