Your message dated Sun, 09 Jan 2011 16:43:31 +0000
with message-id <4d29e5b3.3060...@apebox.org>
and subject line Debian not affected
has caused the Debian Bug report #608288,
regarding mono: CVE-2010-4254 and CVE-2010-4225
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
608288: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608288
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: moon
Severity: serious
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for moon.
CVE-2010-4254[0]:
| Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is
| used, does not properly validate arguments to generic methods, which
| allows remote attackers to bypass generic constraints, and possibly
| execute arbitrary code, via a crafted method call.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4254
http://security-tracker.debian.org/tracker/CVE-2010-4254
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAk0bcLIACgkQNxpp46476ar3VQCeMCkgi2LOffgbYtJ1VFi16BZY
jA4An3O+Jp9RxvLxI+JdU4RnIuJ1pru7
=Dusj
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
We ship an antique Moonlight package in Debian, which is not affected
by CVE-2010-4254. Only 2.x releases or newer sre affected - i.e. the
bug relates to incorrect validation of generic methods, where Moon 1.x
doesn't even contain enough of Mono to *have* generic methods.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJNKeWzAAoJEMkPnLkOH60MkgwIAIWY8g8XZTrwU2Erv8c3GWsw
fHC+p2Qgp62mleRGhs30MEfu6Jeh4/bAhwsqeXH4LaNgapbl5xVmlXowGA0MrbTV
+MgFU3pt+XrshVq5b0PJCDj0pzbS+lOZV6dMzPARJRi+OtvRsCwuFBQU/cRxAGux
91VKzZ+WsRtuBoUU0X/7lnNSu+fwgUYudfH7SaOUadnq8q/Uu+/cb2Rs0ln/CKFy
FfPwsk+8veOBkweAqVDq7bs37iPdUDWajqqqKxAbw58ps7TZUkgnJoC6eAMbpqZi
dwlGuebtjljd2L5ocvItI3MbNQCL5dFsz7G4J7mUaoeVdBOVXOeArmFWRze+azc=
=TWml
-----END PGP SIGNATURE-----
--- End Message ---
