Re: CVE-2014-0205 and CVE-2014-3535

2014-09-11 Thread Ben Hutchings
:02AM +0100, Ben Hutchings wrote: RH and SUSE have updated their kernels for these vulnerabilities, but I haven't heard anything about this and don't know what the upstream fixes are. What's going on? Was any information sent to the linux-distros list? Cannot check the distro

[SECURITY] [DLA 155-1] linux-2.6 security update

2015-02-18 Thread Ben Hutchings
of entropy. A local unprivileged user could potentially use this flaw to bypass the ASLR protection mechanism. -- Ben Hutchings - Debian developer, kernel team member signature.asc Description: This is a digitally signed message part

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Ben Hutchings
a test that verified the patch was correctly included. That is, the test in the patch isn't enough to show the issue in the old code. There's a test in the disclosure here (section 4): http://www.openwall.com/lists/oss-security/2015/01/27/9 Ben. -- Ben Hutchings Teamwork is essential

Testing an update to freetype for squeeze-lts

2015-03-16 Thread Ben Hutchings
freetype in would be appreciated. Any suggestions from the maintainers, likewise. Ben. -- Ben Hutchings When in doubt, use brute force. - Ken Thompson signature.asc Description: This is a digitally signed message part

Re: Please remove me from the list!

2015-03-10 Thread Ben Hutchings
current one. The forwarding address should appear somewhere in the 'Received' header lines. Ben. -- Ben Hutchings Any smoothly functioning technology is indistinguishable from a rigged demo. signature.asc Description: This is a digitally signed message part

Re: Query about possible bug fix involving security issues for web browsers

2015-03-29 Thread Ben Hutchings
either. I am wondering whether some mechanism,, or, filter, can be implemented, [...] You can remove the flash plugin, whichever it is. That won't protect you from sites that exploit bugs in the browser's image decoders or Javascript libraries. Ben. -- Ben Hutchings Sturgeon's Law: Ninety

squeeze update of eglibc

2015-02-28 Thread Ben Hutchings
along with the packages in case they're useful. Ben. -- Ben Hutchings friends: People who know you well, but like you anyway. signature.asc Description: This is a digitally signed message part

[SECURITY] [DLA 160-1] sudo security update

2015-02-27 Thread Ben Hutchings
.squeeze.5. For the stable distribution (wheezy), they have been fixed in version 1.8.5p2-1+nmu2. We recommend that you upgrade your sudo packages. -- Ben Hutchings - Debian developer, kernel team member signature.asc Description: This is a digitally signed message part

Re: squeeze update of cups?

2015-02-26 Thread Ben Hutchings
that fixed too (ideally first). That said, the part from the upstream patch that we're discussing doesn't apply to Squeeze(-LTS), so we might as well upload the patch as- is. Proposed debdiff attached. This does not fix the bug! Ben. -- Ben Hutchings It is easier to write an incorrect

Re: Updating dpkg in squeeze-lts

2015-04-26 Thread Ben Hutchings
On Thu, 2015-04-23 at 07:10 +0200, Guillem Jover wrote: Hi! On Wed, 2015-04-22 at 01:53:16 +0100, Ben Hutchings wrote: I've prepared an update to dpkg in squeeze-lts to fix CVE-2015-0840. As it's a native package, I'd like to check some points with you: - Would you rather I numbered

Updating dpkg in squeeze-lts

2015-04-21 Thread Ben Hutchings
branch, or should I send one or multiple patches? git repository: http://git.decadent.org.uk/gitweb?p=dpkg.git;a=summary http://git.decadent.org.uk/git/dpkg.git packages: https://people.debian.org/~benh/packages/squeeze-lts/ Ben. -- Ben Hutchings Humans are not rational beings

Call for testing: tiff in squeeze-lts

2015-04-30 Thread Ben Hutchings
with the specific applications that people use libtiff in would be appreciated. Any suggestions from the maintainers, likewise. Ben. -- Ben Hutchings It is easier to write an incorrect program than to understand a correct one. signature.asc Description: This is a digitally signed message part

Re: Updating dpkg in squeeze-lts

2015-05-01 Thread Ben Hutchings
On Fri, 2015-05-01 at 05:51 +0200, Guillem Jover wrote: On Mon, 2015-04-27 at 01:11:33 +0100, Ben Hutchings wrote: On Thu, 2015-04-23 at 07:10 +0200, Guillem Jover wrote: I'd prefer if you merged and released the tarball, then I can do the rest. Sure, less work for me. - Are you

Re: php5 packages for testing

2015-05-06 Thread Ben Hutchings
-encode or uuencode them and then decode at build time. (Ugh.) Ben. According to the last changelog entry, the upload seems just include new patches and no new upstream version. Oooh, shame on me, I forgot to add this to the changelog, so sorry for the confusion. -- Ben Hutchings

Accepted tiff 3.9.4-5+squeeze12 (source all i386) into squeeze-lts

2015-05-15 Thread Ben Hutchings
Maintainer: Jay Berkenbilt q...@debian.org Changed-By: Ben Hutchings b...@decadent.org.uk Description: libtiff-doc - TIFF manipulation and conversion documentation libtiff-opengl - TIFF manipulation and conversion tools libtiff-tools - TIFF manipulation and conversion tools libtiff4 - Tag Image

[SECURITY] [DLA 221-1] tiff security update

2015-05-15 Thread Ben Hutchings
), these problems have been fixed in version 3.9.4-5+squeeze12. For the oldstable distribution (wheezy), these problems will be fixed soon. The stable distribution (jessie) was not affected by these problems as they were fixed before release. -- Ben Hutchings - Debian developer, member of Linux

Accepted ruby1.8 1.8.7.302-2squeeze4 (source all i386) into squeeze-lts

2015-05-17 Thread Ben Hutchings
: squeeze-lts Urgency: medium Maintainer: akira yamada ak...@debian.org Changed-By: Ben Hutchings b...@decadent.org.uk Description: libruby1.8 - Libraries necessary to run Ruby 1.8 libruby1.8-dbg - Debugging symbols for Ruby 1.8 libtcltk-ruby1.8 - Tcl/Tk interface for Ruby 1.8 ri1.8 - Ruby

Re: Updating dpkg in squeeze-lts

2015-05-15 Thread Ben Hutchings
On Sun, 2015-05-03 at 16:52 +0200, Guillem Jover wrote: On Fri, 2015-05-01 at 13:24:56 +0100, Ben Hutchings wrote: On Fri, 2015-05-01 at 05:51 +0200, Guillem Jover wrote: Although I cannot fetch from the repo: ,--- $ git pull http://git.decadent.org.uk/git/dpkg.git 1.15.x error

Re: How to deal with wireshark CVE affecting Squeeze

2015-04-11 Thread Ben Hutchings
: a. remove it from support and upload wireshark 1.8 to squeeze-backports if possible, or b. upload the backported wireshark 1.8 package to squeeze-lts Ben. -- Ben Hutchings compatible: Gracefully accepts erroneous data from any source signature.asc Description: This is a digitally signed

Accepted linux-2.6 2.6.32-48squeeze12 (all source) into squeeze-lts

2015-06-16 Thread Ben Hutchings
-48squeeze12 Distribution: squeeze-lts Urgency: high Maintainer: Debian Kernel Team debian-ker...@lists.debian.org Changed-By: Ben Hutchings b...@decadent.org.uk Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base package linux-doc

[SECURITY] [DLA 245-1] p7zip security update

2015-06-14 Thread Ben Hutchings
(jessie), this problem will be fixed soon. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

[SECURITY] [DLA 246-1] linux-2.6 security update

2015-06-17 Thread Ben Hutchings
, except for CVE-2015-4167 which will be fixed later. We recommend that you upgrade your linux-2.6 packages. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Accepted linux-2.6 2.6.32-48squeeze13 (all source) into squeeze-lts

2015-06-17 Thread Ben Hutchings
-48squeeze13 Distribution: squeeze-lts Urgency: high Maintainer: Debian Kernel Team debian-ker...@lists.debian.org Changed-By: Ben Hutchings b...@decadent.org.uk Closes: 789037 Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base package

Re: The content of /etc/apt/sources.list

2015-05-23 Thread Ben Hutchings
it wouldn't still work, though it's likely to run slower again. Maybe time for new hardware? Ben. -- Ben Hutchings If more than one person is responsible for a bug, no one is at fault. signature.asc Description: This is a digitally signed message part

Accepted conntrack 1:0.9.14-2+deb6u1 (i386 source) into squeeze-lts

2015-08-18 Thread Ben Hutchings
-By: Ben Hutchings b...@decadent.org.uk Description: conntrackd - Connection tracking daemon conntrack - Program to modify the conntrack tables Changes: conntrack (1:0.9.14-2+deb6u1) squeeze-lts; urgency=medium . * Non-maintainer upload by the Squeeze LTS team * Change source format to 3.0

Re: Suspend failing

2015-07-24 Thread Ben Hutchings
On Thu, 2015-07-23 at 16:48 -0500, golinux wrote: On 2015-07-21 21:26, Ben Hutchings wrote: On Tue, 2015-07-21 at 19:48 -0500, golinux wrote: I appreciate the timely response. Why did you think it might be the nVidia driver? Maybe compiz is the culprit? I just checked

squeeze update of quassel?

2015-07-14 Thread Ben Hutchings
of this update, it's not a problem, we will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working

VirtualBox support in squeeze LTS

2015-07-16 Thread Ben Hutchings
to the list or updated in squeeze? Ben. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

squeeze update of openjdk-6?

2015-07-16 Thread Ben Hutchings
will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point

squeeze update of virtualbox-ose?

2015-07-16 Thread Ben Hutchings
not a problem, we will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update

squeeze update of apache2?

2015-07-16 Thread Ben Hutchings
package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether

squeeze update of libidn?

2015-07-16 Thread Ben Hutchings
package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether

Re: squeeze update of openjdk-6?

2015-07-18 Thread Ben Hutchings
On Fri, 2015-07-17 at 14:05 +0200, Raphael Hertzog wrote: On Thu, 16 Jul 2015, Ben Hutchings wrote: the Debian LTS team would like to fix the security issues which are currently open in the Squeeze version of openjdk-6: FTR, the OpenJDK maintainer maintains the package in a way that allows

[SECURITY] [DLA 274-1] groovy security update

2015-07-19 Thread Ben Hutchings
a serialized object that will cause the application to execute arbitrary code. For the oldoldstable distribution (squeeze), this problem has been fixed in version 1.7.0-4+deb6u1. For the oldstable distribution (wheezy) and stable distribution (jessie), this problem will be fixed soon. -- Ben

ntp security update

2015-10-24 Thread Ben Hutchings
isn't fixed in sid, though the security tracker currently says it is.  Who's right? Ben. -- Ben Hutchings Beware of bugs in the above code; I have only proved it correct, not tried it. - Donald Knuth signature.asc Description: This is a digitally signed message part

Re: ntp security update

2015-10-25 Thread Ben Hutchings
On Sun, 2015-10-25 at 22:45 +0100, Kurt Roeckx wrote: > On Mon, Oct 26, 2015 at 06:13:07AM +0900, Ben Hutchings wrote: [...] > > > While I have addiotional patches for: > > > CVE-2014-9750.patch (it was missing 1 patch while it was fixed it > > > seems) > > &

Re: ntp security update

2015-10-27 Thread Ben Hutchings
On Tue, 2015-10-27 at 21:57 +0100, Kurt Roeckx wrote: > On Sun, Oct 25, 2015 at 01:30:18PM +0900, Ben Hutchings wrote: > > I've looked through the upstream repository for the patches that fix he > > recently announced issues.  Quite a few of them turned out not to apply

Re: ntp security update

2015-10-25 Thread Ben Hutchings
On Sun, 2015-10-25 at 11:19 +0100, Kurt Roeckx wrote: > On Sun, Oct 25, 2015 at 01:30:18PM +0900, Ben Hutchings wrote: > > I've looked through the upstream repository for the patches that fix he > > recently announced issues.  Quite a few of them turned out not to apply

Re: Update not possible

2015-11-02 Thread Ben Hutchings
an error code (1) > > update with aptitude fails. > C! > C. Is /usr/share/doc a directory or a symlink? Ben. -- Ben Hutchings Nothing is ever a complete failure; it can always serve as a bad example. signature.asc Description: This is a digitally signed message part

Accepted linux-2.6 2.6.32-48squeeze16 (all source) into squeeze-lts

2015-10-11 Thread Ben Hutchings
-48squeeze16 Distribution: squeeze-lts Urgency: medium Maintainer: Debian Kernel Team <debian-ker...@lists.debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base pa

[SECURITY] [DLA 325-1] linux-2.6 security update

2015-10-12 Thread Ben Hutchings
. For the oldstable distribution (wheezy), these problems will be fixed in version 3.2.68-1+deb7u5. For the stable distribution (jessie), these problems will be fixed in version 3.16.7-ckt11-1+deb8u5 or have been fixed earlier. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS

squeeze update of lxc?

2015-10-13 Thread Ben Hutchings
package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether

Re: VirtualBox support in squeeze LTS

2015-09-05 Thread Ben Hutchings
ew days, just let me know where to put it :) > > (note: I wont start packaging until I get a positive feedback, it is a > non-zero amount of work because of many patch > refresh and usual fixes/testing) It's all explained here: https://wiki.debian.org/LTS/Development Ben. -- Ben

Re: squeeze update of network-manager?

2015-09-11 Thread Ben Hutchings
On Fri, 2015-09-11 at 11:25 +0200, Guido Günther wrote: > Hi, > On Fri, Sep 11, 2015 at 11:00:19AM +0200, Guido Günther wrote: > > Hello dear maintainers, > > > > the Debian LTS team would like to fix the security issues which are > > currently open in the Squeeze version of network-manager: > >

[SECURITY] [DLA 324-1] binutils security update

2015-10-01 Thread Ben Hutchings
ld/12613 and CVE-2012-3509 were fixed before release, and PR binutils/18750 will be fixed in a later update. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Accepted linux-2.6 2.6.32-48squeeze14 (all source) into squeeze-lts

2015-09-19 Thread Ben Hutchings
-48squeeze14 Distribution: squeeze-lts Urgency: high Maintainer: Debian Kernel Team <debian-ker...@lists.debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base packag

[SECURITY] [DLA 310-1] linux-2.6 security update

2015-09-21 Thread Ben Hutchings
have been fixed in version 3.16.7-ckt11-1+deb8u4 or earlier. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

squeeze update of eglibc?

2015-09-25 Thread Ben Hutchings
know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered

squeeze update of libvncserver?

2015-09-25 Thread Ben Hutchings
us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone

[SECURITY] [DLA 360-1] linux-2.6 security update

2015-12-08 Thread Ben Hutchings
fixed soon. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Accepted linux-2.6 2.6.32-48squeeze17 (all source) into squeeze-lts

2015-12-06 Thread Ben Hutchings
-48squeeze17 Distribution: squeeze-lts Urgency: medium Maintainer: Debian Kernel Team <debian-ker...@lists.debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base pa

squeeze update of icu?

2016-01-03 Thread Ben Hutchings
the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https://anonscm.debian.org

Re: Missing DLA mail for DLA-378-1 (linux-2.6)?

2016-01-05 Thread Ben Hutchings
On Tue, 2016-01-05 at 17:58 +, Michael Howe wrote: > Hello, > > linux-2.6 2.6.32-48squeeze18 appeared in the archives a couple of days > back, and I see from DLA/list that DLA-378-1 was reserved by Ben > Hutchings, but there doesn't seem to have been an email to > debian-

[SECURITY] [DLA 378-1] linux-2.6 security update

2016-01-05 Thread Ben Hutchings
been fixed in version 3.16.7-ckt20-1+deb8u2 or earlier. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: Accepted linux-2.6 2.6.32-48squeeze18 (all source) into squeeze-lts

2016-01-04 Thread Ben Hutchings
On Mon, 2016-01-04 at 08:32 +0100, Jan Ingvoldstad wrote: > On 01/02/2016 06:06 PM, Ben Hutchings wrote: > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA512 > > > > Format: 1.8 > > Date: Sat, 02 Jan 2016 03:31:10 + > > Source: linux-2.6 > > We

squeeze update of tiff?

2015-12-29 Thread Ben Hutchings
or not. If you don't want to take care of this update, it's not a problem, we will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member

squeeze update of librsvg?

2015-12-29 Thread Ben Hutchings
let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone

squeeze update of macopix?

2015-12-29 Thread Ben Hutchings
the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

squeeze update of giflib?

2015-12-29 Thread Ben Hutchings
the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

squeeze update of tiff?

2015-12-30 Thread Ben Hutchings
or not. If you don't want to take care of this update, it's not a problem, we will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member

squeeze update of inspircd?

2015-12-30 Thread Ben Hutchings
the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

Re: squeeze update of tiff?

2015-12-30 Thread Ben Hutchings
e debian-lts stuff to take into consideration when package maintainers > change. [...] Sorry, Jay, this was due to a bug in the contact-maintainers script. I'll re-send this to the current maintainers. Ben. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.

Re: squeeze update of claws-mail?

2015-12-30 Thread Ben Hutchings
On Wed, 2015-12-30 at 11:18 +0100, Ricardo Mones wrote: > Hi Ben et al, > > On Wed, Dec 30, 2015 at 01:48:47AM +0000, Ben Hutchings wrote: > > Hello dear maintainer(s), > > > > the Debian LTS team would like to fix the security issues which are > > currently ope

squeeze update of redmine?

2015-11-25 Thread Ben Hutchings
and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

squeeze update of dbconfig-common?

2015-11-25 Thread Ben Hutchings
to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

Re: Please test eglibc 2.11.3-4+deb6u8

2015-11-24 Thread Ben Hutchings
to the mqueue implementation in Linux that might possibly have caused this (not because they are known buggy, but they may have user-visible effects).  However it's fairly pointless for me to look any further without that test output. Ben. -- Ben Hutchings Unix is many things to many people,

Re: [Python-modules-team] squeeze update of python-django?

2015-11-25 Thread Ben Hutchings
ueeze, otherwise I wouldn't have bothered you. As Raphaël is also on the LTS team, I expect he'll want to take this. Ben. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: squeeze update of srtp?

2015-11-29 Thread Ben Hutchings
On Mon, 2015-11-30 at 02:31 +0100, Jonas Smedegaard wrote: > Hi Ben and others, > > Quoting Ben Hutchings (2015-11-30 02:11:10) > > the Debian LTS team would like to fix the security issues which are > > currently open in the Squeeze version of srtp: > > https://

squeeze update of srtp?

2015-11-29 Thread Ben Hutchings
the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

Re: Re: squeeze update of srtp?

2015-12-01 Thread Ben Hutchings
fixed: https://sources.debian.net/src/srtp/1.4.4~dfsg-6%2Bdeb6u1/srtp/srtp.c/#L673 https://sources.debian.net/src/srtp/1.4.4~dfsg-6%2Bdeb6u1/srtp/srtp.c/#L939 Ben. -- Ben Hutchings Theory and practice are closer in theory than in practice. - John Levine, mod

Accepted putty 0.60+2010-02-20-1+squeeze4 (all source) into squeeze-lts

2015-11-23 Thread Ben Hutchings
wat...@debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: pterm - PuTTY terminal emulator putty-doc - PuTTY HTML documentation putty - Telnet/SSH client for X putty-tools - command-line tools for SSH, SCP, and SFTP Changes: putty (0.60+2010-02-20-1+squeeze4)

Accepted inspircd 1.1.22+dfsg-4+squeeze3 (source) into squeeze-lts

2016-01-13 Thread Ben Hutchings
ain...@lists.alioth.debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: inspircd - Modular IRCd written in C++ inspircd-dbg - Modular IRCd written in C++ - debugging symbols Closes: 668253 Changes: inspircd (1.1.22+dfsg-4+squeeze3) squeeze-lts; urgency=medium . * No

[SECURITY] [DLA 383-1] claws-mail security update

2016-01-12 Thread Ben Hutchings
sue harder to exploit. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

[SECURITY] [DLA 382-1] sudo security update

2016-01-10 Thread Ben Hutchings
. For the oldstable distribution (wheezy) and the stable distribution (jessie), this will be fixed soon. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: HFS+ specific vulnerability

2016-06-03 Thread Ben Hutchings
On Fri, 2016-06-03 at 17:25 +1000, Brian May wrote: > Ben Hutchings <b...@decadent.org.uk> writes: > > > [ Unknown signature status ] > > On Thu, 2016-06-02 at 17:39 +1000, Brian May wrote: > > > Hello, > > > > > > Do we care about vulerabi

Re: Wheezy update of qemu?

2016-06-13 Thread Ben Hutchings
On Mon, 2016-06-13 at 20:28 +0300, Michael Tokarev wrote: > 13.06.2016 19:55, Ben Hutchings wrote: > > On Mon, 2016-06-13 at 18:23 +0300, Michael Tokarev wrote: > > > 06.06.2016 04:37, Ben Hutchings wrote: > > > > Hello dear maintainer(s), > > > > >

Re: Wheezy update of qemu?

2016-06-13 Thread Ben Hutchings
On Mon, 2016-06-13 at 18:23 +0300, Michael Tokarev wrote: > 06.06.2016 04:37, Ben Hutchings wrote: > > Hello dear maintainer(s), > > > > the Debian LTS team would like to fix the security issues which are > > currently open in the Wheezy version of qemu: > > ht

Wheezy update of expat?

2016-06-05 Thread Ben Hutchings
us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone

Wheezy update of qemu-kvm?

2016-06-05 Thread Ben Hutchings
or not. If you don't want to take care of this update, it's not a problem, we will do our best with your package. Just let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS

Wheezy update of dhcpcd5?

2016-05-31 Thread Ben Hutchings
let us know whether you would like to review and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone

Wheezy update of libpdfbox-java?

2016-05-31 Thread Ben Hutchings
and/or test the updated package before it gets released. Thank you very much. Ben Hutchings,   on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this file: https

Re: HFS+ specific vulnerability

2016-06-02 Thread Ben Hutchings
mat is part of its attack surface.  I don't think we can rule out certain formats as too obscure.  (See for example the recent attacks on ImageMagick/GraphicsMagick using a format that most people never heard of before.  The fix there was to disable support for that format by default.) Ben. --

Re: changelogs missing!

2016-06-19 Thread Ben Hutchings
kages that only exist in the security archive are not available from that server.  Since the last point release for wheezy, uploads to wheezy-security (for LTS) are not being copied to the main archive and so their changelogs are never available from there. Ben. -- Ben Hutchings Never put off til

Re: squeeze update of openssh?

2016-01-15 Thread Ben Hutchings
> Would you like to take care of this yourself? [...] I believe Yves-Alexis Perez is handing this. Ben. -- Ben Hutchings The program is absolutely right; therefore, the computer must be wrong. signature.asc Description: This is a digitally signed message part

Re: squeeze update of openssh?

2016-01-15 Thread Ben Hutchings
On Fri, 2016-01-15 at 14:37 +0100, Yves-Alexis Perez wrote: > On ven., 2016-01-15 at 13:35 +0000, Ben Hutchings wrote: > > On Fri, 2016-01-15 at 11:46 +0100, Mike Gabriel wrote: > > > Hello dear maintainer(s), > > > > > > the Debian LTS team would l

[SECURITY] [DLA 384-1] inspircd security and regression update

2016-01-13 Thread Ben Hutchings
been fixed. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-18 Thread Ben Hutchings
On Mon, 2016-01-18 at 05:08 +, Mike Gabriel wrote: > Hi Ben, hi all, > > On  So 17 Jan 2016 23:42:19 CET, Ben Hutchings wrote: > > > On Sun, 2016-01-17 at 13:10 +0100, Olivier Dousse wrote: > > > Hi Mike, > > > > > > I have the exact same

Re: Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-17 Thread Ben Hutchings
Additionally, the patch is *not* being applied isc-dhcp-server.  It is only applied when building isc-dhcp-server-ldap (see the commands for the build-stamp target).  It needs to be moved further up the patch series. Ben. -- Ben Hutchings Theory and practice are closer in

Security issues for jasper

2016-01-16 Thread Ben Hutchings
missing something? Ben. -- Ben Hutchings Theory and practice are closer in theory than in practice. - John Levine, moderator of comp.compilers signature.asc Description: This is a digitally signed message part

Re: Analysis of issue for phpmyadmin and request for comment on XSS issues

2016-06-26 Thread Ben Hutchings
y DBAs are going to turn Javascript off *and* check every link target before following it. However, I think XSS issues are generally treated as not meriting a DSA/DLA by themselves. Ben. -- Ben Hutchings Humour is the best antidote to reality. signature.asc Description: This is a digitally signed message part

[SECURITY] [DLA 412-1] linux-2.6 security update

2016-02-06 Thread Ben Hutchings
and CVE-2016-0723 were fixed in linux version 3.16.7-ckt20-1+deb8u3 and the remaining problems will be fixed soon. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: gajim 0.13.4-3+squeeze4 for testing

2016-02-04 Thread Ben Hutchings
some quilt files in the source which are > not applicable because gajim doesn't use quilt format. Ignore them, I > will fix this before uploading to squeeze-lts. I've been converting packages to 3.0 (quilt) where necessary, because it saves more time than I expect to waste in dealing with other patch system

[SECURITY] [DLA 426-1] libssh2 security update

2016-02-23 Thread Ben Hutchings
. For the oldstable (wheezy) and stable (jessie) distributions, this will be fixed soon. -- Ben Hutchings - Debian developer, member of Linux kernel and LTS teams signature.asc Description: This is a digitally signed message part

Re: squeeze update of libssh2?

2016-02-23 Thread Ben Hutchings
eady fixed both libssh and libssh2 as I had advance notice under embargo. Ben. -- Ben Hutchings Any smoothly functioning technology is indistinguishable from a rigged demo. signature.asc Description: This is a digitally signed message part

Accepted linux-2.6 2.6.32-48squeeze20 (all source) into squeeze-lts

2016-02-28 Thread Ben Hutchings
-48squeeze20 Distribution: squeeze-lts Urgency: high Maintainer: Debian Kernel Team <debian-ker...@lists.debian.org> Changed-By: Ben Hutchings <b...@decadent.org.uk> Description: firmware-linux-free - Binary firmware for various drivers in the Linux kernel linux-base - Linux image base packag

Re: Upgrading from Debian 6.0 LTS to 7

2016-02-20 Thread Ben Hutchings
, but it does not matter whether you do so before or after upgrading. Ben. > Any help would be much appreciated. > And a big thanks to LTS team for providing us LTS :) > -- Ben Hutchings Tomorrow will be cancelled due to lack of interest. signature.asc Description: This is a digitally signed message part

Re: Supporting armel/armhf in wheezy-lts

2016-04-24 Thread Ben Hutchings
On Sun, 2016-04-24 at 22:24 +0200, Ben Hutchings wrote: > On Mon, 2016-04-18 at 09:45 +0200, Markus Koschany wrote: > > > > Am 18.04.2016 um 08:45 schrieb Guido Günther: > > [...] > > > > > > > > > I'm all for it (although it's easy to say

Re: working for wheezy-security until wheezy-lts starts

2016-04-24 Thread Ben Hutchings
On Wed, 2016-04-13 at 21:51 +1000, Brian May wrote: [...] > (dvswitch) [...] This is known to be broken with newer libav and has not been fixed upstream.  (I think I was able to make it build, but it then crashed at run-time.)  Definitely a candidate for removal. Ben. -- Ben Hutchi

Re: Supporting armel/armhf in wheezy-lts

2016-04-24 Thread Ben Hutchings
spending much time on architecture-specific issues in stable updates (other than x86). Ben. -- Ben Hutchings Larkinson's Law: All laws are basically false. signature.asc Description: This is a digitally signed message part

Re: Supporting armel/armhf in wheezy-lts

2016-04-25 Thread Ben Hutchings
ove to a bounty model for working on LTS. [...] I seriously doubt my employer would let me work on LTS on this basis. Ben. -- Ben Hutchings All the simple programs have been written, and all the good names taken. signature.asc Description: This is a digitally signed message part

  1   2   3   4   >