RFT: Linux 3.16.65 package

2019-04-09 Thread Ben Hutchings
I uploaded a snapshot of the jessie-security branch of linux, with the version 3.16.65-1~git20190405.c586826, to people.debian.org: https://people.debian.org/~benh/packages/jessie-security/ There are source and binaries for amd64 and i386, along with a signed .changes file. Let me know if you

[SECURITY] [DLA 1754-1] samba security update

2019-04-09 Thread Mike Gabriel
Package: samba Version: 2:4.2.14+dfsg-0+deb8u12 CVE ID : CVE-2017-9461 CVE-2018-1050 CVE-2018-1057 CVE-2019-3880 Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix CVE-2017-9461 smbd in Samba had a denial of

Accepted samba 2:4.2.14+dfsg-0+deb8u12 (source amd64 all) into oldstable

2019-04-09 Thread Mike Gabriel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Mon, 08 Apr 2019 23:50:58 +0200 Source: samba Binary: samba samba-libs samba-common samba-common-bin smbclient samba-testsuite registry-tools libparse-pidl-perl samba-dev samba-doc python-samba samba-dsdb-modules

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Abhijith PA
On Tuesday 09 April 2019 03:09 AM, Markus Koschany wrote: > Am 08.04.19 um 21:51 schrieb Salvatore Bonaccorso: >> Hi LTS contributors, >> >> Recently I noticed that for a no-dsa (either for no-dsa or the >> stronger ignored) as explanation was started to be used e.g. "not used >> by any

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Sylvain Beucler
Hi, On 09/04/2019 09:50, Ingo Wichmann wrote: > labeling it "minor issues" when the real reason is "sponsors needed" > sounds wrong to me. That's never been the real reason so far AFAICS, only a complementary reason.     [jessie] - libpodofo (DoS, not used by any sponsor)     [jessie] -

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Ingo Wichmann
Hi Hugo, "funding needed" is OK to me, too. But to me, the packages that we're talking about are "orphaned in LTS". To change that, we need a Debian Maintainer to pick that package, fix it and upload it. Maybe that Debian Maintainer needs funding, maybe not. But still "funding needed" would be

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Hugo Lefeuvre
Hi Ingo, > labeling it "minor issues" when the real reason is "sponsors needed" > sounds wrong to me. > > I'd say "minor issues" is right for minor issues. And "sponsors needed" > is a legitimate, helpful additional information. > > It seems to me, that it's not uncommon to Debian to search for

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Ingo Wichmann
Hi, labeling it "minor issues" when the real reason is "sponsors needed" sounds wrong to me. I'd say "minor issues" is right for minor issues. And "sponsors needed" is a legitimate, helpful additional information. It seems to me, that it's not uncommon to Debian to search for a sponsor of a

Re: more missing DLAs on the website

2019-04-09 Thread Brian May
Holger Levsen writes: > ERROR: .data or .wml file missing for DLA 0015-1 > ERROR: .data or .wml file missing for DLA 0014-1 > ERROR: .data or .wml file missing for DLA 0013-1 > ERROR: .data or .wml file missing for DLA 0012-1 > ERROR: .data or .wml file missing for DLA 0011-1 > ERROR: .data or

Re: libvirt / CVE-2019-3886

2019-04-09 Thread Brian May
Brian May writes: > Ok, so it does sound like I should make this change too. Updated patch attached. -- Brian May diff -Nru libvirt-1.2.9/debian/changelog libvirt-1.2.9/debian/changelog --- libvirt-1.2.9/debian/changelog 2018-03-13 06:51:52.0 +1100 +++ libvirt-1.2.9/debian/changelog

Re: LTS, no-dsa reasoning and sponsored packages

2019-04-09 Thread Hugo Lefeuvre
> If LTS is meant as Debian project, then I would suggest not to start > to use those formulations, which I think are fine for ELTS, which is a > dedicated project not on Debian directly. Saying something is not DSA > worthy or is going to be ignored, because it's not used by a LTS > sponsor will

Re: libvirt / CVE-2019-3886

2019-04-09 Thread Brian May
Guido Günther writes: > I don't think this is needed for jessie since the corresponding function > in qemu was implemented in 4.8.0. Sounds like it won't hurt to leave this in, in any case... > qemuDomainGetTime is present in 1.2.9 and uses the guest agent so it's > affected as well. The

Re: more missing DLAs on the website

2019-04-09 Thread Salvatore Bonaccorso
Hi Brian, On Tue, Apr 09, 2019 at 07:38:19AM +1000, Brian May wrote: > Holger Levsen writes: > > > ERROR: .data or .wml file missing for DLA 1750-1 > > ERROR: .data or .wml file missing for DLA 1730-2 > > ERROR: .data or .wml file missing for DLA 719-1 > > ERROR: .data or .wml file missing for