Re: Wheezy update for lame

2017-10-05 Thread Hugo Lefeuvre
Hi Moritz, > What's the timeline for lame 3.100 ? Quoting Robert Hegemann[0], 2017-09-06: "All known bugs are fixed in CVS now. As we get the very same bugs reported again and again, I guess we should make the 3.100 stable release soon." I'd say 3.100 will be released soon, but afaik there's no

Re: Wheezy update for lame

2017-10-03 Thread Moritz Mühlenhoff
On Sun, Sep 24, 2017 at 04:01:27PM +0200, Hugo Lefeuvre wrote: > Instead of applying the patches I'd propose to wait for lame 3.100 > which I could backport to stretch, jessie and wheezy if the security > team thinks it's a good idea. What's the timeline for lame 3.100? We can probably do that, bu

Wheezy update for lame

2017-09-24 Thread Hugo Lefeuvre
Hi, Over the past several weeks, I have been investigating various vulnerabilities in lame[0] which I couldn't reproduce on any Debian system. I have reported them to lame's upstream which claims they are duplicates of other already reported issues, with fixes available in the CVS (couldn't verify