Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Markus Koschany
Am 28.02.2016 um 18:12 schrieb Holger Levsen: > Hi Markus, > > On Sonntag, 28. Februar 2016, Markus Koschany wrote: >> I have updated https://wiki.debian.org/LTS/Using to prepare for the >> switch to Wheezy LTS. What do you think about sending an EOL >> announcement to debian-lts-announce on March

Re: Unsupported packages for Wheezy LTS

2016-02-29 Thread Raphael Hertzog
On Thu, 19 Nov 2015, Moritz Mühlenhoff wrote: > Another package which needs to be sorted out is the support for > Java. wheezy has both openjdk-6 and openjdk-7 (jessie has only > -7 and stretch will also only have one version). I asked our current sponsors about OpenJDK 6 and none asked us to keep

Re: Unsupported packages for Wheezy LTS

2016-02-29 Thread Markus Koschany
Am 29.02.2016 um 15:17 schrieb Raphael Hertzog: > On Thu, 19 Nov 2015, Moritz Mühlenhoff wrote: >> Another package which needs to be sorted out is the support for >> Java. wheezy has both openjdk-6 and openjdk-7 (jessie has only >> -7 and stretch will also only have one version). > > I asked our c

working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Mike Gabriel
Hi all, as of today, the Debian squeeze LTS support will cease and squeeze will finally enter the archived archives of Debian. .oO( /me gets out his handkerchief ...) As (paid) LTS contributor you may wonder what to do next, esp. until the official Debian wheezy LTS support period starts o

Re: Unsupported packages for Wheezy LTS

2016-02-29 Thread Raphael Hertzog
On Mon, 29 Feb 2016, Markus Koschany wrote: > Matthias Klose, the OpenJDK maintainer, stated that he intends to > support OpenJDK 6 until Ubuntu 12.04 reaches EOL in April 2017 [1] and I > think it should be feasible to mirror this approach for Wheezy LTS > provided everyone agrees to keep OpenJDK

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Paul Gevers
Hi Markus, On 29-02-16 12:35, Markus Koschany wrote: > We recommend that you upgrade your systems to Debian 7 "Wheezy". /me wonders, do we really recommend that? I would say we recommend our users to upgrade to the current stable (via Wheezy), no? And wheezy-lts is there for those that can't or w

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Matus UHLAR - fantomas
On 29-02-16 12:35, Markus Koschany wrote: We recommend that you upgrade your systems to Debian 7 "Wheezy". On 29.02.16 19:59, Paul Gevers wrote: /me wonders, do we really recommend that? I would say we recommend our users to upgrade to the current stable (via Wheezy), no? And wheezy-lts is the

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Paul Gevers
Hi Markus, On 29-02-16 20:25, Matus UHLAR - fantomas wrote: > you only can upgrade to wheezy directly. upgrade accross versions is not > supported. I know, but that is not what I meant. I meant (and wrote), upgrade via wheezy. Paul signature.asc Description: OpenPGP digital signature

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Jan Ingvoldstad
On 2016-02-29 20:27, Paul Gevers wrote: I know, but that is not what I meant. I meant (and wrote), upgrade via wheezy. I think that (what you wrote ealier) would be a sensible recommendation to make. We're only keeping Wheezy around for system setups that were established while Wheezy was s

Re: Bug#789162: aptdaemon: CVE-2015-1323: information disclosure via simulate dbus method

2016-02-29 Thread Guido Günther
Hi, On Thu, Jun 18, 2015 at 02:33:43PM +0200, Salvatore Bonaccorso wrote: > Source: aptdaemon > Version: 1.1.1-4 > Severity: grave > Tags: security upstream > > Hi, > > the following vulnerability was published for aptdaemon, which AFICS > as well affects Debian. > > CVE-2015-1323[0]: > informat

Re: working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Guido Günther
Hi, On Mon, Feb 29, 2016 at 03:25:46PM +, Mike Gabriel wrote: > For this, we can run bin/lts-needs-forward-port.py from the secure-testing > repo and see what issues we fixed in squeeze and port those fixes to the > package version in wheezy-security. Package updates must be coordinated with >

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Markus Koschany
Am 29.02.2016 um 20:27 schrieb Paul Gevers: > Hi Markus, > > On 29-02-16 20:25, Matus UHLAR - fantomas wrote: >> you only can upgrade to wheezy directly. upgrade accross versions is not >> supported. > > I know, but that is not what I meant. I meant (and wrote), upgrade via > wheezy. Hi Paul, t

Re: Wiki update LTS/Using and EOL announcement

2016-02-29 Thread Paul Gevers
Hi Markus, On 29-02-16 21:56, Markus Koschany wrote: > If it helps I could remove the "Debian 7 Wheezy" part and write > "we recommend that you upgrade your systems". That fully resolves the issue I was having with the text. Paul signature.asc Description: OpenPGP digital signature

maintainer feedback on CVE-2014-8350 (smarty3)

2016-02-29 Thread Mike Gabriel
Hi all, I have just looked at what it needs to fix CVE-2014-8350 for smarty3 [1]. Unfortunately, the fix [2] from between 3.1.20 and 3.1.21 is not trivial to backport to wheezy's 3.1.10 version. The packages that depend on smarty3 in Debian wheezy are these: o gosa + its plugins o slba

Re: working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Mike Gabriel
Hi Guido, On Mo 29 Feb 2016 21:54:11 CET, Guido Günther wrote: * prepare a fixed package * test the package * send a .debdiff to t...@security.debian.org * wait for feedback and ideally permission to upload to wheezy-security That's what I'm doing at the moment (sending the debdiff t

Re: working for wheezy-security until wheezy-lts starts

2016-02-29 Thread Guido Günther
On Tue, Mar 01, 2016 at 07:15:28AM +, Mike Gabriel wrote: [..snip..] > >>Issues that are unfixed in wheezy but fixed in squeeze: > >>* aptdaemon-> CVE-2015-1323 > >>* cakephp -> TEMP-000-698CF7 > >>* dhcpcd -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700