> > I am having a hard time following. Looking at the 2nd URL, and > clicking, I find that libjpegturbo is at 7.4 and the last release was in > 2017. But also that the versions there don't make any sense compared to > the timestamps on distfiles, which show 3.1.0 on January 3, 2025. > Oh, I see. 7.4 is maybe the libjpeg.so version, I don't know, or a typo. Perhaps the Red Hat version? https://nvd.nist.gov/vuln/detail/CVE-2016-3616 No idea. -- Regards, kikadf