Hi John,
John Franklin writes:
> I’ve seen several security alerts from Debian, but no matching
> updates in Devuan. For example, the “file" package has
> CVE-2017-1000249, released yesterday.
>
>> For the stable distribution (stretch), this problem has been fixed in
>> version 1:5.30-1+deb9u1.
>>
>> For the unstable distribution (sid), this problem has been fixed in
>> version 1:5.32-1.
>
> But, on a Devuan Ascii VM:
Uhm, Devuan ascii is testing. I'd think that doesn't get any security
upgrades, just like Debian's testing (buster) doesn't get any.
In addition, this particular DSA doesn't mention fixes for oldstable so
I would not expect Devuan's jessie to get any security upgrade either.
Looks like you'll have to wait until whatever hit unstable trickles down
to testing.
> [...]
>
> Maybe this one is too new, but the “apache2" package has
> CVE-2017-9788 released July 18th, 2017.
>
>> For the oldstable distribution (jessie), this problem has been fixed
>> in version 2.4.10-10+deb8u10.
>>
>> For the stable distribution (stretch), this problem has been fixed in
>> version 2.4.25-3+deb9u2.
>>
>> For the unstable distribution (sid), this problem has been fixed in
>> version 2.4.27-1.
>
> The latest apache2 in Ascii is 2.4.25-3+deb9u1.
On my Devuan jessie I get this
$ apt-cache policy apache2
apache2:
Installed: (none)
Candidate: 2.4.10-10+deb8u10
Version table:
2.4.10-10+deb8u10 0
500 http://auto.mirror.devuan.org/merged/ jessie-security/main amd64
Packages
2.4.10-10+deb8u9 0
500 http://auto.mirror.devuan.org/merged/ jessie/main amd64 Packages
This matches what is available for Debian's jessie (oldstable).
Hope this helps,
--
Olaf Meeuwissen, LPIC-2 FSF Associate Member since 2004-01-27
GnuPG key: F84A2DD9/B3C0 2F47 EA19 64F4 9F13 F43E B8A4 A88A F84A 2DD9
Support Free Software https://my.fsf.org/donate
Join the Free Software Foundation https://my.fsf.org/join
_______________________________________________
Dng mailing list
Dng@lists.dyne.org
https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
