Re: Fwd: cacti security update

2014-07-14 Thread Alexander Wirt
On Tue, 15 Jul 2014, Moritz Muehlenhoff wrote: > On Mon, Jul 14, 2014 at 09:20:54PM +0200, Paul Gevers wrote: > > Hi all, > > > > On 5 July, I sent the attached security update to the announce list. It > > seems to have never reached that list. Could somebody enlighten me and > > tell me what I d

Re: Fwd: cacti security update

2014-07-14 Thread Moritz Muehlenhoff
On Mon, Jul 14, 2014 at 09:20:54PM +0200, Paul Gevers wrote: > Hi all, > > On 5 July, I sent the attached security update to the announce list. It > seems to have never reached that list. Could somebody enlighten me and > tell me what I did wrong? Only list masters can investigate this. Please se

Re: DLA documented

2014-07-14 Thread Moritz Muehlenhoff
On Mon, Jul 14, 2014 at 06:45:06PM +0200, Alexander Wirt wrote: > On Mon, 14 Jul 2014, Moritz Mühlenhoff wrote: > > > On Mon, Jul 14, 2014 at 05:06:26PM +0200, Holger Levsen wrote: > > > Hi, > > > > > > Alexander Wirt just offered/suggested to reject mails not conforming to a > > > certain subje

Fwd: cacti security update

2014-07-14 Thread Paul Gevers
Hi all, On 5 July, I sent the attached security update to the announce list. It seems to have never reached that list. Could somebody enlighten me and tell me what I did wrong? Paul --- Begin Message --- Package: cacti Version: 0.8.7g-1+squeeze4 CVE ID : CVE-2014-2326 CVE-

Re: DLA documented

2014-07-14 Thread Holger Levsen
Hi, On Montag, 14. Juli 2014, Moritz Mühlenhoff wrote: > I thought "signed by a DD" is already a requirement for the LTS announce > list? yes, it is (as Alexander already privatly confirmed). cheers, Holger signature.asc Description: This is a digitally signed message part.

Re: DLA documented

2014-07-14 Thread Alexander Wirt
On Mon, 14 Jul 2014, Moritz Mühlenhoff wrote: > On Mon, Jul 14, 2014 at 05:06:26PM +0200, Holger Levsen wrote: > > Hi, > > > > Alexander Wirt just offered/suggested to reject mails not conforming to a > > certain subject format (eg including a DLA ID) as well as unsigned mails. > > (I'd > > su

Re: DLA documented

2014-07-14 Thread Moritz Mühlenhoff
On Mon, Jul 14, 2014 at 05:06:26PM +0200, Holger Levsen wrote: > Hi, > > Alexander Wirt just offered/suggested to reject mails not conforming to a > certain subject format (eg including a DLA ID) as well as unsigned mails. > (I'd > suggest to only allow mails signed by keys able to upload.)

Re: CVE-2014-4610: Integer Overflow in FFmpeg LZO implementation

2014-07-14 Thread Moritz Mühlenhoff
On Thu, Jul 10, 2014 at 12:10:50AM +0200, Andreas Cadhalpun wrote: > > As this seems to be a rather important security bug, I think a backport > would be useful in this case. Raphael wanted to update ffmpeg in squeeze. I'm adding him to CC, so that he can fold in the patch. > I'm afraid I don't

Re: DLA documented

2014-07-14 Thread Holger Levsen
Hi, Alexander Wirt just offered/suggested to reject mails not conforming to a certain subject format (eg including a DLA ID) as well as unsigned mails. (I'd suggest to only allow mails signed by keys able to upload.) If we want this, we should file a wishlist bug against lists.d.o - do we? IMO

DLA documented

2014-07-14 Thread Holger Levsen
Hi, I went ahead and explained LTS and DLA in https://wiki.debian.org/Glossary#LTS and https://wiki.debian.org/Glossary#DLA (and redefined DLA to mean "Debian LTS Advisory...) and also explained DLA ID handling it https://wiki.debian.org/LTS/Development cheers, Holger signature.asc

Re: LTS-ID : LTS6A-2014-015

2014-07-14 Thread Holger Levsen
Hi, On Montag, 14. Juli 2014, Michael Gilbert wrote: > I just commited an initial list the existing LTS announcements to > data/DLA/list, using the same style as data/DSA/list in > secure-testing. I chose DLA based on the name of the > Debian-Lts-Announce mailing list. ok, let's settle on that th

Re: libxml2 for LTS

2014-07-14 Thread Moritz Mühlenhoff
On Sun, Jul 13, 2014 at 10:25:08PM +0200, Thorsten Alteholz wrote: > Hi, > > this is my debdiff for CVE-2014-0191 in libxml2. > > I used the patch for wheezy as template. LGTM, this will need some testing, though to rule out side effects in applications. Maybe you can put the debs on people.debi

Re: updating tor (to 0.2.4.x)

2014-07-14 Thread Moritz Muehlenhoff
On Mon, Jul 14, 2014 at 09:52:42AM +0200, Peter Palfrader wrote: > Hi, > > now that Tor 0.2.4.x has hit stable, I'd like to update it in squeeze as > well. > > Currently squeeze ships with tor 0.2.2.39. (I think initially it even > shipped a 0.2.1.x version.) The arguments for updating to 0.2.4

updating tor (to 0.2.4.x)

2014-07-14 Thread Peter Palfrader
Hi, now that Tor 0.2.4.x has hit stable, I'd like to update it in squeeze as well. Currently squeeze ships with tor 0.2.2.39. (I think initially it even shipped a 0.2.1.x version.) The arguments for updating to 0.2.4.x are the same as for the update in stable outlined in #751977. Any concerns,