Re: php vulnerabilities

2004-12-21 Thread Michael Stone
On Wed, Dec 22, 2004 at 12:25:26AM -0200, Henrique de Moraes Holschuh wrote: On Tue, 21 Dec 2004, Michael Stone wrote: Why would we get rid of apache 1.3? We wouldn't. Nor would we get rid of php4. I was just being sarcastic. The two programs are different cases. I think a reasonable question has

Re: php vulnerabilities

2004-12-21 Thread Henrique de Moraes Holschuh
On Tue, 21 Dec 2004, Michael Stone wrote: > On Tue, Dec 21, 2004 at 07:58:16PM -0200, Henrique de Moraes Holschuh wrote: > >We could just drop support for php4, and get rid of old apache 1.3 while at > >it... > > Why would we get rid of apache 1.3? We wouldn't. Nor would we get rid of php4. I wa

Re: php vulnerabilities

2004-12-21 Thread Michael Stone
On Tue, Dec 21, 2004 at 07:58:16PM -0200, Henrique de Moraes Holschuh wrote: We could just drop support for php4, and get rid of old apache 1.3 while at it... Why would we get rid of apache 1.3? Mike Stone -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Conta

Re: php vulnerabilities

2004-12-21 Thread Henrique de Moraes Holschuh
On Tue, 21 Dec 2004, Adrian Minta wrote: > Drop the support for strange architectures (like arm), focus on i386 and one > or two more used processor and release Sarge imediately ! Otherwise the > situation is going to become more and more unmanageable. We could just drop support for php4, and get

Re: php vulnerabilities

2004-12-21 Thread Florian Weimer
* Adrian Minta: > Drop the support for strange architectures (like arm), focus on i386 and one > or two more used processor and release Sarge imediately ! Otherwise the > situation is going to become more and more unmanageable. AFAIK, the number of architectures isn't the problem, at least as fa

Re: PHP Worm

2004-12-21 Thread Jeroen van Wolffelaar
On Tue, Dec 21, 2004 at 09:29:01PM +0100, Florian Weimer wrote: > * Dane Johansson: > > > I hope I am sending this to the right list :) > > > > Today I read about a new Networm, see more here: > > http://www.europe.f-secure.com/v-descs/santy_a.shtml > > > > I then proceed to check what phpbb.com h

Re: PHP Worm

2004-12-21 Thread Florian Weimer
* Dane Johansson: > I hope I am sending this to the right list :) > > Today I read about a new Networm, see more here: > http://www.europe.f-secure.com/v-descs/santy_a.shtml > > I then proceed to check what phpbb.com has to say > about this and I find this: > http://www.phpbb.com/phpBB/viewtopic.p

Re: php vulnerabilities

2004-12-21 Thread Adrian Minta
Drop the support for strange architectures (like arm), focus on i386 and one or two more used processor and release Sarge imediately ! Otherwise the situation is going to become more and more unmanageable. ... my 2 Cents :) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "uns

PHP Worm

2004-12-21 Thread Dane Johansson
Greetings, I hope I am sending this to the right list :) Today I read about a new Networm, see more here: http://www.europe.f-secure.com/v-descs/santy_a.shtml I then proceed to check what phpbb.com has to say about this and I find this: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=248046 I am ru

Re: php vulnerability

2004-12-21 Thread Christian Storch
On Di, 21.12.2004, 17:35, Sam Morris wrote: > Florian Weimer wrote: >> * Christian Storch: >> > > Use a backport of PHP 4.3.10. Apparently, there is no other way at >> > > this stage to be sure. (Upstream no longer supports PHP 4.1.x.) >> > >> > What about a kind of fork into php4-1 for woody? >>

Re: php vulnerabilities

2004-12-21 Thread Chad Adlawan
On Tue, 21 Dec 2004 13:28:00 +0100, martin f krafft <[EMAIL PROTECTED]> wrote: > > Stop using PHP. Learn Zope and PostgreSQL. > For some of us supporting PHP/MySQL client applications, thats not really an option. Chad -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscri

Re: php vulnerability

2004-12-21 Thread Sam Morris
Florian Weimer wrote: * Christian Storch: > > Use a backport of PHP 4.3.10. Apparently, there is no other way at > > this stage to be sure. (Upstream no longer supports PHP 4.1.x.) > > What about a kind of fork into php4-1 for woody? The diff from 4.3.9 to 4.3.10 is about 4,000 lines long. It co

Re: php vulnerability

2004-12-21 Thread Moritz Muehlenhoff
In gmane.linux.debian.devel.security, Torge Szczepanek wrote: > The last Samba problems couldn't easily be adopted to "older" versions > like 3.0.5. I got many rejects there when trying to build a new > package for Adamantix (based on Debian), when using the official > Samba patch. I didn't finish

Re: php vulnerability

2004-12-21 Thread Florian Weimer
* Torge Szczepanek: > It came to my mind that one maybe should concentrate the efforts of > people working on such security backports in one central repository. > That might really help to support older software and concentrate the > work on security updates of all different flavours of Linux/BSD/

Re: php vulnerabilities

2004-12-21 Thread martin f krafft
also sprach Alessandro Amici <[EMAIL PROTECTED]> [2004.12.21.1529 +0100]: > but... it doesn't install ATM due to broken dependencies > (zope-cmf1.4 is nowhere to be found) did you check the BTS and filed a bug if there is not one already? also, read the first line of my signature before replying,

Re: php vulnerabilities

2004-12-21 Thread Alessandro Amici
On Tuesday 21 December 2004 15:18, martin f krafft wrote: > also sprach Johann Spies <[EMAIL PROTECTED]> [2004.12.21.1451 +0100]: > > Pity plone2 is not available with Debian. > > It is in unstable and will probably make it into sarge. but... it doesn't install ATM due to broken dependencies (zope

Re: php vulnerabilities

2004-12-21 Thread martin f krafft
also sprach Johann Spies <[EMAIL PROTECTED]> [2004.12.21.1451 +0100]: > Pity plone2 is not available with Debian. It is in unstable and will probably make it into sarge. -- Please do not send copies of list mail to me; I read the list! .''`. martin f. krafft <[EMAIL PROTECTED]> : :' :

Re: php vulnerabilities

2004-12-21 Thread Johann Spies
On Tue, Dec 21, 2004 at 01:28:00PM +0100, martin f krafft wrote: > > Stop using PHP. Learn Zope and PostgreSQL. > Pity plone2 is not available with Debian. Regards Johann -- Johann Spies Telefoon: 021-808 4036 Informasietegnologie, Universiteit van Stellenbosch "For a child wi

Re: php vulnerability

2004-12-21 Thread Torge Szczepanek
Am Dienstag, den 21.12.2004, 14:11 +0100 schrieb Florian Weimer: > The diff from 4.3.9 to 4.3.10 is about 4,000 lines long. It contains > other changes, of course, but you still have to isolate the security > fixes. However, in the past, the PHP team neither provided clear > descriptions of secu

Re: php vulnerability

2004-12-21 Thread Florian Weimer
* Christian Storch: >> Use a backport of PHP 4.3.10. Apparently, there is no other way at >> this stage to be sure. (Upstream no longer supports PHP 4.1.x.) >> > > What about a kind of fork into php4-1 for woody? The diff from 4.3.9 to 4.3.10 is about 4,000 lines long. It contains other change

Re: php vulnerabilities

2004-12-21 Thread martin f krafft
sorry for replying to the wrong message. > saravanan ganapathy wrote: > >Can I use those packages for production environment? Of course you can. These packages are, however, not under debian quality control, nor supported by the security team. Moreover, the guy behind the repository is not a Deb

Re: php vulnerabilities

2004-12-21 Thread Francois Bayart
I use dotdeb.org since 1 year in production webserver ( commercial production ) saravanan ganapathy wrote: Recently I 've heard about http://www.dotdeb.org/. They are providing debian packages for php4.3.10. Can I use those packages for production environment? Plese suggest the best way to se

Re: php vulnerability

2004-12-21 Thread saravanan ganapathy
php is no where available in backports.org. Its available in dotdeb.org. Is it ok to use this url? Sarav --- Florian Weimer <[EMAIL PROTECTED]> wrote: > * saravanan ganapathy: > > > I am also worrying about these > vulnerabilities.btw I > > am using debian php package(4.1.2) on woody. >

Re: php vulnerability

2004-12-21 Thread Christian Storch
On Di, 21.12.2004, 10:13, Florian Weimer sagte: > * saravanan ganapathy: > >> I am also worrying about these vulnerabilities.btw I >> am using debian php package(4.1.2) on woody. >> How do I sure that I am out of danger? > > Use a backport of PHP 4.3.10. Apparently, there is no other way at >

Re: php vulnerability

2004-12-21 Thread Florian Weimer
* saravanan ganapathy: > I am also worrying about these vulnerabilities.btw I > am using debian php package(4.1.2) on woody. > How do I sure that I am out of danger? Use a backport of PHP 4.3.10. Apparently, there is no other way at this stage to be sure. (Upstream no longer supports PHP