Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-04 Thread Alexander Wirt
Salvatore Bonaccorso schrieb am Sunday, den 03. March 2013: Control: tags -1 + patch Hi Alex On Sat, Feb 23, 2013 at 01:19:14PM +0100, Alexander Wirt wrote: On Sat, 23 Feb 2013, Salvatore Bonaccorso wrote: On Sat, Feb 23, 2013 at 08:33:20AM +0100, Salvatore Bonaccorso wrote: In

Bug#702217: CVE-2013-1812: DoS

2013-03-04 Thread Moritz Muehlenhoff
Package: ruby-openid Severity: grave Tags: security Justification: user security hole This was assigned CVE-2013-1812: https://github.com/openid/ruby-openid/pull/43 Patch: https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed Cheers, Moritz -- To

Processed: Re: Bug#698562: pdns-backend-{my, pg}sql: fails to upgrade from squeeze: mysqldump: Got error: 1049: Unknown database 'pdns' when selecting the database

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: severity #698562 wishlist Bug #698562 [pdns-backend-mysql,pdns-backend-pgsql] pdns-backend-{my, pg}sql: fails to upgrade from squeeze: mysqldump: Got error: 1049: Unknown database 'pdns' when selecting the database Severity set to 'wishlist'

Bug#698562: pdns-backend-{my, pg}sql: fails to upgrade from squeeze: mysqldump: Got error: 1049: Unknown database 'pdns' when selecting the database

2013-03-04 Thread Marc Haber
severity #698562 wishlist retitle #698562 upgrade from squeeze = wheezy fails if database has not been created before the upgrade thanks Hi Andreas, thanks for reacting so fast. On Sun, Mar 03, 2013 at 09:52:18PM +0100, Andreas Beckmann wrote: On 2013-03-03 21:28, Marc Haber wrote:

Bug#690067: Bug#702195: symlink conffiles are not supported, causing problems for dpkg on upgrade/removal and incorrect debsums reports

2013-03-04 Thread Julien Cristau
On Sun, Mar 3, 2013 at 22:53:50 +0100, Michael Biebl wrote: found 690067 3.3.5-3 thanks I quickly talked to algernon on IRC and did let him know that the proposed fix to use real conffiles for the systemd symlinks is not good. symlinks in .wants directories should never be real files.

Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread Piotr Pokora
Hi! So, php5-midgard2 would need just a rebuild to pick up the new library name, together with uploading of midgard2-core. The mentors link of php5-midgard2 has expired, but if I recall correctly Piotr had only indeed put it there with a changelog entry like rebuild, so there are no actual

Bug#702221: php5: CVE-2013-1635 CVE-2013-1643

2013-03-04 Thread Moritz Muehlenhoff
Package: php5 Severity: grave Tags: security Justification: user security hole Hi, two issues have been reported in php5. CVE-2013-1635 doesn't classify as a security issue per the Debian Security policy, but if the fix is non-intrusive we could include it nonetheless: CVE-2013-1643

Bug#701227: [Pkg-nagios-devel] Bug#701227: nagios-nrpe: CVE-2013-1362: allows the passing of $() as command arguments to execute shell commands

2013-03-04 Thread Salvatore Bonaccorso
Hey Alex On Mon, Mar 04, 2013 at 09:06:52AM +0100, Alexander Wirt wrote: [...] In fact it looks like the patch on my disk :). I am sorry for not handling this earlier, but our new bathroom took my whole spare time in the last weeks. It should be better this week. Okay and thank you!

Processed: your mail

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: found 702005 2.7.3-7+b1 Bug #702005 [python2.7] libpython2.7: Upgrade to libpython2.7 2.7.3-7 fails, breaking python entirely Ignoring request to alter found versions of bug #702005 to the same values previously set thanks Stopping processing

Bug#701897: CVE-2012-5667: buffer overflow with overly long input lines

2013-03-04 Thread Raphael Geissert
Hi, The issue can easily be reproduced on an x86_64 system running squeeze with the public reproducer. Valgrind also shows the issue (but beware of the time and memory it takes). Cheers, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net -- To UNSUBSCRIBE, email to

Bug#701814: Re: Bug#701814: os-prober: damages XFS exported via iSCSI but not mounted locally; potential data loss

2013-03-04 Thread Balint Reczey
Hi, On 02/27/2013 05:28 PM, Torsten Jerzembeck wrote: Julien Cristau wrote: On Wed, Feb 27, 2013 at 13:41:45 +0100, Torsten Jerzembeck wrote: Package: os-prober Version: 1.42 Severity: grave Justification: causes non-serious data loss While updating the kernel on a storage server

Processed: Re: Bug#674908: [sparc] iceweasel: JavaScript crash on some sites

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: # http://bugs.debian.org/674908#33 found 674908 10.0.12esr-1 Bug #674908 [iceweasel] [sparc] iceweasel: JavaScript crash on some sites Marked as found in versions iceweasel/10.0.12esr-1. thanks Stopping processing here. Please contact me if you

Bug#702234: gnome-shell: Screen lock delayed on password prompt

2013-03-04 Thread Asterix
Package: gnome-shell Version: 3.4.2-7 Severity: grave Tags: security Justification: user security hole Dear Maintainer, I tried to type in the password for an encrypted wireless network, and pressed enter. I then closed my lid, expecting it to lock the screen and suspend. It did suspend, but

Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread intrigeri
Hi Timo and Piotr, Timo Jyrinki wrote (04 Mar 2013 07:41:40 GMT) : So, php5-midgard2 would need just a rebuild to pick up the new library name, together with uploading of midgard2-core. Thank you for the prompt clarification! Just to clarify even further, would a binNMU be enough? (The

Processed (with 1 errors): reassign 702038 to src:linux, merging 702038 573483

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: reassign 702038 src:linux 3.8-1~experimental.1 Bug #702038 [src:linux-headers-3.8-trunk-amd64] linux-headers-3.8-trunk-amd64: this package depends on linux-kbuild-3.8, which isn't available Warning: Unknown package

Bug#701792: PHP extension installed to wrong directory

2013-03-04 Thread Ondřej Surý
Uploaded to DELAYED/5. On Mon, Mar 4, 2013 at 8:42 AM, Ondřej Surý ond...@debian.org wrote: Sebastian, thanks for the patch. Are you willing to NMU? Or I can do it (as the last time). Ondrej On Mon, Mar 4, 2013 at 12:13 AM, Sebastian Ramacher sramac...@debian.org wrote: Control: tags

Processed: forcibly merging 573483 702038

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: forcemerge 573483 702038 Bug #573483 [src:linux] linux-headers in unstable regularly uninstallable due to missing linux-kbuild Bug #598504 [src:linux] [experimental] linux-headers-nnn depends on linux-kbuild-nnn which is unavailable Bug #603066

Bug#702241: gnome-packagekit: gpk-update-viewer does not update package index so falsely says is up to date.

2013-03-04 Thread Asterix
Package: gnome-packagekit Version: 3.4.2-2 Severity: serious Tags: security Justification: gpk-update-viewer does not update package index so falsely says is up to date - security issue. Dear Maintainer, Having installed debian wheezy rc-1, I was expecting to be notified of updates, or even

Bug#701814: Using lsof as input for os-prober

2013-03-04 Thread Peter Senna Tschudin
Isn't it a good idea to use lsof to determine what is being exported through iscsi and avoid trying to mount it? Should I try to make the patch for this? -- Peter -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Bug#697586: marked as done (libpango1.0-0: Segfaults and takes Evolution with it)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 13:35:51 +0100 with message-id 1362400551.8695.2.camel@debian and subject line Re: Bug#697586: libpango1.0-0: Segfaults and takes Evolution with it has caused the Debian Bug report #697586, regarding libpango1.0-0: Segfaults and takes Evolution with it to be

Bug#697676: lvm2: cLVM binary package is missing

2013-03-04 Thread Ferenc Wagner
Julien Cristau jcris...@debian.org writes: Somebody would have to properly maintain its dependencies in debian (redhat-cluster, and by extension gfs2-utils, corosync, ...). They're the reason the clvm package had to go. Hi Julien, We're running clvm over Corosync in wheezy (were using

Bug#702221: [php-maint] Bug#702221: php5: CVE-2013-1635 CVE-2013-1643

2013-03-04 Thread Ondřej Surý
Argh, thanks for poke. Building for squeeze-security now. $ diffstat php5_5.3.3-7+squeeze15.debdiff debian/patches/CVE-2013-1635.patch | 48 + debian/patches/CVE-2013-1643.patch | 135 + php5-5.3.3/debian/changelog|7 +

Bug#702226: live-installer hangs when starting installation from live system

2013-03-04 Thread Ben Armstrong
On 04/03/13 06:20 AM, Praveen A wrote: package: live-installer version: 40 severity: critical I downloaded debian-wheezy-live-rc1-amd64-gnome-desktop.iso and live installer just hangs when selecting Install Debian Sid from System Tools menu as seen in the screenshot. It was working in

Bug#701792: PHP extension installed to wrong directory

2013-03-04 Thread Sebastian Ramacher
On 2013-03-04 13:17:54, Ondřej Surý wrote: Uploaded to DELAYED/5. Thank you. Cheers -- Sebastian Ramacher signature.asc Description: Digital signature

Bug#701814: Re: Bug#701814: os-prober: damages XFS exported via iSCSI but not mounted locally; potential data loss

2013-03-04 Thread q1werty
Hi, os-prober uses 'mount -o ro', or grub-mount from 1.45: Please excuse me if this is trivial, but '-o ro' does not prevent write access! According to man: Note that, depending on the filesystem type, state and kernel behavior, the system may still write to the device. For example, Ext3 or

Bug#702226: live-installer hangs when starting installation from live system

2013-03-04 Thread Praveen A
2013/3/4 Ben Armstrong sy...@sanctuary.nslug.ns.ca: On 04/03/13 06:20 AM, Praveen A wrote: package: live-installer version: 40 severity: critical I downloaded debian-wheezy-live-rc1-amd64-gnome-desktop.iso and live installer just hangs when selecting Install Debian Sid from System Tools

Bug#659899: CVE-2011-0790: XSS

2013-03-04 Thread Salvatore Bonaccorso
Hi all On Mon, Feb 27, 2012 at 08:27:05PM +0100, Florian Weimer wrote: * Antoine Beaupré: I don't actually know - I followed your lead and used that patch in the bugzilla Redhat bugtrackers:

Processed: reassign to debian-installer-launcher

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: reassign 702226 debian-installer-launcher Bug #702226 [live-installer] live-installer hangs when starting installation from live system Bug reassigned from package 'live-installer' to 'debian-installer-launcher'. No longer marked as found in

Bug#702234: #702234 gnome-shell: Screen lock delayed on password prompt version graph

2013-03-04 Thread Timo Juhani Lindfors
Hi, to me this sounds like a general X limitation and not an issue in gnome-shell. I can reproduce this even in squeeze with gnome2: 1) start gnome-terminal 2) click the File menu and don't close it 3) close the laptop lid 4) press the power button to start the system again The result is that

Bug#702234: #702234 gnome-shell: Screen lock delayed on password prompt version graph

2013-03-04 Thread Timo Juhani Lindfors
Asterix zzz...@rocketmail.com writes: I think it might be worth putting something in the release notes until the bug is fixed upstream, because it is a security issue, and since it happens with menus as well it probably will effect quite a few people? I'm still not sure if this is something

Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread intrigeri
intrigeri wrote (04 Mar 2013 10:16:35 GMT) : In any case, it looks now clear that this needs to be unblocked else php5-midgard2 will be broken by midgard2-core is no valid reason, in itself, to grant the unblock requested by #688966. Hopefully this will help the release team make a decision :)

Bug#677795: Bug#688966: Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread intrigeri
Hi again, and sorry for the flood.. Piotr Pokora wrote (04 Mar 2013 09:15:53 GMT) : Exactly. There are no changes made to php5-midgard2 package, so it only requires rebuild against fixed[0] midgard2-core package. OK, this confirms #692358 and #688966 are totally unrelated, then. Thank you.

Bug#702221: marked as done (php5: CVE-2013-1635 CVE-2013-1643)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 15:04:12 + with message-id e1ucww0-000356...@franck.debian.org and subject line Bug#702221: fixed in php5 5.4.4-14 has caused the Debian Bug report #702221, regarding php5: CVE-2013-1635 CVE-2013-1643 to be marked as done. This means that you claim that the

Bug#677795: Bug#688966: Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread Piotr Pokora
Exactly. There are no changes made to php5-midgard2 package, so it only requires rebuild against fixed[0] midgard2-core package. OK, this confirms #692358 and #688966 are totally unrelated, then. Only (and only) if midgard2-core[0] and php5-midgard2[1] are distributed together. In any other

Bug#696661: marked as done (bind9 - Fails if openssl can't load the gost engine)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 15:32:47 + with message-id e1ucxnf-0007yh...@franck.debian.org and subject line Bug#696661: fixed in bind9 1:9.8.4.dfsg.P1-6 has caused the Debian Bug report #696661, regarding bind9 - Fails if openssl can't load the gost engine to be marked as done. This

Bug#702260: libxml2: CVE-2013-0338 CVE-2013-0339

2013-03-04 Thread Moritz Muehlenhoff
Package: libxml2 Severity: grave Tags: security Justification: user security hole Please see the Red Hat Bugzilla entries for more details: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0338 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0339 Patch:

Bug#702261: libv8: CVE-2012-5153 CVE-2013-0836

2013-03-04 Thread Moritz Muehlenhoff
Package: libv8 Severity: grave Tags: security Justification: user security hole The previous Chrome release fixed two security issues in libv8: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5153 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0836 It's probably best to contact

Bug#700585: [pkg-cli-apps-team] Bug#700585: This patch should do the trick

2013-03-04 Thread Josselin Mouette
Le dimanche 03 mars 2013 à 12:35 +0800, Chow Loong Jin a écrit : On 03/03/2013 05:27, Josselin Mouette wrote: I’m not using banshee so I didn’t test it, but the bug should be fixed by the attached patch. Thanks for the patch. I believe meebey worked on a patch for gconf# instead, though,

Bug#702267: stunnel: CVE-2013-1762 buffer overflow in TLM authentication of the CONNECT protocol negotiation

2013-03-04 Thread Nico Golde
Package: stunnel Severity: grave Tags: security Hi, the following vulnerability was published for stunnel. Please see https://www.stunnel.org/CVE-2013-1762.html for details. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities Exposures) id in your

Processed: tagging 696661

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 696661 - moreinfo Bug #696661 {Done: LaMont Jones lam...@debian.org} [bind9] bind9 - Fails if openssl can't load the gost engine Removed tag(s) moreinfo. thanks Stopping processing here. Please contact me if you need assistance. --

Bug#677795: Bug#688966: Bug#677795: Bug#688966: Review midgard2-core package

2013-03-04 Thread intrigeri
Piotr Pokora wrote (04 Mar 2013 15:15:23 GMT) : Exactly. There are no changes made to php5-midgard2 package, so it only requires rebuild against fixed[0] midgard2-core package. OK, this confirms #692358 and #688966 are totally unrelated, then. Only (and only) if midgard2-core[0] and

Processed: tagging 696661

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 696661 + pending Bug #696661 {Done: LaMont Jones lam...@debian.org} [bind9] bind9 - Fails if openssl can't load the gost engine Added tag(s) pending. thanks Stopping processing here. Please contact me if you need assistance. -- 696661:

Bug#699877: marked as done (postfix: maintainer address bounces)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 16:18:04 + with message-id e1ucy5u-000661...@franck.debian.org and subject line Bug#699877: fixed in postfix 2.10.0-1 has caused the Debian Bug report #699877, regarding postfix: maintainer address bounces to be marked as done. This means that you claim

Bug#702179: marked as done (postfix: maintainer address bounces (ubuntu-devel-discuss@l.d.o))

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 16:18:04 + with message-id e1ucy5u-000661...@franck.debian.org and subject line Bug#699877: fixed in postfix 2.10.0-1 has caused the Debian Bug report #699877, regarding postfix: maintainer address bounces (ubuntu-devel-discuss@l.d.o) to be marked as done.

Processed: tagging 696661

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 696661 + pending Bug #696661 {Done: LaMont Jones lam...@debian.org} [bind9] bind9 - Fails if openssl can't load the gost engine Ignoring request to alter tags of bug #696661 to the same tags previously set thanks Stopping processing here.

Bug#701814: Re: Bug#701814: os-prober: damages XFS exported via iSCSI but not mounted locally; potential data loss

2013-03-04 Thread Bálint Réczey
Hi, 2013/3/4 q1we...@i.com.ua: Hi, os-prober uses 'mount -o ro', or grub-mount from 1.45: Please excuse me if this is trivial, but '-o ro' does not prevent write access! According to man: Note that, depending on the filesystem type, state and kernel behavior, the system may still

Bug#702226: live-installer hangs when starting installation from live system

2013-03-04 Thread Ben Armstrong
Praveen, What this comes down to is the b4 version of the image was inadvertently built with extra material from sid due to an error in configuration (it was intended that only the live-* packages be included from sid). This problem was fixed in rc1, but that meant that it used all wheezy

Bug#690410: Puredata 0.43.2-4 crashing due to _FORTIFY_SOURCE with large patch

2013-03-04 Thread IOhannes m zmoelnig
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 2013-03-03 14:26, Moritz Muehlenhoff wrote: On Fri, Mar 01, 2013 at 04:08:18PM -0800, Russ Allbery wrote: At this point in the release process, I really think upgrading with _FORTIFY_SOURCE disabled is the correct fix. Just increasing a buffer

Bug#702272: pinta: crash on program start

2013-03-04 Thread Nils Dagsson Moskopp
Package: pinta Version: 1.4-1 Severity: grave Justification: renders package unusable Dear Maintainer, I started pinta. It crashed immediately. I expected it would not crash. -- System Information: Debian Release: 7.0 APT prefers testing APT policy: (500, 'testing'), (500, 'stable'), (1,

Bug#701649: marked as done (libvirt-bin - libvirtd changes permissions of devices to libvirt-qemu:kvm (CVE-2013-1766))

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 18:02:42 + with message-id e1uczik-0007l0...@franck.debian.org and subject line Bug#701649: fixed in libvirt 0.9.12-8 has caused the Debian Bug report #701649, regarding libvirt-bin - libvirtd changes permissions of devices to libvirt-qemu:kvm

Bug#702282: CVE-2012-5621

2013-03-04 Thread Moritz Muehlenhoff
Package: ekiga Severity: grave Tags: security Please see http://marc.info/?l=oss-securitym=135458614417560w=2 This is fixed in experimental, but suid/wheezy is unfixed. Upstream fix: http://git.gnome.org/browse/ekiga/commit/?id=7d09807257 Cheers, Moritz -- To UNSUBSCRIBE, email to

Bug#699230: Mahara: [CVE-2011-3642] (Flowplayer upstream) unpatched vulnerability

2013-03-04 Thread gregor herrmann
On Tue, 29 Jan 2013 12:22:47 +0100, Luciano Bello wrote: Melissa Draper pointed that the embedded copy of flowplayer-core in Mahara is affected by http://code.google.com/p/flowplayer-core/issues/detail?id=441 This seems to be fixed in upstream git:

Bug#667599: dolfin-dev: fails to upgrade from squeeze - apt does not find an upgrade path

2013-03-04 Thread Sylvestre Ledru
On 27/02/2013 13:11, Andreas Beckmann wrote: On 2013-02-27 09:46, Ana Guerrero wrote: Bad news, it doesn't fully work. A couple of cases: [...] Having real metapackages libhdf5-serial, libhdf5-openmpi, libhdf5-mpich2 that depend on their corresponding libhdf5-foo (=$binvers) (and the

Bug#701131: sa-learn-cyrus: diff for NMU version 0.3.5-1.1

2013-03-04 Thread gregor herrmann
tags 701131 + patch tags 701131 + pending thanks Dear maintainer, I've prepared an NMU for sa-learn-cyrus (versioned as 0.3.5-1.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards. -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key

Processed: sa-learn-cyrus: diff for NMU version 0.3.5-1.1

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 701131 + patch Bug #701131 [sa-learn-cyrus] sa-learn-cyrus: directory vs. symlink conflict: /etc/mail/spamassassin Added tag(s) patch. tags 701131 + pending Bug #701131 [sa-learn-cyrus] sa-learn-cyrus: directory vs. symlink conflict:

Processed: severity of 700923 is important

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: # seems like Thijs' severity change didn't make it to control@ severity 700923 important Bug #700923 [pacemaker] pacemaker: CVE-2013-0281 Severity set to 'important' from 'grave' thanks Stopping processing here. Please contact me if you need

Bug#628843: login: tty hijacking possible in su via TIOCSTI, ioctl

2013-03-04 Thread Ismaël RUAU
found 1:4.1.5.1-1 This problem still exists in Wheezy. -- Ismaël RUAU -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Processed: owncloud: diff for NMU version 4.0.8debian-1.5

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 701115 + pending Bug #701115 [owncloud] owncloud: multiple vulnerabilities (oC-SA-2013-003, oC-SA-2013-004, oC-SA-2013-006) Added tag(s) pending. thanks Stopping processing here. Please contact me if you need assistance. -- 701115:

Bug#701115: owncloud: multiple vulnerabilities (oC-SA-2013-003, oC-SA-2013-004, oC-SA-2013-006)

2013-03-04 Thread gregor herrmann
On Thu, 28 Feb 2013 20:03:40 +0100, gregor herrmann wrote: I have prepared a patch which solves the this bug. Thanks alot, this patch looks perfect; I just checked with the commits (stable4) mentioned in the oC-SAs, and it's indeed identical :) Uploaded to DELAYED/2 now to get the fixes out

Bug#701115: owncloud: diff for NMU version 4.0.8debian-1.5

2013-03-04 Thread gregor herrmann
tags 701115 + pending thanks Dear maintainer, Prach Pongpanich has prepared an NMU for owncloud (versioned as 4.0.8debian-1.5) and I've uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards. -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key

Bug#699305: nip2: sRGB.icm is non-free

2013-03-04 Thread Jay Berkenbilt
Jay Berkenbilt q...@debian.org wrote: Stuart Prescott stuart.presc...@bristol.ac.uk wrote: Package: nip2 Version: 7.28.4-1 Severity: serious Justification: DFSG3: must allow derived works Dear Maintainer, The file share/nip2/data/sRGB.icm is not licensed under the same terms as the

Bug#701792: PHP extension installed to wrong directory

2013-03-04 Thread Cleto Martín
Hi! Thanks a lot for the patch. I have just seen this bug report. Sorry for that. This issue is solved at zeroc-ice35b (which is in experimental) and I hope to put in unstable soon. Thanks, Cleto. On 03/04/2013 01:27 PM, Sebastian Ramacher wrote: On 2013-03-04 13:17:54, Ondřej Surý wrote:

Processed: severity of 702241 is important

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: severity 702241 important Bug #702241 [gnome-packagekit] gnome-packagekit: gpk-update-viewer does not update package index so falsely says is up to date. Severity set to 'important' from 'serious' thanks Stopping processing here. Please contact

Bug#702234: marked as done (gnome-shell: Screen lock delayed on password prompt)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 4 Mar 2013 20:55:34 +0100 with message-id 20130304195534.ga...@radis.cristau.org and subject line Re: Bug#702234: gnome-shell: Screen lock delayed on password prompt has caused the Debian Bug report #702234, regarding gnome-shell: Screen lock delayed on password prompt to

Processed: user release.debian....@packages.debian.org, usertagging 691546, tagging 691546

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: user release.debian@packages.debian.org Setting user to release.debian@packages.debian.org (was jcris...@debian.org). usertags 691546 wheezy-can-defer There were no usertags set. Usertags are now: wheezy-can-defer. tags 691546 +

Bug#701776: fsck.btrfs do not accept -a so the system will not boot anymore

2013-03-04 Thread Roger Leigh
On Thu, Feb 28, 2013 at 07:16:25AM -0600, Tim Cuthbertson wrote: I confirm Axel Beckert's statement in message #60. My system cannot boot with the latest patch 0.19+20130131-2 Note that for compatibility with fsck you must support at a minimum (even if you ignore them) the following options:

Bug#699230: Mahara: [CVE-2011-3642] (Flowplayer upstream) unpatched vulnerability

2013-03-04 Thread Julien Cristau
On Mon, Mar 4, 2013 at 19:36:34 +0100, gregor herrmann wrote: I suggest to remove the package from the archive. Added a removal hint for wheezy... Cheers, Julien signature.asc Description: Digital signature

Bug#702272: #702272 pinta: crash on program start

2013-03-04 Thread Timo Juhani Lindfors
Hi, I started pinta, on both i386 and amd64, and it does not crash. To make sure that the issue is not caused by some weird configuration in your system can you please try if the problem occurs in debian live environment? For example just copy

Bug#698871: marked as done (CVE-2013-0219 CVE-2013-0220)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 20:49:53 + with message-id e1ucckx-0001ln...@franck.debian.org and subject line Bug#698871: fixed in sssd 1.8.4-2 has caused the Debian Bug report #698871, regarding CVE-2013-0219 CVE-2013-0220 to be marked as done. This means that you claim that the

Bug#701684: [Pkg-libvirt-maintainers] Bug#701684: virt-viewer no longer contains virt-viewer

2013-03-04 Thread Julien Cristau
On Sun, Mar 3, 2013 at 12:30:05 -0700, Bob Proulx wrote: reopen 701684 thanks Luca Capello wrote: I just got it by this bug as well and IMHO the current solution (upgrading to the versions in experimental) is not fine: virt-viewer in sid is still broken and, after having visited the

Processed: perl: CVE-2013-1667: rehashing flaw

2013-03-04 Thread Debian Bug Tracking System
Processing control commands: found -1 5.16.2-1 Bug #702296 [src:perl] perl: CVE-2013-1667: rehashing flaw Marked as found in versions perl/5.16.2-1. -- 702296: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems -- To

Bug#702296: perl: CVE-2013-1667: rehashing flaw

2013-03-04 Thread Salvatore Bonaccorso
Source: perl Version: 5.10.1-17squeeze4 Severity: grave Tags: security patch Control: found -1 5.16.2-1 Hi Niko and Dominic A a hash-related flaw was announced today and CVE-2013-1667 assigned to it. For further reference see [1,2]. [1]:

Bug#698236: bitlbee: diff for NMU version 3.2-1.1

2013-03-04 Thread Julien Cristau
On Sun, Mar 3, 2013 at 23:08:27 +0100, Sebastian Ramacher wrote: -Build-Depends: libglib2.0-dev (= 2.4), libevent-dev, gnutls-dev | libgnutls-dev, po-debconf, libpurple-dev, libotr2-dev, debhelper (= 6.0.7~), asciidoc +Build-Depends: libglib2.0-dev (= 2.4), libevent-dev, libgnutls28-dev |

Processed: found 702296 in 5.14.2-18

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: found 702296 5.14.2-18 Bug #702296 [src:perl] perl: CVE-2013-1667: rehashing flaw Marked as found in versions perl/5.14.2-18. thanks Stopping processing here. Please contact me if you need assistance. -- 702296:

Bug#693695: marked as done (general: error while loading shared libraries on system upgrade)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 21:02:54 + with message-id e1uccx8-0004sg...@franck.debian.org and subject line Bug#685243: fixed in vlc 2.0.3-5 has caused the Debian Bug report #685243, regarding general: error while loading shared libraries on system upgrade to be marked as done. This

Bug#685243: marked as done (breaks squeeze-wheezy upgrade into very bad state)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 21:02:54 + with message-id e1uccx8-0004sg...@franck.debian.org and subject line Bug#685243: fixed in vlc 2.0.3-5 has caused the Debian Bug report #685243, regarding breaks squeeze-wheezy upgrade into very bad state to be marked as done. This means that you

Bug#700738: one patch, but plenty more needed

2013-03-04 Thread gregor herrmann
On Sun, 03 Mar 2013 10:30:21 -0400, David Bremner wrote: The use-after-frees are quite trivial to fix There's a package on mentors now: http://mentors.debian.net/package/tty-clock https://lists.debian.org/debian-mentors/2013/03/msg00069.html in case one of you who knows the code already wants

Processed: found 702282 in 3.2.7-2, fixed 702282 in 4.0.0-1

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: found 702282 3.2.7-2 Bug #702282 [ekiga] CVE-2012-5621 Marked as found in versions ekiga/3.2.7-2. fixed 702282 4.0.0-1 Bug #702282 [ekiga] CVE-2012-5621 Marked as fixed in versions ekiga/4.0.0-1. thanks Stopping processing here. Please contact

Bug#702282: marked as done (CVE-2012-5621)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 22:33:24 + with message-id e1ucdwi-ap...@franck.debian.org and subject line Bug#702282: fixed in ekiga 3.2.7-6 has caused the Debian Bug report #702282, regarding CVE-2012-5621 to be marked as done. This means that you claim that the problem has been

Bug#702305: mediawiki: API action 'unblock' returns a full user object

2013-03-04 Thread Jonathan Wiltshire
Package: mediawiki Version: 1:1.19.3-2 Severity: grave Tags: security upstream fixed-upstream Justification: security; information disclosure including password hashes Forwarded: https://bugzilla.wikimedia.org/show_bug.cgi?id=43518 The unblock API discloses full user details to anyone who has the

Bug#690410: Puredata 0.43.2-4 crashing due to _FORTIFY_SOURCE with large patch

2013-03-04 Thread Russ Allbery
IOhannes m zmoelnig zmoel...@iem.at writes: since i'm not in the position of uploading the package myself, i'd like to kindly ask one of you DMs (alessio, paul?) to help me out here. I've got it, thanks. Building for upload now. (I haven't done enough to help out with the wheezy release yet,

Processed: tagging 688331

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 688331 + wontfix Bug #688331 [boost1.42] boost1.42: CVE-2012-2677 Added tag(s) wontfix. thanks Stopping processing here. Please contact me if you need assistance. -- 688331: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688331 Debian

Processed: tagging 702305

2013-03-04 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 702305 + pending Bug #702305 [mediawiki] mediawiki: API action 'unblock' returns a full user object Added tag(s) pending. thanks Stopping processing here. Please contact me if you need assistance. -- 702305:

Bug#690410: marked as done (Puredata 0.43.2-4 crashing due to _FORTIFY_SOURCE with large patch)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 23:33:21 + with message-id e1ucesj-0005tg...@franck.debian.org and subject line Bug#690410: fixed in puredata 0.43.2-5 has caused the Debian Bug report #690410, regarding Puredata 0.43.2-4 crashing due to _FORTIFY_SOURCE with large patch to be marked as

Bug#702305: marked as done (mediawiki: API action 'unblock' returns a full user object)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 23:32:47 + with message-id e1ucesb-0005d6...@franck.debian.org and subject line Bug#702305: fixed in mediawiki 1:1.19.4-1 has caused the Debian Bug report #702305, regarding mediawiki: API action 'unblock' returns a full user object to be marked as done.

Bug#702005: marked as done (libpython2.7: Upgrade to libpython2.7 2.7.3-7 fails, breaking python entirely)

2013-03-04 Thread Debian Bug Tracking System
Your message dated Mon, 04 Mar 2013 23:47:52 + with message-id e1ucf6m-0008nn...@franck.debian.org and subject line Bug#702005: fixed in python2.7 2.7.3-8 has caused the Debian Bug report #702005, regarding libpython2.7: Upgrade to libpython2.7 2.7.3-7 fails, breaking python entirely to be

Bug#700738: one patch, but plenty more needed

2013-03-04 Thread Antoine Beaupré
On 2013-03-04, gregor herrmann wrote: On Sun, 03 Mar 2013 10:30:21 -0400, David Bremner wrote: The use-after-frees are quite trivial to fix There's a package on mentors now: http://mentors.debian.net/package/tty-clock https://lists.debian.org/debian-mentors/2013/03/msg00069.html So that

Bug#702314: checkinstall aborts with illegal instruction on kFreeBSD

2013-03-04 Thread Carlos Alberto Lopez Perez
Package: checkinstall Severity: grave Version: 1.6.2-3 Justification: Renders the package unusable. On a Debian/kFreeBSD AMD64 machine running sid, checkinstall aborts with illegal instruction when trying to build a package. # checkinstall --install=no checkinstall 1.6.2, Copyright 2009 Felipe

Bug#698294: [Pkg-puppet-devel] Bug#698294: Bug#698294: diff for NMU 2.7.18-2.1

2013-03-04 Thread micah anderson
Russ Allbery r...@debian.org writes: Anton Gladky gl...@debian.org writes: Ok, I canceled the upload. We cannot postpone Wheezy-release, waiting for every upstream's decision. If the solution works, why should not it be applied? Otherwise the package should be removed from testing. The

Bug#701832: doxygen consistently segfaults on kfreebsd-i386 when building opendnssec documentation

2013-03-04 Thread Jeff Epler
On Sun, Mar 03, 2013 at 12:20:57PM +, Steven Chamberlain wrote: #5 0x000800d21f2c in *__GI___libc_free (mem=optimized out) at malloc.c:3736 ar_ptr = 0x800ff3240 p = optimized out #6 0x000800844a79 in gvFreeContext () from /usr/lib/libgvc.so.5 No symbol