Re: addressing CVE-2018-1311/XERCESC-2188

ge multiple times from different addresses after properly subscribing, and still they did not make it to the list. thanks for the reminder. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B

January LTS Report

html -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: addressing CVE-2018-1311/XERCESC-2188

look. Did I manage to answer your questions? If so, I'd go on, implement the patch and try to get some review from upstream. BTW, I don't think previous messages reached the c-dev mailing list. I tried to subscribe, let's see if this one does. FTR: initial message here[0]. cheers, H

Re: [CVE-2019-17026] Firefox Security Advisory 2020-03

as already been addressed in jessie via DLA-2061-1[0] (firefox-esr) and DLA-2071-1 (thunderbird) on Jan, 09 2020. thanks cheers, Hugo [0] https://security-tracker.debian.org/tracker/CVE-2019-17026 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8

Re: python-reportlab: CVE-2019-17626: remote code execution in colors.py

ns in there. I have asked upstream regarding the licensing issue. For the rest, I think we should wait for followups, or possibly a better patch. Any comments/advice? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A24

addressing CVE-2018-1311/XERCESC-2188

delete it. On ReaderMgr::~ReaderMgr(), delete `fAdoptedStack` and all possibly remaining elements. Feedback? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

Re: [SECURITY] [DLA 2069-1] cacti security update

y and will investigate and follow-up then. thanks! Indeed, another followup seems to be coming for CVE-2020-7106, I added a short note to dla-needed. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D3

Re: RFT: qemu 1:2.1+dfsg-12+deb8u13

fine to me! (That being said I would definitely not upload these changes without at least smoke testing slirp. :)) cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: RFT: qemu 1:2.1+dfsg-12+deb8u13

ke a look at it in the evening. thanks! Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: [SECURITY] [DLA 2069-1] cacti security update

-) cheers, Hugo [0] https://github.com/Cacti/cacti/commit/47a000b5aba4af16967e249b25f25397506e3464 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

December LTS Report

2+yo regression. + prepare, test and upload 8:6.8.9.9-5+deb8u19 (DLA-2049-1). libexif: + investigate CVE-2019-9278 and prepare a patch derived from the Android fix (work in progress). regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27

Re: imagemagick: regression in 8:6.8.9.9-5+deb8u10

a7 https://github.com/ImageMagick/ImageMagick6/commit/4cc316818e5b841ff5a9394a0730d5be6e8686ce backporting them is sufficient to fix the issue. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D3

Re: imagemagick: regression in 8:6.8.9.9-5+deb8u10

ne used in stretch). This will be fixed in the next security update. cheers, Hugo [0] https://github.com/ImageMagick/ImageMagick/commit/4b85d29608d5bc0ab641f49e80b6cf8965928fb4 [1] https://github.com/ImageMagick/ImageMagick6/commit/663e70e90257797f4634ea8dd4a31e0947d1f266 --

Re: imagemagick: regression in 8:6.8.9.9-5+deb8u10

4 and 0227. I'll try to ship a patch for this along with the next jessie update. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc D

November LTS Report

assigned hours to 12. This month's 22.75 remaining hours will be returned to the pool. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signatur

October LTS Report

upstreamed before releasing a DLA. python-reportlab: + Investigate CVE-2019-17626, still no upstream fix yet. & various misc triage regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25

CVE-2019-17540 in imagemagick: fixing commits?

/issues/detail?id=15826 [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17540 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP

Re: cacti: CVE-2019-16723

he issue and appears to confirm previous analysis. Any comments? cheers, Hugo [0] https://github.com/Cacti/cacti/commit/cf73ae1a9f65b5a27d7f9d10c8e14835c3a76326 [1] https://github.com/Cacti/cacti/blob/develop/lib/rrd.php#L1179 [2] https://github.com/Cacti/cacti/blob/develop/graph_image.php#L132 --

Publishing advisories for regression updates on the website

ed to state clearly that we either (1) do it or (2) don't do it, and document it in the wiki. If we decide to do it, it would be nice to publish missing advisories from previous regression updates as well? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B

Re: Bug#942172: clamav-daemon: After upgrade, clamd cannon create /var/run/clamav/clamd.ctl and stop.

't hesitate to open a bug report, I will take a look at it. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: clamav-daemon: After upgrade, clamd cannon create /var/run/clamav/clamd.ctl and stop.

th uploading. You can find (UNRELEASED) amd64 builds, signed by myself on my Debian webpage: https://people.debian.org/~hle/lts/clamav/ regards, Hugo [0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=824042 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4

Re: clamd update, some tests failing

What is our policy on this matter? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: libsdl2 patches cause regressions in Jessie

bsdl1.2, the update was missing this patch[0]. I forgot to add an entry for libsdl2. cheers, Hugo [0] https://hg.libsdl.org/SDL/rev/32075e9e2135 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2

Re: libsdl2 patches cause regressions in Jessie

> Unless I am mistaken, there is another regression in libsdl1.2, the update > was missing this patch[0]. > > I forgot to add an entry for libsdl2. the dla-needed entry was confusing, indeed. I have updated it to reflect the current situation. -- Hugo L

Re: libsdl2 patches cause regressions in Jessie

On Mon, Oct 07, 2019 at 11:22:45PM +0200, Hugo Lefeuvre wrote: > > This looks like a regression, indeed. I will provide a regression update > > as soon as possible. > > Looks like I'm actually not the one who issued this update. Abhijith: do > you want to handle this,

Re: libsdl2 patches cause regressions in Jessie

> This looks like a regression, indeed. I will provide a regression update > as soon as possible. Looks like I'm actually not the one who issued this update. Abhijith: do you want to handle this, or should I proceed with a fix tomorrow? cheers, Hugo -- Hugo Le

Re: libsdl2 patches cause regressions in Jessie

es CVE-2019-7635 and the > commit here <https://hg.libsdl.org/SDL/rev/07c39cbbeacf> fixes CVEs > CVE-2019-7638 and CVE-2019-7636. This looks like a regression, indeed. I will provide a regression update as soon as possible. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.

Re: ClamAV update in jessie

bly the best option, and instead of pointing to the tracker I would just explain the situation and list the four reverse dependencies. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: ClamAV update in jessie

ink they would build if I uploaded them earlier. Regarding the DLAs. I plan to release a DLA per upload (one DLA for clamav and one for each reverse dependency). Announcing all five uploads under a single DLA seems a bit messy to me. Any comment? regards, Hugo -- Hugo Lefeu

Re: ClamAV update in jessie

imple, and the versions are close. Probably six hours altogether, but this is a rough estimation. FTR, the transition in stretch was tracked as #924278[0]. cheers, Hugo [0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924278 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA40

ClamAV update in jessie

'd like to know what you think about this, and if you can think of any alternative/less time consuming solution. (cherry picking changes does not seem reasonable to me) regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB

September LTS Report

spend these hours in october. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: since update 1.3.3.5-4+deb8u5 php ldap authentification failure

latest 389-ds-base update. Did you notice anything wrong during your tests? Thanks! regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc

Re: About the security issues affecting imagemagick in Jessie

up for imagemagick. This is borderline, so let's stop wasting time: we can keep a dla-needed entry with appropriate comments for both front desk and regular lts contributors. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: About the security issues affecting imagemagick in Jessie

propriate to tag them as ignored in data/CVE/list? > > Otherwise they pop up again and again in lts-cve-triage.py. I have done some more triage. However please note that these issues pop up in lts-cve-triage because they are still open in stretch. The security team is currently w

Re: About the security issues affecting imagemagick in Jessie

cause it is big, not really understandable, and undocumented. Upstream did not answer my questions yet. I'd just remove imagemagick from dla-needed and wait some time, until upstream clarifies this patch. If he doesn't, I'd just mark this no-dsa. regards, Hugo --

August LTS Report

requesting a CVE number for a temporary entry from our tracker. + The last patches have been reviewed and merged this morning, meaning that I will be able to release the jessie update in the next days. Otherwise, the usual triage. I kept an eye on hdf5. cheers, Hugo -- Hug

Re: xymon vulnerabilities in jessie, stretch and buster

he issue, but the vulnerable code is present. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: xymon vulnerabilities in jessie, stretch and buster

nyways, 4.3.29 introduced quite a few regressions[0], we should probably wait for 4.3.30. regards, Hugo [0] https://lists.xymon.com/archive/2019-August/046643.html -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37

Re: xymon vulnerabilities in jessie, stretch and buster

nfident enough with the codebase to do that. Thanks! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

xymon vulnerabilities in jessie, stretch and buster

d be worth inspecting the diff, but there were quite a few releases between 4.3.17 and 4.3.29... I'm considering to cherry pick relevant changes for the most important issues. Christoph and Axel, do you have comments/suggestions regarding this? regards, Hugo -- Hug

reproducing tika vulnerabilities in jessie/buster

help me to reproduce these vulnerabilties with the code from jessie/buster? thanks for your work! regards, Hugo [0] https://security-tracker.debian.org/tracker/source-package/tika -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8

Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}

gards, Hugo [0] https://tika.apache.org/security.html -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: clamav triage (updated via -updates)

always the latest version is present without waiting for the next point > release. Thanks your answer. I suppose that buster and stretch will be upgraded to the latest upstream release when the definitive patch will be available for this issue. I will then backport the same changes to je

clamav triage (updated via -updates)

bian.org/934359 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

security fixes for CVE-2019-10088 and CVE-2019-1009{3,4}

743f6 Can anybody confirm? Are there other fixes I should consider applying? thanks! regards, Hugo Lefeuvre (Debian LTS team) -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357

Re: imagemagick: CVE-2019-13305/CVE-2019-13306

/ImageMagick6/commit/cb5ec7d98195aa74d5ed299b38eff2a68122f3fa -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

CVE-2019-12977 analysis

than what he can already do. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

July LTS Report

month. misc: + various triage in the tracker. + wavpack: take a look at current issues, answer Brian's e-mail. + hdf5: take stock of the situation, prepare plans for next update. I should be able to use up the remaining hours in august. cheers, Hugo -- Hugo Lefeuvre

Re: [SECURITY] [DLA 1865-1] sdl-image1.2 security update

LAs. > 3. DLAs that are related to prior DLAs should use the same first part > and an incremented second part. Sounds reasonable. Thanks! regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D

Re: [SECURITY] [DLA 1865-1] sdl-image1.2 security update

gt; the correct information and a note about what changed. Thanks, I wasn't aware of this. I can't find any information about it in our documentation, did I miss something? (just in case: this is not a regression, just a typo in the advisory) regards, Hugo -- Hugo Le

Re: [SECURITY] [DLA 1865-1] sdl-image1.2 security update

On Sat, Jul 27, 2019 at 03:30:14PM -0300, Hugo Lefeuvre wrote: > Package: sdl-image1.2 > Version: 1.2.12-5+deb9u2 > CVE ID : CVE-2018-3977 CVE-2019-5051 CVE-2019-5052 CVE-2019-7635 > CVE-2019-12216 CVE-2019-12217 CVE-2019-12218 CV

Re: minor issues (wavpack)

p these patches in a future update. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: libsdl2-image security issues in testing

a member of the CVE-2019-12221 family, and is therefore fixed by [0]. cheers, Hugo [0] https://hg.libsdl.org/SDL_image/rev/e7e9786a1a34 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

libsdl2-image security issues in testing

aging upstream's latest 2.0.5 release should be sufficient, but they can also be addressed with more targeted fixes. I can provide some help if needed. Thanks for your work! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8

June (E)LTS Report

remaining hours will be returned to the pool. == Debian ELTS report I was allocated 15 hours. I did not spend any of them (I already returned them to the pool on June, 18th). cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D

May (E)LTS Report

oper triage for currently open issues. Prepare and test a security update addressing CVE-2019-10053 (not uploaded yet, but should be done by tomorrow). misc: + various triage, see tracker's logs. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_

Re: failed armel build of wireshark 1.12.1+g01b65bf-4+deb8u19

> Given back. Thanks Emilio! No idea what happened (hardware issue?), anyways, build succeeded. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D D

failed armel build of wireshark 1.12.1+g01b65bf-4+deb8u19

=wireshark&suite=jessie-security -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: CVE-2019-12221 affects libsdl2-image/sdl-image1.2, not libsdl2/libsdl1.2

se issues as well, although I didn't have time to do it yet. I will update the tracker entries then. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2

Re: CVE-2019-12221 affects libsdl2-image/sdl-image1.2, not libsdl2/libsdl1.2

n the bugzilla, right thing would be to replace the source package > tracking entries to the correct source. > So basically replace tracking of slibsdl2 and libsdl1.2 with > libsdl2-image and sdl-image1.2 instead. I see that you already did it, thanks! :) cheers, Hugo --

CVE-2019-12221 affects libsdl2-image/sdl-image1.2, not libsdl2/libsdl1.2

] - libsdl2-image and same for libsdl1.2? thanks, Hugo [0] https://bugzilla.libsdl.org/show_bug.cgi?id=4628 [1] https://salsa.debian.org/security-tracker-team/security-tracker/commit/39f9e891a4b37 -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F

Re: dla-needed/imagemagick entry

t of adding fixes for other recent CVEs, but given the pain it was to backport CVE-2019-11598 and CVE-2019-11597 (multiple issues in the patches, required extensive testing), I though it would maybe be better to avoid very large uploads and keep them for future DLAs. cheers, Hugo -- Hu

Re: dla-needed/imagemagick entry

dresses these issues. Upstream fixed these issues yesterday, I will update my work and send it to you. Thanks! Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D

Re: dla-needed/imagemagick entry

ream addresses these issues. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: dla-needed/imagemagick entry

19-10650, CVE-2019-11598 and CVE-2019-11597. I'm currently testing it. Still OK to upload during the week-end? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5

dla-needed/imagemagick entry

fixes should be feasible, even if the code changed quite a bit. I'm not sure upgrading to a whole upstream release is worth it. Any comments? Thanks! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_

Re: dla-needed/imagemagick entry

9-10650 and possibly CVE-2019-11598. Do you think an upload ~ next week-end would be feasible for you? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: dla-needed/imagemagick entry

th > > it. > > > > Any comments? > > > That all makes sense. I did not do any work on backporting fixes, apart > from making an attempt to build the latest upstream from sid in jessie. > Since the backport idea did not go anywhere, you should be able to pick >

Re: jinja2 update for CVE-2019-10906/CVE-2016-10745

nks. We'll go for no-dsa in jessie as well. I see you have marked CVE-2016-10745 no-dsa in stretch but not CVE-2019-10906. Fixing CVE-2019-10906 without CVE-2016-10745 does not make much sense to me, so I assumed it was oversight and marked CVE-2019-10906 no-dsa in stretch as well. cheers, Hugo -

Re: April (E)LTS Report

maining wireshark CVEs, should be uploaded by next month. -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

April (E)LTS Report

. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

jinja2 update for CVE-2019-10906/CVE-2016-10745

ck on this? Anyways, it only makes sense to me to fix this in Jessie if I also prepare a stretch update at the same time. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F

Re: LTS, no-dsa reasoning and sponsored packages

ect[0], not mentors from the package sponsoring process. Yet another reason to not use "sponsoring" related arguments in the tracker? [0] https://wiki.debian.org/LTS/Funding -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247

Re: LTS, no-dsa reasoning and sponsored packages

ot sure we want to introduce such uncertain information in the tracker anyways. -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity

part > of the front-desk duties. I also find them useful. -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: CVE-2019-10906 - jinja sandbox escape poc

> This should help confirming vulnerability in other suites. 2.7.3-1 and all later releases affected. In addition, both 2.7.3-1 and 2.8-1 are affected by the previous str.format issue[0]. [0] https://palletsprojects.com/blog/jinja-281-released/ -- Hugo Lefeuvre (

CVE-2019-10906 - jinja sandbox escape poc

p(dic) }}') >>> t.render(dic={"x": User('joe')}) "{'SECRET_KEY': '12345'}" Expected behaviour would be jinja2.exceptions.SecurityError. Adapted from[0]. regards, Hugo [0] https://palletsprojects.com/blog/jinja-281-released/ --

March Report

quite quickly due to my liblivemedia, kde4libs and hdf5 work. I wanted to continue my work on faad2 but did not manage to find time for that, so I will try to finish this next month. Best Regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F

Re: hdf5 undetermined cves

cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

hdf5 undetermined cves

. Did I miss something? regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

[SECURITY] CVE-2019-7443 (kauth) in kdelibs

Hi, I'm Hugo Lefeuvre, from the Debian LTS team. I am currently working on CVE-2019-7443 which appears to affect not only kauth but also kdelibs since it ships a very similar kdecore/auth/backends/dbus/DBusHelperProxy.cpp file[0]. As far as I am aware the fix for CVE-2019-7443 was not appli

Re: recent DLAs not yet on www.debian.org

to create merge requests, then it should be mentioned but I don't > really > think that this is an efficient way. I doubt this is the workflow of the > security team. I have asked for commit rights and got them right away :) https://salsa.debian.org/webmaster-team/webwml/merge_requ

Re: February Report

> Here is my LTS report for February. > > I was allocated 20 hours. I have spent all of them in the following > tasks: -> 19.5h, not 20. -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38

February Report

iling list. Best Regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

qemu CVE-2019-6501: not-affected in Jessie and Stretch?

y was introduced in 0a96ca2437646bad197b0108c5f4a93e7ead05a9[1]. thanks! cheers, Hugo [0] https://git.qemu.org/?p=qemu.git;a=commit;h=a71c775b24ebc664129eb1d9b4c360590353efd5 [1] https://git.qemu.org/?p=qemu.git;a=commit;h=0a96ca2437646bad197b0108c5f4a93e7ead05a9 -- Hugo Lefeuvre

Re: tiff

yet?). I suggest to mention CVE-2019-7663 here. :) thanks! Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: tiff

; + return 0; I don't really like this patch... it has not been merged yet (the PR has been closed, so I guess it will never get merged) and looks more like a hack to me. What if tilew * spp = INT_MAX ? Then oskew + iskew will still overflow. So this does not fix the issue. chee

Re: tiff

Hi, > Attached is my proposed patch for tiff in Jessie. I will be able to test the upload with my usual set of test files tomorrow if necessary. > +From d0a842c5dbad2609aed43c701a12ed12461d3405 Mon Sep 17 00:00:00 2001 > +From: Hugo Lefeuvre > +Date: Wed, 21 Nov 2018 18:50:34 +010

January Report

1/msg00071.html -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: Review and testing phpmyadmin for Jessie LTS

und before upload :) > I'll fix it and perform some tests. Thanks for the review and the time > that you spent on this. I am available for testing the updated package if needed. cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4

Re: [Qemu-devel] [PATCH v2] bt: use size_t type for length parameters instead of int

xcessive value should not be considered a bug but invalid user passed input, that is normal behaviour, right? In this case I expect qemu to simply reject the input instead of triggering an assert failure and terminating. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA

Re: [Qemu-devel] [PATCH v2] bt: use size_t type for length parameters instead of int

ut they won't if user compiles without asserts. Also, AFAIK any assert failure will stop the qemu host process which is not what we want in this case. regards, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD

Re: qemu - CVE-2018-19665: bt subsystem mishandles negative length variables

Hi Adrian, > On 1/12/19 5:52 PM, Hugo Lefeuvre wrote: > > the subsystem doesn't seem to be very actively maintained and that the user > > base is quite small, it is maybe better to mark this no-dsa in stretch and > > Please don't forget thet Debian has derivat

Re: Review and testing phpmyadmin for Jessie LTS

getInfo(); > ++if (class_exists($class_name)) { > ++return $class_name::getInfo(); > ++} > ++return '' I guess a ; is missing here :) cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8

Re: qemu - CVE-2018-19665: bt subsystem mishandles negative length variables

checking using assert(). If these assert() calls are standard ansi ones, then their failure would stop the whole qemu process which is not exactly what we want right? cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: tmpreaper jessie update

part changelog entries. I will do a few more tests and upload. Thanks ! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

tmpreaper jessie update

uld be aware of about these changes. thanks ! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

Re: Review and testing phpmyadmin for Jessie LTS

t helps. will have a look later today, thanks ! cheers, Hugo -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C signature.asc Description: PGP signature

qemu - CVE-2018-19665: bt subsystem mishandles negative length variables

seem to be very actively maintained and that the user base is quite small, it is maybe better to mark this no-dsa in stretch and jessie. Cheers, Hugo [0] https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg03570.html -- Hugo Lefeuvre (hle)|www.owl.eu.com RSA4096_

  1   2   3   >