Bug#945317: xcftools NMU for CVE-2019-5086 and CVE-2019-5087

From	Markus Koschany <apo@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#945317: xcftools NMU for CVE-2019-5086 and CVE-2019-5087
Date	2021-02-11 03:10 +0100
Message-ID	<BH9AC-5Yx-1@gated-at.bofh.it> (permalink)
References	(2 earlier) <BGQoh-2AI-1@gated-at.bofh.it> <BGYFc-7LU-19@gated-at.bofh.it> <BH4Ui-3bN-15@gated-at.bofh.it> <z5oF4-6rx-11@gated-at.bofh.it> <BH4Ui-3bN-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Salvatore,

Am Mittwoch, den 10.02.2021, 22:03 +0100 schrieb Salvatore Bonaccorso:
[...]
> 
> I'm not fully in favor to have all the (build-)rdeps forced out of
> Debian, that would likely not be a benefit as seems unfair to the
> castle-game-engine, game-data-packager and neurodebian packages, but
> still think having out xcftools out of bullseye would be the right
> thing.
> 

I believe it makes sense to remove xcftools from Debian because there is a lack
of upstream support and development but I wouldn't be too aggressive about the
removal at the moment. My intention is to send a patch to fix the open CVE in
stable to you when we have addressed the remaining 32 bit issues. I believe it
would be possible to substitute xcftools with imagemagick but as Simon McVittie
for game-data-packager already pointed out, the result wouldn't always be the
same. So a bug report like "Should this package be removed from Debian" with
severity important should be sufficient for now and bug reports for reverse-
decencies that highlight the current problems are a good start.

Cheers,

Markus

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#945317: xcftools NMU for CVE-2019-5086 and CVE-2019-5087 Markus Koschany <apo@debian.org> - 2021-02-11 03:10 +0100
  Bug#945317: xcftools NMU for CVE-2019-5086 and CVE-2019-5087 Moritz Muehlenhoff <jmm@inutil.org> - 2021-02-17 09:40 +0100
    Bug#945317: xcftools NMU for CVE-2019-5086 and CVE-2019-5087 Markus Koschany <apo@debian.org> - 2021-02-25 09:20 +0100

csiph-web