Bug#778872: [Pkg-utopia-maintainers] Bug#778872: Bug#778872: Bug#778872: Bug#778872: firewalld: breaks boot (probably LightDM)

2015-02-28 Thread Michael Biebl
control: severity -1 important

Am 24.02.2015 um 20:58 schrieb Michael Biebl:
 Am 23.02.2015 um 20:28 schrieb Michael Biebl:
 Am 23.02.2015 um 19:41 schrieb Dominik George:
 I tried purging firewalld and removing all remaining configuration, but
 to no avail.


 If purging the firewalld package does not solve the problem, how can
 firewalld break your system?

 I was intending to say purging and reinstalling.


 Please provide steps how this problem can be reproduced.
 
 A verbose journal log might helpful as well to diagnose your problem.
 For that, please add systemd.log_level=debug to the kernel command
 line, then login and dump the journal into a file via journalctl -alb 
 journal.txt and attach it to the bug report.

Since I haven't received any further information and other users haven't
confirmed the problem either, I'm downgrading this bug report.

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature


Processed: Re: [Pkg-utopia-maintainers] Bug#778872: Bug#778872: Bug#778872: Bug#778872: firewalld: breaks boot (probably LightDM)

2015-02-28 Thread Debian Bug Tracking System
Processing control commands:

 severity -1 important
Bug #778872 [firewalld] firewalld: breaks boot (probably LightDM)
Severity set to 'important' from 'critical'

-- 
778872: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778872
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: tagging 776391

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 776391 squeeze wheezy
Bug #776391 [eglibc] [CVE-2015-0235]: heap-based buffer overflow in 
__nss_hostname_digits_dots()
Added tag(s) squeeze and wheezy.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
776391: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776391
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#725284: Bug#779412: block devices loosing state after resume: trigger udev rules to re-apply settings

2015-02-28 Thread Michael Biebl
Am 28.02.2015 um 09:30 schrieb Chris:
 (http://bugs.debian.org/779412 explanation)
 
 There is a general problem with non-permanent block devices settings
 (hard disks, optical disks, usb storage, ...), that are not restored 
 when resuming from suspend (instead using factory defaults and 
 loosing all pre-suspend settings).
 
 And as long as the ata/scsi command set drivers can not save and
 restore every state register a device may have (impossible?),
 systemd may ship a viable workaround for this:
 
 A systemd unit file could trigger an udev change action upon resume for
 block devices. This way the same udev rules that set up the devices when
 they are first plugged, will re-apply their settings after resume.
 
 Providing this centrally with the systemd package could avoid that 
 multiple packages ship their own files, resulting in multiple change 
 events triggerd on each resume.
 
 Examples for very important (non-permanent) settings are with
 hdparm (i.e. the important -B hard disk wear settings)
 https://bugs.debian.org/725284
 smartctl/mdadm/lvm/btrfs/zfs/... (i.e. set error recovery timeouts to
 prevent controller resets and data loss)
 http://sourceforge.net/p/smartmontools/mailman/message/33501936/
 

I don't think working around this in udev/systemd is a good idea.
After all, most of those custom settings aren't applied via udev rules
anyway. This should be fixed in the kernel properly (or the individual
services) and not be papered over in systemd.

Marco, what do you think?

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature


Processed: tagging 779202

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 779202 wheezy
Bug #779202 [src:kfreebsd-8] kfreebsd-8: CVE-2015-1414: DoS via IGMP packet
Added tag(s) wheezy.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779202: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779202
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: Re: Bug#779294: /usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by /usr/bin/python)

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 779294 sid
Bug #779294 [apt,python2.7,libc6] /usr/bin/python: 
/lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by 
/usr/bin/python)
Added tag(s) sid.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779294: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779294
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#725284: block devices loosing state after resume: trigger udev rules to re-apply settings

2015-02-28 Thread Chris
(http://bugs.debian.org/779412 explanation)

There is a general problem with non-permanent block devices settings
(hard disks, optical disks, usb storage, ...), that are not restored 
when resuming from suspend (instead using factory defaults and 
loosing all pre-suspend settings).

And as long as the ata/scsi command set drivers can not save and
restore every state register a device may have (impossible?),
systemd may ship a viable workaround for this:

A systemd unit file could trigger an udev change action upon resume for
block devices. This way the same udev rules that set up the devices when
they are first plugged, will re-apply their settings after resume.

Providing this centrally with the systemd package could avoid that 
multiple packages ship their own files, resulting in multiple change 
events triggerd on each resume.

Examples for very important (non-permanent) settings are with
hdparm (i.e. the important -B hard disk wear settings)
https://bugs.debian.org/725284
smartctl/mdadm/lvm/btrfs/zfs/... (i.e. set error recovery timeouts to
prevent controller resets and data loss)
http://sourceforge.net/p/smartmontools/mailman/message/33501936/




A draft for such a central systemd unit file:

[Unit]
Description=Trigger all block device udev rules on resume, to re-apply all 
non-permanent device settings (e.g. smartctl and hdparm rules).
After=suspend.target After=hibernate.target
After=hybrid-sleep.target

[Service]
Type=oneshot
ExecStart=/sbin/udevadm trigger --action=change --subsystem-match=block

[Install]
WantedBy=suspend.target
WantedBy=hibernate.target
WantedBy=hybrid-sleep.target


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#779294: /usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by /usr/bin/python)

2015-02-28 Thread David Kalnischkies
On Fri, Feb 27, 2015 at 08:17:26PM +0100, Andreas Beckmann wrote:
Preparing to replace python2.7-minimal 2.7.3-6+deb7u2 (using 
  .../python2.7-minimal_2.7.8-11_i386.deb) ...
Unpacking replacement python2.7-minimal ...
[…]
Preparing to replace debconf 1.5.49 (using .../debconf_1.5.55_all.deb) 
  ...
/usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not 
  found (required by /usr/bin/python)
dpkg: warning: subprocess old pre-removal script returned error exit 
  status 1
dpkg: trying script from the new package instead ...
/usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not 
  found (required by /usr/bin/python)
dpkg: error processing /var/cache/apt/archives/debconf_1.5.55_all.deb 
  (--unpack):
 subprocess new pre-removal script returned error exit status 1
[…]
  This looks a bit like python was unpacked before the new glibc.
  
  debconf calls pycompile (and python).  It looks like this kind of thing can
  happen with any binary which needs the new glibc, and in this case it hits 
  python.

The dpkg error is talking about the prerm script of debconf.
Looking at it shows that it indeed calls python scripts (pyclean,
py3clean) generated by dh_python2 and dh_python respectively.

Now, the guaranties you have while prerm is running are not really
great: Everything can be half-installed (in a new version), but was
configured (in an old version) [see §6.5]. Not really a 'problem' as
debconf has no dependency on python-minimal at all, so it can be in any
state anyway.

Looking at python-minimal (which contains the /usr/bin/python link) and
then on python2.7-minimal (which contains the link target) looks better:
python2.7-minimal pre-depends on glibc, which is a strong guaranty and
given that the log contains the unpack of python2.7-minimal, it should
also contain unpack+configure of glibc – if the version already
installed isn't high enough.

The python2.7-minimal version 2.7.9-1 currently in sid pre-depends =
2.15 on amd64 and i386 (and a bunch of other archs - not on all!), so we
should have seen glibc here and before someone is showing log to
disprove me, I presume tagging 'sid' was a mistake.

The python2.7-minimal version 2.7.8-11 currently in jessie and the one
this log was talking about pre-depends = 2.15 on amd64, but on i386 the
pre-depends is a relaxed = 2.3.6-6~. That is satisfiable by wheezys
libc6 (currently at 2.13-38+deb7u8) easily (The same or similar again
for other archs as well). I have my doubts this version contains 2.15
symbols through, but this is by definition not apts fault. The question
is now how this pre-dependency came to be, but that is something python
and glibc maintainers can work out.



Slightly unrelated sidenote: python-minimal might be better of
pre-depending on python2.7-minimal. I have my doubts it could actually
happen in practice, but in theory I could freshly install python and
upgrade debconf in the following order:
unpack python-minimal  (the pyclean script is installed)
unpack debconf (prerm finds pyclean script and calls it)
unpack python2.7-minimal (the python interpreter is installed)

The second one will fail as pyclean can't be executed as the interpreter
isn't installed. APT will avoid doing this in general, hence my doubt
that this is a problem in practice, but it is technically allowed (as
long as debconf has no python dependency). This probably get slight more
real if python-minimal ever decides to link to (e.g.) python5 instead.



Best regards

David Kalnischkies


signature.asc
Description: Digital signature


Processed: IMO important only

2015-02-28 Thread Debian Bug Tracking System
Processing control commands:

 severity -1 important
Bug #761023 [bb] [bb] Visual stops when audio starts
Severity set to 'important' from 'grave'

-- 
761023: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761023
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#761023: IMO important only

2015-02-28 Thread Holger Levsen
control: severity -1 important

Hi,

I have used bb a few times *with* audio, mostly I have used it without. Also 
bb is used as a nice demo at events, usually without audio. So I'd argue that 
this bug perfectly fits the description of severity important: 

important: a bug which has a major effect on the usability of a package, 
without rendering it completely unusable to everyone.

To prevent removal from jessie I've downgraded the severity accordingly.


cheers,
Holger


signature.asc
Description: This is a digitally signed message part.


Bug#779367: moreinfo

2015-02-28 Thread Holger Levsen
control: tags -1 + moreinfo
control: severity -1 important

Hi,

thanks for your bugreport!

Just that raspian is not Debian, even though its based on Debian. So, can you 
reproduce this bug on Debian?


cheers,
Holger


signature.asc
Description: This is a digitally signed message part.


Processed: moreinfo

2015-02-28 Thread Debian Bug Tracking System
Processing control commands:

 tags -1 + moreinfo
Bug #779367 [ulogd] ulogd: Unable to create netlink socket: Bad file descriptor
Added tag(s) moreinfo.
 severity -1 important
Bug #779367 [ulogd] ulogd: Unable to create netlink socket: Bad file descriptor
Severity set to 'important' from 'grave'

-- 
779367: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779367
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#742388: Fixed in alsa-utils 1.0.27.2-1

2015-02-28 Thread Elimar Riesebieter
On Mon, 28 Apr 2014 18:37:30 -0400 Felipe Sateler fsate...@debian.org wrote:
 This was fixed in alsa-utils by a similar approach.

So bug closed herewith.

Elimar
-- 
  Alles was viel bedacht wird ist bedenklich!;-)
 Friedrich Nietzsche


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#720678: Bug#712980: fixed in alsa-utils 1.0.27.2-1

2015-02-28 Thread Elimar Riesebieter
On Sat, 19 Oct 2013 14:34:36 + Jordi Mallach jo...@debian.org wrote:
 Source: alsa-utils
 Source-Version: 1.0.27.2-1
 
 We believe that the bug you reported is fixed in the latest version of
 alsa-utils, which is due to be installed in the Debian FTP archive.

Should be closed really.

Elimar
-- 
  Alles was viel bedacht wird ist bedenklich!;-)
 Friedrich Nietzsche


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#725284: Bug#779412: block devices loosing state after resume: trigger udev rules to re-apply settings

2015-02-28 Thread Chris
Am Sat, 28 Feb 2015 09:38:27 +0100
schrieb Michael Biebl bi...@debian.org:

 I don't think working around this in udev/systemd is a good idea.

Idealy and in the long run, the kernel drivers should keep state, yes.
But until then, better not to make releases with default configurations
that deliver serious problems (excessive hardware wear, data loss) to
the users. 

I believe before things stadardized around systemd and udev, packages
like hdparm, laptop-mode-tools, pm-utils, acpi-support,
gnome-power-manager, and more, all tried to work around problems with
block devices loosing state. Unfortunately, accumulating a large mess
and interferences resuling in releases with many bugs in this regard.

Now the situation can improve a lot, if we can say packages are safe if
they use udev rules to initialize devices. (As the kernel keeps
state, or systemd centrally triggers a udev change event where this is
not (yet) the case.)

 most of those custom settings aren't applied via udev rules
 anyway.

Which settings were you refering to?
With current versions hdparm, mdadm, etc. all seem to ship udev rules.
And that seems to be the proper way to configure the standard
hot-pluggable systems of today. (leaving aside embedded, non-systemd,
non udev systems)


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: jessie

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 644047 + sid jessie
Bug #644047 [gdm3] gdm3: /etc/default/locale ignored, locale set to C, breaks 
gnome-terminal
Added tag(s) sid and jessie.
 tags 761023 + sid jessie
Bug #761023 [bb] [bb] Visual stops when audio starts
Added tag(s) sid and jessie.
 tags 757413 + sid jessie
Bug #757413 {Done: Steve McIntyre st...@einval.com} [partman-target] 
debian-installer: Please do not add mount point on /media/usb0 because create 
conflict with mount point create by kdm desktop session
Added tag(s) sid and jessie.
 tags 779370 + sid jessie
Bug #779370 [hdparm] hdparm + systemd: old apm/pm-utils hooks not 
working/migrated
Added tag(s) sid and jessie.
 tags 766960 + sid jessie
Bug #766960 {Done: Didier Raboud o...@debian.org} 
[src:debian-installer-netboot-images] debian-installer-netboot-images: Please 
provide packages for Debian 8
Added tag(s) sid and jessie.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
644047: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644047
757413: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=757413
761023: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761023
766960: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766960
779370: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779370
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#757413: Processed: jessie

2015-02-28 Thread Cyril Brulebois
Debian Bug Tracking System ow...@bugs.debian.org (2015-02-28):
  tags 757413 + sid jessie
 Bug #757413 {Done: Steve McIntyre st...@einval.com} [partman-target] 
 debian-installer: Please do not add mount point on /media/usb0 because create 
 conflict with mount point create by kdm desktop session
 Added tag(s) sid and jessie.

Again?

Mraw,
KiBi.


signature.asc
Description: Digital signature


Bug#775795: Patch to use /usr/sbin/service in Debian service-provider

2015-02-28 Thread Apollon Oikonomopoulos
On Fri, 27 Feb 2015 11:20:30 +0200 Apollon Oikonomopoulos apoi...@debian.org 
wrote:
 The attached patch on top of 3.7.2-2 (hopefully) addresses all of 
 these issues (and drops support for pre-2.88 sysv-rc if you don't 
 mind). I have not tested it on a sysvinit Jessie system though, so if 
 anyone could do this it would be appreciated!

I also tested it on a sysv-rc Jessie system. This is an updated version 
of the patch, marking the systemctl command as optional. Without this, 
sysv-rc Jessie systems would have the Debian provider blacklisted 
because of the missing systemctl command.

Interdiff:

--- b/lib/puppet/provider/service/debian.rb
+++ b/lib/puppet/provider/service/debian.rb
@@ -15,7 +15,7 @@
   # http://projects.reductivelabs.com/issues/2538
   # is resolved.
   commands :invoke_rc = /usr/sbin/invoke-rc.d
-  commands :systemctl = /bin/systemctl
+  optional_commands :systemctl = /bin/systemctl
 
   # This isn't being used directly, it's just here to ensure
   # that the /usr/sbin/service binary is available.

Cheers,
Apollon
From a9b76dbfba96f537227c445297d3ccd115de46ca Mon Sep 17 00:00:00 2001
From: Apollon Oikonomopoulos apoi...@debian.org
Date: Fri, 27 Feb 2015 10:55:34 +0200
Subject: [PATCH] Fix service listing and enable/disable in Debian
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add two support methods to detect when we're running systemd as PID 1
and if a service has only an initscript.

Use these to implement the following functionality:

 • Under systemd, use systemctl enable/disable for all services. This
   works correctly for all types of services.

 • Under systemd, use systemctl is-enabled only for services that have a
   systemd unit file and fall back to invoke-rc.d for sysv services.

Also, fix self.instances to augment the list of systemd-enabled services
with the sysv services.

Finally drop pre-2.88 sysv-rc support and use `update-rc.d enable' for
all services when running under sysv-rc, preserving order changes.
---
 lib/puppet/provider/service/debian.rb | 94 ++-
 1 file changed, 71 insertions(+), 23 deletions(-)

diff --git a/lib/puppet/provider/service/debian.rb b/lib/puppet/provider/service/debian.rb
index 9f7a2f5..7a26409 100644
--- a/lib/puppet/provider/service/debian.rb
+++ b/lib/puppet/provider/service/debian.rb
@@ -15,6 +15,7 @@ Puppet::Type.type(:service).provide :debian, :parent = :init do
   # http://projects.reductivelabs.com/issues/2538
   # is resolved.
   commands :invoke_rc = /usr/sbin/invoke-rc.d
+  optional_commands :systemctl = /bin/systemctl
 
   # This isn't being used directly, it's just here to ensure
   # that the /usr/sbin/service binary is available.
@@ -23,38 +24,82 @@ Puppet::Type.type(:service).provide :debian, :parent = :init do
 
   defaultfor :operatingsystem = :debian
 
+  def self.runs_on_systemd?
+Dir.exists? /run/systemd/system
+  end
+
+  def is_sysv_unit?
+# The sysv generator sets the SourcePath attribute to the name of the
+# initscript. Use this to detect whether a unit is backed by an initscript
+# or not.
+source = systemctl(:show, -pSourcePath, @resource[:name])
+source.start_with? SourcePath=/etc/init.d/
+  end
+
+  def self.instances
+# We need to merge services with systemd unit files with those only having
+# an initscript. Note that we could use `systemctl --all` to get sysv
+# services as well, however it would only output *enabled* services.
+i = {}
+if self.runs_on_systemd?
+  begin
+output = systemctl('list-unit-files', '--type', 'service', '--full', '--all',  '--no-pager')
+output.scan(/^(\S+)\.service\s+(disabled|enabled)\s*$/i).each do |m|
+  i[m[0]] = new(:name = m[0])
+end
+  rescue Puppet::ExecutionFailure
+  end
+end
+get_services(defpath).each do |sysv|
+  unless i.has_key?(sysv.name)
+i[sysv.name] = sysv
+  end
+end
+return i.values
+  end
+
   # Remove the symlinks
   def disable
-if `dpkg --compare-versions $(dpkg-query -W --showformat '${Version}' sysv-rc) ge 2.88 ; echo $?`.to_i == 0
-  update_rc @resource[:name], disable
+if self.class.runs_on_systemd?
+  systemctl(:disable, @resource[:name])
 else
-  update_rc -f, @resource[:name], remove
-  update_rc @resource[:name], stop, 00, 1, 2, 3, 4, 5, 6, .
+  update_rc @resource[:name], disable
 end
   end
 
   def enabled?
-# TODO: Replace system call when Puppet::Util::Execution.execute gives us a way
-# to determine exit status.  http://projects.reductivelabs.com/issues/2538
-system(/usr/sbin/invoke-rc.d, --quiet, --query, @resource[:name], start)
-
-# 104 is the exit status when you query start an enabled service.
-# 106 is the exit status when the policy layer supplies a fallback action
-# See x-man-page://invoke-rc.d
-if [104, 106].include?($CHILD_STATUS.exitstatus)
-  return :true
-elsif 

Bug#779420: debconf-{i18n,utils}: dependency on debconf too weak

2015-02-28 Thread Helmut Grohne
Package: debconf-i18n,debconf-utils
Version: 1.5.55
Severity: serious
Justification: policy 12.3 footnote 2
Tags: patch

debconf-i18n contains a symlink /usr/share/doc/debconf-i18n - debconf.
Its dependency on debconf is unversioned though which means, that the
copyright and changelog files can get out of sync. This violates the
Debian policy section 12.3 footnote 2.

The solution is to add (= ${source:Version}) (since both are Arch:all) to
debconf-i18n's Depends in debian/control.

Note that debhelper cannot be blamed on this, because debconf does not
use dh_installdocs --link-doc, but rather instantiates this symlink on
its own. It therefore is debconf's responsibility to add the versioned
dependency.

The same issue holds for nettle-utils.

Attaching a .debdiff for your convenience.

Helmut
diff -Nru debconf-1.5.55/debian/changelog debconf-1.5.55+nmu1/debian/changelog
--- debconf-1.5.55/debian/changelog 2014-12-14 08:43:06.0 +0100
+++ debconf-1.5.55+nmu1/debian/changelog2015-02-28 11:22:37.0 
+0100
@@ -1,3 +1,11 @@
+debconf (1.5.55+nmu1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Tighten dependency on debconf for packages sharing their
+/usr/share/doc to comply with Debian policy 12.3. (Closes: #-1)
+
+ -- Helmut Grohne hel...@subdivi.de  Sat, 28 Feb 2015 11:21:46 +0100
+
 debconf (1.5.55) unstable; urgency=low
 
   * Team upload
diff -Nru debconf-1.5.55/debian/control debconf-1.5.55+nmu1/debian/control
--- debconf-1.5.55/debian/control   2014-11-24 10:11:06.0 +0100
+++ debconf-1.5.55+nmu1/debian/control  2015-02-28 11:21:43.0 +0100
@@ -31,7 +31,7 @@
 Conflicts: debconf-english, debconf-utils ( 1.3.22)
 Replaces: debconf ( 1.3.0), debconf-utils ( 1.3.22)
 Architecture: all
-Depends: debconf, liblocale-gettext-perl, libtext-iconv-perl, 
libtext-wrapi18n-perl, libtext-charwidth-perl, ${misc:Depends}
+Depends: debconf (= ${source:Version}), liblocale-gettext-perl, 
libtext-iconv-perl, libtext-wrapi18n-perl, libtext-charwidth-perl, 
${misc:Depends}
 Description: full internationalization support for debconf
  This package provides full internationalization for debconf, including
  translations into all available languages, support for using translated
@@ -52,7 +52,7 @@
 
 Package: debconf-utils
 Section: devel
-Depends: debconf (= 1.3.20), ${misc:Depends}
+Depends: debconf (= ${source:Version}), ${misc:Depends}
 Conflicts: debconf ( 0.1.0)
 Replaces: debconf ( 0.1.0)
 Architecture: all


Bug#779274: marked as done (t1disasm: buffer overflow in set_cs_start)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 09:50:58 +
with message-id e1yre30-0007an...@franck.debian.org
and subject line Bug#779274: fixed in t1utils 1.39-1
has caused the Debian Bug report #779274,
regarding t1disasm: buffer overflow in set_cs_start
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
779274: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779274
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---

Package: t1utils
Version: 1.38-3
Severity: grave
Tags: security
Usertags: afl

$ t1asm crash.raw crash.pfb
t1asm: warning: no charstrings found in input file

$ t1disasm crash.pfb /dev/null
Segmentation fault

Backtrace:

#0  ___fprintf_chk (fp=0x6f6f6f6f, flag=1, format=0x804eedc %.*s) at 
fprintf_chk.c:30
#1  0x0804d653 in fprintf (__fmt=0x804eedc %.*s, __stream=optimized out) at 
/usr/include/i386-linux-gnu/bits/stdio2.h:97
#2  eexec_line (line=0xd320 /m, 'o' repeats 36 times, {string currentfile exch 
readstring pop}executeonly def\n, line_len=optimized out, line_len@entry=94) at t1disasm.c:462
#3  0x0804e05e in disasm_output_binary (data=0xd320 /m, 'o' repeats 36 times, 
{string currentfile exch readstring pop}executeonly def\n, len=94) at t1disasm.c:595
#4  0x0804cf67 in process_pfb (ifp=0x80531c0, ifp_filename=0xd9ff 
crash.pfb, fr=0xd760) at t1lib.c:295
#5  0x08048f41 in main (argc=3, argv=0xd834) at t1disasm.c:770

This happened because set_cs_start overwrote the file pointer with data 
from the disassembled file.


I believe the bug can be exploited for code execution, at least on 
systems that don't have executable space protection.


This bug was found using American fuzzy lop:
http://lcamtuf.coredump.cx/afl/

-- System Information:
Debian Release: 8.0
 APT prefers unstable
 APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages t1utils depends on:
ii  libc6  2.19-15

--
Jakub Wilk
currentfile eexec
/m{string currentfile exch readstring 
pop}executeonly def
---End Message---
---BeginMessage---
Source: t1utils
Source-Version: 1.39-1

We believe that the bug you reported is fixed in the latest version of
t1utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Niels Thykier ni...@thykier.net (supplier of updated t1utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sat, 28 Feb 2015 08:53:38 +0100
Source: t1utils
Binary: t1utils
Architecture: source
Version: 1.39-1
Distribution: experimental
Urgency: medium
Maintainer: Niels Thykier ni...@thykier.net
Changed-By: Niels Thykier ni...@thykier.net
Description:
 t1utils- Collection of simple Type 1 font manipulation programs
Closes: 779274
Changes:
 t1utils (1.39-1) experimental; urgency=medium
 .
   * New upstream release.
 - Fix infinite loop in t1disasm on some fonts.
 - Fix leak of va_list by adding necessary va_end calls.
 - Fix buffer-overflow that can reliably overwrite a
   FILE* pointer.  (Closes: #779274)
   * Drop patch for the infinite loop in t1disasm, since it is
 included in the upstream release.
Checksums-Sha1:
 d053866efeadfdf28efdbb2da77493fcbac55d6b 1704 t1utils_1.39-1.dsc
 655711f5150dd75e45bdc6b81ddb87ff16b0d567 65681 t1utils_1.39.orig.tar.gz
 8056fbacd0a28208cb158ffca94db808913cf778 5928 t1utils_1.39-1.debian.tar.xz
Checksums-Sha256:
 aba5f8c2280a1d1b6c014a8014d60ec3c17d57407f1ce35ecf82952f1b734759 1704 
t1utils_1.39-1.dsc
 13d7e8f5095fbabce23dc8a91278c7d347cec1564202370236207d3a7c1ab6b8 65681 
t1utils_1.39.orig.tar.gz
 cd1310aee01267cfc07f94b20b2e6016769cd79ec843e4b32363787648eb0f76 5928 
t1utils_1.39-1.debian.tar.xz
Files:
 96bf33b585f3f8ffc19132eed1b455b7 1704 text optional t1utils_1.39-1.dsc
 1084d7722d64b9a0d20819c60cacfa58 65681 text optional t1utils_1.39.orig.tar.gz
 4afec396395f0f49deedbec67519cff6 5928 text optional 

Processed: Re: Bug#779294: /usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by /usr/bin/python)

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 reassign 779294 python2.7
Bug #779294 [apt,python2.7,libc6] /usr/bin/python: 
/lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by 
/usr/bin/python)
Bug reassigned from package 'apt,python2.7,libc6' to 'python2.7'.
Ignoring request to alter found versions of bug #779294 to the same values 
previously set
Ignoring request to alter fixed versions of bug #779294 to the same values 
previously set
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779294: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779294
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: notfound 773315 in subversion/1.0.0-1

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 notfound 773315 subversion/1.0.0-1
Bug #773315 {Done: James McCoy james...@debian.org} [subversion] subversion: 
CVE-2014-8108
The source subversion and version 1.0.0-1 do not appear to match any binary 
packages
No longer marked as found in versions subversion/1.0.0-1.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
773315: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773315
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#758388: marked as done (depends on insecure and unmaintained python-oauth2)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:38:04 +
with message-id e1yrp5i-0001pl...@franck.debian.org
and subject line Bug#779447: Removed package(s) from unstable
has caused the Debian Bug report #758388,
regarding depends on insecure and unmaintained python-oauth2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
758388: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758388
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Source: python-django-social-auth
Version: 0.7.23-1
Severity: Grave

This package depends on python-oauth2 which has unresolved security issues
(#722656, #722657), no longer available in testing, and no longer
maintained upstream.

python-django-social-auth needs to be updated (if possible) to use
python-oauthlib instead.

See http://lists.debian.org/52f86a59.9000...@debian.org
-- 
Brian May br...@microcomaustralia.com.au
---End Message---
---BeginMessage---
Version: 0.7.23-1+rm

Dear submitter,

as the package python-django-social-auth has just been removed from the Debian 
archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779447

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#779119: marked as done (shorewall: depend on perl instead of perl-modules)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 22:33:38 +
with message-id e1yrpx4-00085h...@franck.debian.org
and subject line Bug#779119: fixed in shorewall 4.6.4.3-2
has caused the Debian Bug report #779119,
regarding shorewall: depend on perl instead of perl-modules
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
779119: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779119
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: shorewall
Version: 4.6.4.3-1
Severity: serious
Justification: blocks another serious bug

According to the package description of perl-modules, other packages
should not depend on it, since it is considered an internal implementation
detail of the perl package. At present we are dealing with an RC bug[1] in
perl which is exacerbated by such dependencies.

As such, please could you replace

Depends: perl-modules

with

Depends: perl

NMUs will be forthcoming; feel free to let me know whether you prefer
to handle this as a maintainer upload or not.

Thanks,
Dominic.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777597#32
---End Message---
---BeginMessage---
Source: shorewall
Source-Version: 4.6.4.3-2

We believe that the bug you reported is fixed in the latest version of
shorewall, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Roberto C. Sanchez robe...@connexer.com (supplier of updated shorewall 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sat, 28 Feb 2015 17:07:05 -0500
Source: shorewall
Binary: shorewall
Architecture: source all
Version: 4.6.4.3-2
Distribution: unstable
Urgency: low
Maintainer: Roberto C. Sanchez robe...@connexer.com
Changed-By: Roberto C. Sanchez robe...@connexer.com
Description:
 shorewall  - Shoreline Firewall, netfilter configurator
Closes: 779119
Changes:
 shorewall (4.6.4.3-2) unstable; urgency=low
 .
   * Depend upon perl instead of perl-modules (Closes: #779119)
Checksums-Sha1:
 86bee2669152e7787f30b08192fd341dd55e82e0 1919 shorewall_4.6.4.3-2.dsc
 10fc267e1aa840683b47d95fdb7dc991a157812a 34720 
shorewall_4.6.4.3-2.debian.tar.xz
 9005a47e0c65115ac39db234a619ed437ea45da9 694500 shorewall_4.6.4.3-2_all.deb
Checksums-Sha256:
 9029d82e28fd942761b8c68454907357b2e010dc746d4f1116401ea52417a8df 1919 
shorewall_4.6.4.3-2.dsc
 c65ff3a6763951f03abebb34d32d96f51a9e162583ae73f303f8c6441370949d 34720 
shorewall_4.6.4.3-2.debian.tar.xz
 e90045c0ff0a61fb567208b47aee667a68a715497333f149aa8f256a9f89e323 694500 
shorewall_4.6.4.3-2_all.deb
Files:
 fca53526500eaf85fe5f9deebfe33133 1919 net optional shorewall_4.6.4.3-2.dsc
 6284ee65013e3acd4356ada5aaa2 34720 net optional 
shorewall_4.6.4.3-2.debian.tar.xz
 f8b45a2c936d1f5495101463c8779d10 694500 net optional 
shorewall_4.6.4.3-2_all.deb

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJU8j74AAoJECzXeF7dp7IP/PsQAITCvYy8ITpRVeBAxPeC6IXb
jH14O6O0Awbe3FtKqfyTFv8z2l4CCVFEcbXNYza+CgMgb7BOHKVUVDhD3qOj+wHv
IcfrhSXNa8ZCZdSyAcjtiIintjI+VxxgYyFY5hMpv6u32KYOIcK3Wz49dyiv3vTn
abeJ2gnV/bpFMvWDhkXD2hyGgZRMbuEnCVwayYVZn2mdg3EupocNGT9TtHFNQcJZ
CF7IxyIf6NXZBhxdKHs3Kq77RQGCf53RjtP5Tof+gtC34LnCSXkDuS6PCSx/CC1S
VOlz7LcI0wLx63EgG3beErrkff2si12evmitTO33bbLaVMhdNWfZIV99CG9Gopby
3OC6HUVmzIJlh21h+yhcj+mqjIiB5wP/O5f2kGFALz0U9yB3qXJnAHy415/JTCNF
EWf5ybUWRXPOEOiTeUyUKHXhNr04dP9V4rdyToL96tQofjZ1Nc6Fh1imxyzMbVR7
+2uNRN2QQbKBCQWq0rw0WcmYT7vBB+HGqoCxW/pGEprRdBCkatZXmKZBulWgZAKq
G6sNlQqK1pOrUPG1ZzCr7Nrzhr1YZeIOhwT/6XgO58KlB1FiBqs/llUPcEw/MtNV
aDlDkB5KgO9sJATon0wrwcD7hC58VVhuiXYQIBs64E1e6MZs5yzy7xuNDAQanD8W
Be2QlHk3soC+rkB6IoEC
=R04H
-END PGP SIGNATUREEnd Message---


Bug#779120: marked as done (shorewall-core: depend on perl instead of perl-modules)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 22:33:46 +
with message-id e1yrpxc-00087u...@franck.debian.org
and subject line Bug#779120: fixed in shorewall-core 4.6.4.3-2
has caused the Debian Bug report #779120,
regarding shorewall-core: depend on perl instead of perl-modules
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
779120: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779120
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: shorewall-core
Version: 4.6.4.3-1
Severity: serious
Justification: blocks another serious bug

According to the package description of perl-modules, other packages
should not depend on it, since it is considered an internal implementation
detail of the perl package. At present we are dealing with an RC bug[1] in
perl which is exacerbated by such dependencies.

As such, please could you replace

Depends: perl-modules

with

Depends: perl

NMUs will be forthcoming; feel free to let me know whether you prefer
to handle this as a maintainer upload or not.

Thanks,
Dominic.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777597#32
---End Message---
---BeginMessage---
Source: shorewall-core
Source-Version: 4.6.4.3-2

We believe that the bug you reported is fixed in the latest version of
shorewall-core, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Roberto C. Sanchez robe...@connexer.com (supplier of updated shorewall-core 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sat, 28 Feb 2015 17:10:06 -0500
Source: shorewall-core
Binary: shorewall-core
Architecture: source all
Version: 4.6.4.3-2
Distribution: unstable
Urgency: low
Maintainer: Roberto C. Sanchez robe...@connexer.com
Changed-By: Roberto C. Sanchez robe...@connexer.com
Description:
 shorewall-core - Shorewall core components
Closes: 779120
Changes:
 shorewall-core (4.6.4.3-2) unstable; urgency=low
 .
   * Depend upon perl instead of perl-modules (Closes: #779120)
Checksums-Sha1:
 b5be9243cf05d030fc785411987681112d466f88 1946 shorewall-core_4.6.4.3-2.dsc
 6e7859d4efb521b3bb6cdfc2e138fb32f2acc58e 2488 
shorewall-core_4.6.4.3-2.debian.tar.xz
 2db25b1f0976caa02bcb08f61e762c80426cef6d 41010 shorewall-core_4.6.4.3-2_all.deb
Checksums-Sha256:
 a07b0edfb8e2f1f701e1bfdef6796610a216bb9689a2651f11af2f1f10bebc4a 1946 
shorewall-core_4.6.4.3-2.dsc
 42d89b4c28446e7c711e9876b2ce157a886b34907afcb3398169d96a48b03176 2488 
shorewall-core_4.6.4.3-2.debian.tar.xz
 9561c2e315576f91b9ba2f3c80763898a8833a8d9e5340fffd2b68d7d5417fc3 41010 
shorewall-core_4.6.4.3-2_all.deb
Files:
 bba3ea4a077989634cc784fdb3fc581b 1946 net optional shorewall-core_4.6.4.3-2.dsc
 f158a3bf106cd1ccd5784316ebe4337e 2488 net optional 
shorewall-core_4.6.4.3-2.debian.tar.xz
 0aee204dd4995843a72c3c644116d81d 41010 net optional 
shorewall-core_4.6.4.3-2_all.deb

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJU8j74AAoJECzXeF7dp7IP67EP/0eRRDEsqrl4t330nRQ3pH8u
oK1xgz+3FhgY/AxMH+H1gfW3Jq5gMdZCUwOew2q1FFzig5oxjHEGMuo3nIc8o+uw
qy3u0dM87DuIh0uFUzBgwgljlOLzz3Bx+bi0ECUoC0JnF0KoZ0dtWKSBPBb1uYu2
Uhu4+OsfLnBop7veoxSk1n+XkntnlZFkvbsrHGWXeV80y2x7kxyEZKtwhzSwGUDt
GSgMqemqfG5/yhDt8GGS92y2sPEWm3fzuhxGFHD87wVcDKMk8sNhi815660r4UYP
fBQtdt9d2NL0O6MIO9fSgK4ExIITpyy6/FxDQzI2EJmCJEbNDah9w5lZruMDXm5I
T8OnvvVsYXlrmnv3gtntQA/i+f7cro82+0twVv1biFBWL9Z4JE6mbf0UCfVsJoDd
9XYjoFxlxx5zOHD507Ss0aDLIQP4LutuSbyABVGiwKLmFgnU/MaBR+2n0r/GoTUq
0g/hBARq7uzBblnpp61yEVY/ju425DCP0yVpev4ebBXn4t9bx4zVyfH+2bBqA93j
HI9blVXahObnhhlWdEgm5zlmMoALUUgRauno79YGt4YL2wZpEezgEQTuAcJcvOXa
rG22gnJxf9yIdX+IZI2rS6mMEXBcA4Lj6oLlVmaSSRU7fBTAymMrGtBw5RgUuU++
NO9b7TTS5ocZ2zxmQY84
=ACnE
-END PGP SIGNATUREEnd Message---


Bug#779294: /usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not found (required by /usr/bin/python)

2015-02-28 Thread Aurelien Jarno
reassign 779294 python2.7
thanks

On 2015-02-26 18:33, Matthias Klose wrote:
 On 02/26/2015 06:01 PM, Andreas Beckmann wrote:
  during a test with piuparts I noticed a failure to upgrade from 'wheezy'.
  
  I'm not exactly sure which package to blame.
  This happened on i386, I cannot reproduce it on amd64.
  The package being tested was lsb-desktop, but it can probably show up
  elsewhere as well.
  
 From the attached log (scroll to the bottom...):
  
(Reading database ... 18847 files and directories currently installed.)
Preparing to replace libpython2.7 2.7.3-6+deb7u2 (using 
  .../libpython2.7_2.7.8-11_i386.deb) ...
Unpacking replacement libpython2.7:i386 ...
Preparing to replace python2.7 2.7.3-6+deb7u2 (using 
  .../python2.7_2.7.8-11_i386.deb) ...
Unpacking replacement python2.7 ...
Preparing to replace python2.7-minimal 2.7.3-6+deb7u2 (using 
  .../python2.7-minimal_2.7.8-11_i386.deb) ...
Unpacking replacement python2.7-minimal ...
dpkg: warning: unable to delete old directory '/etc/python2.7': Directory 
  not empty
Selecting previously unselected package libpython2.7-minimal:i386.
Unpacking libpython2.7-minimal:i386 (from 
  .../libpython2.7-minimal_2.7.8-11_i386.deb) ...
Preparing to replace debconf 1.5.49 (using .../debconf_1.5.55_all.deb) ...
/usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not 
  found (required by /usr/bin/python)
dpkg: warning: subprocess old pre-removal script returned error exit 
  status 1
dpkg: trying script from the new package instead ...
/usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not 
  found (required by /usr/bin/python)
dpkg: error processing /var/cache/apt/archives/debconf_1.5.55_all.deb 
  (--unpack):
 subprocess new pre-removal script returned error exit status 1
/usr/bin/python: /lib/i386-linux-gnu/libc.so.6: version `GLIBC_2.15' not 
  found (required by /usr/bin/python)
dpkg: error while cleaning up:
 subprocess installed post-installation script returned error exit status 
  1
Processing triggers for man-db ...
Errors were encountered while processing:
 /var/cache/apt/archives/debconf_1.5.55_all.deb
  
  This looks a bit like python was unpacked before the new glibc.
 
 debconf calls pycompile (and python).  It looks like this kind of thing can
 happen with any binary which needs the new glibc, and in this case it hits 
 python.

The real problem is that python2.7-minimal uses symbols from glibc 2.15,
while it doesn't declare a dependency on them. This is due to a bug in
the Depends/Pre-Depends mangling in debian/rules.
dh_shlibdeps create the following debian/python2.7-minimal.substvars:

| misc:Depends=
| shlibs:Depends=libc6 (= 2.15), libc6 (= 2.3.6-6~), zlib1g (= 1:1.2.0)

Note that libc6 is listed twice. This is not a problem given that
dpkg-gencontrol later merge them. However the order is sometimes
changing, so one might get the following file instead:

| misc:Depends=
| shlibs:Depends=libc6 (= 2.3.6-6~), libc6 (= 2.15), zlib1g (= 1:1.2.0)

This file is later mangled by the following code from debian/rules:

| dep=`sed -n '/^shlibs:Depends/s/.*\(libc6[^,]*\).*/\1/p' 
debian/python2.7-minimal.substvars`; \
| echo shlibs:Pre-Depends=$dep  debian/python2.7-minimal.substvars
| sed -i '/^shlibs:Depends/s/libc6[^,]*[, ]*//' 
debian/python2.7-minimal.substvars

Depending on the above order, dep might equal libc6 (= 2.15) or
libc6 (= 2.3.6-6~). In the latter case, the dependency is incorrect,
leading to the reported bug.

-- 
Aurelien Jarno  GPG: 4096R/1DDD8C9B
aurel...@aurel32.net http://www.aurel32.net


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed (with 1 errors): Re: Bug#778196: No, not fixed

2015-02-28 Thread Debian Bug Tracking System
Processing control commands:

 found 778196 1.6.9-2+deb8u1
Bug #778196 {Done: Benjamin Kaduk ka...@mit.edu} [openafs-modules-dkms] Fails 
to built with current Jessie's kernel
Marked as found in versions openafs/1.6.9-2+deb8u1; no longer marked as fixed 
in versions openafs/1.6.9-2+deb8u1.
 reopen
Unknown command or malformed arguments to command.


-- 
778196: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778196
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#778196: No, not fixed

2015-02-28 Thread Anders Kaseorg
Control: found 778196 1.6.9-2+deb8u1
Control: reopen

Commit a6013738 (Linux: Move code to reset the root to afs/LINUX) is a 
prerequisite of 860764da (Linux: d_alias becomes d_u.d_alias), but the 
former is missing in 1.6.9-2+deb8u1.

Anders


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: found 773315 in subversion/1.0.0-1

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 found 773315 subversion/1.0.0-1
Bug #773315 {Done: James McCoy james...@debian.org} [subversion] subversion: 
CVE-2014-8108
The source subversion and version 1.0.0-1 do not appear to match any binary 
packages
Marked as found in versions subversion/1.0.0-1.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
773315: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773315
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: Re: Bug#779433: perl-modules: upgrade to perl-modules 5.20.2-1 breaks doc-base reconfiguration

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 severity 779433 serious
Bug #779433 [perl-modules] perl-modules: upgrade to perl-modules 5.20.2-1 
breaks doc-base reconfiguration
Severity set to 'serious' from 'important'
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779433: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779433
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#778948: marked as done (e2fsprogs: CVE-2015-1572 buffer overflow)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 19:18:50 +
with message-id e1yrmuy-00016n...@franck.debian.org
and subject line Bug#778948: fixed in e2fsprogs 1.41.12-4+deb6u2
has caused the Debian Bug report #778948,
regarding e2fsprogs: CVE-2015-1572 buffer overflow
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
778948: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778948
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
package: src:e2fsprogs
severity: important
tags: security

A buffer overflow issue was recently fixed for e2fsprogs:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1572

Best wishes,
Mike
---End Message---
---BeginMessage---
Source: e2fsprogs
Source-Version: 1.41.12-4+deb6u2

We believe that the bug you reported is fixed in the latest version of
e2fsprogs, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 778...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz deb...@alteholz.de (supplier of updated e2fsprogs package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sat, 28 Feb 2015 19:00:40 +0100
Source: e2fsprogs
Binary: e2fsck-static libcomerr2 comerr-dev libss2 ss-dev e2fsprogs-udeb 
e2fslibs e2fslibs-dev e2fsprogs e2fsprogs-dbg e2fslibs-dbg libcomerr2-dbg 
libss2-dbg
Architecture: source i386
Version: 1.41.12-4+deb6u2
Distribution: squeeze-lts
Urgency: high
Maintainer: Theodore Y. Ts'o ty...@mit.edu
Changed-By: Thorsten Alteholz deb...@alteholz.de
Description: 
 comerr-dev - common error description library - headers and static libraries
 e2fsck-static - statically-linked version of the ext2/ext3/ext4 filesystem 
checke
 e2fslibs   - ext2/ext3/ext4 file system libraries
 e2fslibs-dbg - debugging information for e2fslibs
 e2fslibs-dev - ext2/ext3/ext4 file system libraries - headers and static 
librari
 e2fsprogs  - ext2/ext3/ext4 file system utilities
 e2fsprogs-dbg - debugging information for e2fsprogs
 e2fsprogs-udeb - stripped-down versions of e2fsprogs, for debian-installer 
(udeb)
 libcomerr2 - common error description library
 libcomerr2-dbg - debugging information for libcomerr2
 libss2 - command-line interface parsing library
 libss2-dbg - debugging information for libss2
 ss-dev - command-line interface parsing library - headers and static libra
Closes: 778948
Changes: 
 e2fsprogs (1.41.12-4+deb6u2) squeeze-lts; urgency=high
 .
   * Non-maintainer upload by the Debian LTS team.
   * Fix CVE-2015-1572: incomplete fix for CVE-2015-0247.
 (closes: #778948)
Checksums-Sha1: 
 f6f9aea37985fcea7d9456773a6d487cb07f4718 1887 e2fsprogs_1.41.12-4+deb6u2.dsc
 f2504142cb805ce4b0fd98e97e40d7f6d39d805a 4795216 
e2fsprogs_1.41.12-4+deb6u2.tar.gz
 561cc9f187e0e5288136c3faa84c90c68ff82b27 454384 
e2fsck-static_1.41.12-4+deb6u2_i386.deb
 4c9c550010e79284d901e119c3edc0b85f165b28 49364 
libcomerr2_1.41.12-4+deb6u2_i386.deb
 dd808969b25ab3bbf031aea1aae079dc69500f30 54084 libss2_1.41.12-4+deb6u2_i386.deb
 7c3bad839baa26e91d04373a6d340954adb437ed 140802 
e2fslibs_1.41.12-4+deb6u2_i386.deb
 c01c235dcd001cbc1f91e7a72551e8ecab64603a 174908 
e2fslibs-dev_1.41.12-4+deb6u2_i386.deb
 3a81794800b01a59e31017279c136d6f78b9ae17 804494 
e2fsprogs_1.41.12-4+deb6u2_i386.deb
 c7b4896c4cdc41a3b019794892f214595d047e64 832472 
e2fsprogs-dbg_1.41.12-4+deb6u2_i386.deb
 24069da47db74cbbd42f1e70d2699a81c294c717 238830 
e2fslibs-dbg_1.41.12-4+deb6u2_i386.deb
 5c775c04ec19e484f047a0414e42e6e79e4603e9 51812 
libcomerr2-dbg_1.41.12-4+deb6u2_i386.deb
 2e3d33361916a90518ebe940a91ab2c286381eae 60424 
libss2-dbg_1.41.12-4+deb6u2_i386.deb
 1b022bb8d93d5aef9ac3c10b6059781cb919b6d7 41930 
comerr-dev_2.1-1.41.12-4+deb6u2_i386.deb
 3d0bb41d19531d5f54d2f8c2417f8aae36ac4ce5 17024 
ss-dev_2.0-1.41.12-4+deb6u2_i386.deb
 37e500a522eec76536e7d04b2c7b290e79cf781d 213748 
e2fsprogs-udeb_1.41.12-4+deb6u2_i386.udeb
Checksums-Sha256: 
 52fe155b51ca543eb2f1aaabe2ba90bf14e3af198f5c163a4b36217e670baa65 1887 
e2fsprogs_1.41.12-4+deb6u2.dsc
 2acf988bb8f30b52069eba97a21b46555751a4b1a03f7cf77b955e343dfd3f0f 4795216 
e2fsprogs_1.41.12-4+deb6u2.tar.gz
 d804b38aec95c160351eea3001d276ff1e1d7380b75749a0ec544bc371761f91 454384 

Bug#778196: No, not fixed

2015-02-28 Thread Dirk Heinrichs

Hi,

installation of 1.6.9-2+deb8u1 produces the following error:

Setting up openafs-modules-dkms (1.6.9-2+deb8u1) ...
Loading new openafs-1.6.9 DKMS files...
Building only for 3.16.0-4-amd64
Building initial module for 3.16.0-4-amd64
Error! Bad return status for module build on kernel: 3.16.0-4-amd64 
(x86_64)
Consult /var/lib/dkms/openafs/1.6.9/build/make.log for more 
information.


make.log attached.

Please reopen.

Thanks...

Dirk

--
Dirk Heinrichs dirk.heinri...@altum.de
Tel: +49 (0)2471 209385 | Mobil: +49 (0)176 34473913
GPG Public Key CB614542 | Jabber: dirk.heinri...@altum.de
Tox: he...@toxme.se
Sichere Internetkommunikation: http://www.retroshare.org
Privacy Handbuch: https://www.privacy-handbuch.de

DKMS make.log for openafs-1.6.9 for kernel 3.16.0-4-amd64 (x86_64)
Sa 28. Feb 20:48:36 CET 2015
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
/var/lib/dkms/openafs/1.6.9/build/build-tools/missing: Unknown `--is-lightweight' option
Try `/var/lib/dkms/openafs/1.6.9/build/build-tools/missing --help' for more information
configure: WARNING: 'missing' script is too old or missing
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking for style of include used by make... GNU
checking dependency style of gcc... none
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for flex... no
checking for lex... no
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking for libxslt... no
checking for saxon... no
checking for xalan-j... no
checking for xsltproc... xsltproc
checking for docbook2pdf... no
checking for dblatex... dblatex
checking for library containing strerror... none required
checking for pid_t... yes
checking for size_t... yes
checking whether ln -s works... yes
checking for ranlib... ranlib
checking for bison... no
checking for byacc... no
checking if lex is flex... no
checking whether byte order is known at compile time... yes
checking whether byte ordering is bigendian... no
checking whether printf understands the %z length modifier... yes
checking your OS... linux
checking if gcc accepts -march=pentium... no
checking if gcc needs -fno-strength-reduce... yes
checking if gcc needs -fno-strict-aliasing... yes
checking if gcc supports -fno-common... yes
checking if gcc supports -pipe... yes
checking if linux kbuild requires EXTRA_CFLAGS... yes
checking for linux kernel module build works... yes
checking for linux/config.h... no
checking for linux/completion.h... yes
checking for linux/exportfs.h... yes
checking for linux/freezer.h... yes
checking for linux/key-type.h... yes
checking for linux/semaphore.h... yes
checking for linux/seq_file.h... yes
checking for struct vfs_path... no
checking for kuid_t... yes
checking for write_begin in struct address_space_operations... yes
checking for name in struct backing_dev_info... yes
checking for session_keyring in struct cred... yes
checking for ctl_name in struct ctl_table... no
checking for d_u.d_alias in struct dentry... yes
checking for d_automount in struct dentry_operations... yes
checking for i_alloc_sem in struct inode... no
checking for i_blkbits in struct inode... yes
checking for i_blksize in struct inode... no
checking for i_mutex in struct inode... yes
checking for i_security in struct inode... yes
checking for flock in struct file_operations... yes
checking for iterate in struct file_operations... yes
checking for read_iter in struct file_operations... yes
checking for sendfile in struct file_operations... no
checking for mount in struct file_system_type... yes
checking for truncate in struct inode_operations... no
checking for preparse in struct key_type... yes
checking for instantiate_prep in struct key_type... no
checking for path in struct nameidata... yes
checking for owner in struct 

Bug#755655: marked as done (django-oauth-plus: Please ensure it works with Django 1.7)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:36:48 +
with message-id e1yrp44-0001jp...@franck.debian.org
and subject line Bug#779446: Removed package(s) from unstable
has caused the Debian Bug report #755655,
regarding django-oauth-plus: Please ensure it works with Django 1.7
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
755655: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=755655
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Source: django-oauth-plus
Version: 2.2.4-2
Severity: important
User: python-dja...@packages.debian.org
Usertags: django17

Hello,

your package django-oauth-plus depends on python-django. As you might
know, Django 1.7 will be soon available and as each new upstream major
version, it brings many changes, some of them which are backwards
incompatible (after a deprecation period covering 2 major versions):
https://docs.djangoproject.com/en/1.7/releases/1.7/
https://docs.djangoproject.com/en/1.7/releases/1.7/#backwards-incompatible-changes-in-1-7

We intend to upload Django 1.7 to unstable as soon as it is available
because we really want the latest version in jessie and the freeze is
approaching fast. In preparation of that, I have uploaded a release
candidate in experimental.

Please test your package against Django 1.7 in experimental. If a new
upstream version of your package is required, please package it now.
If you can't upload it to unstable because it only works with Django 1.7,
feel free to upload it to experimental too.

If the current package works fine, please close this bug (or retitle it as
a suggestion to implement Python 3 support and drop its severity to
wishlist[1]). If it's broken, please tag it as confirmed. If it's not
broken, but would benefit from further work, please tag it as confirmed
but reduce the severity.

If you have experimental in your sources.list you can install the latest
version easily:
$ sudo apt-get install -t experimental python-django python3-django

[1] We have recently added Python 3 support with the addition of
python3-django. Consider doing the same if your package is a Django
application/library.

Thank you for your help!

PS: I will raise the confirmed bugs that are still of severity
important to serious once we upload Django 1.7 to unstable.
---End Message---
---BeginMessage---
Version: 2.2.4-2+rm

Dear submitter,

as the package django-oauth-plus has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779446

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#758386: marked as done (depends on insecure and unmaintained python-oauth2)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:36:48 +
with message-id e1yrp44-0001jp...@franck.debian.org
and subject line Bug#779446: Removed package(s) from unstable
has caused the Debian Bug report #758386,
regarding depends on insecure and unmaintained python-oauth2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
758386: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758386
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Source: django-oauth-plus
Version: 2.2.4-2
Severity: Grave

This package depends on python-oauth2 which has unresolved security issues
(#722656, #722657), no longer available in testing, and no longer
maintained upstream.

django-oauth-plus needs to be updated (if possible) to use python-oauthlib
instead.

See http://lists.debian.org/52f86a59.9000...@debian.org
-- 
Brian May br...@microcomaustralia.com.au
---End Message---
---BeginMessage---
Version: 2.2.4-2+rm

Dear submitter,

as the package django-oauth-plus has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779446

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#722656: marked as done (python-oauth2: CVE-2013-4346: _check_signature() ignores the nonce value when validating signed urls)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:39:32 +
with message-id e1yrp6i-0001tx...@franck.debian.org
and subject line Bug#779421: Removed package(s) from unstable
has caused the Debian Bug report #722656,
regarding python-oauth2: CVE-2013-4346: _check_signature() ignores the nonce 
value when validating signed urls
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
722656: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722656
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: python-oauth2
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for python-oauth2.

CVE-2013-4346[0]:
_check_signature() ignores the nonce value when validating signed urls

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities  Exposures) id in your changelog entry.

Fixes upstream are not available so far.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4346
http://security-tracker.debian.org/tracker/CVE-2013-4346
[1] http://www.openwall.com/lists/oss-security/2013/09/12/7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
---End Message---
---BeginMessage---
Version: 1.5.211-2+rm

Dear submitter,

as the package python-oauth2 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779421

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#722657: marked as done (python-oauth2: CVE-2013-4347: Uses poor PRNG)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:39:32 +
with message-id e1yrp6i-0001tx...@franck.debian.org
and subject line Bug#779421: Removed package(s) from unstable
has caused the Debian Bug report #722657,
regarding python-oauth2: CVE-2013-4347: Uses poor PRNG
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
722657: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722657
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: python-oauth2
Version: 1.5.211-2
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for python-oauth2.

CVE-2013-4347[0]:
Uses poor PRNG

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities  Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4347
http://security-tracker.debian.org/tracker/CVE-2013-4347
[1] https://github.com/simplegeo/python-oauth2/issues/9

Regards,
Salvatore
---End Message---
---BeginMessage---
Version: 1.5.211-2+rm

Dear submitter,

as the package python-oauth2 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779421

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#758389: marked as done (depends on insecure and unmaintained python-oauth2)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 21:38:43 +
with message-id e1yrp5v-0001pq...@franck.debian.org
and subject line Bug#779448: Removed package(s) from unstable
has caused the Debian Bug report #758389,
regarding depends on insecure and unmaintained python-oauth2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
758389: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758389
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Source: turses
Version: 2.3.14-1
Severity: Grave

This package depends on python-oauth2 which has unresolved security issues
(#722656, #722657), no longer available in testing, and no longer
maintained upstream.

turses needs to be updated (if possible) to use python-oauthlib instead.

See http://lists.debian.org/52f86a59.9000...@debian.org
-- 
Brian May br...@microcomaustralia.com.au
---End Message---
---BeginMessage---
Version: 0.2.20-1+rm

Dear submitter,

as the package turses has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/779448

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)---End Message---


Bug#776816: Acknowledgement (firmware-realtek: fails to connect after a few suspends (or some uptime?))

2015-02-28 Thread Ben Hutchings
Control: severity -1 normal
Control: notfixed -1 0.36+wheezy.1

On Wed, 2015-02-18 at 23:25 -0500, Antoine Beaupré wrote:
 Control: severity -1 grave
 Control: fixed -1 0.36+wheezy.1
 
 I am now pretty sure this is a bug, a regression, even, in the realtek
 firmware. I downgraded to the wheezy version 4 days ago, and problems
 went away (hence the fixed above). Now that I upgraded again, problems
 are back.
[...]

The rtl8192ce firmware (rtl8192cfw.bin, rtl8192cfwU.bin and
rtl8192cfwU_B.bin for various versions of the chip) has not been changed
since version 0.36+wheezy.1 of the package.  So this problem is not a
regression.

Ben.

-- 
Ben Hutchings
friends: People who know you well, but like you anyway.


signature.asc
Description: This is a digitally signed message part


Processed: Re: Bug#776816: Acknowledgement (firmware-realtek: fails to connect after a few suspends (or some uptime?))

2015-02-28 Thread Debian Bug Tracking System
Processing control commands:

 severity -1 normal
Bug #776816 [firmware-realtek] firmware-realtek: fails to connect after a few 
suspends (or some uptime?)
Severity set to 'normal' from 'grave'
 notfixed -1 0.36+wheezy.1
Bug #776816 [firmware-realtek] firmware-realtek: fails to connect after a few 
suspends (or some uptime?)
No longer marked as fixed in versions firmware-nonfree/0.36+wheezy.1.

-- 
776816: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776816
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#776525: marked as done (scilab: failed to build on ppc64el)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 23:04:39 +
with message-id e1yrqr5-0003ey...@franck.debian.org
and subject line Bug#776525: fixed in scilab 5.5.1-6
has caused the Debian Bug report #776525,
regarding scilab: failed to build on ppc64el
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
776525: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776525
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
package: src:scilab
version: 5.5.1-5
severity: serious

The latest upload failed to build on the ppc64el buildd:
https://buildd.debian.org/status/package.php?p=scilab

Best wishes,
Mike
---End Message---
---BeginMessage---
Source: scilab
Source-Version: 5.5.1-6

We believe that the bug you reported is fixed in the latest version of
scilab, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 776...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sébastien Villemot sebast...@debian.org (supplier of updated scilab package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sat, 28 Feb 2015 22:47:24 +0100
Source: scilab
Binary: scilab-cli scilab scilab-data scilab-include scilab-minimal-bin 
scilab-full-bin scilab-minimal-bin-dbg scilab-full-bin-dbg scilab-doc 
scilab-doc-fr scilab-doc-pt-br scilab-doc-ja scilab-test
Architecture: source all amd64
Version: 5.5.1-6
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Team 
debian-science-maintain...@lists.alioth.debian.org
Changed-By: Sébastien Villemot sebast...@debian.org
Description:
 scilab - Scientific software package for numerical computations
 scilab-cli - Scientific software package - Command Line Interpreter
 scilab-data - Scientific software package for numerical computations (data file
 scilab-doc - Scientific software package (english documentations)
 scilab-doc-fr - Scientific software package (french documentation)
 scilab-doc-ja - Scientific software package (Japanese documentation)
 scilab-doc-pt-br - Scientific software package (Brazilian Portuguese 
documentation)
 scilab-full-bin - Scientific software package for numerical computations (all 
binar
 scilab-full-bin-dbg - Scientific software package (scilab debugging symbols)
 scilab-include - Scientific software package for numerical computations 
(include f
 scilab-minimal-bin - Scientific software package for numerical computations 
(minimal b
 scilab-minimal-bin-dbg - Scientific software package (scilab-cli debugging 
symbols)
 scilab-test - Scientific software package for numerical computations (test file
Closes: 776525
Changes:
 scilab (5.5.1-6) unstable; urgency=medium
 .
   * Team upload.
   * Readd m4-java-ppc64el.patch in d/patches/series. It had been
 mistakenly removed in the previous upload. This fixes the FTBFS on
 ppc64el. (Closes: #776525)
   * Fix a mistake in the above patch concerning bin/scilab. The machine
 name (output of 'uname -m') is ppc64le and not ppc64el. This error
 was making scilab unable to start on ppc64el.
Checksums-Sha1:
 3f84e32872117b006b562ce4c58e8745aab265fc 3958 scilab_5.5.1-6.dsc
 8b543cf12779ec986b2d6114a8211d6240e20063 40492 scilab_5.5.1-6.debian.tar.xz
 72c7df4b35093418fd8206ed26f52c03d385597c 510314 scilab-cli_5.5.1-6_all.deb
 6084b10184802bd39d3ea19242c8fc268e45fe86 82424 scilab_5.5.1-6_all.deb
 80a3444ce96d5de93e3f792bccf0cd9df168386d 35052018 scilab-data_5.5.1-6_all.deb
 cd52f9f21f5b2090362737cc37461fa011383081 7984400 scilab-doc_5.5.1-6_all.deb
 7adb0e4942c64b28d9f6c83679612581e12730d3 7279594 scilab-doc-fr_5.5.1-6_all.deb
 7a6d0a8464a96838afee5f3362aa17e7c87ce91a 7101116 
scilab-doc-pt-br_5.5.1-6_all.deb
 3cef5c74ff8e8a8f0dc06726b42d22782b9042f7 7536060 scilab-doc-ja_5.5.1-6_all.deb
 3b52ece6cb2d2b3dccb60445ec08d57fd429 13855924 scilab-test_5.5.1-6_all.deb
 d5d3715551b0fd13ddf0e90c68b9a722c82304c7 130770 
scilab-include_5.5.1-6_amd64.deb
 5175285cb2b0637159eb4bb47918935989b6be91 2579354 
scilab-minimal-bin_5.5.1-6_amd64.deb
 9c3037ee0ad892d245f0cf1c790c4d88e26cee8d 1509720 
scilab-full-bin_5.5.1-6_amd64.deb
 ea1ba958384cee19c42764be7cf89a74fa0395c3 5012946 
scilab-minimal-bin-dbg_5.5.1-6_amd64.deb
 

Processed: Re: Processed: Re: Processed (with 1 errors): Re: Bug#778196: No, not fixed

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 fixed 778196 1.6.10-4
Bug #778196 [openafs-modules-dkms] Fails to built with current Jessie's kernel
Marked as fixed in versions openafs/1.6.10-4.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
778196: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778196
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: tagging 779119, tagging 779120

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 779119 + pending
Bug #779119 [shorewall] shorewall: depend on perl instead of perl-modules
Added tag(s) pending.
 tags 779120 + pending
Bug #779120 [shorewall-core] shorewall-core: depend on perl instead of 
perl-modules
Added tag(s) pending.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779119: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779119
779120: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779120
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: Re: Processed (with 1 errors): Re: Bug#778196: No, not fixed

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 reopen 778196
Bug #778196 {Done: Benjamin Kaduk ka...@mit.edu} [openafs-modules-dkms] Fails 
to built with current Jessie's kernel
'reopen' may be inappropriate when a bug has been closed with a version;
all fixed versions will be cleared, and you may need to re-add them.
Bug reopened
No longer marked as fixed in versions openafs/1.6.10-4.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
778196: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778196
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#763148: Prevent migration to jessie

2015-02-28 Thread ciryat

Andreas,

how about leaving all these package conflicts and quarrels (that already 
waste enough time of thousands of developers) behind and just use 
0install, which is a /distributed/ package management system (supporting 
all POSIX + Windows with one and only one package).


http://0install.net/0install-2.0.html
Or directly from git.
https://github.com/0install/0install

Or install 0install from the package repositories of (most) distros.

There are many examples on the webpage. As an example, see
https://github.com/ryppl/boost-zero

For common questions and answers of a dialogue with a package manager 
research group (Mancoosi), see:

http://thread.gmane.org/gmane.comp.file-systems.zero-install.devel/2322

Kind regards,
Jan


Processed: scummvm: fails to work on armhf, ARM ASM is buggy [PATCH]

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tags 779029 confirmed
Bug #779029 [scummvm] scummvm: fails to work on armhf, ARM ASM is buggy [PATCH]
Added tag(s) confirmed.
 owner 779029 !
Bug #779029 [scummvm] scummvm: fails to work on armhf, ARM ASM is buggy [PATCH]
Owner recorded as Markus Koschany a...@gambaru.de.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
779029: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779029
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#779443: debdry: missing dependency on python3-apt

2015-02-28 Thread Antonio Terceiro
Package: debdry
Version: 0.2-1
Severity: serious
Justification: Policy 3.5

debdry is missing a dependency on python3-apt. All the bits seems to be
in place, and I don't understand stdeb enough to figure out what's
wrong. python3-apt is just not being included in ${python3:Depends}.

-- System Information:
Debian Release: 8.0
  APT prefers buildd-unstable
  APT policy: (500, 'buildd-unstable'), (500, 'unstable'), (500, 'testing'), 
(1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=pt_BR.UTF-8, LC_CTYPE=pt_BR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages debdry depends on:
ii  python3  3.4.2-2
pn  python3:any  none

debdry recommends no packages.

debdry suggests no packages.

-- no debconf information

-- 
Antonio Terceiro terce...@debian.org


signature.asc
Description: Digital signature


Bug#778387: marked as done (cups: CVE-2014-9679)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 18:02:07 +
with message-id e1yrlij-0008vv...@franck.debian.org
and subject line Bug#778387: fixed in cups 1.5.3-5+deb7u5
has caused the Debian Bug report #778387,
regarding cups: CVE-2014-9679
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
778387: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778387
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: cups
Severity: grave
Tags: security

This was assigned CVE-2014-9679 and is fixed in experimental
already: https://www.cups.org/str.php?L4551

Cheers,
Moritz
---End Message---
---BeginMessage---
Source: cups
Source-Version: 1.5.3-5+deb7u5

We believe that the bug you reported is fixed in the latest version of
cups, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 778...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Didier Raboud o...@debian.org (supplier of updated cups package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Tue, 17 Feb 2015 08:24:04 +0100
Source: cups
Binary: libcups2 libcupsimage2 libcupscgi1 libcupsdriver1 libcupsmime1 
libcupsppdc1 cups cups-client libcups2-dev libcupsimage2-dev libcupscgi1-dev 
libcupsdriver1-dev libcupsmime1-dev libcupsppdc1-dev cups-bsd cups-common 
cups-ppdc cups-dbg cupsddk
Architecture: source all amd64
Version: 1.5.3-5+deb7u5
Distribution: wheezy-security
Urgency: high
Maintainer: Debian Printing Team debian-print...@lists.debian.org
Changed-By: Didier Raboud o...@debian.org
Description: 
 cups   - Common UNIX Printing System(tm) - server
 cups-bsd   - Common UNIX Printing System(tm) - BSD commands
 cups-client - Common UNIX Printing System(tm) - client programs (SysV)
 cups-common - Common UNIX Printing System(tm) - common files
 cups-dbg   - Common UNIX Printing System(tm) - debugging symbols
 cups-ppdc  - Common UNIX Printing System(tm) - PPD manipulation utilities
 cupsddk- Common UNIX Printing System (transitional package)
 libcups2   - Common UNIX Printing System(tm) - Core library
 libcups2-dev - Common UNIX Printing System(tm) - Development files CUPS library
 libcupscgi1 - Common UNIX Printing System(tm) - CGI library
 libcupscgi1-dev - Common UNIX Printing System(tm) - Development files for CGI 
libra
 libcupsdriver1 - Common UNIX Printing System(tm) - Driver library
 libcupsdriver1-dev - Common UNIX Printing System(tm) - Development files 
driver librar
 libcupsimage2 - Common UNIX Printing System(tm) - Raster image library
 libcupsimage2-dev - Common UNIX Printing System(tm) - Development files CUPS 
image li
 libcupsmime1 - Common UNIX Printing System(tm) - MIME library
 libcupsmime1-dev - Common UNIX Printing System(tm) - Development files MIME 
library
 libcupsppdc1 - Common UNIX Printing System(tm) - PPD manipulation library
 libcupsppdc1-dev - Common UNIX Printing System(tm) - Development files PPD 
library
Closes: 778387
Changes: 
 cups (1.5.3-5+deb7u5) wheezy-security; urgency=high
 .
   * Backport upstream patch to fix cupsRasterReadPixels buffer overflow with
 invalid page header and compressed raster data
 (CVE-2014-9679, STR: #4551, Closes: #778387)
Checksums-Sha1: 
 4c0b2b9e3a5cad48ef07ad2bd7b69ed135b2f5b4 3260 cups_1.5.3-5+deb7u5.dsc
 9277e6ebd9ca55ec1a63598ecf972dd5de7794f3 376371 
cups_1.5.3-5+deb7u5.debian.tar.gz
 eb8a51fcfe4809a867b25c2245fce04fd1d2abcc 903580 
cups-common_1.5.3-5+deb7u5_all.deb
 4b03c9687a5374abca5282b23cfdec5614dd152c 87268 cupsddk_1.5.3-5+deb7u5_all.deb
 81b3b671ca4e60b8cc9ff4c0720c5c187b1753c9 255574 
libcups2_1.5.3-5+deb7u5_amd64.deb
 2d830c3caaeb9e198c46d6c5687b811a53d4f90d 137942 
libcupsimage2_1.5.3-5+deb7u5_amd64.deb
 df9683bd74fff75b9780fe7ca2254c192a4eade1 116216 
libcupscgi1_1.5.3-5+deb7u5_amd64.deb
 0d2e4a1d9097c45f147baf1739c2b36b30809fa3 104184 
libcupsdriver1_1.5.3-5+deb7u5_amd64.deb
 f3bae337c4730dc1ca83412ee398b258a107531c 99156 
libcupsmime1_1.5.3-5+deb7u5_amd64.deb
 571a1bf5ceec034878203807db9ea2be2bbbfdff 139358 
libcupsppdc1_1.5.3-5+deb7u5_amd64.deb
 b592b13fd4a6f324ec4f9001738a04ab37ac21c6 1402126 cups_1.5.3-5+deb7u5_amd64.deb
 fd38d1b0b13e0c9e017d1e7c28b574306c0d303a 

Bug#777197: marked as done (glibc: CVE-2015-1472 CVE-2015-1473)

2015-02-28 Thread Debian Bug Tracking System
Your message dated Sat, 28 Feb 2015 18:02:32 +
with message-id e1yrlii-6d...@franck.debian.org
and subject line Bug#777197: fixed in eglibc 2.13-38+deb7u8
has caused the Debian Bug report #777197,
regarding glibc: CVE-2015-1472 CVE-2015-1473
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
777197: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777197
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: glibc
Severity: grave
Tags: security
Justification: user security hole

Hi,
please see https://sourceware.org/bugzilla/show_bug.cgi?id=16618
The patch is here: 
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06

This was introduced by 
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=3f8cc204fdd0
(2.15). Since the patch was backported into wheezy, it is also
affected (while squeeze is not).

Cheers,
Moritz
---End Message---
---BeginMessage---
Source: eglibc
Source-Version: 2.13-38+deb7u8

We believe that the bug you reported is fixed in the latest version of
eglibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 777...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno aure...@debian.org (supplier of updated eglibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Format: 1.8
Date: Sun, 22 Feb 2015 09:49:50 +0100
Source: eglibc
Binary: libc-bin libc-dev-bin glibc-doc eglibc-source locales locales-all nscd 
multiarch-support libc6 libc6-dev libc6-dbg libc6-prof libc6-pic libc6-udeb 
libc6.1 libc6.1-dev libc6.1-dbg libc6.1-prof libc6.1-pic libc6.1-udeb libc0.3 
libc0.3-dev libc0.3-dbg libc0.3-prof libc0.3-pic libc0.3-udeb libc0.1 
libc0.1-dev libc0.1-dbg libc0.1-prof libc0.1-pic libc0.1-udeb libc6-i386 
libc6-dev-i386 libc6-sparc64 libc6-dev-sparc64 libc6-s390 libc6-dev-s390 
libc6-s390x libc6-dev-s390x libc6-amd64 libc6-dev-amd64 libc6-powerpc 
libc6-dev-powerpc libc6-ppc64 libc6-dev-ppc64 libc6-mipsn32 libc6-dev-mipsn32 
libc6-mips64 libc6-dev-mips64 libc0.1-i386 libc0.1-dev-i386 libc6-i686 
libc6-xen libc0.1-i686 libc0.3-i686 libc0.3-xen libc6.1-alphaev67 
libc6-loongson2f libnss-dns-udeb libnss-files-udeb
Architecture: source all
Version: 2.13-38+deb7u8
Distribution: wheezy-security
Urgency: medium
Maintainer: GNU Libc Maintainers debian-gl...@lists.debian.org
Changed-By: Aurelien Jarno aure...@debian.org
Description: 
 eglibc-source - Embedded GNU C Library: sources
 glibc-doc  - Embedded GNU C Library: Documentation
 libc-bin   - Embedded GNU C Library: Binaries
 libc-dev-bin - Embedded GNU C Library: Development binaries
 libc0.1- Embedded GNU C Library: Shared libraries
 libc0.1-dbg - Embedded GNU C Library: detached debugging symbols
 libc0.1-dev - Embedded GNU C Library: Development Libraries and Header Files
 libc0.1-dev-i386 - Embedded GNU C Library: 32bit development libraries for 
AMD64
 libc0.1-i386 - Embedded GNU C Library: 32bit shared libraries for AMD64
 libc0.1-i686 - Embedded GNU C Library: Shared libraries [i686 optimized]
 libc0.1-pic - Embedded GNU C Library: PIC archive library
 libc0.1-prof - Embedded GNU C Library: Profiling Libraries
 libc0.1-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libc0.3- Embedded GNU C Library: Shared libraries
 libc0.3-dbg - Embedded GNU C Library: detached debugging symbols
 libc0.3-dev - Embedded GNU C Library: Development Libraries and Header Files
 libc0.3-i686 - Embedded GNU C Library: Shared libraries [i686 optimized]
 libc0.3-pic - Embedded GNU C Library: PIC archive library
 libc0.3-prof - Embedded GNU C Library: Profiling Libraries
 libc0.3-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libc0.3-xen - Embedded GNU C Library: Shared libraries [Xen version]
 libc6  - Embedded GNU C Library: Shared libraries
 libc6-amd64 - Embedded GNU C Library: 64bit Shared libraries for AMD64
 libc6-dbg  - Embedded GNU C Library: detached debugging symbols
 libc6-dev  - Embedded GNU C Library: Development Libraries and Header Files
 libc6-dev-amd64 - Embedded GNU C Library: 64bit Development Libraries for AMD64
 libc6-dev-i386 - Embedded GNU C 

Bug#779029: tagged as pending

2015-02-28 Thread Markus Koschany
tag 779029 pending
--

We believe that the bug #779029 you reported has been fixed in the Git
repository. You can see the commit message below and/or inspect the
commit contents at:

http://anonscm.debian.org/cgit/pkg-games/scummvm.git/diff/?id=78ee8c2

(This message was generated automatically by
 'git-post-receive-tag-pending-commitmsg' hook).
---
commit 78ee8c2d5fb965bd52d206989f98726902c48bf9
Author: Markus Koschany a...@gambaru.de
Date:   Sat Feb 28 18:46:31 2015 +0100

Add disable-arm-asm.patch

Closes: #779029
Thanks: Konstantinos Margaritis mar...@freevec.org for the report and 
patch
and Vagrant Cascadian for further testing.


-- 
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: Bug#779029 tagged as pending

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tag 779029 pending
Bug #779029 [scummvm] scummvm: fails to work on armhf, ARM ASM is buggy [PATCH]
Added tag(s) pending.
 --
Stopping processing here.

Please contact me if you need assistance.
-- 
779029: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779029
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Processed: reassign 773445 to initramfs-tools, forcibly merging 770912 773445

2015-02-28 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 reassign 773445 initramfs-tools
Bug #773445 [src:linux] linux-image-3.18.0-trunk-686-pae fails to boot from 
encrypted usb drive
Bug reassigned from package 'src:linux' to 'initramfs-tools'.
No longer marked as found in versions linux/3.18-1~exp1.
Ignoring request to alter fixed versions of bug #773445 to the same values 
previously set
 forcemerge 770912 773445
Bug #770912 [initramfs-tools] initramfs-tools: Add xhci-pci to base modules 
(linux 3.18)
Bug #773445 [initramfs-tools] linux-image-3.18.0-trunk-686-pae fails to boot 
from encrypted usb drive
Severity set to 'normal' from 'critical'
Marked as found in versions initramfs-tools/0.116.
Added tag(s) patch.
Bug #770912 [initramfs-tools] initramfs-tools: Add xhci-pci to base modules 
(linux 3.18)
Added tag(s) upstream.
Merged 770912 773445
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
770912: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770912
773445: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773445
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#779468: apt-spy: creates an invalid sources list

2015-02-28 Thread Manolo Díaz
Package: apt-spy
Version: 3.2.2-1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

After showing a lot of lines like

Couldn't find country AT . Skipping.
Couldn't find country AU . Skipping.
Couldn't find country BE . Skipping.
...

your package creates a sources list file without any mirror. Example:

deb (null) testing main #contrib non-free
deb-src (null) testing main #contrib non-free


Also, it fails to update the mirror list due the the lack of
http://http.us.debian.org/debian/README.mirrors.txt

Best Regards,
Manolo Díaz

-- System Information:
Debian Release: 8.0
Architecture: amd64 (x86_64)

Kernel: Linux 3.19.0+ (SMP w/2 CPU cores)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages apt-spy depends on:
ii  libc6 2.19-15
ii  libcurl3  7.38.0-4

apt-spy recommends no packages.

apt-spy suggests no packages.

-- no debconf information


--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#777511: linux-image-3.16: md: bug with re-adding a partially recovered device to a mirror

2015-02-28 Thread Ben Hutchings
On Mon, 2015-02-09 at 01:18 +, Cyril Vechera wrote:
 Package: src:linux
 Version: 3.16.7-ckt4-3
 Severity: important
 File: linux-image-3.16
 Tags: upstream
 
 Dear Maintainer,
 
 For an md mirror with bitmap, when re-adding a device that was
 previously detached during recovery, new recovery starts from the offset
 of last recovery. If there were any writes to the mirror before that
 recovery offset during device was detaching, they will be stored only on
 the present part of mirror and will be ignored on the re-added device. 
 
 Bug is detected on following kernels:
   * 3.16 kernel / Debian 8
   * 3.16 kernel / Ubuntu 14.10.
 
 Bug is not detected on following kernels:
   * 3.2 kernel / Debian 7
   * 3.13.0-27-generic kernel / Ubuntu 14.04
   * 3.19.0-rc4 kernel from mainline

Sorry for the delay in replying to this, and thanks very much for the
test script.

I agree with your results for Debian 3.2- and 3.16-based kernel
packages. However I was also able to reproduce this on Debian's version
3.19-1~exp1.  I then bisected our package versions and found that his
seems to be a regression between 3.12-1~exp1 and 3.12.3-1~exp1.

I don't know why you couldn't reproduce this on 3.13 or 3.19-rc4.

Anyway, if this was really a regression between 3.12 and 3.12.3 then
this commit is most likely to blame:

commit 52df633c9c9c92264e04e1ead9290e5192a8768e
Author: NeilBrown ne...@suse.de
Date:   Thu Nov 28 10:34:18 2013 +1100

md: test mddev-flags more safely in md_check_recovery.

commit 142d44c310819e1965ca70b4d55d7679f5797e25 upstream.

However, reverting that didn't fix the bug for me.

Have you reported this upstream yet?

Ben.

-- 
Ben Hutchings
Absolutum obsoletum. (If it works, it's out of date.) - Stafford Beer


signature.asc
Description: This is a digitally signed message part