Артур Истомин wrote: > > > > Moving to -current is considerably easier. > > So, in fact all 5.6's users sitting with vuln freetype in base now. Excellent!
Perhaps I was unclear, so here's a few suggestions, but far be it for me to tell anyone else what to do. You could go through FreeType's commit history and review their changes. The fix in 2.5.4 was necessary because a previous fix was incomplete, and the fix in 2.5.5 was necessary because the fix in 2.5.4 was incorrect, so who knows? Maybe you'll even discover another bug. Or you could start with the linked Ubuntu advisory and try to discover where they hide the relevant patches. Heaven forbid they directly link to them, somebody might discover Ubuntu is based on open source software. Or you could go talk to the FreeType developers and come back with a patch that's somewhat less than sixty thousand lines long. Or you and a couple friends could each pick one possibility and race! Or you can just complain. Whatever you think will result in the best outcome.
