Re: [SECURITY] lighttpd

2013-02-04 Thread Corinna Vinschen
On Feb 1 00:26, Yaakov wrote: On Tue, 9 Oct 2012 12:56:17 +0200, Corinna Vinschen wrote: Lapo? Ping? Are you still with us? It would seem not. :-( $ grep Lapo cygwin-pkg-maint botan Lapo Luchini bsdiff Lapo Luchini libtidy-devel

Re: [SECURITY] lighttpd

2013-01-31 Thread Cygwin/X
On Tue, 9 Oct 2012 12:56:17 +0200, Corinna Vinschen wrote: Lapo? Ping? Are you still with us? It would seem not. :-( $ grep Lapo cygwin-pkg-maint botan Lapo Luchini bsdiff Lapo Luchini libtidy-devel Lapo Luchini

Re: [SECURITY] lighttpd

2012-10-09 Thread Corinna Vinschen
Lapo? Ping? Are you still with us? On Aug 14 20:52, Yaakov (Cygwin/X) wrote: On Thu, 2012-03-29 at 13:39 -0500, Yaakov (Cygwin/X) wrote: On 2012-03-29 09:58, Lapo Luchini wrote: Yaakov (Cygwin/X) wrote: BLODA? Not that I know of: WindowsDefender is deactivated (and I

Re: [SECURITY] lighttpd

2012-08-14 Thread Yaakov (Cygwin/X)
On Thu, 2012-03-29 at 13:39 -0500, Yaakov (Cygwin/X) wrote: On 2012-03-29 09:58, Lapo Luchini wrote: Yaakov (Cygwin/X) wrote: BLODA? Not that I know of: WindowsDefender is deactivated (and I checked the service is not running), and only other stuff in the BLODA is nVidia, some

Re: [SECURITY] lighttpd

2012-03-29 Thread Yaakov (Cygwin/X)
On 2012-03-29 09:58, Lapo Luchini wrote: Yaakov (Cygwin/X) wrote: BLODA? Not that I know of: WindowsDefender is deactivated (and I checked the service is not running), and only other stuff in the BLODA is nVidia, some version but I can't really do much to avoid that. I wonder. So do I,

Re: [SECURITY] lighttpd

2012-03-27 Thread Lapo Luchini
Yaakov (Cygwin/X) wrote: PS: my Win7 cygwin needs rebaseall very very often. Still didn't check it through. BLODA? Windows Defender, but I de-activated the online scan and (wrongly?) hoped this de-activated the hook. It probably doesn't, I'll try disabling the service as suggested in the ML,

Re: [SECURITY] lighttpd

2012-03-27 Thread Yaakov (Cygwin/X)
On 2012-03-27 06:01, Lapo Luchini wrote: Yaakov (Cygwin/X) wrote: The attached .cygport and patch WFM. Do these not work for you? Nope, it's just the same as the 1.4.28 as found on CygPorts repository (and trivially-updated to 1.4.30). Didn't report it yet because I hadn't the time to check

Re: [SECURITY] lighttpd

2012-02-27 Thread Lapo Luchini
Lapo Luchini wrote: I will schedule an update-session for all my packages that needs it ...failing it; neither the current package nor cygwin-ports one upgrade cleanly and I hadn't the time to work around it. If anyone has the time to do this long-awaited upgrade or wants to take maintainership

Re: [SECURITY] lighttpd

2012-02-27 Thread Yaakov (Cygwin/X)
On Mon, 2012-02-27 at 22:33 +0100, Lapo Luchini wrote: ...failing it; neither the current package nor cygwin-ports one upgrade cleanly and I hadn't the time to work around it. Could you clarify? If anyone has the time to do this long-awaited upgrade or wants to take maintainership of the

Re: [SECURITY] lighttpd

2012-02-03 Thread Lapo Luchini
Corinna Vinschen wrote: FYI, I also pinged Lapo via PM and got no reply so far. If he doesn't reply within the next 2 weeks, I guess we have to assume he's not with us anymore :( ARGH, sorry! I seems I can't really rely on myself to monitor there mailing lists with proper enough care anymore

Re: [SECURITY] lighttpd

2012-01-31 Thread Corinna Vinschen
On Jan 27 04:21, Yaakov (Cygwin/X) wrote: On Sun, 2011-12-18 at 18:13 -0600, Yaakov (Cygwin/X) wrote: Lapo, Cygwin's lighttpd is still at 1.4.20, which is over three years old. In the meantime, ten more releases have occurred, some of which (including today's) fix security issues.

Re: [SECURITY] lighttpd

2012-01-27 Thread Yaakov (Cygwin/X)
On Sun, 2011-12-18 at 18:13 -0600, Yaakov (Cygwin/X) wrote: Lapo, Cygwin's lighttpd is still at 1.4.20, which is over three years old. In the meantime, ten more releases have occurred, some of which (including today's) fix security issues. Please update lighttpd to 1.4.30 ASAP. Ping?

[SECURITY] lighttpd

2011-12-18 Thread Yaakov (Cygwin/X)
Lapo, Cygwin's lighttpd is still at 1.4.20, which is over three years old. In the meantime, ten more releases have occurred, some of which (including today's) fix security issues. Please update lighttpd to 1.4.30 ASAP. Yaakov

[SECURITY] Lighttpd: Buffer overflow

2007-09-29 Thread Yaakov (Cygwin Ports)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Lapo, Here's another buffer overflow, this time affecting lighttpd's mod_fastcgi. Yaakov -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (Cygwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

Re: SECURITY: lighttpd

2007-05-26 Thread Lapo Luchini
Lapo Luchini wrote: I'll update it ASAP, thanks for the prod. BTW: the Windows partition of my laptop kinda died, so I can't use the spare time on the bus. I'll have to finish it on my main box, competing for free time with paid jobs... PS: anyway who is using lighttpd for anything other than a

Re: SECURITY: lighttpd

2007-05-08 Thread Lapo Luchini
Yaakov (Cygwin Ports) wrote: Two vulnerabilities have been discovered in Lighttpd, each allowing for a Denial of Service. Solution: upgrade to = 1.4.14 (current is 1.4.9) Uh... whps. Is that mine? AFAIR yes, I'll update it ASAP, thanks for the prod. -- Lapo Luchini [EMAIL PROTECTED]

SECURITY: lighttpd

2007-05-07 Thread Yaakov (Cygwin Ports)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Two vulnerabilities have been discovered in Lighttpd, each allowing for a Denial of Service. Solution: upgrade to = 1.4.14 (current is 1.4.9) More information: http://security.gentoo.org/glsa/glsa-200705-07.xml