Thank you. I marked the CVEs as ignored. // Ola
On 11 May 2018 at 15:30, Matteo F. Vescovi <[email protected]> wrote: > Hi Ola! > > On Fri, May 11, 2018 at 11:34 AM, Ola Lundqvist <[email protected]> wrote: > > Hi all > > > > Summary: > > Fact: Blender is vulnerable and the vulnerability is possible code > execution > > Question 1: Should we bother about updating blender in wheezy > (considering > > the likelyhood of exploit, see below)? > > [...] > > Following a specific request from Security Team member Moritz (jmm), I > started working on backporting security fixes for that bunch of open > CVEs you cited for stretch. > On the first mail he sent me on Apr 26, he stated: > > - - - >8 - - - > Still, given that it's a fair number of open issues, should we fix > at least stretch-security? It's probably fine to ignore jessie, I doubt > anyone is doing modelling with such an old version at this point (and > jessie is EOL pretty soon anyway). > - - - >8 - - - > > Stretch is in my TODO list, indeed. > Jessie and wheezy could be ingnored. > > Hope this helps. > > Cheers. > > > -- > Matteo F. Vescovi || Debian Developer > GnuPG KeyID: 4096R/0x8062398983B2CF7A > > -- --- Inguza Technology AB --- MSc in Information Technology ---- / [email protected] Folkebogatan 26 \ | [email protected] 654 68 KARLSTAD | | http://inguza.com/ Mobile: +46 (0)70-332 1551 | \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / ---------------------------------------------------------------
