Bug#1092025: bookworm-pu: package libebml/1.4.4-1+deb12u1

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: libe...@packages.debian.org Control: affects -1 + src:libebml User: release.debian@packages.debian.org Usertags: pu Fixes a minor security issues, tested with mkvtoolnix. Cheers, Moritz diff -Nru libebml-1.4.4/

Bug#1092018: bookworm-pu: package tiff/4.5.0-6+deb12u2

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: t...@packages.debian.org, g...@debian.org Control: affects -1 + src:tiff User: release.debian@packages.debian.org Usertags: pu Fixes various low severity security issues in tiff, PoCs have all been used to (where availab

Bug#1091885: bookworm-pu: package audiofile/0.3.6-5+deb12u1

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: audiof...@packages.debian.org, debian-multime...@lists.debian.org Control: affects -1 + src:audiofile User: release.debian@packages.debian.org Usertags: pu Fixes two minor security issues not worth a DSA, debdiff below.

Bug#1091857: bookworm-pu: package gnuchess/6.2.7-1+deb12u1

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: gnuch...@packages.debian.org Control: affects -1 + src:gnuchess User: release.debian@packages.debian.org Usertags: pu Fix for low severity issue which doesn't warrant a DSA, debdiff below. Cheers, Moritz diff -

Bug#1091761: bookworm-pu: package poco/1.11.0-3+deb12u1

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: p...@packages.debian.org Control: affects -1 + src:poco User: release.debian@packages.debian.org Usertags: pu Fix for CVE-2023-52389 (which doesn't warrant a DSA), debdiff below. Cheers, Moritz diff -Nru poco-1

Bug#1091632: RUSTSEC-2024-0428

Source: rust-kvm-ioctls Version: 0.2.0-1 Severity: important Tags: security X-Debbugs-Cc: Debian Security Team https://rustsec.org/advisories/RUSTSEC-2024-0428.html https://github.com/rust-vmm/kvm/pull/298 Cheers, Moritz

Bug#1086506: RM: mathtex -- RoQA; dead upstram, open security issues, orphaned

Package: ftp.debian.org Severity: normal Tags: security X-Debbugs-Cc: math...@packages.debian.org, Debian Security Team Control: affects -1 + src:mathtex User: ftp.debian@packages.debian.org Usertags: remove Please remove mathtex, it's dead upstream and there are open security issues. The la

Bug#1086505: RM: clickhouse -- RoQA; unmaintained, open security issues, outdated, RC-buggy

Package: ftp.debian.org Severity: normal Tags: security X-Debbugs-Cc: clickho...@packages.debian.org, Debian Security Team Control: affects -1 + src:clickhouse User: ftp.debian@packages.debian.org Usertags: remove Please remove clickhouse. The last maintainer upload was in 2019, there's a lo

Bug#1086302: RM: lief -- RoQA; unmaintained, RC-buggy, open security issue

Package: ftp.debian.org Severity: normal Tags: security X-Debbugs-Cc: l...@packages.debian.org, Debian Security Team Control: affects -1 + src:lief User: ftp.debian@packages.debian.org Usertags: remove Please remove lief. The last maintainer upload was over six years ago, the package FTBFSes

Bug#1086301: RM: mathtex -- RoQA; orphaned, dead upstream, open security issues

Package: ftp.debian.org Severity: normal Tags: security X-Debbugs-Cc: math...@packages.debian.org, Debian Security Team Control: affects -1 + src:mathtex User: ftp.debian@packages.debian.org Usertags: remove Please remove mathtex. It's dead upstream and there are open security issues. Cheer

Bug#1082053: RUSTSEC-2023-0086

Source: rust-lexical-core Version: 0.7.6-2 Severity: important Tags: security X-Debbugs-Cc: Debian Security Team https://rustsec.org/advisories/RUSTSEC-2023-0086.html https://github.com/Alexhuszagh/rust-lexical/issues/102 https://github.com/Alexhuszagh/rust-lexical/issues/101 https://github.com/

Bug#1080080: RM: aiorwlock -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: aiorwl...@packages.debian.org Control: affects -1 + src:aiorwlock User: ftp.debian@packages.debian.org Usertags: remove Please remove aiorwlock. It FTBFSes since three years and the last maintainer upload was in 2019. Cheers, Mori

Bug#1079993: RM: evqueue-core -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: evqueue-c...@packages.debian.org Control: affects -1 + src:evqueue-core User: ftp.debian@packages.debian.org Usertags: remove Please remove evqueue-core. It's RC-buggy since over five years and the last maintainer upload was in 2018. Chee

Bug#1079992: RM: aiocoap -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: aioc...@packages.debian.org Control: affects -1 + src:aiocoap User: ftp.debian@packages.debian.org Usertags: remove Please remove aiocoap. It FTBFSes since over two years and the last maintainer upload was in 2019. Cheers, Moritz

Bug#1079991: RM: aws-shell -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: aws-sh...@packages.debian.org Control: affects -1 + src:aws-shell User: ftp.debian@packages.debian.org Usertags: remove Please remove aws-shell. It's RC-buggy and dropped from testing since 4.5 years and the last maintainer upload was in 2

Bug#1079990: RM: fonts-alegreya-sans -- RoQA; ummaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: fonts-alegreya-s...@packages.debian.org Control: affects -1 + src:fonts-alegreya-sans User: ftp.debian@packages.debian.org Usertags: remove Please remove fonts-alegreya-sans. There was only ever a single upload back in 2019 and the package

Bug#1079989: RM: python-arrayfire -- RoQA; blocks removal of arrayfire

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: python-arrayf...@packages.debian.org Control: affects -1 + src:python-arrayfire User: ftp.debian@packages.debian.org Usertags: remove src:arrayfire is RC-buggy and has a pending RM bug. This package contains the Python bindings and needs t

Bug#1079988: RM: arrayfire -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: arrayf...@packages.debian.org Control: affects -1 + src:arrayfire User: ftp.debian@packages.debian.org Usertags: remove Please remove arrayfire. The last upload was in 2016 and it's dropped from testing due to RC bugs since 2018 (e.g. FTBF

Bug#1079695: RM: xmms2-scrobbler -- RoQA; broken, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: xmms2-scrobb...@packages.debian.org Control: affects -1 + src:xmms2-scrobbler User: ftp.debian@packages.debian.org Usertags: remove Please remove xmms2-scrobbler. It's broken since last.fm changed their site in 2015 (!) (#798099) and the l

Bug#1079694: RM: jajuk -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ja...@packages.debian.org Control: affects -1 + src:jajuk User: ftp.debian@packages.debian.org Usertags: remove Please remove jajuk. The last upload happened in 2017 and it's RC-buggy/removed from testing for over five years now. Cheers,

Bug#1079690: RM: perl-doc-html -- RoQA; unmaintained, outdated

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: perl-doc-h...@packages.debian.org Control: affects -1 + src:perl-doc-html User: ftp.debian@packages.debian.org Usertags: remove Please remove perl-doc-html. It contains outdated docs, has been dropped from testing since 2018 and is orphane

Bug#1079657: RM: fakeroot-ng -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: fakeroot...@packages.debian.org Control: affects -1 + src:fakeroot-ng User: ftp.debian@packages.debian.org Usertags: remove Please remove fakeroot-ng. It FTBFSes since over two years without any reaction and the last maintainer upload (who

Bug#1079656: RM: haskell98-tutorial -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: haskell98-tutor...@packages.debian.org Control: affects -1 + src:haskell98-tutorial User: ftp.debian@packages.debian.org Usertags: remove Please remove haskell98-tutorial. It's RC-buggy since 2021 and up for adoption without any takers sin

Bug#1079647: RM: libneo4j-client -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: libneo4j-cli...@packages.debian.org Control: affects -1 + src:libneo4j-client User: ftp.debian@packages.debian.org Usertags: remove Please remove libneo4j-client. It's RC-buggy since 2021 when GCC 11 became the default and the last maintai

Bug#1079645: RM: ifscheme -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ifsch...@packages.debian.org Control: affects -1 + src:ifscheme User: ftp.debian@packages.debian.org Usertags: remove Please remove ifscheme. It's broken since at least 2021 (#981637) and orphaned without an adopter since 2020. Cheers,

Bug#1079643: RM: tldjs -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: tl...@packages.debian.org Control: affects -1 + src:tldjs User: ftp.debian@packages.debian.org Usertags: remove Please remove tldjs. It's RC-buggy since 2021, missed the last two stable releases and the last maintainer upload was in 2018.

Bug#1079640: RM: binutils64 -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal User: ftp.debian@packages.debian.org Usertags: remove Please remove binutils64. It's RC-buggy since (and thus never made it into a stable release) since April 2021 without any maintainer reaction and there were no further uploads after the initial ones

Bug#1079639: RM: bdfproxy -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: bdfpr...@packages.debian.org Control: affects -1 + src:bdfproxy User: ftp.debian@packages.debian.org Usertags: remove Please remove bdfproxy. It's RC-buggy since 1.5 years and never made it into any stable release. The last maintainer uplo

Bug#1079638: RM: beanbag -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: bean...@packages.debian.org Control: affects -1 + src:beanbag User: ftp.debian@packages.debian.org Usertags: remove Please remove beanbag. It FTBFSes since 2020 and the last maintainer upload happened in 2015. Cheers, Moritz

Bug#1079637: RM: qiskit-aer -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: qiskit-...@packages.debian.org Control: affects -1 + src:qiskit-aer User: ftp.debian@packages.debian.org Usertags: remove Please remove qiskit-aer. There's multiple RC bugs, the last maintainer upload was in 2021 and it has been dropped f

Bug#1079636: RM: myhdl -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: my...@packages.debian.org Control: affects -1 + src:myhdl User: ftp.debian@packages.debian.org Usertags: remove Please remove myhdl. The last upload was in 2019 and it's RC-buggy and dropped from testing for over three years (and missed th

Bug#1079453: RM: itop -- RoQA; unmaintained, broken

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: i...@packages.debian.org Control: affects -1 + src:itop User: ftp.debian@packages.debian.org Usertags: remove Please remove itop. The last maintainer upload was in 2008 and the package is broken since 2018 (and dropped from testing since 2

Bug#1079452: RM: obs-ptz -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: obs-...@packages.debian.org Control: affects -1 + src:obs-ptz User: ftp.debian@packages.debian.org Usertags: remove Please remove obs-ptz. There was only ever a single upload and the package FTBFSes since October 2022 without any maintaine

Bug#1079451: RM: pdfrw -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: pd...@packages.debian.org Control: affects -1 + src:pdfrw User: ftp.debian@packages.debian.org Usertags: remove Please remove pdfrw. The last maintainer upload was in 2018 and it's broken since Python 3.7 became the default and thus dropp

Bug#1079449: RM: literki -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: lite...@packages.debian.org Control: affects -1 + src:literki User: ftp.debian@packages.debian.org Usertags: remove Please remove literki. The last maintainer upload happened in 2010 and the package has multiple open RC bugs and hasn't bee

Bug#1079448: RM: lilyterm -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: lilyt...@packages.debian.org Control: affects -1 + src:lilyterm User: ftp.debian@packages.debian.org Usertags: remove Please remove lilyterm. The last upload happened in 2017 and the package is RC-buggy since 2020. Cheers, Moritz

Bug#1079447: RM: ricochet-im -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ricochet...@packages.debian.org Control: affects -1 + src:ricochet-im User: ftp.debian@packages.debian.org Usertags: remove Please remove ricochet-im. The last upload happened 5.5 years ago and the package is RC-buggy since 2021. Cheers,

Bug#1079445: RM: pstack -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: pst...@packages.debian.org Control: affects -1 + src:pstack User: ftp.debian@packages.debian.org Usertags: remove Please remove pstack. The last upload was in 2011 and it's RC-buggy since 4.5 years. Cheers, Moritz

Bug#1079444: RM: pxe-kexec -- RoQA; unmaintained, FTBFS

Package: ftp.debian.org Severity: normal Tags: ftbfs X-Debbugs-Cc: pxe-ke...@packages.debian.org Control: affects -1 + src:pxe-kexec User: ftp.debian@packages.debian.org Usertags: remove Please remove pxe-kexec. The last upload was in 2012 and it FTBFSes due to missing compat with GCC 11 since

Bug#1079372: RM: watson -- RoQA; unmaintained, FTBFS

Package: ftp.debian.org Severity: normal Tags: ftbfs X-Debbugs-Cc: wat...@packages.debian.org Control: affects -1 + src:watson User: ftp.debian@packages.debian.org Usertags: remove Please remove watson. The last maintainer upload was in 2019 and the package FTBFSes since 2021. Cheers,

Bug#1079371: RM: drmips -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: drm...@packages.debian.org Control: affects -1 + src:drmips User: ftp.debian@packages.debian.org Usertags: remove Please remove drmips. The last maintainer upload was in 2016 and the packages FTBFSes since four years. Cheers, Mori

Bug#1079370: RM: effcee -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: eff...@packages.debian.org Control: affects -1 + src:effcee User: ftp.debian@packages.debian.org Usertags: remove Please remove effcee. There was only ever a single upload and the package FTBFSes since three years. Cheers, Moritz

Bug#1079351: RM: rdup -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: r...@packages.debian.org Control: affects -1 + src:rdup User: ftp.debian@packages.debian.org Usertags: remove Please remove rdup. It's RC-buggy since 2019 and dropped from testing since then. The last maintainer upload was in 2017. Cheers

Bug#1079349: RM: pafy -- RoQA; Broken, unmaintained, alternatives exist

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: p...@packages.debian.org Control: affects -1 + src:pafy User: ftp.debian@packages.debian.org Usertags: remove Please remove pafy. It's broken since two years and already missed Bookworm for that. The last maintainer upload was in 2016. Ch

Bug#1079322: RM: origami -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: orig...@packages.debian.org Control: affects -1 + src:origami User: ftp.debian@packages.debian.org Usertags: remove Please remove origami. It's broken since 4.5 years (953144) and thus missed the last two stable releases. The last maintain

Bug#1079321: RM: privbind -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: privb...@packages.debian.org Control: affects -1 + src:privbind User: ftp.debian@packages.debian.org Usertags: remove Please remove privbind. The last maintainer upload was in 2010 and it is RC-buggy since 2021 (and thus missed Bookworm al

Bug#1079318: RM: mahimahi -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: mahim...@packages.debian.org Control: affects -1 + src:mahimahi User: ftp.debian@packages.debian.org Usertags: remove Please remove mahimahi, the last maintainer upload was in 2017 and it FTBFSes since 3.5 years (and thus missed Bookworm a

Bug#1079314: RM: ignore-me -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ignore...@packages.debian.org Control: affects -1 + src:ignore-me User: ftp.debian@packages.debian.org Usertags: remove Please remove ignore-me. There was only ever a single upload in 2018 and the package FTBFSes since 6.5 years. Cheers,

Bug#1079315: RM: bwctl -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: bw...@packages.debian.org Control: affects -1 + src:bwctl User: ftp.debian@packages.debian.org Usertags: remove Please remove bwctl. The last maintainer upload was in 2015 and it FTBFSes since 2021 (and thus missed Bookworm already). Chee

Bug#1079311: RM: gli -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: g...@packages.debian.org Control: affects -1 + src:gli User: ftp.debian@packages.debian.org Usertags: remove Please remove gli. The last upload was in 2017 and it FTBFSes since 6.5 years. There are no reverse dependencies. Cheers,

Bug#1079309: RM: lsdb -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: l...@packages.debian.org Control: affects -1 + src:lsdb User: ftp.debian@packages.debian.org Usertags: remove Please remove lsdb. It's RC-buggy since 2020 and missed Bookworm already. The last maintainer upload was in 2007 and it has been

Bug#1079308: RM: picprog -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: picp...@packages.debian.org Control: affects -1 + src:picprog User: ftp.debian@packages.debian.org Usertags: remove Please remove picprog. It's RC-buggy since 2019 and thus missed the last two stable releases (since Linux 5.5 entered Debia

Bug#1079306: RM: openmx -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ope...@packages.debian.org Control: affects -1 + src:openmx User: ftp.debian@packages.debian.org Usertags: remove Please remove openmx. It FTBFSes since GCC 10 was made the default in 2020 and thus missed the last two stable releases and i

Bug#1079303: RM: navi2ch -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: navi...@packages.debian.org Control: affects -1 + src:navi2ch User: ftp.debian@packages.debian.org Usertags: remove Please remove navi2ch. There was only ever a single upload in 2012 and the package is RC-buggy since 2020 and thus missed t

Bug#1079304: RM: mxt-app -- RoQA; RC-buggy, unmaintained

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: mxt-...@packages.debian.org Control: affects -1 + src:mxt-app User: ftp.debian@packages.debian.org Usertags: remove Please remove mxt-app. It's FTBFSes without any maintainer reaction since 4.5 years and thus missed the last two stable rel

Bug#1079294: RM: termtris -- RoQA; unmaintained, RC-buggy, not in any stable release

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: termt...@packages.debian.org Control: affects -1 + src:termtris User: ftp.debian@packages.debian.org Usertags: remove Please remove termtris. It's unmaintained (there was only ever a single upload in 2019) and it's RC-buggy since 2020 (and

Bug#1079290: RM: twofish -- RoQA; unmaintained, dead upstream, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: twof...@packages.debian.org Control: affects -1 + src:twofish User: ftp.debian@packages.debian.org Usertags: remove Please remove twofish. It's RC-buggy since 2021 and already missed Bookworm due to that. Upstream is dead and there are no

Bug#1079289: RM: xjig -- RoQA; Unmaintained, RC-buggy, dead upstream

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: x...@packages.debian.org Control: affects -1 + src:xjig User: ftp.debian@packages.debian.org Usertags: remove Please remove xjig. It's dead upstream, unmaintained (last maintainer upload in 2013) and RC-buggy due to netpbm changes. It alre

Bug#1079287: RM: gems -- RoQA; unmaintained, RC-buggy, dead upstream

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: g...@packages.debian.org Control: affects -1 + src:gems User: ftp.debian@packages.debian.org Usertags: remove Please remove gems. It's unmaintained (last upload 13 years ago), it's RC-buggy since 2021 and missed the last stable release. C

Bug#1079286: RM: snort -- RoQA; unmaintained, RC-buggy

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: sn...@packages.debian.org Control: affects -1 + src:snort User: ftp.debian@packages.debian.org Usertags: remove Please remove snort. It's unmaintained (last upload three years ago), it missed two stable releases and there's plenty of open

Bug#1079285: RM: enigmail -- RoQA; obsolete

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: enigm...@packages.debian.org Control: affects -1 + src:enigmail User: ftp.debian@packages.debian.org Usertags: remove Please remove enigmail. Thunderbird now has native GPG support and the package was only needed in old releases to support

Bug#1074275: Depends on gpac

Source: ogmrip Version: 1.0.1-4 Severity: serious gpac is unsupportable and thus orphaned and not in stable. It should be removed, but ogmrip depends on it. From a quick glance ogmrip also supports mencoder, so possibly that dependency could simply get removed? Cheers, Moritz

Bug#1074276: Depends on gpac

Source: ccextractor Version: 0.94+ds1-3 Severity: serious gpac is unsupportable, thus orphaned and not in Bookworm. It should be removed, but ccextractor build depends on it. From a quick glance is also has some build flags for ffmpeg, so maybe that's an alternative? Cheers, Moritz

Bug#1074225: RM: watchcatd -- RoQA; dead upstream, obsolete

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: watchc...@packages.debian.org Control: affects -1 + src:watchcatd User: ftp.debian@packages.debian.org Usertags: remove Please remove watchcatd. It's dead upstream and generally obsolete, such process supervision is built into systemd nati

Bug#1073968: RM: sleepd -- RoQA; unmaintained, dead upstream

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: sle...@packages.debian.org Control: affects -1 + src:sleepd User: ftp.debian@packages.debian.org Usertags: remove Please remove sleepd. Upstream development has stopped a long time ago, and it's orphaned for a decade without an adopter. C

Bug#1073235: bookworm-pu: package bluez/5.66-1+deb12u2

On Mon, Jun 17, 2024 at 06:18:40PM +0100, Adam D. Barratt wrote: > Control: tags -1 + confirmed > > On Fri, 2024-06-14 at 23:25 +0200, Moritz Muehlenhoff wrote: > > Attached debdiff fixes three minor security issues. The update > > has been tested on a Bookworm system. debdi

Bug#1072366: libndp: CVE-2024-5564

On Fri, Jun 14, 2024 at 07:30:46AM +0200, Florian Ernst wrote: > On Thu, Jun 13, 2024 at 08:17:41PM +0200, Moritz Muehlenhoff wrote: > > Thanks, these look good! Please upload to security-master, I'll take care > > of the DSA over the weekend. > > Thanks for verify

Bug#1073277: RM: ramond -- RoQA; unmaintained, dead upstream, unused

Package: ftp.debian.org Severity: normal X-Debbugs-Cc: ram...@packages.debian.org Control: affects -1 + src:ramond User: ftp.debian@packages.debian.org Usertags: remove Please remove ramond. It's dead upstream, the last maintainer upload was in 2012 without a new adopter and it's basically non

Bug#1073235: bookworm-pu: package bluez/5.66-1+deb12u2

Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: bl...@packages.debian.org, iwama...@debian.org Control: affects -1 + src:bluez User: release.debian@packages.debian.org Usertags: pu Attached debdiff fixes three minor security issues. The update has been tested on a Boo

Bug#1072366: libndp: CVE-2024-5564

Hi Florian, > Please give those packages an additional check, and feel free to just > upload them when they indeed meet your requirements, or briefly ping me > back for me to upload them / possibly apply further changes, whatever > suits you best. Thanks, these look good! Please upload to securit

Bug#1073012: Automatically rewrite incoming entries from some CNAs as NFUs

Package: security-tracker Severity: wishlist These days the scopes of CNAs are usually narrow and scoped to a specific vendor. We should leverage this for pre-processing incoming data and to reduce toil. We can do this by extending the "automatic update" job to automatically annotate CVEs assig

Bug#1072366: libndp: CVE-2024-5564

Hi Florian, On Mon, Jun 10, 2024 at 08:41:27AM +0200, Florian Ernst wrote: > Dear Security Team, > > On Sat, Jun 01, 2024 at 04:57:53PM +0200, Salvatore Bonaccorso wrote: > > [...] > > [0] https://security-tracker.debian.org/tracker/CVE-2024-5564 > > https://www.cve.org/CVERecord?id=CVE-2024-

Bug#1072720: libglib2.0-0: Following fix #1070745, typing `A keys doesn't type an À anymore

On Sun, Jun 09, 2024 at 06:23:00PM +0100, Simon McVittie wrote: > On Sun, 09 Jun 2024 at 17:23:27 +0200, gru...@laposte.net wrote: > > Please note that ^e gives ê correctly but `A doesn't > > Security team: > > Based on this information, I don't think this is a regression caused by > the GLib sec

Bug#1072527: Mark libreswan as EOLed in Bullseye

Source: debian-security-support Version: 1:13+2024.05.15 Severity: wishlist X-Debbugs-Cc: d...@fifthhorseman.net Security support for libreswan in Bullseye is EOLed, the recent security fixes for CVE-2023-38710 are too intrusive/risky to backport (also see https://github.com/libreswan/libreswan/is

Bug#1072124: gnome-shell: CVE-2024-36472

On Tue, May 28, 2024 at 05:33:32PM -0400, Jeremy Bícha wrote: > Control: forwarded -1 https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7688 > > On Tue, May 28, 2024 at 5:24 PM Moritz Mühlenhoff wrote: > > CVE-2024-36472[0]: > > | In GNOME Shell through 45.7, a portal helper can be launched > >

Bug#1071628: python-pymysql: CVE-2024-36039

On Tue, May 28, 2024 at 09:06:51AM +0200, Thomas Goirand wrote: > On 5/22/24 17:08, Moritz Mühlenhoff wrote: > > The following vulnerability was published for python-pymysql. > > > > We should also fix this in a DSA, could you prepare debdiffs for > > bookworm-security and bullseye-security? > >

Bug#1071746: clojure: CVE-2024-22871

On Fri, May 24, 2024 at 11:42:38AM -0400, Louis-Philippe Véronneau wrote: > On Fri, 24 May 2024 16:53:28 +0200 =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= > wrote: > > Source: clojure > > X-Debbugs-CC: t...@security.debian.org > > Severity: important > > Tags: security > > > > Hi, > > > > The following v

Bug#1053004: CVE-2019-10784 and CVE-2023-40619

On Wed, May 22, 2024 at 02:42:58PM -0300, Leandro Cunha wrote: > Hi everyone, > > On Wed, May 22, 2024 at 12:39 PM Moritz Mühlenhoff wrote: > > > > Am Wed, Mar 06, 2024 at 06:39:01AM -0300 schrieb Leandro Cunha: > > > Hi Christoph Berg, > > > > > > On Wed, Mar 6, 2024 at 5:42 AM Christoph Berg w

Bug#1071127: Mark slurm-wlm as EOLed in Bullseye

Source: debian-security-support Version: 1:13+2024.01.30 Severity: wishlist X-Debbugs-Cc: gennaro.ol...@gmail.com Security support for slurm-wlm in Bullseye is EOLed, the recent changes were too intrusive too meaningfully backport.

Bug#1070175: RM: salt/3002.6+dfsg1-4+deb11u1

On Wed, May 01, 2024 at 06:29:29PM +0100, Adam D. Barratt wrote: > On Wed, 2024-05-01 at 13:02 +0200, Moritz Muehlenhoff wrote: > > Please remove salt in the next Bullseye point release. > > It was already removed frm unstable for being unsupportable > > and unmaintained (htt

Bug#1070176: Mark pdns-recursor as EOLed in Bullseye

Source: debian-security-support Version: 1:13+2024.01.30 Severity: wishlist X-Debbugs-Cc: z...@debian.org Please mark pdns-recursor as EOL/no longer covered by security support in Bullseye. These packages can still be used for select use cases (internal resolver within a company network), but 4.4

Bug#1070175: RM: salt/3002.6+dfsg1-4+deb11u1

Package: release.debian.org Severity: normal X-Debbugs-Cc: s...@packages.debian.org Control: affects -1 + src:salt User: release.debian@packages.debian.org Usertags: rm Please remove salt in the next Bullseye point release. It was already removed frm unstable for being unsupportable and unmain

Bug#1069762: pdns-recursor: CVE-2024-25583 - 4.8.8 for stable

On Thu, Apr 25, 2024 at 08:37:14AM +0200, Chris Hofstaedtler wrote: > Hi Moritz, > > could we once again use the upstream release for stable? > debdiff 4.8.7-1 -> 4.8.8-1 is attached. Ack. Following the 4.8 releases has served us well. debdiff looks fine, please build with -sa and upload to secur

Bug#1068818: sngrep: CVE-2024-3119 CVE-2024-3120

On Sun, Apr 21, 2024 at 07:35:43PM +, Victor Seva wrote: > Hi, > > > I've just uploaded sngrep 1.8.1-1 to sid and prepared 1.6.0-1+deb12u1 for > bookworms-security [0]. > > Attached debdiff file. > > Waiting for you reply, > Victor > > [0] > https://salsa.debian.org/pkg-voip-team/sngrep/

Bug#1064183: libapache2-mod-auth-openidc: CVE-2024-24814

On Thu, Apr 18, 2024 at 02:40:41PM +0200, Moritz Schlarb wrote: > Dear Salvatore, > > I've prepared, built, tested and uploaded fixed versions for bullseye > (2.4.9.4-0+deb11u4), bookworm (2.4.12.3-2+deb12u1) and trixie (2.4.15.7-1). > > Would you like to issue a DSA for them or is it enough that

Bug#1068451: bookworm-pu: package libtommath/1.2.0-6+deb12u1

Package: release.debian.org Severity: normal Tags: bookworm User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: libtomm...@packages.debian.org Control: affects -1 + src:libtommath Addresses CVE-2023-36328, debdiff below. Acked by Dominique before. Cheers, Moritz diff

Bug#1068412: apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709

On Fri, Apr 05, 2024 at 08:16:43AM +0400, Yadd wrote: > On 4/4/24 22:51, Moritz Mühlenhoff wrote: > > Source: apache2 > > X-Debbugs-CC: t...@security.debian.org > > Severity: grave > > Tags: security > > > > Hi, > > > > The following vulnerabilities were published for apache2. > > > > CVE-2024-2

Bug#1056156: varnish: CVE-2023-44487: VSV00013 Varnish HTTP/2 Rapid Reset Attack

On Thu, Apr 04, 2024 at 05:54:51AM +0200, Salvatore Bonaccorso wrote: > Hi Marco, > > [CC'ing security team] > > On Mon, Apr 01, 2024 at 04:25:05PM +0200, Marco d'Itri wrote: > > Control: found -1 5.0.0-1 > > Control: fixed -1 7.4.2 > > > > On Nov 17, Salvatore Bonaccorso wrote: > > > > > CVE-

Bug#1060407: gtkwave update for {bookworm,bullseye,buster}-security

Hi Adrian, > >... > > > debdiffs contain only changes to debian/ > > > > The bookworm/bullseye debdiffs looks good, please upload to > > security-master, thanks! > > both are now uploaded. DSA has been released, thanks! > > Note that both need -sa, but dak needs some special attention when >

Bug#1032670: allegro4.4: CVE-2021-36489

On Thu, Mar 21, 2024 at 09:33:51PM +0100, Andreas Rönnquist wrote: > On Fri, 10 Mar 2023 18:04:23 +0100 =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= > wrote: > > Source: allegro4.4 > > X-Debbugs-CC: t...@security.debian.org > > Severity: important > > Tags: security > > > > Hi, > > > > The following vuln

Bug#1064517: texlive-bin: CVE-2024-25262

On Fri, Feb 23, 2024 at 10:13:53PM +0100, Hilmar Preuße wrote: > On 23.02.24 16:31, Moritz Mühlenhoff wrote: > > Hello Moritz, > > > The following vulnerability was published for texlive-bin. > > > > CVE-2024-25262[0]: > > | texlive-bin commit c515e was discovered to contain heap buffer > > | ov

Bug#1060016: packagekit: CVE-2024-0217

On Wed, Feb 21, 2024 at 04:15:17PM +0100, Matthias Klumpp wrote: > I'd read the "unaffected at 1.2.7" as version 1.2.7 and higher not > having the bug... But then again, on another page it said that the > respective patch only lowered the impact... > I remember merging that patch, and it was a pret

Bug#1060016: packagekit: CVE-2024-0217

On Tue, Feb 20, 2024 at 10:11:35PM +0100, Matthias Klumpp wrote: > The CVE page lists that commit as "patch" now, and given that emitting > a finished transaction as finished multiple times could indeed cause > issues (and use-after-free issues potentially as well), I am inclined > to think that th

Bug#1063736: snort removal from bullseye (Re: Bug#1063736: RM: snort -- RoQA; security issues, unmaintained)

On Mon, Feb 12, 2024 at 06:16:48PM +, Jonathan Wiltshire wrote: > On Mon, Feb 12, 2024 at 09:24:47AM +, Holger Levsen wrote: > > hi, > > > > On Sun, Feb 11, 2024 at 09:44:18PM +, Jonathan Wiltshire wrote: > > > Requested by security team. Not in stable or testing. > > > > once this ha

Bug#1063534: [Debian-iot-maintainers] Bug#1063534: libjwt: CVE-2024-25189

On Fri, Feb 09, 2024 at 04:40:31PM +0100, Thorsten Alteholz wrote: > Hi Moritz, > > thanks for the bug. Upstream knows about the issue and already fixed it [1] > + [2]. Thanks. I think the real worl impact is pretty negligible, it's enough to land a fix for the next release, but not for released

Bug#1061543: indent: CVE-2024-0911

On Fri, Jan 26, 2024 at 08:48:47PM +0100, Santiago Vila wrote: > severity 1061543 important > found 1061543 2.2.12-1 > found 1061543 2.2.12-4+deb12u2 > thanks > > El 26/1/24 a las 8:52, Moritz Mühlenhoff escribió: > > Source: indent > > X-Debbugs-CC: t...@security.debian.org > > Severity: normal >

Bug#1061572: bullseye-pu: package unadf/0.7.11a-4+deb11u1

Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: un...@packages.debian.org Control: affects -1 + src:unadf Addresses two no-dsa security issues, same fix already rolled out for Bookworm. Debdiff below. Cheers,

Bug#1060861: RUSTSEC-2023-0078

On Mon, Jan 15, 2024 at 09:10:57PM +0100, Salvatore Bonaccorso wrote: > Hi Moritz, > > On Mon, Jan 15, 2024 at 08:49:04PM +0100, Moritz Muehlenhoff wrote: > > Source: rust-tracing > > Version: 0.1.37-1 > > Severity: important > > Tags: security >

Bug#1060861: RUSTSEC-2023-0078

Source: rust-tracing Version: 0.1.37-1 Severity: important Tags: security X-Debbugs-Cc: Debian Security Team https://rustsec.org/advisories/RUSTSEC-2023-0078.html https://github.com/tokio-rs/tracing/pull/2765 Fixed by: https://github.com/tokio-rs/tracing/commit/20a1762b3fd5f1fafead198fd18e469c68

Bug#1060407: Multiple security issues

Source: gtkwave Version: 3.3.116-1 Severity: grave Tags: security X-Debbugs-Cc: Debian Security Team A very thorough security audit of gtkwave unveiled a total of 82 security issues in gtkwave, all fixed in 3.3.118: CVE-2023-32650 CVE-2023-34087 CVE-2023-34436 CVE-2023-35004 CVE-2023-35057 CVE-2

  1   2   3   4   5   6   7   8   9   10   >