package.mask: Mask vulnerable versions of libXfont

Bug: https://bugs.gentoo.org/634044

diff --git a/profiles/package.mask b/profiles/package.mask
index 610525adf369d2762008f6c7e8be03f2e2559146..a58c5d739872152db00b8cdc714777f367d66af2 100644 (file)
--- a/profiles/package.mask
+++ b/profiles/package.mask
@@ -29,6 +29,11 @@
 
 #--- END OF EXAMPLES ---
 
+# Matt Turner <mattst88@gentoo.org> (08 Nov 2017)
+# Vulnerable to CVE-2017-13720, CVE-2017-13722 (bug #634044). Only in tree for
+# masked xorg-server-1.12.
+<x11-libs/libXfont-1.5.0
+
 # Brian Evans <grknight@gentoo.org> (07 Nov 2017)
 # Remote service removed this method, dead upstream
 # Masked for removal in 30 days.