Am Dienstag, den 20.10.2009, 17:01 -0700 schrieb Jesse Keating: > On Wed, 2009-10-21 at 01:11 +0200, Christoph Wickert wrote: > > > > What really scares me is that there is a number of security updates in > > bodhi that don't have a tag request in trac. Are maintainers that > > careless? We don't want F12 released with 6 weeks old security bugs, so > > it might be worth to mail their owners if there is no tag request. > > "security" is a pretty broad and vague moniker. Are any of these known > privilege escalations, or could they just be crashers or DoS?
AFAICS these are privilege escalations and a have CVE assigned: https://admin.fedoraproject.org/updates/ocaml-mysql-1.0.4-11.fc12 https://admin.fedoraproject.org/updates/ocaml-postgresql-1.12.3-1.fc12 https://admin.fedoraproject.org/updates/ocaml-camlimages-3.0.1-12.fc12.1 But these are already tagged and the submitter forgot to withdraw the requests. Others: https://admin.fedoraproject.org/updates/perl-Net-OAuth-0.19-1.fc12 https://admin.fedoraproject.org/updates/rt3-3.8.4-6.fc12 this one has no details or comments at all :( Regards, Christoph -- fedora-devel-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/fedora-devel-list
