Hello Michael, you are still listed in dla-needed.txt as the owner of Gosa. Apparently you already prepared a debdiff and sent it to the security team but it was never released. Would it be possible to share it with us? Or can you confirm that the following patches from Jessie will resolve this issue?
https://tracker.debian.org/media/packages/g/gosa/changelog-2.7.4%2Breloaded2-1%2Bdeb8u2 CVE-2015-8771: 0006_code-injection-in-samba-hash-generation.patch, 0007_update-sambaHashHook-description.patch. Fix potential code injection issue in Samba hash generation. (CVE-2015-8771) CVE-2014-9760: https://sources.debian.net/src/gosa/2.7.4%2Breloaded2-12/debian/patches/0003_xss-vulnerability-on-login-screen.patch/ Regards Markus
signature.asc
Description: OpenPGP digital signature
