Re: working for wheezy-security until wheezy-lts starts

2016-03-13 Thread Moritz Mühlenhoff
On Sun, Mar 13, 2016 at 12:52:09PM +0100, Guido Günther wrote: > Looking at > > > http://metadata.ftp-master.debian.org/changelogs/main/x/xen/xen_4.1.4-3+deb7u9_changelog > > and the source package the current practice is to pull in the individual > patches. Ack. > I wonder if somebody ca

Re: tracking security issues without CVEs

2016-03-13 Thread Paul Wise
On Sat, Mar 12, 2016 at 10:51 PM, Kurt Roeckx wrote: > On Sun, Mar 06, 2016 at 03:33:16PM +1100, Brian May wrote: >> For example, if there are no CVEs are we able to use OVEs instead? > > What abaout DWF? That didn't exist at the time of Brian's post. I think OVE/OVI still have less friction than

Re: working for wheezy-security until wheezy-lts starts

2016-03-13 Thread Guido Günther
Hi Brian, On Sun, Mar 13, 2016 at 11:13:31AM +1100, Brian May wrote: > Moritz Mühlenhoff writes: > > > 1. We're already one wheezy update behind for xen (since some of > > the changes were invasive and complex). It would be great if > > someone from the Freexian sponsor pool would work on a wheez

Re: working for wheezy-security until wheezy-lts starts

2016-03-13 Thread Markus Koschany
Am 13.03.2016 um 04:32 schrieb Brian May: > Brian May writes: > >>> 2. Spend some time on investigating what it takes to backport >>> libav from jessie to wheezy. 11.x is still supported by >>> libav upstream and we could share triage work for jessie/wheezy >>> going forwards. 0.8 has simply too