Preparation of Debian GNU/Linux 2.2r4

2.2.25: Important ARM fixes

2.2.26: Important PowerPC fixes

Not sure if we should demand architectures to be in sync...

Security Update, DSA 049, DSA 066

Get architectures in sync

This is non-US.

Security Update, DSA 054

Showstopper, ChangeLog:

* Grr, really fix the installation stop now (closes: #94346)

Note from the Editor: Petr, you are a moron...

Fixed cslatex stops installation (closes: #67214, #69224)

Fix insecure regex's in debian.procmail example filter

Fix for serial console installs.

Fixed format string vulnerability in accept.c.

DSA 058

Rebuilt for sparc, security update otherwise, DSA 046

DSA 060, 071

Security update, DSA 057

Security update, DSA 084

fts/chdir vulnerability fix.

No DSA assigned though

Security Update, DSA 061

* Security upload by new maintainer, backported from unstable. * src/preproc/pic/pic.y: Fix format string vulnerability that could allow the -S flag to be disabled (closes: #107459). Patch adapted from one by Zenith Parsec <zen-parse@gmx.net>.

DSA 072

DSA 080

DSA 073, though it mentioned horde 1.2.6-0.potato.1 and imp 2.2.6-0.potato.1

The maintainer, Ola Lundqvist, commented:

"The potato.1 version (the real security fix) was broken. :(

I uploaded it too fast, without testing the postgres part. It also had some other minor issues because I forgot to apply one patch.

So if any new packages of horde and imp should go to a new revision only the latest version should go there (from proposed-updates)."

(source) 2.2.19_2.2.19.1 - Current security patch

(i386) 2.2.19-4 - Corrected flavour

(arm) First version of 2.2.19, security patch missing

(m68k) First version of 2.2.19, security patch applied

(sparc) Update of 2.2.19, security patch missing

(alpha) Update of 2.2.19, security patch applied

(powerpc) First version of 2.2.19, security patch applied

remove all packages from the above list

I plan to request removal for these kernel headers images, patches and source files from the stable distribution. Please drop me a line with a reason if you object.

2.0.36: There is still 2.0.38 which contains some security fixes.

2.2.10/i386: There will be 2.2.19-4 in 2.2r4

2.2.10/arm: There will be 2.2.13/19991215 left over

2.2.10/m68k: There will be 2.2.17/2.2.17-1 and 2.2.10/m68k/-mac left over. This needs to be discussed because a) 2.2.10 contained a -mac image which would be pulled out of the other 2.2.10 kernels and b) 2.2.17 doesn't contain that image anymore.

2.2.12/i386: There will be 2.2.19-4 in 2.2r4

2.2.12/arm: There will be 2.2.13/19991215 left over

2.2.13/i386: There will be 2.2.19-4 in 2.2r4

2.2.15/i386: There will be 2.2.19-4 in 2.2r4

2.2.15/powerpc: There will be 2.2.17 left over

2.2.15/sparc: There will be 2.2.19 left over

2.2.17/i386: There will be 2.2.19-4 in 2.2r4

2.2.17/powerpc: There will be 2.2.19 left over

2.2.17/sparc: There will be 2.2.19 left over

2.2.18pre21/i386: There will be 2.2.19-4 in 2.2r4

2.2.18pre21/alpha: There will be 2.2.19 left over

2.2.18pre21/powerpc: There will be 2.2.19 left over

2.2.18pre21/sparc: There will be 2.2.19 left over

2.2.19pre17/i386: There will be 2.2.19-4 in 2.2r4. These pkgs must not be removed since boot-floppies/i386 in potato are only buildable with these.

2.2.19pre17/powerpc: There will be 2.2.19 left over

Broken sync upload.

If there would be libpaper *and* libpaperg version 1.0.3-13.potato1 for sparc, I'd be convinced to accept the package.

I have prepared an upload for libpaper *and* libpaperg binary packages sitting on auric, waiting for a free path to proposed-updates.

Sparc missing

Get powerpc back in sync

* Feature added: menu option to create bootstrap partition needed for powerpc NewWorld machines with the proper type and size (patch supplied by Ethan Benson). This should help newbies that won't read the docs anyway. Closes: #99660.

* Bugfix: mac-fdisk used to get the disk size wrong when brute force probing for end-of-disk by seek&read. Turns out gcc did not cope with arithmetics on long long types without explicit cast. Closes: #99700.

I wonder why there was an m68k version of mac-fdisk.

3.5.5-6.1: * Non-maintainer upload. * mc-gpg.el: one character fix to regex so it will parse output from GnuPG >= 1.0.5.

3.5.5-6.2: * Aknowledge James Troup non-maintainer upload. (Closes: #100930) * One character fix from James Troup to cope with GNU PG >= 1.0.5.

That's required, since GnuPG 1.0.6 will get into stable (DSA 061)

* Fix possible (but rare) security problem if site password was blank * Fix maintainer field * Completely fix previous security flaw * Fix dedent in Mailman/SecurityManager.py (closes: #107768)

DSA missing, it seems

* Backport another security fix from unstable. * Count how many times privileges have been dropped, and don't regain them until regain_effective_privs() is called the same number of times. The lack of nesting meant it was still possible to create files owned by uid man (thanks, Luki R.; closes: #99624).

Security Update, DSA 056, DSA 059

DSA 076

Security Update, DSA 051

DSA 085

The m68k version is a binary-NMU since the build system was turned into unstable without notification.

Upstream bug-fix release for security problems

DSA 068

Update for kernel-source-2.2.19pre17. There are no packages compiled for 2.2.19.1 which would be required for them to work.

Now: When I let the new kernel slip in, there won't be working pcmcia-cs modules. I guess I'll have to move the entire kernel and modules crap on hold for 2.2r4 then.

Need further info, why aren't pcmcia-modules-2.2.19pre17-idepci and the like sufficient? Herbert has mail.

Herbert says: For i386, only kernel-image 2.2.19-4 should be kept. They correspond to the pcmcia modules listed above (3.1.22-0.2potatok4).

However, there is a kernel-image 2.2.19-4, but it has no security patch.

NOTE to self: For i386: Either reject all kernel + pcmcia crap so it has to be resorted for 2.2r5, or install kernel 2.2.19-4 + pcmcia 3.1.22-0.2potatok4 for ia32 and gods sake or wait for new pcmcia packages.

Current configuration: install kernel-with-security-patch, but reject all pcmcia crap

Herbert Xu: These pcmcia modules (3.1.22-0.2potatok4potato.4) correspond to kernel-image 2.2.19-4potato.4, which does have the security patch.

Get architectures back in sync

Changelog for 3.15.2-1:

* New upstream release, with improved security and robustness involving signal handlers. Author recommends upgrading to this version on any system where it is installed setuid or setgid. * This release fixes also Bug #108417: procmail -p -m resets PATH.

Changelog for 3.20.1-1:

* New upstream release, with improved security and robustness involving signal handlers. Author recommends upgrading to version 3.20 on any system where it is installed setuid or setgid.

Changelog for 3.21.1-1:

* New upstream release, with improved security and robustness involving signal handlers. Author recommends upgrading to this version on any system where it is installed setuid or setgid. Note: In 3.20 the INCLUDERC directive was broken on some archs.

DSA 083

The rejected .changes files don't have binaries associated with it...

Fixes several probles that occur after booting of a PowerMac box after basic potato installation.

100127: quik and quikconfig runs unconditionally during installation, defaulting to yes which causes a new quik bootblock to be installed when running non-interactively (during boot-floppy installation for instance). This bug is even niftier when combined with quik.conf not getting installed as a conffile, so being replaced automatically with a default, broken file.

93871: quik vs. glibc setjmp implementation issues.

93980: quik doesn't pass kernel args correctly causing a kernel oops after IDE setup.

Get architectures back in sync

DSA 062

Security Update, DSA 048, DSA 065

Security Update, DSA 050, 052

DSA 078

* Fix DoS problem with invalid handling of mkdir-only PUT requests, squid bugzilla #233

DSA 077

Security Update, DSA 075

Get architectures back in sync

* Fixed exploit that allowed to gain uid.guid uucp.uucp: Applied patch that blocks the long arg variants of -I -u -g in uuxqt (taken from Calderas security update; From: Jeff Johnson <jbj@redhat.com>) * Changed maintainer to weasel@debian.org

DSA 079

* [SECURITY FIX] backport fix of mime header buffer overflow SNS Advisory No.32 w3m malformed MIME header Buffer Overflow Vulnerability http://www.lac.co.jp/security/snsadv/32.html (Japanese) * dont install w3m.el in emacs dir because it wont work well. closes: Bug#96385

It's an unknown security fix, but w3m security advisories tend to be in Japanese only, so we can't handle them properly anyway. However, even all architectures are in sync, wow.

This security advisory is already translated in English http://www.lac.co.jp/security/english/snsadv_e/32_e.html

FTP-Masters: Please remove the powerpc version somehow, it is compiled against unstable libraries and thus is not installable on potato.

DSA 081

DSA 081

* Patched with upstream v1.30-epoch patch. Webalizer stopped working on Oct 5th, 2001, which is fixed with this patch. Closes: #114828, #114832

A serious problem, rendering the program useless

* Security fix: /etc/rt/config.pm was world readable (closes: #62383)

Get architectures back in sync

* Fix buffer overflow in titlebar handling

DSA 074

aj: a calendar program getting days of a month wrong seems a decent thing to fix.

The alpha version is compiled against unstable, bummer.

* Non-maintainer upload by security team * Fix buffer overflow in svc_logprint() * Set default umask to 022 in init_common()

DSA 063

* config.c, faces.c, imagetypes.c, options.c, packtar.c: fix unsafe str{cpy,cat} usage. Seen in http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186

DSA 069

Get architectures back in sync

Get architectures in sync

xvt (2.1-13) stable unstable; urgency=HIGH . * Fix a yada bug which prevented the package building in some situations. Closes:Bug#102744. . xvt (2.1-12) unstable; urgency=HIGH . * Fix a couple of buffer overflows which could result in a local root compromise. Thanks to Christophe Bailleux <cb@t-online.fr> for finding them.

DSA 082

The m68k version is a binary-NMU since the build system was turned into unstable without notification.

Security upload, DSA 006, DSA 007, DSA 043

Zope 2.1.6-7 indeed had two problems with two of the Hotfixes included, so I prepared a new version 2.1.6-8 and uploaded that to Incoming (target 'stable'):

First, Hotfix_2000-10-02 broke some stuff in 2.1.6 (the README said that this Hotfox_2000-10-02 would apply to 2.2.x and later, which is obviously correct). Therefore 2000-10-02 was removed in 2.1.6-8. Obviously, the vulnerability fixed by this Hotfix was only introduced in Zope 2.2.0.

Then, Hotfix_2000-10-11 wouldn't work with 2.1.6 out of the box, but since 2.1.6 was affected by the vulnerability nonetheless, I had to apply a fix to the Hotfix. Included in 2.1.6-8 as well.

This time, 2.1.6-8 has been tested on a potato system to a moderate degree.

zope (2.1.6-10) stable; urgency=high

* Include Hotfix_2001-05-01 ("ZClass permission mappings"), which addresses an important issue with ZClasses in that any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for unauthorized access within the Zope instance.

Wow... finally even all architectures are in sync...

* Binary-only non-maintainer upload for arm; no source changes. * rebuild against current libc, which doesn't have LFS support.

Get architectures back in sync

* Non-maintainer upload on behalf of Simon Huggins <huggie@earth.li> * Applied patch from Martin Kraemer to fix mod_negotiation bug to prevent revealing of directory contents.

This looks like a half security update, right?

DSA 067-1 is a broken security upload and requires an update. [further]

* New maintainer. * Recompile. Due to strange interactions with libc6, functions weren't interpreted, and the package was practically unusable. Closes: #108924.

Architectures missing: alpha and i386

* [security fix] backport from freewnn 1.1.0+1.1.1-a017-6.4 - adduser wnn, kwnn, cwnn for jserver,kserver,cserver respectively instead of running as root user - restrict upload/create path under jserver_dir

The 2nd upload is required to make the package installable *sigh* At least, it is proved to be tested now...

However: alpha is missing

Alleged security update.

Changelog says:

* Several security exploits found to icecast. No simple way to patch

* old version, so upgrade to latest stable version from icecast.org

* If questions or assistance needed join #icecast on openprojects.net IRC

Do you have a documentation about said security exploits? That's still pending

Is it something different than this one?

"icecast" is a server used to distribute audio streams to compatible clients such as winamp, mpg123, xmms and many others. Matt Messier (mmessier@prilnari.com) and John Viega (viega@list.org) have identified several buffer overflow and format strings problems in Icecast that could be remotely exploited. Our latest update to this software changes the package to use an unprivileged user ("icecast") for the daemon, so the impact of this vulnerability is not as high. Recent distributions (CL >= 5.1) have this package compiled with StackGuard to make it more difficult to exploit buffer overflows.

It's said to be.

Clarification appreciated.

Security Update, DSA 023 [further]

Bdale reports a serious problem with this upload, it broke some functionality. He's going to upload a fixed version, so this will have to wait for 2.2r4 then. Fixed for 2.2.2.2000.01.31-5.

arm and powerpc missing

* Recompiled with correct CGIBASE to avoid bad links; closes: #104474. Grave bug, warrants inclusion into stable.

3/6 architectures missing

nedit is now Free Software.

sparc missing

Changelog says: * Fixed same overflow with minimal change.

3/6 architectures are still missing

DSA 070 mentioned version 0.16-4potato.2 [further]

Security Update (DSA 020 mentions 4.0.3pl1-0potato1.1) [further]

Roland Bauerschmidt reports "php4-cgi broken". Look at #89431. /usr/lib/cgi-bin/php4 is a symlink to debian/php4-cgi/usr/bin/php4 which of course doesn't exist.

Rebuild for 4.0.3pl1-0potato2 issued. Missing: alpha, sparc

Updated packages should be uploaded soon.

* postgresql: applied patch from Ben Pfaff <pfaffben@msu.edu> to cure problem with segfault in pg_dump. High urgency because pg_dump is essential for transferring data when upgrading postgresql. Closes: #101940

No security update but something that is anticipated to prevent data loss, I'm convinced.

But anyway, some architectures are missing: alpha, sparc

Security update, DSA 048 [further]

Broken on sparc and alpha, needs a new upload