Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1120902 > unrolled thread
| Started by | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| First post | 2022-10-14 13:00 +0200 |
| Last post | 2022-10-14 14:10 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.bugs.dist
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 13:00 +0200
Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:00 +0200
Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:10 +0200
Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <roehling@debian.org> - 2022-10-14 14:40 +0200
Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <timo@gaussglocke.de> - 2022-10-14 14:10 +0200
| From | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2022-10-14 13:00 +0200 |
| Subject | Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 |
| Message-ID | <FgqA2-eaU2-15@gated-at.bofh.it> |
Control: tags -1 + confirmed On Sun, 2022-10-02 at 19:38 +0200, Timo Röhling wrote: > The update fixes two vulnerabilities with low priority, i.e. > the security team has decided not to issue a DSA. > > [ Impact ] > CVE-2022-34300: Heap overflow in DecodePixelData > CVE-2022-38529: Heap overflow in rleUncompress > + * Fix low-priority vulnerabilities I'm not sure I'd use that wording in a changelog personally - more likely just "fix security issues" or "backport fixes" or similar - but it's up to you. Please go ahead. Regards, Adam
[toc] | [next] | [standalone]
| From | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2022-10-14 14:00 +0200 |
| Message-ID | <Fgrw5-ebsB-3@gated-at.bofh.it> |
| In reply to | #1120902 |
On Fri, 2022-10-14 at 11:53 +0100, Adam D. Barratt wrote: > Control: tags -1 + confirmed > > On Sun, 2022-10-02 at 19:38 +0200, Timo Röhling wrote: > > The update fixes two vulnerabilities with low priority, i.e. > > the security team has decided not to issue a DSA. > > > > [ Impact ] > > CVE-2022-34300: Heap overflow in DecodePixelData > > CVE-2022-38529: Heap overflow in rleUncompress > > > > + * Fix low-priority vulnerabilities > > I'm not sure I'd use that wording in a changelog personally - more > likely just "fix security issues" or "backport fixes" or similar - > but > it's up to you. Hmmm. The debdiff you've uploaded is rather larger than I was expecting, or was proposed. That appears to be (which I should have spotted earlier) because stable has 1.0.0+dfsg-1 and your upload is based on 1.0.*1*+dfsg-1. Regards, Adam
[toc] | [prev] | [next] | [standalone]
| From | "Adam D. Barratt" <adam@adam-barratt.org.uk> |
|---|---|
| Date | 2022-10-14 14:10 +0200 |
| Message-ID | <FgrFL-ebLu-3@gated-at.bofh.it> |
| In reply to | #1120914 |
On Fri, 2022-10-14 at 13:58 +0200, Timo Röhling wrote: > * Adam D. Barratt <adam@adam-barratt.org.uk> [2022-10-14 12:53]: > > On Fri, 2022-10-14 at 11:53 +0100, Adam D. Barratt wrote: > > > Control: tags -1 + confirmed > > > > > > On Sun, 2022-10-02 at 19:38 +0200, Timo Röhling wrote: > > > > The update fixes two vulnerabilities with low priority, i.e. > > > > the security team has decided not to issue a DSA. > > > > > > > > [ Impact ] > > > > CVE-2022-34300: Heap overflow in DecodePixelData > > > > CVE-2022-38529: Heap overflow in rleUncompress > > > > > > > > > > + * Fix low-priority vulnerabilities > > > > > > I'm not sure I'd use that wording in a changelog personally - > > > more > > > likely just "fix security issues" or "backport fixes" or similar > > > - > > > but > > > it's up to you. > > > > Hmmm. The debdiff you've uploaded is rather larger than I was > > expecting, or was proposed. > > > > That appears to be (which I should have spotted earlier) because > > stable > > has 1.0.0+dfsg-1 and your upload is based on 1.0.*1*+dfsg-1. > Is there something we can do about this? > Should I prepare a new upload with 1.0.1+really1.0.0, for instance? There's a holding queue in front of proposed-updates, so the upload isn't in the archive yet. Assuming the diff would be similar to that initially proposed, you can simply prepare and upload 1.0.0+dfsg-1+deb11u1 and we can sort things out from there. Regards, Adam
[toc] | [prev] | [next] | [standalone]
| From | Timo Röhling <roehling@debian.org> |
|---|---|
| Date | 2022-10-14 14:40 +0200 |
| Message-ID | <Fgs8N-ebUs-5@gated-at.bofh.it> |
| In reply to | #1120916 |
[Multipart message — attachments visible in raw view] — view raw
* Adam D. Barratt <adam@adam-barratt.org.uk> [2022-10-14 13:04]: >Assuming the diff would be similar to that initially proposed, you can >simply prepare and upload 1.0.0+dfsg-1+deb11u1 and we can sort things >out from there. It is, so I uploaded the correct version now. Sorry for the screw-up, I should have noticed that before I even proposed the update. Cheers Timo -- ⢀⣴⠾⠻⢶⣦⠀ ╭────────────────────────────────────────────────────╮ ⣾⠁⢠⠒⠀⣿⡁ │ Timo Röhling │ ⢿⡄⠘⠷⠚⠋⠀ │ 9B03 EBB9 8300 DF97 C2B1 23BF CC8C 6BDD 1403 F4CA │ ⠈⠳⣄⠀⠀⠀⠀ ╰────────────────────────────────────────────────────╯
[toc] | [prev] | [next] | [standalone]
| From | Timo Röhling <timo@gaussglocke.de> |
|---|---|
| Date | 2022-10-14 14:10 +0200 |
| Message-ID | <FgrFL-ebLu-5@gated-at.bofh.it> |
| In reply to | #1120914 |
[Multipart message — attachments visible in raw view] — view raw
* Adam D. Barratt <adam@adam-barratt.org.uk> [2022-10-14 12:53]: >On Fri, 2022-10-14 at 11:53 +0100, Adam D. Barratt wrote: >> Control: tags -1 + confirmed >> >> On Sun, 2022-10-02 at 19:38 +0200, Timo Röhling wrote: >> > The update fixes two vulnerabilities with low priority, i.e. >> > the security team has decided not to issue a DSA. >> > >> > [ Impact ] >> > CVE-2022-34300: Heap overflow in DecodePixelData >> > CVE-2022-38529: Heap overflow in rleUncompress >> > >> >> + * Fix low-priority vulnerabilities >> >> I'm not sure I'd use that wording in a changelog personally - more >> likely just "fix security issues" or "backport fixes" or similar - >> but >> it's up to you. > >Hmmm. The debdiff you've uploaded is rather larger than I was >expecting, or was proposed. > >That appears to be (which I should have spotted earlier) because stable >has 1.0.0+dfsg-1 and your upload is based on 1.0.*1*+dfsg-1. Is there something we can do about this? Should I prepare a new upload with 1.0.1+really1.0.0, for instance? Cheers Timo -- ⢀⣴⠾⠻⢶⣦⠀ ╭────────────────────────────────────────────────────╮ ⣾⠁⢠⠒⠀⣿⡁ │ Timo Röhling │ ⢿⡄⠘⠷⠚⠋⠀ │ 9B03 EBB9 8300 DF97 C2B1 23BF CC8C 6BDD 1403 F4CA │ ⠈⠳⣄⠀⠀⠀⠀ ╰────────────────────────────────────────────────────╯
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web