Hi,
[reducing CC list]
Thank you very much for the hint on the checksum verification commit
(2fb3722ce), it was really the bit missing. I've added that to the patch
series and rerolled the rest of the patches to add the Verify type (which is
now called VerifyConfig, but we don't have the
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512
Package: bind9
Version: 1:9.9.5.dfsg-9+deb8u16
CVE ID : CVE-2018-5740
CVE-2018-5740
The "deny-answer-aliases" feature in BIND has a flaw which can
cause named to exit with an assertion failure.
For Debian 8
Package: 389-ds-base
Version: 1.3.3.5-4+deb8u2
CVE ID : CVE-2018-10871 CVE-2018-10935
Debian Bug : 906985
CVE-2018-10871
By default nsslapd-unhashed-pw-switch was set to 'on'. So a copy of
the unhashed password was kept in modifiers and was possibly logged in
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512
Format: 1.8
Date: Wed, 28 Aug 2018 18:03:02 +0200
Source: bind9
Binary: bind9 bind9utils bind9-doc host bind9-host libbind-dev libbind9-90
libdns100 libisc95 liblwres90 libisccc90 libisccfg90 dnsutils lwresd
libbind-export-dev libdns-export100
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Format: 1.8
Date: Thu, 30 Aug 2018 16:40:44 +0200
Source: 389-ds-base
Binary: 389-ds 389-ds-base-libs 389-ds-base-libs-dbg 389-ds-base-dev
389-ds-base 389-ds-base-dbg
Architecture: source all amd64
Version: 1.3.3.5-4+deb8u2
Distribution:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Format: 1.8
Date: Sat, 25 Aug 2018 22:06:19 +0530
Source: squirrelmail
Binary: squirrelmail
Architecture: source all
Version: 2:1.4.23~svn20120406-2+deb8u3
Distribution: jessie-security
Urgency: high
Maintainer: Jeroen van Wolffelaar
Changed-By:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
Package: squirrelmail
Version: 2:1.4.23~svn20120406-2+deb8u3
CVE IDs: CVE-2018-14950 CVE-2018-14951 CVE-2018-14952
CVE-2018-14953 CVE-2018-14954 CVE-2018-14955
Debian Bug : #905023
It was discovered
Hi Abhijith,
> I've prepared security update for squirrelmail. Please review and
> upload.
Thanks. I have reserved DLA-1484-1 for this and will upload & announce
shortly.
> I am not sure about lintian warning (which was already there)
> /license-problem-non-free-RFC/.
(If it was already there
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512
Hello.
I've prepared security update for squirrelmail. Please review and
upload. Debdiff is attached. I've tested new build against given
POC[1]. I am not sure about lintian warning (which was already there)
/license-problem-non-free-RFC/.
Thanks
