Processed: You can close the bug.
Processing commands for cont...@bugs.debian.org: > # After browsing through all bugreports submitted by me I found the > # following ones or as fixed (at least I cannot reproduce the bug > # anymore), or I am just simple not interested in fixing them due > # to some other reasons. As a maintainer you can simply close them, > # I don't mind. > # 432017 - works for me now > submitter 432017 ! Bug #432017 [aptitude] Aptitude forgets about "automatically installed" status on upgrade. Changed Bug submitter to '"Artur R. Czechowski" ' from '"Artur R. Czechowski" ' > # 294115 - see the bugreport for explanation > submitter 294115 ! Bug #294115 [pump] pump: cannot get an IP from dhcp server Changed Bug submitter to '"Artur R. Czechowski" ' from '"Artur R. Czechowski" ' > # 338386 - works for me now > submitter 338386 ! Bug #338386 [aptitude] Resolving broken dependencies is not fully working Changed Bug submitter to '"Artur R. Czechowski" ' from '"Artur R. Czechowski" ' > # 432192 - solution given by maintainer, works for me > submitter 432192 ! Bug #432192 [pbuilder] debsign does not know about arch Changed Bug submitter to '"Artur R. Czechowski" ' from '"Artur R. Czechowski" ' > # 451639 - already not interested in having this implemented > submitter 451639 ! Bug #451639 [planet] Please add a hook run for new entries Changed Bug submitter to '"Artur R. Czechowski" ' from '"Artur R. Czechowski" ' > -- Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database) -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#294115: You can close the bug.
# After browsing through all bugreports submitted by me I found the # following ones or as fixed (at least I cannot reproduce the bug # anymore), or I am just simple not interested in fixing them due # to some other reasons. As a maintainer you can simply close them, # I don't mind. # 432017 - works for me now submitter 432017 ! # 294115 - see the bugreport for explanation submitter 294115 ! # 338386 - works for me now submitter 338386 ! # 432192 - solution given by maintainer, works for me submitter 432192 ! # 451639 - already not interested in having this implemented submitter 451639 ! -- Blogi to bastardy WWW, które się po nocach ryćkało z top-postingiem. /Leslie/ -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
netstat-nat 1.4.9-2 MIGRATED to testing
FYI: The status of the netstat-nat source package in Debian's testing distribution has changed. Previous version: 1.4.9-1 Current version: 1.4.9-2 -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See http://release.debian.org/testing-watch/ for more information. -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
html-munger REMOVED from testing
FYI: The status of the html-munger source package in Debian's testing distribution has changed. Previous version: 0.01-7 Current version: (not in testing) Hint: Package not in unstable The script that generates this mail tries to extract removal reasons from comments in the britney hint files. Those comments were not originally meant to be machine readable, so if the reason for removing your package seems to be nonsense, it is probably the reporting script that got confused. Please check the actual hints file before you complain about meaningless removals. -- This email is automatically generated once a day. As the installation of new packages into testing happens multiple times a day you will receive later changes on the next day. See http://release.debian.org/testing-watch/ for more information. -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#560920: CVE-2009-3560 and CVE-2009-3720 denial-of-services
package: matanza severity: serious tags: security Hi, The following CVE (Common Vulnerabilities & Exposures) ids were published for expat. I have determined that this package embeds a vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is a mass bug filing (due to so many packages embedding expat), I have not had time to determine whether the vulnerable code is actually present in any of the binary packages derived from this source package. Please determine whether this is the case. If the binary packages are not affected, please feel free to close the bug with a message containing the details of what you did to check. CVE-2009-3560[0]: | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, | as used in the XML-Twig module for Perl, allows context-dependent | attackers to cause a denial of service (application crash) via an XML | document with malformed UTF-8 sequences that trigger a buffer | over-read, related to the doProlog function in lib/xmlparse.c, a | different vulnerability than CVE-2009-2625 and CVE-2009-3720. CVE-2009-3720[1]: | The updatePosition function in lib/xmltok_impl.c in libexpat in Expat | 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, | allows context-dependent attackers to cause a denial of service | (application crash) via an XML document with crafted UTF-8 sequences | that trigger a buffer over-read, a different vulnerability than | CVE-2009-2625. These issues also affect old versions of expat, so this package in etch and lenny is very likely affected. This is a low-severity security issue, so DSAs will not be issued to correct these problems. However, you can optionally submit a proposed-update to the release team for inclusion in the next stable point releases. If you plan to do this, please open new bugs and include the security tag so we are aware that you are working on that. For further information see [0],[1],[2],[3]. In particular, [2] and [3] are links to the patches for CVE-2009-3560 and CVE-2009-3720 respectively. Note that the ideal solution would be to make use of the system expat so only one package will need to be updated for future security issues. Preferably in your update to unstable, alter your package to make use of the system expat. If you fix the vulnerability please also make sure to include the CVE id in your changelog entry. [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560 http://security-tracker.debian.org/tracker/CVE-2009-3560 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 http://security-tracker.debian.org/tracker/CVE-2009-3720 [2] http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165 [3] http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Bug#560940: CVE-2009-3560 and CVE-2009-3720 denial-of-services
package: tla severity: serious tags: security Hi, The following CVE (Common Vulnerabilities & Exposures) ids were published for expat. I have determined that this package embeds a vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is a mass bug filing (due to so many packages embedding expat), I have not had time to determine whether the vulnerable code is actually present in any of the binary packages derived from this source package. Please determine whether this is the case. If the binary packages are not affected, please feel free to close the bug with a message containing the details of what you did to check. CVE-2009-3560[0]: | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, | as used in the XML-Twig module for Perl, allows context-dependent | attackers to cause a denial of service (application crash) via an XML | document with malformed UTF-8 sequences that trigger a buffer | over-read, related to the doProlog function in lib/xmlparse.c, a | different vulnerability than CVE-2009-2625 and CVE-2009-3720. CVE-2009-3720[1]: | The updatePosition function in lib/xmltok_impl.c in libexpat in Expat | 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, | allows context-dependent attackers to cause a denial of service | (application crash) via an XML document with crafted UTF-8 sequences | that trigger a buffer over-read, a different vulnerability than | CVE-2009-2625. These issues also affect old versions of expat, so this package in etch and lenny is very likely affected. This is a low-severity security issue, so DSAs will not be issued to correct these problems. However, you can optionally submit a proposed-update to the release team for inclusion in the next stable point releases. If you plan to do this, please open new bugs and include the security tag so we are aware that you are working on that. For further information see [0],[1],[2],[3]. In particular, [2] and [3] are links to the patches for CVE-2009-3560 and CVE-2009-3720 respectively. Note that the ideal solution would be to make use of the system expat so only one package will need to be updated for future security issues. Preferably in your update to unstable, alter your package to make use of the system expat. If you fix the vulnerability please also make sure to include the CVE id in your changelog entry. [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560 http://security-tracker.debian.org/tracker/CVE-2009-3560 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 http://security-tracker.debian.org/tracker/CVE-2009-3720 [2] http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165 [3] http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch -- To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
