Package: kdelibs3 Version: 4:2.2.2-13.woody.12 Severity: normal I just wanted to apply the latest security update for kdelibs (DSA 631-1), I was quite astonished, when I got The following NEW packages will be installed: libarts libglib2.0-0
I was under the impression, that security updates should only change
the minimum possible. DSA 631-1 I did not list any notice regarding new
dependencies.
I compared the dependencies of -13.woody.12 (Installed as of this writing)
and -13.woody.13 which is supposed to be the security update. I see, that
two new dependencies have been added:
libarts (>= 4:2.2.2-1) | libarts-alsa (>= 4:2.2.2-1)
libglib2.0-0 (>= 2.0.1)
If these are indeed security-related changes, than they should be mentioned
in the DSA.
I downloaded the deb next and looked at the changelog. It states:
* Non-maintainer upload by the Security Team
* Applied upstream patch to fix arbitrary FTP command execution
[kio/ftp/ftp.cc, CAN-2004-1165]
Again, no mentioning of changed dependencies. I now really start to wonder
what has happened.
-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux zola 2.4.28-grsec-hk02 #1 Mon Dec 27 14:36:44 CET 2004 i686
Locale: LANG=C, LC_CTYPE=C
Versions of packages kdelibs3 depends on:
ii kdelibs3-bin 4:2.2.2-13.woody.12 KDE core binaries (binary files)
ii kdelibs3-bin [kdelib 4:2.2.2-13.woody.12 KDE core binaries (binary files)
ii libbz2-1.0 1.0.2-1 A high-quality block-sorting file
ii libc6 2.2.5-11.5 GNU C Library: Shared libraries an
ii libfam0 2.6.6.1-5.2 client library to control the FAM
ii libjpeg62 6b-5 The Independent JPEG Group's JPEG
ii libpcre3 3.4-1.1 Philip Hazel's Perl Compatible Reg
ii libpng2 1.0.12-3.woody.9 PNG library - runtime
ii libqt2 3:2.3.1-22 Qt GUI Library (runtime version).
ii libstdc++2.10-glibc2 1:2.95.4-11woody1 The GNU stdc++ library
ii libtiff3g 3.5.5-6.woody5 Tag Image File Format library
ii libxml2 2.4.19-4woody2 GNOME XML library
ii libxslt1 1.0.16-0.2 XSLT processing library
ii xbase-clients 4.1.0-16woody5 miscellaneous X clients
ii xlibs 4.1.0-16woody5 X Window System client libraries
ii zlib1g 1:1.1.4-1.0woody0 compression library - runtime
--
Helge Kreutzmann, Dipl.-Phys. [EMAIL PROTECTED]
gpg signed mail preferred
64bit GNU powered http://www.itp.uni-hannover.de/~kreutzm
Help keep free software "libre": http://www.freepatents.org/
pgp3wFCOz9n18.pgp
Description: PGP signature
