Your message dated Sun, 31 Jan 2010 19:57:02 +0000
with message-id <[email protected]>
and subject line Bug#548358: fixed in libxerces2-java 2.8.1-1+etch1
has caused the Debian Bug report #548358,
regarding libxerces2-java: CVE-2009-2625 infinite loop denial of service in
libxerces2-java
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
548358: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548358
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libxerces2-java
Version: 2.9.1-2
Severity: normal
Discussed here:
http://mail-archives.apache.org/mod_mbox/xerces-j-users/200908.mbox/thread
Michael Glavassevich claims this is fixed in Xerces Java subversion here:
http://marc.info/?l=xerces-cvs&m=124569778024398&w=2
-- System Information:
Debian Release: 5.0.2
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libxerces2-java depends on:
ii libjaxp1.3-java 1.3.04-3 Java XML parser and transformer AP
ii sun-java5-jre [java2-runtim 1.5.0-17-0.1 Sun Java(TM) Runtime Environment (
ii sun-java6-jre [java2-runtim 6-12-1 Sun Java(TM) Runtime Environment (
Versions of packages libxerces2-java recommends:
ii libxerces2-java-gcj 2.9.1-2 Validating XML parser for Java wit
Versions of packages libxerces2-java suggests:
pn libxerces2-java-doc <none> (no description available)
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: libxerces2-java
Source-Version: 2.8.1-1+etch1
We believe that the bug you reported is fixed in the latest version of
libxerces2-java, which is due to be installed in the Debian FTP archive:
libxerces2-java_2.8.1-1+etch1.diff.gz
to main/libx/libxerces2-java/libxerces2-java_2.8.1-1+etch1.diff.gz
libxerces2-java_2.8.1-1+etch1.dsc
to main/libx/libxerces2-java/libxerces2-java_2.8.1-1+etch1.dsc
libxerces2-java_2.8.1-1+etch1_all.deb
to main/libx/libxerces2-java/libxerces2-java_2.8.1-1+etch1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Giuseppe Iuculano <[email protected]> (supplier of updated libxerces2-java
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 29 Jan 2010 12:08:29 +0100
Source: libxerces2-java
Binary: libxerces2-java
Architecture: source all
Version: 2.8.1-1+etch1
Distribution: oldstable-security
Urgency: high
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Giuseppe Iuculano <[email protected]>
Description:
libxerces2-java - Validating XML parser for Java with DOM level 3 support
Closes: 548358
Changes:
libxerces2-java (2.8.1-1+etch1) oldstable-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Fixed CVE-2009-2625: denial of service (infinite loop and application hang)
via malformed XML input (Closes: #548358)
Files:
755507a0cfcb7e2c83bb5c4a048295ec 908 libs optional
libxerces2-java_2.8.1-1+etch1.dsc
737df086ccae96f77334974617ccb4e0 1691101 libs optional
libxerces2-java_2.8.1.orig.tar.gz
a28511449d840005ba690a19bb6898f0 9951 libs optional
libxerces2-java_2.8.1-1+etch1.diff.gz
51c1bee829550381fccc419ae13d788e 1109884 libs optional
libxerces2-java_2.8.1-1+etch1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAktiw50ACgkQNxpp46476ap61QCgndJUFT0ec/RZDBJuJMJfaOEl
AOcAnjycorK3Cl9AvyweBBeBXxQdeRRJ
=5VK9
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
pkg-java-maintainers mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/pkg-java-maintainers
