Confirmation de désabonnement de notre base

2010-10-11 Thread Expressmut
Bonjour, Ceci est une confirmation que vous vous êtes désabonné de notre base. -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/31086d433c06273ea9bea4a96281a...@smt

RECEVEZ UN CHEQUE DE 180 € et 30 % d'économies sur vos dépenses de santé.

2010-10-11 Thread Mutuelle-sante-moins-chere
Cette newsletter vous a été envoyée au format graphique HTML. Si vous lisez cette version, alors votre logiciel de messagerie préfère les e-mails au format texte. Vous pouvez lire la version originale en ligne: http:/

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Boyd Stephen Smith Jr.
On Monday, October 11, 2010 17:18:34 you wrote: >On 10/11/2010 12:21 PM, Boyd Stephen Smith Jr. wrote: >>> Anyone else perceive this situation as being a bit sub-optimal from >>> the security perspective? >> >> No. > >Interesting. Do you happen to run any such systems in a production >environment?

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Michael Gilbert
On Mon, 11 Oct 2010 17:18:34 -0500 Marsh Ray wrote: > > You would need to convince the kernel team that the bigmem kernel > > should be the default on i386 systems. > > "Please?" Don't ask this list, ask the kernel team (via bug report and/or mailing list message). Note that ubuntu uses some kin

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Marsh Ray
On 10/11/2010 12:21 PM, Boyd Stephen Smith Jr. wrote: Anyone else perceive this situation as being a bit sub-optimal from the security perspective? No. Interesting. Do you happen to run any such systems in a production environment? Debian server admins are running amd64, not i386, and NX

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Michael Gilbert
On Mon, 11 Oct 2010 11:50:54 -0500, Marsh Ray wrote: > On 10/10/2010 12:40 PM, Kees Cook wrote: > > > > On Sun, Oct 10, 2010 at 01:35:10PM -0400, Brchk05 wrote: > >> this means that my CPU supports nx but I do > >> not have the right type of kernel, i.e., one that uses PAE > >> addressing, to suppo

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Boyd Stephen Smith Jr.
In <4cb3406e.5020...@extendedsubset.com>, Marsh Ray wrote: >On 10/10/2010 12:40 PM, Kees Cook wrote: >> On Sun, Oct 10, 2010 at 01:35:10PM -0400, Brchk05 wrote: >>> this means that my CPU supports nx but I do >>> not have the right type of kernel, i.e., one that uses PAE >>> addressing, to support

Re: non-executable stack (via PT_GNU_STACK) not being enforced

2010-10-11 Thread Marsh Ray
On 10/10/2010 12:40 PM, Kees Cook wrote: On Sun, Oct 10, 2010 at 01:35:10PM -0400, Brchk05 wrote: this means that my CPU supports nx but I do not have the right type of kernel, i.e., one that uses PAE addressing, to support enforcement (or is that part Ubuntu specific). Does this sound plausib

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Michael Gilbert
On Mon, 11 Oct 2010 10:39:37 -0500, Jordon Bedwell wrote: > On Mon, 2010-10-11 at 11:15 -0400, Michael Gilbert wrote: > > I highly doubt that there is anything malicious going on here, and there > > is always the "Debian does not hide problems" mantra. The simplest, > > and most-likely explanation

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Jordon Bedwell
On Mon, 2010-10-11 at 11:15 -0400, Michael Gilbert wrote: > I highly doubt that there is anything malicious going on here, and there > is always the "Debian does not hide problems" mantra. The simplest, > and most-likely explanation is that it was easier to update to the new > upstream, rather tha

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Michael Gilbert
On Mon, 11 Oct 2010 09:46:04 -0500, Jordon Bedwell wrote: > On Mon, 2010-10-11 at 10:40 -0400, Michael Gilbert wrote: > > The problem here appears to be the jump to the new upstream version > > (1.8.2 to 1.8.13), which has a different dependency set. New > > upstreams are usually disallowed in sec

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Jordon Bedwell
On Mon, 2010-10-11 at 10:40 -0400, Michael Gilbert wrote: > The problem here appears to be the jump to the new upstream version > (1.8.2 to 1.8.13), which has a different dependency set. New > upstreams are usually disallowed in security uploads. The question > is why was that OK in this case, ra

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Michael Gilbert
On Mon, 11 Oct 2010 14:14:41 +0100, Ian Jackson wrote: > Florian Weimer writes ("[SECURITY] [DSA-2115-2] New moodle packages fix > several vulnerabilities"): > > DSA-2115-1 introduced a regression because it lacked a dependency on > > the wwwconfig-common package, leading to installations problems

Re: [SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities

2010-10-11 Thread Ian Jackson
Florian Weimer writes ("[SECURITY] [DSA-2115-2] New moodle packages fix several vulnerabilities"): > DSA-2115-1 introduced a regression because it lacked a dependency on > the wwwconfig-common package, leading to installations problems. This > update addresses this issue. For reference, the text