Hi László, On Fr 05 Jun 2015 21:03:03 CEST, László Böszörményi (GCS) wrote:
Hi all, On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel <mike.gabr...@das-netzwerkteam.de> wrote:On Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote:On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote:Source: fuse Version: 2.8.4-1.1+deb6u1there was no DLA for this upload, could you please prepare one and send it to the list?! Thanks already.You mean to debian-lts-announce, right?Let me know if you need a hand with this.Please review the following, I'm open for suggestions. -- cut -- Subject: [DLA 238-1] fuse security update Package : fuse Version : 2.8.4-1.1+deb6u1 CVE ID : CVE-2015-3202 Debian Bug : #786439 Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users. For the old-oldstable distribution (squeeze-lts), this problem has been fixed in version 2.8.4-1.1+deb6u1. We recommend that you upgrade your fuse packages.
The announcement is ok. But...Please request the DLA (here DLA-238-1) via bin/genDLA and immediately commit the resulting change to the secure-testing SVN repo. Once the DLA has been securely requested and has been documented in SVN, you can take your time with writing the announcement mail.
Santiago and I recently had the issue that we sent out mails for the same DLA and both committed the change to secure-testing SVN _after_ sending. Which caused some confusion.
At the moment DLA 238-1 is still available in secure-testing SVN, so please commit the change to secure-testing SVN asap and only then go ahead with sending your announcement mail.
Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb
pgp3SZvQuodYr.pgp
Description: Digitale PGP-Signatur