[SECURITY] [DLA 735-1] gst-plugins-base0.10 security update

2016-12-07 Thread Emilio Pozuelo Monfort
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: gst-plugins-base0.10 Version: 0.10.36-1.1+deb7u1 CVE ID : CVE-2016-9811 An out of bounds heap read issue was found in gst-plugins-base0.10. For Debian 7 "Wheezy", these problems have been fixed in version

[SECURITY] [DLA 734-1] mapserver security update

2016-12-07 Thread Chris Lamb
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Package: mapserver Version: 6.0.1-3.2+deb7u3 CVE ID : CVE-2016-9839 It was discovered that there was an information leakage vulnerability in mapserver, a CGI-based framework for Internet map services. For Debian 7 "Wheezy",

Re: Fixing CVE-2016-9839 for mapserver in wheezy

2016-12-07 Thread Bas Couwenberg
On 2016-12-07 09:49, Chris Lamb wrote: Sebastiaan Couwenberg wrote: Thanks, the fixed version has been uploaded, but the security-tracker marks it (6.0.1-3.2+deb7u3) as vulnerable which is incorrect. The security-tracker is generated from the files in the secure-testing repository, not from

Re: Fixing CVE-2016-9839 for mapserver in wheezy

2016-12-07 Thread Chris Lamb
Sebastiaan Couwenberg wrote: > Thanks, the fixed version has been uploaded, but the security-tracker > marks it (6.0.1-3.2+deb7u3) as vulnerable which is incorrect. The security-tracker is generated from the files in the secure-testing repository, not from the archive itself. Can you confirm

Wheezy update of roundcube?

2016-12-07 Thread Chris Lamb
Hello dear maintainer(s), the Debian LTS team would like to fix the security issues which are currently open in the Wheezy version of roundcube: https://security-tracker.debian.org/tracker/source-package/roundcube Would you like to take care of this yourself? If yes, please follow the workflow