Re: pspp - cve-2017-10791 - cve-2017-10792

2017-07-04 Thread Ben Pfaff
I applied fixes for both of these bugs to the PSPP repository, as the following commits. The fixes will be in the next PSPP release. commit 41c6f5447941e5d36d0554ba874671649353752f Author: Ben Pfaff Date: Tue Jul 4 12:58:55 2017 -0400 sys-file-reader: Fix integer overflows in parse_long_

Re: Bug#866890: pspp - cve-2017-10791 - cve-2017-10792

2017-07-04 Thread Friedrich Beckmann
Hi Ben, my understanding is that they bring up two different problems. For https://bugzilla.redhat.com/show_bug.cgi?id=1467004 (Hash Function) the argument is that shift operations and overflows are undefined or implementation dependent for signed integers as used in the hash function. https:/

Re: unattended upgrades don't work in wheezy

2017-07-04 Thread Matus UHLAR - fantomas
On 04.07.17 10:38, Antoine Beaupré wrote: Adding the bug in CC. so am I. On Tue, Jul 4, 2017 at 10:02 PM, Matus UHLAR wrote: I just found out that the unattended-upgrades package in wheezy does not upgrade packages although configured to do it. On 2017-07-04 22:13:44, Paul Wise wrote: I

Re: unattended upgrades don't work in wheezy

2017-07-04 Thread Antoine Beaupré
Control: fixed -1 0.93.1+nmu1 Adding the bug in CC. On 2017-07-04 22:13:44, Paul Wise wrote: > On Tue, Jul 4, 2017 at 10:02 PM, Matus UHLAR wrote: > >> I just found out that the unattended-upgrades package in wheezy does not >> upgrade packages although configured to do it. > > I note that this s

Re: unattended upgrades don't work in wheezy

2017-07-04 Thread Paul Wise
On Tue, Jul 4, 2017 at 10:02 PM, Matus UHLAR wrote: > I just found out that the unattended-upgrades package in wheezy does not > upgrade packages although configured to do it. I note that this same situation will apply to jessie when it becomes oldoldstable. I haven't tested the default stretch

unattended upgrades don't work in wheezy

2017-07-04 Thread Matus UHLAR - fantomas
Hello, I just found out that the unattended-upgrades package in wheezy does not upgrade packages although configured to do it. The problem lies in /etc/apt/apt.conf.d/50unattended-upgrades wile, which only contains records for stable and oldstable, but not for oldoldstable. I have filled up bug

Re: Bug#866890: pspp - cve-2017-10791 - cve-2017-10792

2017-07-04 Thread Ben Pfaff
The attribution of the problem to the hash function is probably wrong, since that function is purely combinatorial logic, but the report as a whole is right because the attachment in the bug report at https://bugzilla.redhat.com/show_bug.cgi?id=1467004 does cause pspp-convert to assert-fail. I'm l