Re: status of the gdm3 security update

2018-08-27 Thread Antoine Beaupré
Oh, and I forgot to mention the test packages are available here: https://people.debian.org/~anarcat/debian/jessie-lts/ Cheers, A.

status of the gdm3 security update

2018-08-27 Thread Antoine Beaupré
Hi! After asking Markus the status of the gdm3 security upgrade for jessie, he nicely offered me to take it over since he got stuck. Using his patches, however, I wasn't able to reproduce the problems. Sure, it *looks* like gdm is "crashing", but I /think/ it's actually doing what it's asked. The

Re: Missing dependency on latest jessie-security release of linux-image-4.9-amd64

2018-08-27 Thread Ben Hutchings
On Mon, 2018-08-27 at 16:23 +0200, Shaun Bugler - Hetzner (Pty) Ltd wrote: > Hello, we have shifted a number of servers using linux-image-4.9-amd64 > from backports to the jessie-security release, with great success. Today > however, we see the package was bumped to 4.9+80+deb9u6~deb8u1, which >

Re: twitter-bootstrap / CVE-2018-14040 / CVE-2018-14041 / CVE-2018-14042

2018-08-27 Thread Antoine Beaupré
On 2018-08-08 17:35:52, Brian May wrote: > If I got this right, we cannot use $(xyz) unless the value of xyz is > trusted. Otherwise executing $(xyz) can result in the execution of code > if xyz is something like "". This > happens immediately, and even if you don't use the return value. > > > I be

Re: tiff / CVE-2018-15209

2018-08-27 Thread Antoine Beaupré
On 2018-08-14 17:27:29, Brian May wrote: > I have been trying to reproduce this bug (buffer overflow), but instead > I get increasing memory usage until my computer crashes. With versions > from Jessie, Stretch, and Sid. So maybe another security issue? > > I note that CVE-2017-11613 and CVE-2018-5

Missing dependency on latest jessie-security release of linux-image-4.9-amd64

2018-08-27 Thread Shaun Bugler - Hetzner (Pty) Ltd
Hello, we have shifted a number of servers using linux-image-4.9-amd64 from backports to the jessie-security release, with great success. Today however, we see the package was bumped to 4.9+80+deb9u6~deb8u1, which has a dependency on: dedi # aptitude show linux-image-4.9-amd64 Package: linux-i