Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-13 Thread Pierre Riteau
On Wed, Apr 12, 2006 at 05:59:45PM +0200, Moritz Muehlenhoff wrote: > > The Debian security FAQ says that non-free is not supported, and I > > understand why. But it also says that if it is fixable, an update can be > > made. There were (a few) non-free security updates in the past. > > > > I see

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-12 Thread Moritz Muehlenhoff
Pierre Riteau wrote: > On Wed, Apr 05, 2006 at 11:00:16AM +0200, Moritz Muehlenhoff wrote: > > x11 isn't setuid at all. -sdl has a strong debconf warning, that setuid > > root is a risk (I guess it's used for DGA?) and the user can select it. > > Only svgalib is setuid root, but a system running sv

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Pierre Riteau
On Wed, Apr 05, 2006 at 11:00:16AM +0200, Moritz Muehlenhoff wrote: > x11 isn't setuid at all. -sdl has a strong debconf warning, that setuid > root is a risk (I guess it's used for DGA?) and the user can select it. > Only svgalib is setuid root, but a system running svgalib apps in the year > 2006

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Bruno Barrera C.
On Wed, 2006-04-05 at 11:22 +0200, Moritz Muehlenhoff wrote: > Steve Langasek wrote: > > On Wed, Apr 05, 2006 at 11:00:16AM +0200, Moritz Muehlenhoff wrote: > > > Steve Langasek wrote: > > > > > > This bug has been pending for more than two months and no fix in > > > > > > Debian > > > > > > yet..

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Moritz Muehlenhoff
Steve Langasek wrote: > On Wed, Apr 05, 2006 at 11:00:16AM +0200, Moritz Muehlenhoff wrote: > > Steve Langasek wrote: > > > > > This bug has been pending for more than two months and no fix in > > > > > Debian > > > > > yet... Does Bruno still track his bugs? > > > > > > Here is two patches for b

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Steve Langasek
On Wed, Apr 05, 2006 at 11:00:16AM +0200, Moritz Muehlenhoff wrote: > Steve Langasek wrote: > > > > This bug has been pending for more than two months and no fix in Debian > > > > yet... Does Bruno still track his bugs? > > > > Here is two patches for both Sarge and Sid versions. > > > > Pierre R

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Moritz Muehlenhoff
Steve Langasek wrote: > > > This bug has been pending for more than two months and no fix in Debian > > > yet... Does Bruno still track his bugs? > > > > Here is two patches for both Sarge and Sid versions. > > > > Pierre Riteau > > > > (CC'ing [EMAIL PROTECTED] for the stable fix, and the > > >

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Steve Langasek
On Wed, Apr 05, 2006 at 10:08:55AM +0200, Moritz Muehlenhoff wrote: > On Tue, Apr 04, 2006 at 02:56:21PM +0200, Pierre Riteau wrote: > > This bug has been pending for more than two months and no fix in Debian > > yet... Does Bruno still track his bugs? > > Here is two patches for both Sarge and Si

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-05 Thread Moritz Muehlenhoff
On Tue, Apr 04, 2006 at 02:56:21PM +0200, Pierre Riteau wrote: > This bug has been pending for more than two months and no fix in Debian > yet... Does Bruno still track his bugs? > > Here is two patches for both Sarge and Sid versions. > > Pierre Riteau > > (CC'ing [EMAIL PROTECTED] for the stab

Bug#349653: xmame: exploitable buffer overflows [CVE-2006-0176]

2006-04-04 Thread Pierre Riteau
This bug has been pending for more than two months and no fix in Debian yet... Does Bruno still track his bugs? Here is two patches for both Sarge and Sid versions. Pierre Riteau (CC'ing [EMAIL PROTECTED] for the stable fix, and the Co-Maintainer as I don't know if he receives BTS replies) (Emai