Re: [SECURITY] [DSA 3817-1] jbig2dec security update
On 24/03/17 22:32, Moritz Muehlenhoff wrote: > - > Debian Security Advisory DSA-3817-1 secur...@debian.org > https://www.debian.org/security/ Moritz Muehlenhoff > March 24, 2017https://www.debian.org/security/faq > - > > Package: jbig2dec > CVE ID : CVE-2016-9601 > > Multiple security issues have been found in the JBIG2 decoder library, > which may lead to lead to denial of service or the execution of arbitrary > code if a malformed image file (usually embedded in a PDF document) is > opened. > > For the stable distribution (jessie), this problem has been fixed in > version 0.13-4~deb8u1. Hi Security, Release folks, This security update is in the form of a new upstream release, going from 0.11+20120125-1 in stable to 0.13-4~deb8u1. I was rather alarmed to find the following entry in the NEWS.Debian file that appears to pertain to this update: > jbig2dec (0.12-1) unstable; urgency=medium > > * Licensing has changed to GNU Affero General Public License (AGPL). > Please ensure that all use complies with this new license. > > -- Jonas Smedegaard Fri, 31 Jul 2015 11:45:03 +0200 Was this expected? Has any thought been paid to people who use libjbig2dec in jessie currently that may fall foul of this license change? Thanks, Chris -- Chris Boot bo...@debian.org GPG: 8467 53CB 1921 3142 C56D C918 F5C8 3C05 D9CE
Bug#780038: unblock: ulogd2/2.0.4-2
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package ulogd2. The updated package fixes an RC bug (#779865). This is done by adding some maintscript entries to remove more obsolete conffiles from the previous ulogd package. Here is the full debdiff from 2.0.4-1 (version in testing) to 2.0.4-2 (version freshly uploaded to sid): diff -Nru ulogd2-2.0.4/debian/changelog ulogd2-2.0.4/debian/changelog --- ulogd2-2.0.4/debian/changelog 2014-04-13 14:49:13.0 +0100 +++ ulogd2-2.0.4/debian/changelog 2015-03-08 15:22:46.0 + @@ -1,3 +1,15 @@ +ulogd2 (2.0.4-2) unstable; urgency=medium + + [ Andreas Beckmann ] + * Fix removal of old ulogd initscript upon initial installation of ulogd2. + * Remove more obsolete conffiles. + + [ Chris Boot ] + * Apply patches from Andreas Beckmann correct the transition from ulogd to +ulogd2. (Closes: #779865, LP: #1354720) + + -- Chris Boot Sun, 08 Mar 2015 15:22:44 + + ulogd2 (2.0.4-1) unstable; urgency=medium * New upstream release: diff -Nru ulogd2-2.0.4/debian/ulogd2.maintscript ulogd2-2.0.4/debian/ulogd2.maintscript --- ulogd2-2.0.4/debian/ulogd2.maintscript 2014-04-13 11:42:32.0 +0100 +++ ulogd2-2.0.4/debian/ulogd2.maintscript 2015-03-08 15:22:10.0 + @@ -1,4 +1,6 @@ # Remove the old ulogd 1.x init script, as it can cause problems/confusion -rm_conffile /etc/init.d/ulogd 2.0.2-4~ ulogd +# Provide a fall-back old-version ("0") as a hack to ensure this is performed +# by dpkg-maintscript-helper on the initial install of ulogd2, too. +rm_conffile /etc/init.d/ulogd 2.0.4-2~ ulogd -- "$@" 0 diff -Nru ulogd2-2.0.4/debian/ulogd.maintscript ulogd2-2.0.4/debian/ulogd.maintscript --- ulogd2-2.0.4/debian/ulogd.maintscript 1970-01-01 01:00:00.0 +0100 +++ ulogd2-2.0.4/debian/ulogd.maintscript 2015-03-08 15:22:10.0 + @@ -0,0 +1,2 @@ +rm_conffile /etc/init.d/ulogd 2.0.4-2~ +rm_conffile /etc/logrotate.d/ulogd 2.0.4-2~ unblock ulogd2/2.0.4-2 Thanks for your consideration. Regards, Chris -- System Information: Debian Release: 8.0 APT prefers testing APT policy: (990, 'testing'), (500, 'testing-updates') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores) Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) -- To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/E1YUdgd-0004hA-Jq@ripley
Bug#784998: jessie-pu: package ulogd2/2.0.4-2+deb8u1
Package: release.debian.org Severity: normal Tags: jessie User: release.debian@packages.debian.org Usertags: pu Hi release team folks, I would like to do an upload to stable (jessie) to correct an important bug in ulogd2, a package I maintain. The bug is an endianness issue that prevents the JSON output plugin in ulogd2 from working correctly on big-endian systems. The bug has been reported to BTS as 784935: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784935 The issue is fixed in upstream version 2.0.5, which I have uploaded to sid today as 2.0.5-1. My upstream was kind enough to report the bug and isolate the necessary patch for stable. I have prepared an upload in a new Git branch on Alioth: http://anonscm.debian.org/cgit/collab-maint/ulogd2.git/log/?h=debian-jessie Here is the debdiff from 2.0.4-2 (current version in jessie) to 2.0.4-2+deb8u1: diff -Nru ulogd2-2.0.4/debian/changelog ulogd2-2.0.4/debian/changelog --- ulogd2-2.0.4/debian/changelog 2015-03-08 15:22:46.0 + +++ ulogd2-2.0.4/debian/changelog 2015-05-11 13:32:43.0 +0100 @@ -1,3 +1,12 @@ +ulogd2 (2.0.4-2+deb8u1) stable; urgency=medium + + * Begin a new debian-jessie branch: update debian/gbp.conf. + * Add upstream patch Fix-JSON-output-on-big-endian-systems.patch: +- Corrects JSON output of integer types on big-endian systems. + (Closes: #784935) + + -- Chris Boot Mon, 11 May 2015 13:32:13 +0100 + ulogd2 (2.0.4-2) unstable; urgency=medium [ Andreas Beckmann ] diff -Nru ulogd2-2.0.4/debian/gbp.conf ulogd2-2.0.4/debian/gbp.conf --- ulogd2-2.0.4/debian/gbp.conf2014-07-27 09:51:25.0 +0100 +++ ulogd2-2.0.4/debian/gbp.conf2015-05-11 13:23:11.0 +0100 @@ -1,4 +1,5 @@ [DEFAULT] -debian-branch = debian +debian-branch = debian-jessie +dist = jessie pristine-tar = True diff -Nru ulogd2-2.0.4/debian/patches/Fix-JSON-output-on-big-endian-systems.patch ulogd2-2.0.4/debian/patches/Fix-JSON-output-on-big-endian-systems.patch --- ulogd2-2.0.4/debian/patches/Fix-JSON-output-on-big-endian-systems.patch 1970-01-01 01:00:00.0 +0100 +++ ulogd2-2.0.4/debian/patches/Fix-JSON-output-on-big-endian-systems.patch 2015-05-11 13:23:11.0 +0100 @@ -0,0 +1,52 @@ +From: Jimmy Jones +Subject: Fix JSON output on big endian systems +Acked-by: Eric Leblond +Acked-by: Chris Boot +Origin: upstream, commit:4f267553aede76dc91133ba88c69f8b8faf00b72 +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784935 +Forwarded: not-needed +Last-Update: 2015-05-11 + +Corrects the output of JSON integers on big-endian systems. + +--- + output/ulogd_output_JSON.c | 11 +++ + 1 file changed, 11 insertions(+) + +diff --git a/output/ulogd_output_JSON.c b/output/ulogd_output_JSON.c +index e7ac642..3ad2620 100644 +--- a/output/ulogd_output_JSON.c b/output/ulogd_output_JSON.c +@@ -158,7 +158,11 @@ static int json_interp(struct ulogd_pluginstance *upi) + break; + case ULOGD_RET_BOOL: + case ULOGD_RET_INT8: ++ json_object_set_new(msg, field_name, json_integer(key->u.value.i8)); ++ break; + case ULOGD_RET_INT16: ++ json_object_set_new(msg, field_name, json_integer(key->u.value.i16)); ++ break; + case ULOGD_RET_INT32: + json_object_set_new(msg, field_name, json_integer(key->u.value.i32)); + break; +@@ -171,10 +175,17 @@ static int json_interp(struct ulogd_pluginstance *upi) + json_object_set_new(msg, "action", json_string("blocked")); + break; + } ++ json_object_set_new(msg, field_name, json_integer(key->u.value.ui8)); ++ break; + case ULOGD_RET_UINT16: ++ json_object_set_new(msg, field_name, json_integer(key->u.value.ui16)); ++ break; + case ULOGD_RET_UINT32: ++ json_object_set_new(msg, field_name, json_integer(key->u.value.ui32)); ++ break; + case ULOGD_RET_UINT64: + json_object_set_new(msg, field_name, json_integer(key->u.value.ui64)); ++ break; + default: + /* don't know how to interpret this key. */ + break; +-- +2.1.4 + diff -Nru ulogd2-2.0.4/debian/patches/series ulogd2-2.0.4/debian/patches/series --- ulogd2-2.0.4/debian/patches/series 2014-04-13 11:42:32.0 +0100 +++ ulogd2-2.0.4/debian/patches/series 2015-05-11 13:23:11.0 +0100 @@ -2,3 +2,4 @@ enable-nflog-by-default.patch put-logfiles-in-var-log-ulog.patch ulogd8-ulogd2.patch +Fix-JSON-output-on-big-endian-systems.patch -- System Information: Debian Release: 8.0
Bug#784998: jessie-pu: package ulogd2/2.0.4-2+deb8u1
Control: tags -1 + pending On 12/05/15 21:46, Adam D. Barratt wrote: > Please go ahead, thanks. Thanks for accepting. Uploaded. Chris -- Chris Boot deb...@bootc.net GPG: 8467 53CB 1921 3142 C56D C918 F5C8 3C05 D9CE -- To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/5552f310.4060...@bootc.net
Bug#890204: transition: ppp
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition Hi release team folks, I have just uploaded a new version of ppp to experimental. That upload requires packages that build pppd plugins to be rebuilt due to a change in the pppd ABI. I would like to upload that package to sid as soon as feasible. This is the first opportunity we've had to try my new plugin ABI tracking technique. I've given the ben file below a try myself and I think it does the right thing, but I would appreciate any comments you might have about it. I have manually rebuilt all affected packages and all build fine so binNMUs should be the only thing required for all of them. Note that connman seems to be a package to newly depend on ppp-dev and builds a pppd plugin but it doesn't use my dh_ppp helper. I will be filing a bug against that package (including a patch) shortly. Even without said patch a binNMU is sufficient (and required) for binary compatibility with the new ppp upload. Ben file: title = "ppp"; is_affected = .build-depends ~ /ppp-dev/; is_good = .depends ~ /ppp \(<< 2.4.7-3~\)/ | .breaks ~ /ppp \(>= 2.4.7-3~\)/; is_bad = .depends ~ /ppp \(<< 2.4.7-2~\)/ | .breaks ~ /ppp \(>= 2.4.7-2~\)/;
Bug#890204: transition: ppp
On 11/02/18 21:04, Chris Boot wrote: > Note that connman seems to be a package to newly depend on ppp-dev and > builds a pppd plugin but it doesn't use my dh_ppp helper. I will be > filing a bug against that package (including a patch) shortly. Even > without said patch a binNMU is sufficient (and required) for binary > compatibility with the new ppp upload. Please see bug #890207 and the Salsa Merge Request at: https://salsa.debian.org/debian/connman/merge_requests/1 Thanks, Chris -- Chris Boot bo...@debian.org signature.asc Description: OpenPGP digital signature
Bug#890204: transition: ppp
On 17/02/18 08:03, Emilio Pozuelo Monfort wrote: > Control: tags -1 confirmed > > On 11/02/18 22:04, Chris Boot wrote: >> Package: release.debian.org >> Severity: normal >> User: release.debian@packages.debian.org >> Usertags: transition >> >> Hi release team folks, >> >> I have just uploaded a new version of ppp to experimental. That upload >> requires packages that build pppd plugins to be rebuilt due to a change >> in the pppd ABI. I would like to upload that package to sid as soon as >> feasible. [snip] > Please go ahead. Uploaded. Note that connman just got in today before me so that'll need a binNMU now as well. Cheers, Chris -- Chris Boot bo...@debian.org signature.asc Description: OpenPGP digital signature
Bug#977972: transition: ppp
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition Hi release team folks, There has been a version of ppp in experimental since 2020-02-15. I've got a very slightly revised version that I'd like to upload over the holidays (mostly just cosmetic packaging updates) but I'll wait to upload until I hear from you. This new version is an ABI break due to the new upstream version, hence the transition. As usual this isn't a traditional library package upload so the Ben file looks a bit foreign. See #890204 for the (only) other time we did this. Best regards, Chris Ben file: title = "ppp"; is_affected = .build-depends ~ /ppp-dev/; is_good = .depends ~ /ppp \(>= 2\.4\.8-1\+~\)/ | .breaks ~ /ppp \(<< 2\.4\.8-1\+~\)/; is_bad = .depends ~ /ppp \(>= 2\.4\.7-2\+~\)/ | .breaks ~ /ppp \(<< 2\.4\.7-2\+~\)/;
Bug#977972: transition: ppp
On 25/12/2020 14:38, Sebastian Ramacher wrote: Please go ahead. Uploaded. -- Chris Boot bo...@debian.org
Bug#979303: transition: ppp
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition Hi release team folks, There has been a new upstream release of ppp (2.4.9). I know this is very soon after my upload of 2.4.8 and its transition, but I'm also both aware of the transition freeze that's coming up and a large number of improvements in the new release. Before I go ahead and update all my packaging, is it likely that we can get ppp 2.4.9 into bullseye? I dont' wish to over-burden you or push the boundaries of the freeze, hence the query. In case this is acceptable: Ben file: title = "ppp"; is_affected = .build-depends ~ /ppp-dev/; is_good = .depends ~ /ppp \(>= 2\.4\.9-1\+~\)/ | .breaks ~ /ppp \(<< 2\.4\.9-1\+~\)/; is_bad = .depends ~ /ppp \(>= 2\.4\.8-1\+~\)/ | .breaks ~ /ppp \(<< 2\.4\.8-1\+~\)/; Many thanks in advance, Chris
Bug#1056574: transition: ppp
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition X-Debbugs-Cc: p...@packages.debian.org Control: affects -1 + src:ppp Hello Release Team friends, I uploaded ppp-2.5.0-1+1 to experimental back in September, and I think it's time to unleash it on unstable, ideally in the next few days. This is an ABI break both due to the new upstream version but there are also significant changes in this release that may break dependent packages. The upload I'm planning, 2.5.0-1+2, only has a minor fix for loong64 and a changelog fix. As usual this isn't a traditional library package upload so the Ben file looks a bit foreign. See #890204 for a previous time we did this. Thanks, Chris Ben file: title = "ppp"; is_affected = .build-depends ~ /ppp-dev/; is_good = .depends ~ /ppp \(>= 2\.5\.0-1\+~\)/ | .breaks ~ /ppp \(<< 2\.5\.0-1\+~\)/; is_bad = .depends ~ /ppp \(>= 2\.4\.9-1\+~\)/ | .breaks ~ /ppp \(<< 2\.4\.9-1\+~\)/;
Bug#1056574: transition: ppp
[re-sending to include the bug, oops] On 24/11/2023 15:52, Emilio Pozuelo Monfort wrote: On 23/11/2023 11:54, Chris Boot wrote: Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: transition X-Debbugs-Cc: p...@packages.debian.org Control: affects -1 + src:ppp Hello Release Team friends, I uploaded ppp-2.5.0-1+1 to experimental back in September, and I think it's time to unleash it on unstable, ideally in the next few days. This is an ABI break both due to the new upstream version but there are also significant changes in this release that may break dependent packages. Any way to reduce possible breakage, or to detect and fix it before the transition starts? Like rebuilding rdeps, or checking rdep autopkgtests? I'll go an do some rebuilds now and see how they go. If any breakage occurs it will be obvious at build time. The upload I'm planning, 2.5.0-1+2, only has a minor fix for loong64 and a changelog fix. As usual this isn't a traditional library package upload so the Ben file looks a bit foreign. See #890204 for a previous time we did this. I have added a tracker, should appear in an hour or two. Many thanks. Cheers, Chris -- Chris Boot bo...@debian.org
Bug#1056574: transition: ppp
On 26/11/2023 10:56, Chris Boot wrote: Any way to reduce possible breakage, or to detect and fix it before the transition starts? Like rebuilding rdeps, or checking rdep autopkgtests? I'll go an do some rebuilds now and see how they go. If any breakage occurs it will be obvious at build time. The status of the rdeps (list taken from the tracker): connman: OK network-manager: OK pptpd: https://bugs.debian.org/1056898 sstp-client: https://bugs.debian.org/1056900 network-manager-fortisslvpn: https://bugs.debian.org/1056901 network-manager-l2tp: OK network-manager-pptp: OK network-manager-sstp: https://bugs.debian.org/1056903 Cheers, Chris -- Chris Boot bo...@debian.org
Bug#1056574: transition: ppp
On 26/11/2023 11:36, Chris Boot wrote: On 26/11/2023 10:56, Chris Boot wrote: Any way to reduce possible breakage, or to detect and fix it before the transition starts? Like rebuilding rdeps, or checking rdep autopkgtests? I'll go an do some rebuilds now and see how they go. If any breakage occurs it will be obvious at build time. The status of the rdeps (list taken from the tracker): connman: OK network-manager: OK pptpd: https://bugs.debian.org/1056898 sstp-client: https://bugs.debian.org/1056900 network-manager-fortisslvpn: https://bugs.debian.org/1056901 network-manager-l2tp: OK network-manager-pptp: OK network-manager-sstp: https://bugs.debian.org/1056903 All that's left now is pptpd (with an offer from Christoph to upload when ready) and network-manager-fortisslvpn (with commits fixing the issues upstream, but no upstream release). In the mean time, #1065940 has become a blocker for the time_t transition. I think I'd rather upload 2.5.0 and break network-manager-fortisslvpn than just the patch to fix the breakage. Would the release team be happy to continue with this transition? Thanks, Chris -- Chris Boot bo...@debian.org