Re: [SECURITY] [DLA 2320-1] golang-github-seccomp-libseccomp-golang security update

2020-08-11 Thread Mark Heimstaedt
how do i unenroll from deb 8 lts, now that I have upgraded the box to deb 10 ? On Tue, Aug 11, 2020 at 3:38 AM Adrian Bunk wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > - - > Debian LTS Advisory

Re: slirp / CVE-2020-7039 / CVE-2020-8608

2020-08-11 Thread Roberto C . Sánchez
On Wed, Aug 12, 2020 at 08:55:43AM +1000, Brian May wrote: > I am seriously thinking that slirp from unstable should be ported as is > from sid to buster and stretch. This is not a new upstream version, it > has bug fixes and security updates only. Probably the same changes I > would have to make

slirp / CVE-2020-7039 / CVE-2020-8608

2020-08-11 Thread Brian May
I am seriously thinking that slirp from unstable should be ported as is from sid to buster and stretch. This is not a new upstream version, it has bug fixes and security updates only. Probably the same changes I would have to make myself in fact. Such as replacing sprintf calls with snprintf calls

Re: roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious SVG or math content

2020-08-11 Thread Guilhem Moulin
Hi Roberto, On Tue, 11 Aug 2020 at 14:57:15 -0400, Roberto C. Sánchez wrote: >>> Dear security team, Should have been LTS team of course, bad templating from my side :-P >> I'll take care of it shortly. >> > I have uploaded the updated, published the DLA to the mailing list and > submitted a

Re: roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious SVG or math content

2020-08-11 Thread Roberto C . Sánchez
On Tue, Aug 11, 2020 at 01:40:48PM -0400, Roberto C. Sánchez wrote: > On Tue, Aug 11, 2020 at 07:11:57PM +0200, Guilhem Moulin wrote: > > Dear security team, > > > > In a recent post roundcube webmail upstream has announced the following > > security fix for #968216: > > > > Cross-site

[SECURITY] [DLA 2322-1] roundcube security update

2020-08-11 Thread Roberto C . Sánchez
- Debian LTS Advisory DLA-2322-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 11, 2020 https://wiki.debian.org/LTS

Accepted roundcube 1.2.3+dfsg.1-4+deb9u7 (source) into oldstable

2020-08-11 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 11 Aug 2020 18:38:40 +0200 Source: roundcube Binary: roundcube-core roundcube roundcube-mysql roundcube-pgsql roundcube-sqlite3 roundcube-plugins Architecture: source Version: 1.2.3+dfsg.1-4+deb9u7 Distribution:

Re: roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious SVG or math content

2020-08-11 Thread Roberto C . Sánchez
On Tue, Aug 11, 2020 at 07:11:57PM +0200, Guilhem Moulin wrote: > Dear security team, > > In a recent post roundcube webmail upstream has announced the following > security fix for #968216: > > Cross-site scripting (XSS) via HTML messages with malicious SVG > or math content

roundcube: CVE-2020-16145: XSS vulnerability via HTML messages with malicious SVG or math content

2020-08-11 Thread Guilhem Moulin
Dear security team, In a recent post roundcube webmail upstream has announced the following security fix for #968216: Cross-site scripting (XSS) via HTML messages with malicious SVG or math content (CVE-2020-16145) AFAICT CVE-2020-16145 is only about SVG not math, but the upstream

Accepted linux-4.19 4.19.132-1~deb9u2 (source) into oldstable

2020-08-11 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 11 Aug 2020 13:47:06 +0100 Source: linux-4.19 Binary: linux-support-4.19.0-0.bpo.10 linux-doc-4.19 linux-kbuild-4.19 linux-perf-4.19 linux-bootwrapper-4.19.0-0.bpo.10 linux-source-4.19 linux-headers-4.19.0-0.bpo.10-common

[SECURITY] [DLA 2321-1] firmware-nonfree new upstream version

2020-08-11 Thread Ben Hutchings
- Debian LTS Advisory DLA-2321-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 11, 2020 https://wiki.debian.org/LTS

[SECURITY] [DLA 2320-1] golang-github-seccomp-libseccomp-golang security update

2020-08-11 Thread Adrian Bunk
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian LTS Advisory DLA-2320-1debian-...@lists.debian.org https://www.debian.org/lts/security/ August 10, 2020

Accepted linux-latest-4.19 105+deb10u5~deb9u1 (source amd64) into oldstable, oldstable

2020-08-11 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 04 Aug 2020 22:30:56 +0100 Source: linux-latest-4.19 Binary: linux-image-4.19-alpha-generic linux-headers-4.19-alpha-generic linux-image-4.19-alpha-generic-dbg linux-image-4.19-alpha-smp linux-headers-4.19-alpha-smp

Accepted linux-4.19 4.19.132-1~deb9u1 (all source) into oldstable, oldstable

2020-08-11 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 04 Aug 2020 16:57:14 +0100 Binary: linux-doc-4.19 linux-headers-4.19.0-0.bpo.10-common linux-headers-4.19.0-0.bpo.10-common-rt linux-source-4.19 linux-support-4.19.0-0.bpo.10 Source: linux-4.19 Architecture: all source

Accepted firmware-nonfree 20190114-2~deb9u1 (source all) into oldstable, oldstable

2020-08-11 Thread Debian FTP Masters
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Tue, 04 Aug 2020 14:27:39 +0100 Source: firmware-nonfree Binary: firmware-linux firmware-linux-nonfree firmware-adi firmware-ralink firmware-amd-graphics firmware-atheros firmware-bnx2 firmware-bnx2x firmware-brcm80211