Re: Possible regression/problem with libssh2 update

2019-04-02 Thread Mike Gabriel
revision of the jessie package and will test later today with the PHP example given in #924965 msg-23. (Now, I need to run to an appointment). http://packages.sunweavers.net/debian/pool/main/libs/libssh2/ Greets, Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike

Re: Jessie update of cron?

2019-03-21 Thread Mike Gabriel
x27;t. @@ -149,7 +150,10 @@ +(CVE-2017-9525) + * Add d/NEWS altering to the new 1000 lines limit. + -+ -- Christian Kastner Sun, 17 Mar 2019 14:12:24 +0100 ++ [ Mike Gabriel ] ++ * debian/NEWS: Fix from unstable to jessie-security. ++ ++ -- Mike Gabriel Thu, 21 Mar 2019 20:43:10 +0100 +

Re: sqlalchemy security fix available for testing

2019-03-15 Thread Mike Gabriel
Hi Sylvain, On Fr 15 Mär 2019 15:35:07 CET, Mike Gabriel wrote: HI Sylvain, On Di 12 Mär 2019 15:17:01 CET, Sylvain Beucler wrote: Hi, I made a fix for sqlalchemy available for testing (CVE-2019-7164/7548): https://people.debian.org/~beuc/lts/sqlalchemy/ Upstream author Mike Bayer warns

Re: Jessie update of cron?

2019-03-15 Thread Mike Gabriel
Hi Christian, On Fr 15 Mär 2019 15:11:11 CET, Christian Kastner wrote: Hi Mike, On 2019-03-15 14:52, Mike Gabriel wrote: Dear maintainer(s), The Debian LTS team would like to fix the security issues which are currently open in the Jessie version of cron: https://security-tracker.debian.org

Re: sqlalchemy security fix available for testing

2019-03-15 Thread Mike Gabriel
d has arrived in jessie-security, so that one of the paid contributors can handle the DLAnnouncement. Thanks! Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139

Re: Jessie update of cron?

2019-03-15 Thread Mike Gabriel
take over the wheezy cron pkg, too. After my internal openssh woes (which I still need to look into, in fact), I could need some easy to fix package. Thanks for noticing. Please ack that the take over is ok. Thanks! Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 197

Jessie update of glib2.0?

2019-03-15 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of glib2.0 updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS

Jessie update of otrs2?

2019-03-15 Thread Mike Gabriel
he updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of otrs2 updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS team m

Jessie update of cron?

2019-03-15 Thread Mike Gabriel
he updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of cron updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS team m

Re: Bug#923486: CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possible

2019-03-08 Thread Mike Gabriel
t/?id=3d896c157c722bc47adca51a58dca859225b5874 -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@debian.org, http://sunweavers.net diff -Nru openssh-6.7p1/debian/changelog openssh-

w-i-p status for upcoming openssh upload to jessie LTS

2019-02-28 Thread Mike Gabriel
-i-p .debdiff to document work done on the jessie LTS upload proposal, but uploading does not make sense before CVE-2019-6111 receives a better fix. Greets, Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde mobile: +49

Re: DLA-1654-1 libav missing?

2019-02-06 Thread Mike Gabriel
advisories. Yu'll be happy to know that with the current patchset, this is the only older advisory missing until the 2018 gap due to the mailing list crash. :) See also: https://salsa.debian.org/webmaster-team/webwml/merge_requests/53 A. Nice! Mike -- mike gabriel aka sunweaver (D

Re: [SECURITY] [DLA 1635-1] sssd security update

2019-01-18 Thread Mike Gabriel
Hi all, On Do 17 Jan 2019 13:34:29 CET, Mike Gabriel wrote: Package: sssd Version: 1.11.7-3+deb8u2 CVE ID : CVE-2019-3811 Debian Bug : 919051 A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/'

Please test FreeRDP v1.1 upload candidates (jessie + stretch)

2019-01-11 Thread Mike Gabriel
Hi all, for those who don't read Planet Debian, here my request to test proposed updates for FreeRDP in jessie + stretch: https://sunweavers.net/blog/node/81 light+love, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 839

Bug#916912: [pre-approval] stretch-pu: package freerdp/1.1.0~git20140921.1.440916e+dfsg1-13+deb9u3

2018-12-20 Thread Mike Gabriel
Package: release.debian.org Severity: normal Tags: stretch User: release.debian@packages.debian.org Usertags: pu Dear Debian stretch Release Team, in Debian LTS, we are currently discussing a complex update of the freerdp (v1.1) package. The current status is this: * since March 2018 free

Re: Addressing FreeRDP security issues in Debian jessie (and stretch)

2018-12-12 Thread Mike Gabriel
Hi Moritz, On Wednesday, 12 December 2018, Moritz Mühlenhoff wrote: > On Wed, Dec 12, 2018 at 03:46:10PM +0000, Mike Gabriel wrote: > > Hi Moritz, > > > > On Di 11 Dez 2018 22:15:33 CET, Moritz Mühlenhoff wrote: > > > > > On Tue, Dec 11, 2018 at

Re: Addressing FreeRDP security issues in Debian jessie (and stretch)

2018-12-12 Thread Mike Gabriel
Hi Moritz, On Di 11 Dez 2018 22:15:33 CET, Moritz Mühlenhoff wrote: On Tue, Dec 11, 2018 at 04:42:17PM +, Mike Gabriel wrote: From my understanding the potential remote code executions that are mentioned in the CVE descriptions are triggered by a malign server and the code executions

Re: poppler: CVE-2018-16646 denial-of-service via crafted file

2018-12-12 Thread Mike Gabriel
Hi Moritz, On Mi 12 Dez 2018 11:46:32 CET, Moritz Mühlenhoff wrote: On Thu, Nov 08, 2018 at 10:51:37AM +, Mike Gabriel wrote: Hi Moritz, On Di 06 Nov 2018 17:14:35 CET, Moritz Mühlenhoff wrote: > On Fri, Sep 28, 2018 at 08:32:25PM +0200, Markus Koschany wrote: > > Package

Re: Addressing FreeRDP security issues in Debian jessie (and stretch)

2018-12-11 Thread Mike Gabriel
Hi Moritz, On Mo 10 Dez 2018 22:30:34 CET, Moritz Mühlenhoff wrote: On Mon, Dec 10, 2018 at 05:44:51PM +, Mike Gabriel wrote: Hi, I'd like to discuss the possible pathways for getting FreeRDP fixed in Debian jessie LTS (and Debian stretch, too). debian-security@ldo is not the p

Addressing FreeRDP security issues in Debian jessie (and stretch)

2018-12-10 Thread Mike Gabriel
ways to go? If so, please share yours. The FreeRDP v1.1 backporting work (8-10 hours) would have to be outsourced to ThinCast in Austria (where most FreeRDP upstream devs work these days). Looking forward to your ideas and comments, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleck

[libav LTS triaging] Re: Resource for PoCs found

2018-12-05 Thread Mike Gabriel
Hi again, hi Markus, On Do 06 Dez 2018 08:17:29 CET, Mike Gabriel wrote: Hi, today, I stumbled over a Git repo on Github containing many proof of contents for various open/closed CVEs: https://github.com/asarubbo/poc/ Probably, some of us already know that repo, but I thought, I&#

Resource for PoCs found

2018-12-05 Thread Mike Gabriel
Hi, today, I stumbled over a Git repo on Github containing many proof of contents for various open/closed CVEs: https://github.com/asarubbo/poc/ Probably, some of us already know that repo, but I thought, I'd share it anyway. Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, her

not many tasks in dla-needed.txt, is extra CVE triaging required

2018-11-29 Thread Mike Gabriel
s, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de pgpAWgjzCw_8b.pgp Descriptio

Re: unclaiming packages claimed for 3 weeks or more

2018-11-27 Thread Mike Gabriel
Hi Holger, On Mo 26 Nov 2018 21:42:15 CET, Holger Levsen wrote: so I just ran "./bin/review-update-needed --lts --unclaim 3w" again and it would unclaim src:salt from Mike Gabriel, as Mike has claimed it more than 3 weeks ago and has not stated anything in a note in data/dla-needed.

Re: poppler: CVE-2018-16646 denial-of-service via crafted file

2018-11-08 Thread Mike Gabriel
S (see attached .debdiff). @Moritz: do you see any reason for holding it back at this moment? Thanks+Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30

Re: [SECURITY] [DLA 1488-1 (invalid)] spice security update

2018-08-31 Thread Mike Gabriel
Dear all, On Fr 31 Aug 2018 23:30:53 CEST, Mike Gabriel wrote: Package: spice Version: 0.12.5-1+deb8u6 CVE ID : CVE-2018-10873 Debian Bug : #906315 A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling

Bug#907723: link package versions on security-tracker to source packages

2018-08-31 Thread Mike Gabriel
r/CVE-2018-10873 -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de pgpJ0yLem6HwV.pgp Descri

Re: Getting phpldapadmin (CVE-2018-12869) fixed

2018-08-16 Thread Mike Gabriel
Hi Brian, On Do 16 Aug 2018 09:15:11 CEST, Brian May wrote: Mike Gabriel writes: Unfortunately, I can only continue working on this when back from vacation (13th Aug). I will remove my name from the package in dla-needed.txt and if noone else has picked it up until then, I will continue my

Getting phpldapadmin (CVE-2018-12869) fixed

2018-07-31 Thread Mike Gabriel
it up until then, I will continue my work that I already started today. The other open issue for phpldapadmin (no-dsa, actually) CVE-2017-11107 is easy to fix (Ubuntu has a patch for it). Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148

Re: Jessie update of network-manager-vpnc?

2018-07-31 Thread Mike Gabriel
Hi Michael, On Sa 21 Jul 2018 01:22:50 CEST, Michael Biebl wrote: Am 21.07.2018 um 00:13 schrieb Mike Gabriel: Dear maintainer(s), The Debian LTS team would like to fix the security issues which are currently open in the Jessie version of network-manager-vpnc: https://security

Re: Jessie update of network-manager-vpnc?

2018-07-22 Thread Mike Gabriel
Hi Michael, On Saturday, July 21, 2018, Michael Biebl wrote: > Am 21.07.2018 um 00:13 schrieb Mike Gabriel: > > Dear maintainer(s), > > > > The Debian LTS team would like to fix the security issues which are > > currently open in the Jessie version of network-manager

Re: Jessie update of mutt?

2018-07-21 Thread Mike Gabriel
HI Antonio, On Sa 21 Jul 2018 06:41:21 CEST, Antonio Radici wrote: On Thu, Jul 19, 2018 at 04:06:06PM +0200, Mike Gabriel wrote: Dear maintainer(s), The Debian LTS team would like to fix the security issues which are currently open in the Jessie version of mutt: https://security

Jessie update of libxml2?

2018-07-20 Thread Mike Gabriel
. Just let us know whether you would like to review and/or test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of libxml2 updates for the LTS releases. Thank you very much. Mike Gabriel, on

Jessie update of network-manager-vpnc?

2018-07-20 Thread Mike Gabriel
iew and/or test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of network-manager-vpnc updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS te

Re: Jessie update of phpldapadmin?

2018-07-19 Thread Mike Gabriel
Hi Fabio, On Do 19 Jul 2018 16:34:36 CEST, Fabio Tranchitella wrote: Dear Mike, On 19/07/2018 16:25, Mike Gabriel wrote: Dear maintainer(s), The Debian LTS team would like to fix the security issues which are currently open in the Jessie version of phpldapadmin: https://security

Re: Jessie update of clamav?

2018-07-19 Thread Mike Gabriel
Hi all, On Do 19 Jul 2018 21:18:13 CEST, Sebastian Andrzej Siewior wrote: On 2018-07-19 17:06:30 [+0200], Mike Gabriel wrote: The Debian LTS team would like to fix the security issues which are currently open in the Jessie version of clamav: https://security-tracker.debian.org/tracker/CVE

Jessie update of clamav?

2018-07-19 Thread Mike Gabriel
ust let us know whether you would like to review and/or test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of clamav updates for the LTS releases. Thank you very much. Mike Gabriel, on beh

Jessie update of phpldapadmin?

2018-07-19 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of phpldapadmin updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member

Jessie update of resiprocate?

2018-07-19 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of resiprocate updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of th

Jessie update of vim-syntastic?

2018-07-19 Thread Mike Gabriel
nd/or test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of vim-syntastic updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member

Jessie update of ruby-zip?

2018-07-19 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of ruby-zip updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of th

Jessie update of sam2p?

2018-07-19 Thread Mike Gabriel
ust let us know whether you would like to review and/or test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of sam2p updates for the LTS releases. Thank you very much. Mike Gabriel, on beh

Jessie update of mutt?

2018-07-19 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of mutt updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS

Jessie update of twig?

2018-07-19 Thread Mike Gabriel
r test the updated package before it gets released. You can also opt-out from receiving future similar emails in your answer and then the LTS Team will take care of twig updates for the LTS releases. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS team h

Re: Wheezy update of smarty3?

2018-01-18 Thread Mike Gabriel
code gets executed. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de pgpSmcO

Re: Wheezy update of smarty3?

2018-01-18 Thread Mike Gabriel
21. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de diff -Nru smarty3-3.1.21/debian/c

Re: Wheezy update of smarty3?

2018-01-14 Thread mike . gabriel
Hi Chris, On Sunday, January 14, 2018, Chris Lamb wrote: > Hey Mike, > > > I will take over fixing the open CVE for smarty3 on wheezy during the > > week in the course of getting the other versions fixed, too. > > > > Ping me again in a week, if no upload has occurred. > > Hey, how are you ge

Re: Wheezy update of smarty3?

2018-01-07 Thread Mike Gabriel
t I will take over fixing the open CVE for smarty3 on wheezy during the week in the course of getting the other versions fixed, too. Ping me again in a week, if no upload has occurred. Thanks, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby mobile: +49 (1520) 1976 148 lan

Re: Wheezy update of freerdp?

2017-07-30 Thread Mike Gabriel
h. Markus Koschany, on behalf of the Debian LTS team. I'd appreciate, if the the wheezy LTS team could handle the security upload of freerdp(v1). Thanks! Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint:

Re: Security update of Gosa

2016-06-21 Thread Mike Gabriel
self. Greets, Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4354) 8390 139 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@debian.org, http://sunweavers.net pgpidsAkHdQ2g.pgp Description: Digitale PGP-Signatur

Re: working for wheezy-security until wheezy-lts starts

2016-03-01 Thread Mike Gabriel
On Di 01 Mär 2016 08:44:08 CET, Guido Günther wrote: On Tue, Mar 01, 2016 at 07:15:28AM +, Mike Gabriel wrote: [..snip..] >>Issues that are unfixed in wheezy but fixed in squeeze: >>* aptdaemon-> CVE-2015-1323 >>* cakephp -> TEMP-0

Re: working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Mike Gabriel
9639 CVE-2014-9640 CVE-2015-6749 """ I think these would be adressed via stable point release updates in wheezy/jessie rather than going via the security team. Yeah, if at all. I just listed them for completeness sake. Mike -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@debian.org, http://sunweavers.net pgpilfX2MIOoU.pgp Description: Digitale PGP-Signatur

maintainer feedback on CVE-2014-8350 (smarty3)

2016-02-29 Thread Mike Gabriel
https://github.com/smarty-php/smarty/commit/279bdbd3521cd717cae6a3ba48f1c3c6823f439d.patch -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mai

working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Mike Gabriel
g workflow can be very similar to what we are used to. For the interim phase until the 26th of April 2016, however, we need to run a modified approach. Request for feedback and comments... (I have some concrete proposals in mind, but I want to check, if these issues have already been solv

Re: triaging CVE-2016-1503+1504

2016-01-25 Thread Mike Gabriel
d. Further actions: try exploit, ask upstream, second opinion. did you contact upstream about that alread? I don't want to bother them again. Cheers, -- Guido No, I haven't contacted upstream, yet. Nor have I tried the exploit on dhcpcd in Debian squeeze(-lts). Greets, Mike -- mike g

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-18 Thread Mike Gabriel
Hi all, On Mo 18 Jan 2016 14:25:18 CET, Mike Gabriel wrote: I will rebuild my chroots, test removing again the CFLAGS export in debian/rules and test the resulting packages once more. New upload (+squeeze10) of isc-dhcp has just been dput to squeeze-lts. The new version should be

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-18 Thread Mike Gabriel
today. Any feedback on the provided .debdiff is welcome. I will rebuild my chroots, test removing again the CFLAGS export in debian/rules and test the resulting packages once more. /me sighs and deeply apologizes, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-18 Thread Mike Gabriel
Hi Ben, On Mo 18 Jan 2016 12:47:51 CET, Ben Hutchings wrote: On Mon, 2016-01-18 at 05:08 +, Mike Gabriel wrote: Hi Ben, hi all, On  So 17 Jan 2016 23:42:19 CET, Ben Hutchings wrote: > On Sun, 2016-01-17 at 13:10 +0100, Olivier Dousse wrote: > > Hi Mike, > > > >

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-18 Thread Mike Gabriel
sc-dhcp.pkg/isc-dhcp_4.1.1-P1-15+squeeze9_4.1.1-P1-15+squeeze10.debdiff -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/mailxc

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-17 Thread Mike Gabriel
queeze10 revision upload, but I'd really like to get the dhcpd.conf issue sorted out and addressed with next upload first. I will upload +squeeze10 with attached .debdiff later today. Any feedback on the provided .debdiff is welcome. Thanks+Greets, Mike -- DAS-NETZWERKTEAM mike gabrie

Re: squeeze update of openssh?

2016-01-15 Thread Mike Gabriel
t-affected by one of those TEMP issues, the other one (X11 SECURITY / ssh -X issue) should get fixed IMHO. Greets, Mike -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@deb

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-15 Thread Mike Gabriel
ding from dhcp3-server. Thanks+Greets, Mike PS: Attached is the .debdiff between isc-dhcp-4.1.1-P1-15+squeeze8 and isc-dhcp-4.1.1-P1-15+squeeze9. -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de

squeeze update of openssh?

2016-01-15 Thread Mike Gabriel
iew and/or test the updated package before it gets released. Thank you very much. Mike Gabriel, on behalf of the Debian LTS team. PS: A member of the LTS team might start working on this update at any point in time. You can verify whether someone is registered on this update in this f

Re: isc-dhcp-server in squeeze-lst broken after update

2016-01-15 Thread Mike Gabriel
tly upload package and report back. Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/mailxchange/kronolith/fb.ph

Re: squeeze update of tiff?

2016-01-04 Thread Mike Gabriel
queeze LTS update yourself. I (with my LTS team hat on) just signed up for looking at fixing tiff in squeeze-lts. @László: once you finished your research tomorrow, could you send a short summary with your findings (or even upload a new package version to unstable)? Thanks+>Greets, Mike

Re: squeeze update of fuseiso?

2015-10-01 Thread Mike Gabriel
reproducer ISO images at hand. Greets, Mike [1] https://bugzilla.redhat.com/show_bug.cgi?id=862211 [2] https://bugzilla.redhat.com/show_bug.cgi?id=861358 -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das

Re: squeeze update of wordpress?

2015-09-30 Thread Mike Gabriel
ng on fixing wordpress in squeeze-lts now. Regards, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%

Re: Marking TEMP-* issues as resolved

2015-09-29 Thread Mike Gabriel
ually commit that change (or such)? The commit directly after the above mail seems to be rev36841, but that only contains references to upstream fixes, not a reference from data/CVE/list to a DLA in data/DLA/list. Just curious and eager to learn more about the workflow of Debian security

Re: libemail-address-perl, no "squeeze update of ..." mail sent, yet

2015-09-29 Thread Mike Gabriel
Hi again, On Di 29 Sep 2015 15:06:23 CEST, Mike Gabriel wrote: Hi Raphael, On Di 29 Sep 2015 13:55:06 CEST, Raphael Hertzog wrote: On Tue, 29 Sep 2015, Mike Gabriel wrote: Is there a reason that no "squeeze update of ..." mail has been sent for libemail-address-perl, yet, (

Re: libemail-address-perl, no "squeeze update of ..." mail sent, yet

2015-09-29 Thread Mike Gabriel
Hi again, On Di 29 Sep 2015 15:06:23 CEST, Mike Gabriel wrote: Hi Raphael, On Di 29 Sep 2015 13:55:06 CEST, Raphael Hertzog wrote: On Tue, 29 Sep 2015, Mike Gabriel wrote: Is there a reason that no "squeeze update of ..." mail has been sent for libemail-address-perl, yet, (

Re: libemail-address-perl, no "squeeze update of ..." mail sent, yet

2015-09-29 Thread Mike Gabriel
Hi Raphael, On Di 29 Sep 2015 13:55:06 CEST, Raphael Hertzog wrote: On Tue, 29 Sep 2015, Mike Gabriel wrote: Is there a reason that no "squeeze update of ..." mail has been sent for libemail-address-perl, yet, (i.e., when triaging the latest security issue in that package)? Yes,

libemail-address-perl, no "squeeze update of ..." mail sent, yet

2015-09-29 Thread Mike Gabriel
ke -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb pgptW_0f7VawL.pgp Description

Re: [SECURITY] [DLA 317-1] vorbis-tools security update

2015-09-29 Thread Mike Gabriel
HI Raphael, On Di 29 Sep 2015 11:45:19 CEST, Raphael Hertzog wrote: Hello Mike, On Tue, 29 Sep 2015, Mike Gabriel wrote: Package: vorbis-tools Version: 1.4.0-1+deb6u1 This package seems to have never been uploaded to squeeze-lts... You are supposed to wait until you get

Re: squeeze update of vorbis-tools?

2015-09-21 Thread Mike Gabriel
on an LTS update of vorbis-tools during this week. light+love, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy

Re: VirtualBox support in squeeze LTS

2015-09-07 Thread Mike Gabriel
on the wiki, "virtualbox-ose (Mike Gabriel)" so please Mike, can you get the packaging and followup with the upload? You can dget them easily from DoM, or ask me to put them everywhere else I don't know that LTS stuff enough to learn it and do things correctly. I would apprecia

Re: Bug#793616: marked as done (openssh: CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices)

2015-08-20 Thread Mike Gabriel
5719.  If you > didn't include that then I think you need to issue a follow-up advisory. > > -- > Colin Watson                                      Thanks for feedback, I put the above on my radar and will check and follow-up when I have returned from VAC. Mike -- DAS-NET

Re: squeeze update of remind?

2015-08-07 Thread Mike Gabriel
Dear Ana, - Original message - > On Fri, Aug 07, 2015 at 11:17:57AM +0000, Mike Gabriel wrote: > > Hi Ana, > > > > On  Mi 29 Jul 2015 23:13:39 CEST, Ana Guerrero Lopez wrote: > > > > > On Wed, Jul 29, 2015 at 04:45:37PM +0200, Santiago Ruano Ri

Re: squeeze update of remind?

2015-08-07 Thread Mike Gabriel
ake care of the update. Have been a CVE number assigned already? Ana ooopss... Sorry! Only found/read this mail now. I have just uploaded a fix for the above issue to squeeze-lts. Hope that was ok. Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 14

CVE-2015-5352: openSSH in squeeze not affected(?)

2015-07-16 Thread Mike Gabriel
drot.org/openssh.git/commit/?h=V_6_9&id=1bf477d3cdf1a864646d59820878783d42357a1d -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerk

Re: bin/genDLA proposal: auto-commit requested DLA numbers (was: Re: [SECURITY] [DLA 265-1] unattended-upgrades security update)

2015-07-05 Thread Mike Gabriel
HI Raphael, On Sa 04 Jul 2015 08:25:27 CEST, Raphael Hertzog wrote: Hi, On Sat, 04 Jul 2015, Mike Gabriel wrote: >It displays a colorful warning and offers to commit only the >modified file (if you use svn, if you use git-svn like me, you're on your >own). Why not also comm

Re: bin/genDLA proposal: auto-commit requested DLA numbers (was: Re: [SECURITY] [DLA 265-1] unattended-upgrades security update)

2015-07-03 Thread Mike Gabriel
Hi Raphael, On Fr 03 Jul 2015 21:19:14 CEST, Raphael Hertzog wrote: On Fri, 03 Jul 2015, Mike Gabriel wrote: I just discussed this with Moritz Mühlenhoff on #debian-security. His request is to leave all genDSA specific stuff in the genD{S,L}A script untouched. What about the attached patch

bin/genDLA proposal: auto-commit requested DLA numbers (was: Re: [SECURITY] [DLA 265-1] unattended-upgrades security update)

2015-07-03 Thread Mike Gabriel
Hi all, On Fr 03 Jul 2015 13:49:29 CEST, Mike Gabriel wrote: Can this svn commit for the DLA number not be done within bin/genDLA ? Well... Actually it could. Good point. Let me get some feedback from the security team as genDLA is a symlink to genDSA which is the main tool used by the

Re: [SECURITY] [DLA 265-1] unattended-upgrades security update

2015-07-03 Thread Mike Gabriel
On Fr 03 Jul 2015 13:08:25 CEST, Christian Mack wrote: Hello Am 03.07.2015 um 13:03 schrieb Mike Gabriel: Hi Holger, On Fr 03 Jul 2015 12:48:06 CEST, Holger Levsen wrote: Hi, On Freitag, 3. Juli 2015, Mike Gabriel wrote: The only way I can think of in terms of making this more fool

Re: [SECURITY] [DLA 265-1] unattended-upgrades security update

2015-07-03 Thread Mike Gabriel
Hi Holger, On Fr 03 Jul 2015 12:48:06 CEST, Holger Levsen wrote: Hi, On Freitag, 3. Juli 2015, Mike Gabriel wrote: The only way I can think of in terms of making this more fool proof, I guess, is by rejecting mails to debian-lts-announce if o a used DLA has not been reserved via the

Re: libxml2 in squeeze-lts: remove or activate patch files in debian/patches

2015-07-03 Thread Mike Gabriel
in "1.0" formatted packages documented somewhere? Or is it documented in the Debian policy? Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de fr

Re: [SECURITY] [DLA 265-1] unattended-upgrades security update

2015-07-03 Thread Mike Gabriel
comments? Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb pgpD6YCUlUBhe.pgp

Re: debdiff for CVE-2015-3206 (pykerberos)

2015-07-02 Thread Mike Gabriel
Hi Guido, On Mi 01 Jul 2015 09:05:36 CEST, Guido Günther wrote: On Tue, Jun 30, 2015 at 09:14:14PM +, Mike Gabriel wrote: Hi Guido, I just saw that you are co-maintainer of pykerberos. I realized after I had already put my name behind the package name in dla-needed.txt. As you are also

debdiff for CVE-2015-3206 (pykerberos)

2015-06-30 Thread Mike Gabriel
https://github.com/02strich/pykerberos/commit/02d13860b25fab58e739f0e000bed0067b7c6f9c [2] https://security-tracker.debian.org/tracker/CVE-2015-3206 -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwer

Re: Accepted fuse 2.8.4-1.1+deb6u1 (source amd64) into squeeze-lts

2015-06-06 Thread Mike Gabriel
Hi László, On Fr 05 Jun 2015 21:03:03 CEST, László Böszörményi (GCS) wrote: Hi all, On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel wrote: On Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote: On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote: Source: fuse Version: 2.8.4-1.1+deb6u1

Security update of libxml2 in Debian squeeze-lts

2015-06-04 Thread Mike Gabriel
debian squeeze main -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb diff -u

Re: Accepted fuse 2.8.4-1.1+deb6u1 (source amd64) into squeeze-lts

2015-06-04 Thread Mike Gabriel
, Holger Let me know if you need a hand with this. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel

Re: squeeze update of fuse?

2015-06-01 Thread Mike Gabriel
Hi Laszlo, - Original message - > On Mon, Jun 1, 2015 at 3:36 PM, Mike Gabriel > wrote: > > On  Mo 01 Jun 2015 11:44:27 CEST, László Böszörményi (GCS) wrote: > > > I consider this my fault - I had the assumption that Thorsten will or > > > already did th

Re: squeeze update of fuse?

2015-06-01 Thread Mike Gabriel
appy to do (and will do) a DebLTS NMU (referecing Santiago as the patch author/rebaser). Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de f

Re: squeeze update of fuse?

2015-06-01 Thread Mike Gabriel
u prefer. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb pgp_J3ngnLcCY.

Re: Debian squeeze LTS, a last release

2015-05-30 Thread Mike Gabriel
nkful that the Debian project is so well documented, because asking all the relevant questions would be more time consuming than reading good documentation.] Greets, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike

Re: squeeze update of fuse?

2015-05-30 Thread Mike Gabriel
Regards, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb pgpGxYO

Bug#784214: allow manual override for the regression DLA/DSA Id

2015-05-04 Thread Mike Gabriel
Package: security-tracker Severity: wishlist Tags: patch Hi, attached is a patch that adds manual DLA/DSA id override support if an upload tackles a regression already announce via an earlier DSA/DLA. Current use case / example: xorg-server +deb6u1 (DLA-120-1) fixed CVE-2014-8092 xorg-serve

Request for review xdg-utils 1.0.2+cvs20100307-2+deb6u1

2015-04-22 Thread Mike Gabriel
iff is attached. The .dsc file (source package) can be obtained from [1]. Thanks! Mike [1] http://packages.it-zukunft-schule.de/debian/pool/main/x/xdg-utils/xdg-utils_1.0.2+cvs20100307-2+deb6u1.dsc -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB

Re: Request for review: xorg-server 2:1.7.7-18+deb6u2 (CVE-2015-0255)

2015-04-22 Thread Mike Gabriel
Hi again... On Mi 22 Apr 2015 14:31:40 CEST, Mike Gabriel wrote: Debdiff is attached to this mail. The .dsc file can be obtained via [1]. and here comes the missing .debdiff... Mike -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8

Request for review: xorg-server 2:1.7.7-18+deb6u2 (CVE-2015-0255)

2015-04-22 Thread Mike Gabriel
about some feedback, Mike [1] http://packages.it-zukunft-schule.de/debian/pool/main/x/xorg-server/xorg-server_1.7.7-18+deb6u2.dsc -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunwea...@debia

<    1   2   3   >