Re: Security support incomplete?

2016-02-02 Thread Yves-Alexis Perez
On mar., 2016-02-02 at 17:36 +, Pedro M. Jorge wrote: > Even the tracker has its issues. The tracker is (more or less) live data, so it's giving the current state of information the security team (and all interested contributors actually) has.  The DSA is more static, and represent the view

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Marc Haber
On Tue, Feb 02, 2016 at 05:14:42PM +0100, Yves-Alexis Perez wrote: > On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote: > > Can anyone please clarify? In particular, I would like to know what the > > exact policies regarding coverage of security support are, and what > > issues have not

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Sébastien NOBILI
Hi, Le mardi 02 février 2016 à 18:21, Wolfgang Jeltsch a écrit : > • Where is a list of unfixed security issues? "debsecan" package might be an option for getting such a list. I don't have an oldstable install to check if this particular issue is in the list. Maybe someone else could check for

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Holger Levsen
Hi Wolfgang, On Dienstag, 2. Februar 2016, Wolfgang Jeltsch wrote: > • Where does the tracker talk about security policies? (I actually > doubt that such information is in the tracker at all.) That's out of scope for the tracker indeed, however right now I dont know where to find such

Re: [SECURITY] [DSA 3465-1] openjdk-6 security update

2016-02-02 Thread g . cyr
Bonjour, Je suis en congés du 01/02 au 05/02 inclus. En mon absence merci de contacter le service web sur l'adresse service...@viadom.fr. Cordialement, Guillaume Cyr

Re: Security support incomplete?

2016-02-02 Thread Pavlos K. Ponos
Hello, I checked in my oldstable installation, curl is in that list (taken from debsecan) It seems that I missed that too.. https://security-tracker.debian.org/tracker/CVE-2016-0755 Regards Pavlos *Pavlos K. Ponos* Account Manager at nlg GmbH PhD Candidate at University of Macedonia View

Re: Security support incomplete?

2016-02-02 Thread Davide Prina
On 02/02/2016 17:21, Wolfgang Jeltsch wrote: • Where is a list of unfixed security issues? You can know security issues of potentially security issues on packages you have installed on your system: 1) you can list installed package with open security issues # apt-get install debsecan $

Re: Security support incomplete?

2016-02-02 Thread Davide Prina
On 02/02/2016 22:29, Davide Prina wrote: On 02/02/2016 17:21, Wolfgang Jeltsch wrote: • Where is a list of unfixed security issues? You can know security issues of potentially security issues on packages you have installed on your system: 1) you can list installed package with open

Re: Downloading all information in JSON format

2016-02-02 Thread Sébastien Delafond
On 2016-02-01, Sébastien Delafond wrote: > The JSON API was disabled this week-end, because it was causing a > huge load on security-tracker.d.o, thus impacting the rest of the > functionalities. It will be restored shortly. The JSON API is back, after putting in a crude caching mechanism. There

Re: [SECURITY] [DSA 3455-1] curl security update

2016-02-02 Thread Wolfgang Jeltsch
Hi, I notice that there are no fixes for oldstable. Is oldstable not affected by this security issue? All the best, Wolfgang Am Mittwoch, den 27.01.2016, 12:16 + schrieb Alessandro Ghedini: > - > Debian Security

Re: [SECURITY] [DSA 3455-1] curl security update

2016-02-02 Thread Freddy Spierenburg
Hi Wolfgang, On Tue, Feb 02, 2016 at 11:40:03AM +0200, Wolfgang Jeltsch wrote: > I notice that there are no fixes for oldstable. Is oldstable not > affected by this security issue? [cut] > > Package: curl > > CVE ID : CVE-2016-0755 Please check out:

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Wolfgang Jeltsch
Am Dienstag, den 02.02.2016, 17:14 +0100 schrieb Yves-Alexis Perez: > On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote: > > Can anyone please clarify? In particular, I would like to know what the > > exact policies regarding coverage of security support are, and what > > issues have not

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Yves-Alexis Perez
On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote: > Can anyone please clarify? In particular, I would like to know what the > exact policies regarding coverage of security support are, and what > issues have not been fixed intentionally in oldstable (and maybe even > stable). Everything

Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Lupe Christoph
On Tuesday, 2016-02-02 at 17:14:42 +0100, Yves-Alexis Perez wrote: > On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote: > > Can anyone please clarify? In particular, I would like to know what the > > exact policies regarding coverage of security support are, and what > > issues have not

Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update)

2016-02-02 Thread Wolfgang Jeltsch
Am Dienstag, den 02.02.2016, 10:58 +0100 schrieb Freddy Spierenburg: > Hi Wolfgang, > > On Tue, Feb 02, 2016 at 11:40:03AM +0200, Wolfgang Jeltsch wrote: > > I notice that there are no fixes for oldstable. Is oldstable not > > affected by this security issue? > [cut] > > > Package: curl >

Re: Security support incomplete?

2016-02-02 Thread Pedro M. Jorge
On 2016-02-02 16:14, Yves-Alexis Perez wrote: On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote: Can anyone please clarify? In particular, I would like to know what the exact policies regarding coverage of security support are, and what issues have not been fixed intentionally in