imagemagick collab-maint repository

2016-12-26 Thread Roberto C . Sánchez
All, I recently saw that php5, squid, and squid3 have LTS-specific repositories on git.debian.org. Since imagemagick appears to have a large volume of issues for the LTS team to address and at least once we have had to effect a hand-off part way through preparation of an upload, I have gone

Re: Qemu CVEs in Xen

2016-12-26 Thread Moritz Mühlenhoff
On Mon, Dec 26, 2016 at 08:04:29PM +0100, Hugo Lefeuvre wrote: > Hi Moritz, > > > That doesn't make sense. Only a very small subset of the qemu copy > > is security-relavant in Xen and if that happens they've usually > > published an XSA advisory for it. > > XSA advisories are published for

Re: Testing Asterisk for Wheezy LTS

2016-12-26 Thread Gabriel Filion
Hi there, Markus Koschany: > I have prepared a new security update for Asterisk. I am CCing Gabriel > because he was interested to help with testing in the past. Feedback is > very much appreciated. You can find amd64 binary packages and the debdiff at > >

Re: Qemu CVEs in Xen

2016-12-26 Thread Hugo Lefeuvre
Hi Moritz, > That doesn't make sense. Only a very small subset of the qemu copy > is security-relavant in Xen and if that happens they've usually > published an XSA advisory for it. XSA advisories are published for stable versions, which is not the case of the version in wheezy. So, IMO it makes

Wheezy update of libphp-phpmailer?

2016-12-26 Thread Ola Lundqvist
Hello dear maintainer(s), the Debian LTS team would like to fix the security issues which are currently open in the Wheezy version of libphp-phpmailer: https://security-tracker.debian.org/tracker/CVE-2016-10033 According to the advisory this vulnerability is of critical nature. There are however

Re: Qemu CVEs in Xen

2016-12-26 Thread Moritz Mühlenhoff
On Tue, Nov 29, 2016 at 10:18:51AM +0100, Hugo Lefeuvre wrote: > Hi, > > So far, I have triaged ~120 CVEs. I have used all my assigned hours, so > I won't be able to finish the work this month. > > I have marked Xen as affected by 45 'new' CVEs until now. Not all of > them deserve a DLA. That

[SECURITY] [DLA 765-1] qemu-kvm security update

2016-12-26 Thread Hugo Lefeuvre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Package: qemu-kvm Version: 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in qemu-kvm: CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support

[SECURITY] [DLA 764-1] qemu security update

2016-12-26 Thread Hugo Lefeuvre
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Package: qemu Version: 1.1.2+dfsg-6+deb7u19 CVE ID : CVE-2016-9911 CVE-2016-9921 CVE-2016-9922 Multiple vulnerabilities have been found in QEMU: CVE-2016-9911 Quick Emulator (Qemu) built with the USB EHCI Emulation