Groups > linux.debian.bugs.dist > #1120916

Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1

From	"Adam D. Barratt" <adam@adam-barratt.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1
Date	2022-10-14 14:10 +0200
Message-ID	<FgrFL-ebLu-3@gated-at.bofh.it> (permalink)
References	(2 earlier) <FgqA2-eaU2-15@gated-at.bofh.it> <Fgrw5-ebsB-3@gated-at.bofh.it> <FgrFL-ebLu-5@gated-at.bofh.it> <Fcbgd-bAIm-1@gated-at.bofh.it> <FgrFL-ebLu-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Fri, 2022-10-14 at 13:58 +0200, Timo Röhling wrote:
> * Adam D. Barratt <adam@adam-barratt.org.uk> [2022-10-14 12:53]:
> > On Fri, 2022-10-14 at 11:53 +0100, Adam D. Barratt wrote:
> > > Control: tags -1 + confirmed
> > > 
> > > On Sun, 2022-10-02 at 19:38 +0200, Timo Röhling wrote:
> > > > The update fixes two vulnerabilities with low priority, i.e.
> > > > the security team has decided not to issue a DSA.
> > > > 
> > > > [ Impact ]
> > > > CVE-2022-34300: Heap overflow in DecodePixelData
> > > > CVE-2022-38529: Heap overflow in rleUncompress
> > > > 
> > > 
> > > +  * Fix low-priority vulnerabilities
> > > 
> > > I'm not sure I'd use that wording in a changelog personally -
> > > more
> > > likely just "fix security issues" or "backport fixes" or similar
> > > -
> > > but
> > > it's up to you.
> > 
> > Hmmm. The debdiff you've uploaded is rather larger than I was
> > expecting, or was proposed.
> > 
> > That appears to be (which I should have spotted earlier) because
> > stable
> > has 1.0.0+dfsg-1 and your upload is based on 1.0.*1*+dfsg-1.
> Is there something we can do about this?
> Should I prepare a new upload with 1.0.1+really1.0.0, for instance?

There's a holding queue in front of proposed-updates, so the upload
isn't in the archive yet.

Assuming the diff would be similar to that initially proposed, you can
simply prepare and upload 1.0.0+dfsg-1+deb11u1 and we can sort things
out from there.

Regards,

Adam

Thread

Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 13:00 +0200
  Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:00 +0200
    Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:10 +0200
      Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <roehling@debian.org> - 2022-10-14 14:40 +0200
    Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <timo@gaussglocke.de> - 2022-10-14 14:10 +0200

csiph-web