Re: [vendor-sec] New Fetchmail issue

2005-12-20 Thread seth vidal
On Wed, 2005-12-21 at 00:05 -0500, Gene Heskett wrote: > On Tuesday 20 December 2005 16:40, Jesse Keating wrote: > >On Tue, 2005-12-20 at 12:22 -0800, Josh Bressers wrote: > >> http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt > >> > >> Just a DoS, nothing to cause a panic before the holiday :)

Re: [vendor-sec] New Fetchmail issue

2005-12-20 Thread Gene Heskett
On Tuesday 20 December 2005 16:40, Jesse Keating wrote: >On Tue, 2005-12-20 at 12:22 -0800, Josh Bressers wrote: >> http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt >> >> Just a DoS, nothing to cause a panic before the holiday :) > >>From investigation and chatting w/ RH, seems only FC2 is affe

Re: [vendor-sec] New Fetchmail issue

2005-12-20 Thread Jesse Keating
On Tue, 2005-12-20 at 12:22 -0800, Josh Bressers wrote: > http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt > > Just a DoS, nothing to cause a panic before the holiday :) From investigation and chatting w/ RH, seems only FC2 is affected by this (and FC3 but RH is fixing FC3). They recommend w

Re: mock/rh73

2005-12-20 Thread Rex Dieter
seth vidal wrote: On Tue, 2005-12-20 at 14:11 -0600, Rex Dieter wrote: John Dalbec wrote: Mach/apt is no longer supported Mach/yum doesn't work unless yum is at least the FC3 version Speaking of rh73... I've been trying to get mock/rh73 working (hosted on an rhel4 box), but have gotten stu

Re: mock/rh73

2005-12-20 Thread seth vidal
On Tue, 2005-12-20 at 14:11 -0600, Rex Dieter wrote: > John Dalbec wrote: > > Mach/apt is no longer supported > > Mach/yum doesn't work unless yum is at least the FC3 version > > Speaking of rh73... I've been trying to get mock/rh73 working (hosted on > an rhel4 box), but have gotten stuck(*). A

mock/rh73

2005-12-20 Thread Rex Dieter
John Dalbec wrote: Mach/apt is no longer supported Mach/yum doesn't work unless yum is at least the FC3 version Speaking of rh73... I've been trying to get mock/rh73 working (hosted on an rhel4 box), but have gotten stuck(*). Anyone have any luck with it? (*) chroot /var/lib/mock/redhat-7.3

Re: RPM/YUM/Mach catch-22

2005-12-20 Thread Jesse Keating
On Tue, 2005-12-20 at 12:59 -0600, Rex Dieter wrote: > Not with rh73's version of rpm. Epoch-less packages are the equivalent > of Epoch -1 (ie, Epoch: 0 trumps a lack of Epoch). > Ah, my bad. I glazed over the whole epoch thing, going with 'dont add if not there, don't bump if there' -- Je

Re: RPM/YUM/Mach catch-22

2005-12-20 Thread Rex Dieter
Jesse Keating wrote: When no epoch is present, 0 is assumed. Adding epoch 0 shouldn't break anything. Please try this and test within a chroot? Not with rh73's version of rpm. Epoch-less packages are the equivalent of Epoch -1 (ie, Epoch: 0 trumps a lack of Epoch). -- Rex -- fedora-lega

Re: RPM/YUM/Mach catch-22

2005-12-20 Thread Rex Dieter
John Dalbec wrote: Mach/apt is no longer supported Mach/yum doesn't work unless yum is at least the FC3 version RHL 7.3 libpng-devel is uninstallable using FC3 RPM because FC3 RPM expects versioned dependencies to include the epoch. I don't know whether adding the epoch to the versioned dependen

Re: RPM/YUM/Mach catch-22

2005-12-20 Thread Jesse Keating
On Tue, 2005-12-20 at 13:32 -0500, John Dalbec wrote: > Mach/apt is no longer supported > Mach/yum doesn't work unless yum is at least the FC3 version > RHL 7.3 libpng-devel is uninstallable using FC3 RPM because FC3 RPM expects > versioned dependencies to include the epoch. > I don't know whether

RPM/YUM/Mach catch-22

2005-12-20 Thread John Dalbec
Mach/apt is no longer supported Mach/yum doesn't work unless yum is at least the FC3 version RHL 7.3 libpng-devel is uninstallable using FC3 RPM because FC3 RPM expects versioned dependencies to include the epoch. I don't know whether adding the epoch to the versioned dependency would break RHL

Apache Security Advisory

2005-12-20 Thread James Kosin
Everyone, Apache has this patch for 1.3 and 2.0 breanches of apache to fix CVE-2005-3352 http://issues.apache.org/bugzilla/show_bug.cgi?id=37874 I've just applied the patch to my version. I'm guessing that since they applied a patch to both branches this is definately a problem for all leg

Re: createrepo

2005-12-20 Thread Jesse Keating
On Tue, 2005-12-20 at 12:54 -0500, John Dalbec wrote: > I'm pleased to see that someone has run createrepo in > http://download.fedoralegacy.org/redhat/7.3/updates/i386. Could that same > person please run createrepo in > http://download.fedoralegacy.org/redhat/7.3/os/i386? > Thanks, > John Ha

createrepo

2005-12-20 Thread John Dalbec
I'm pleased to see that someone has run createrepo in http://download.fedoralegacy.org/redhat/7.3/updates/i386. Could that same person please run createrepo in http://download.fedoralegacy.org/redhat/7.3/os/i386? Thanks, John -- fedora-legacy-list mailing list fedora-legacy-list@redhat.com htt

[Fwd: FYI: branch-1-5: fix local denial of service in relink]

2005-12-20 Thread James Kosin
Everyone, Not sure if this interests anyone. I reported and the libtool group responded with a patch for the mktemp file patch supplied by redhat. The group did say it was an open security / DOS (denial of service) problem. Also, sorry about my email not being signed... Our network went from w