wireshark security update for Wheezy LTS

Hi, I have prepared an update for wireshark in Wheezy. Please see the diff to previous version attached. I have submitted a practically identical changeset to the Security Team for accepting it as an update to Jessie's version. Changes: wireshark (1.12.1+g01b65bf-4+deb8u6~deb7u2) wheezy-securit

Re: Analysis of issue for phpmyadmin and request for comment on XSS issues

On Sun, 2016-06-26 at 23:47 +0200, Ola Lundqvist wrote: > Hi LTS team > > I have done some analysis of the issues for phpmyadmin. > > It would be good to know what your opinion about XSS issues for admin > software like phpmyadmin is. I do not see how that can be very important. I > mean you know

Analysis of issue for phpmyadmin and request for comment on XSS issues

Hi LTS team I have done some analysis of the issues for phpmyadmin. It would be good to know what your opinion about XSS issues for admin software like phpmyadmin is. I do not see how that can be very important. I mean you know the URL and do not really use external links for accessing it. Or do

Re: claiming tiff

On 26/06/16 16:10, Bálint Réczey wrote: > Added that information in dla-needed.txt. Thanks. I added links to each cve in data/CVE/list but forgot to add a note to dla-needed. > In that case I don't claim them yet. Let's see how upstream responds. OK. Cheers, Emilio

Re: claiming tiff

Hi Emilio, 2016-06-26 9:58 GMT+02:00 Emilio Pozuelo Monfort : > On 26/06/16 02:19, Bálint Réczey wrote: >> Hi, >> >> There are newly discovered vulnerabilities in tiff [1]. >> >> I no one objects I plan looking into them and working with the >> maintainer(s) to get them fixed in Wheezy LTS and in

Re: cacti LTS

Hi Emilio [By the way, I read debian-lts, so no need to mail me directly, dropped your To: as well]. On 26-06-16 10:40, Emilio Pozuelo Monfort wrote: >> I believe CVE-2016-2313 should be included in this fix. > > Certainly! I have backported the fix and included in this new debdiff. Looks good

Re: testing php5 for Wheezy LTS

Hi, I installed some packages [1] and smoke tested with owncloud, no problems so far. I used the webclient, davdroid on android and a windows owncloud client to test. HTH Stefan [1] libapache2-mod-php5_5.4.45-0+deb7u4_i386.deb php-pear_5.4.45-0+deb7u4_all.deb php5_5.4.45-0+deb7

Re: cacti LTS

On 26/06/16 09:23, Paul Gevers wrote: > Hi Emilio > > On 25-06-16 22:03, Emilio Pozuelo Monfort wrote: >>> Just in case somebody starts working on it, I'd like to review proposed >>> uploads of cacti to LTS. CVE-2016-2313 was initially wrongly fixed (a >>> sledgehammer for a simple nail). CVE-2016

Re: claiming tiff

On 26/06/16 02:19, Bálint Réczey wrote: > Hi, > > There are newly discovered vulnerabilities in tiff [1]. > > I no one objects I plan looking into them and working with the > maintainer(s) to get them fixed in Wheezy LTS and in newer > releases. I looked at this yesterday. These CVEs aren't fixe

Re: cacti LTS

Hi Emilio On 25-06-16 22:03, Emilio Pozuelo Monfort wrote: >> Just in case somebody starts working on it, I'd like to review proposed >> uploads of cacti to LTS. CVE-2016-2313 was initially wrongly fixed (a >> sledgehammer for a simple nail). CVE-2016-3659 still needs reproducing >> in Debian and