Re: CVE-2017-11735 in mp3split / libvorbis

2017-09-30 Thread Guido Günther
Hi Ron, On Sun, Oct 01, 2017 at 06:53:51AM +1030, Ron wrote: > On Sat, Sep 30, 2017 at 08:17:50PM +0200, Guido Günther wrote: > > Hi Ron, > > Looking at > > > > > > https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932 > > > > do you really

Re: CVE-2017-11735 in mp3split / libvorbis

2017-09-30 Thread Guido Günther
Hi Salvatore, On Sat, Sep 30, 2017 at 09:29:16PM +0200, Salvatore Bonaccorso wrote: > Hi Guido, > > On Sat, Sep 30, 2017 at 08:17:50PM +0200, Guido Günther wrote: > > Security team, if the CVE is in mp3splt not libvorbis do we need to give > > back the CVE and request a new one? Is doing this via

Re: CVE-2017-11735 in mp3split / libvorbis

2017-09-30 Thread Ron
On Sat, Sep 30, 2017 at 08:17:50PM +0200, Guido Günther wrote: > Hi Ron, > Looking at > > > https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932 > > do you really mean CVE-2017-11333¹? Isn't this CVE-2017-11735²? Both where > reported in t

Re: Fwd: Re: [Ticket#2017092834000757] Bug#876462: otrs2: CVE-2017-14635: Code Injection / Privilege Escalation OTRS

2017-09-30 Thread Markus Koschany
Am 30.09.2017 um 21:24 schrieb Patrick Matthäi: [...] > Oh yeah this ugly issue / change.. > @security team: > IMHO we have got onl the two options to remove support for otrs2 in oos > or to update it to the most recent 3.3.x version. I know many companies > who are using the offical Debian package

Re: CVE-2017-11735 in mp3split / libvorbis

2017-09-30 Thread Salvatore Bonaccorso
Hi Guido, On Sat, Sep 30, 2017 at 08:17:50PM +0200, Guido Günther wrote: > Security team, if the CVE is in mp3splt not libvorbis do we need to give > back the CVE and request a new one? Is doing this via If you think the CVE was wrongly assigned, can you please contact MITRE (via the form method)

Re: Fwd: Re: [Ticket#2017092834000757] Bug#876462: otrs2: CVE-2017-14635: Code Injection / Privilege Escalation OTRS

2017-09-30 Thread Patrick Matthäi
Am 29.09.2017 um 20:00 schrieb Markus Koschany: > Am 29.09.2017 um 19:51 schrieb Markus Koschany: > [...] >> Apparently version 3.1.7 used the MyISAM engine which now conflicts with >> the new default InnoDB database. I know how it could be fixed by hand >> but I don't think this is the recommend

CVE-2017-11735 in mp3split / libvorbis

2017-09-30 Thread Guido Günther
Hi Ron, Looking at https://anonscm.debian.org/cgit/users/ron/mp3splt.git/commit/?id=18f018cd774cb931116ce06a520dc0c5f9443932 do you really mean CVE-2017-11333¹? Isn't this CVE-2017-11735²? Both where reported in the same message. I can confirm that this fixes CVE-2017-11735 for me. Security

Re: for LTS

2017-09-30 Thread Guido Günther
Hi, On Sat, Sep 30, 2017 at 11:03:13AM +0200, Moritz Muehlenhoff wrote: > Hi, > when we're marking issues as for the suites supported > by the security team and if that issue is also marked in wheezy > (or whatever is LTS at the time), ok to also mark the LTS suite as > or do you want to do dea

Re: for LTS

2017-09-30 Thread Emilio Pozuelo Monfort
On 30/09/17 11:03, Moritz Muehlenhoff wrote: > Hi, > when we're marking issues as for the suites supported > by the security team and if that issue is also marked in wheezy > (or whatever is LTS at the time), ok to also mark the LTS suite as > or do you want to do deal with that by yourself? >

for LTS

2017-09-30 Thread Moritz Muehlenhoff
Hi, when we're marking issues as for the suites supported by the security team and if that issue is also marked in wheezy (or whatever is LTS at the time), ok to also mark the LTS suite as or do you want to do deal with that by yourself? Specific example of such a change: r56270 Cheers,