Preparation of Debian GNU/Linux 2.2r5

* Non-maintainer upload on behalf of Simon Huggins <huggie@earth.li> * Applied patch from Martin Kraemer to fix mod_negotiation bug to prevent revealing of directory contents.

This looks like a half security update, right?

DSA 067-1

2002-01-02: It would be nice if somebody could tell me why I tagged this version 'broken'. I don't think it's because of a missing fix for Bug#73013, so I don't remember anymore. *sigh*

Sync with other architectures

ChangeLog also says:

* Corrected stupid typo in templates file, Closes: #74785, #74815, #74828

* This problem makes it impossible to install the package, so it is important and must go in.

Package was missing from stable.

* New maintainer.

* Recompile. Due to strange interactions with libc6, functions weren't interpreted, and the package was practically unusable. Closes: #108924.

Boot glue for ARM CATS systems

Required on some ARM systems

current stable boot-floppies Build-Depend on it.

* Repackaged for potato because the version of dtaus in potato isn't able to create DTAUS files using the Euro currency which is the one and only official currency in Germany since yesterday. Hence, the version in potato is entirely useless since yesterday and has to be updated if people are using it for their money management.

Security Update, DSA 097

* [security fix] backport from freewnn 1.1.0+1.1.1-a017-6.4 - adduser wnn, kwnn, cwnn for jserver,kserver,cserver respectively instead of running as root user - restrict upload/create path under jserver_dir

The 2nd upload is required to make the package installable *sigh* At least, it is proved to be tested now...

GnuPG provides this functionality already, it replaces these packages just fine, they are not needed anymore. Even worse, they are not even installable anymore, since they depend on gnupg but gnupg conflicts with them.

Security upload: DSA 095

Changelog says:

* Use lpr as the print spooler, even if it happens not to be installed on the build system. Version 1.15.2-2 broke 'groff -l', which worked with previous versions of groff in stable (thanks, Mike Fontenot).

Since I can't even find a single bug report that says 'groff -l' is broken in stable, I guess it will only be used on accident. Hence, I don't think this justifies an update to stable.

I rethought my decision again. 2.2r3 had a working version, 2.2r4 unfortunately broke it. We should tryto fix that. Upgrading from r3 or older to the next current version should not break more things but fix them. *sigh*

DSA 073, though it mentioned imp 2.2.6-0.potato.1

The maintainer, Ola Lundqvist, commented:

"The potato.1 version (the real security fix) was broken. :(

I uploaded it too fast, without testing the postgres part. It also had some other minor issues because I forgot to apply one patch.

So if any new packages of horde and imp should go to a new revision only the latest version should go there (from proposed-updates)."

.4: SECURITY FIX, backport from 2.2.7, closes: #118986

Security Update, DSA 023

Bdale reports a serious problem with this upload, it broke some functionality. He's going to upload a fixed version, so this will have to wait for 2.2r5 (formerly 2.2r4) then. Fixed for 2.2.2.2000.01.31-5.

Rebuilt with current kernel that has security fixes incorporated, was supposed for 2.2r4 but uploaded too late.

ARM 20011109: Build against kernel-source 2.2.19.1-2 and latest ARM patch.

Sparc: BenC says that it actually fixes an oops on sun4u when mounting nfs partitions (Bug#98755).

DSA 098

* Non-maintainer upload by security team

* Fix buffer overflow in src/daemon/gnuserv.c:permitted() Patch from Flavio Veloso <flaviovs@magnux.com>

* Fix printf format attacks in src/daemon/gnuserv.c logging functions

Get m68k and powerpc back in sync, package is required for installation of NewWorld powerpc machines.

Security Fix. Related to DSA 094?

Changelog for 1.1-9:

* Cross site scripting (CSS) fixes, backported from Mailman 2.0.8.

* Support list names with spaces in them. Changelog for 1.1-10:

* Add missing paranthesis in Mailman/Cgi/edithtml.py, line 88

Get versions in sync

Included patch for secure tempfile handling, see #117283 for details

Security update: DSA 096

* Applied patch-1.2.5.tlr.terminate.1 to fix a remotely exploitable buffer overflow.

nedit is now Free Software.

Changelog says: * Fixed same overflow with minimal change.

DSA 070 mentioned version 0.16-4potato.2 [further]

Security Fix, DSA 091

Security Update (DSA 020 mentions 4.0.3pl1-0potato1.1) [further]

Roland Bauerschmidt reports "php4-cgi broken". Look at #89431. /usr/lib/cgi-bin/php4 is a symlink to debian/php4-cgi/usr/bin/php4 which of course doesn't exist.

* Fix 'smtpd command log memory exhaustion' problem.

* Fix dhelp dangling symlink problem. Closes: #91877, #97332.

* Rebuild on current potato. Closes: #102388, #99220.

Security Fix: DSA 093

* postgresql: applied patch from Ben Pfaff <pfaffben@msu.edu> to cure problem with segfault in pg_dump. High urgency because pg_dump is essential for transferring data when upgrading postgresql. Closes: #101940

No security update but something that is anticipated to prevent data loss, I'm convinced.

Get versions back in sync

DSA 086

* Urgency high because this addresses a well-known vulnerability which is being exploited.

* Add security fixes from -7.

* Add build-depends.

* Remove client's setuid bit; people who need it can turn it back on, and everyone else will be safer.

Get versions back in sync.

Security upload, DSA 087

* New maintainer

* Security fixes: - symlink vulnerability in xteld (see #87787). - symlink vulnerability in xtel while printing harcopy of screen. - run xteld under control of tcpd to be able to restrict access to the service from network.

* Backport of annoying and easy to fix bugs from woody version of xtel: - Fixed segfaults (see #43566). - Fixed a little typo in the /etc/xtel/lignes file. - Fixed creation of the symlink to french doc directory (see #55131).

* Other annoying fixes: - bad X resource in Xtel[m].ad (missing '-o -' in a2ps printing command).

DSA 090

* Applied a patch from Massimo Dal Zotto <dz@cs.unitn.it>. This is a workaround for a serious bug (#94892) in libXaw.

Seems this bug makes xxgdb useless in stable

* New maintainer.

* yabasic.c: Fixed a /tmp race condition.

* Completed the FHS transition to allow building with a recent debhelper. Closes: #98875.

No DSA assigned, maintainer, please get in touch with the Security Team

Sync with other architectures

Get versions more in sync

* back-port dump current version to potato at the request of Martin Schulze. The 0.4b22 upstream version included important fixes for data corruption that can occur with the version that was released with potato.

MISSING alpha
MISSING arm
MISSING sparc

Glob security patch. DSA missing

MISSING alpha
MISSING arm
MISSING m68k
MISSING powerpc

* Recompiled with correct CGIBASE to avoid bad links; closes: #104474. Grave bug, warrants inclusion into stable.

MISSING alpa

Support statd callbacks from later 2.2 kernels. (Bug#111990)

It seems that this upload fixes a disparity between late 2.2 kernels and the older nfs-utils package from stable in connection with statd/lockd.

MISSING alpha
MISSING arm

Get versions back in sync

Beware: change the distribution to stable only.

MISSING arm

Misplaced upload to 'stable unstable'

Alleged security update.

Changelog says:

* Several security exploits found to icecast. No simple way to patch

* old version, so upgrade to latest stable version from icecast.org

* If questions or assistance needed join #icecast on openprojects.net IRC

Do you have a documentation about said security exploits? That's still pending

Is it something different than this one?

"icecast" is a server used to distribute audio streams to compatible clients such as winamp, mpg123, xmms and many others. Matt Messier (mmessier@prilnari.com) and John Viega (viega@list.org) have identified several buffer overflow and format strings problems in Icecast that could be remotely exploited.

Our latest update to this software changes the package to use an unprivileged user ("icecast") for the daemon, so the impact of this vulnerability is not as high. Recent distributions (CL >= 5.1) have this package compiled with StackGuard to make it more difficult to exploit buffer overflows.

It's said to be.

Clarification appreciated.

To make it worse, there is now Version: 1.3.10-1.1

* Binary-only recompile by security team

* Rebuild with potato libc6

Minor bugfix: * Include backport of billion second bug.

Misplaced upload:

Distribution: stable unstable

* Dropping the 'task-webserver-roxen2' package... * Updating config.{sub|guess} Closes: #111546

ChangeLog says:

* Permanently fix problem with NMU's being built against incorrect kernel interfaces (closes: #94380, #95015, #102226)

* add uploaders: header to control file

This upload most probably fixes the problem with the old alpha version not being able to run properly due to a bad build environment. This problem may be solved by a general change... may be... Steve Langasek should speak up...

He said:

Samba upstream takes advantage of the best system facilities (libc/kernel) available at compile time. Because Debian releases usually include a baseline kernel and an 'experimental' kernel, Eloy and I have introduced packaging code in unstable that prevents Samba from detecting facilities that it should not be compiled against. The 2.0.7-4 upload backports these packaging mods to potato, both correcting the problems with past alpha security NMUs and safeguarding against the possibility of future problems with security NMUs in potato.

Rejecting on behalf of the maintainer, see Bug#127444:

Upgrading from samba 2.0.7-3.4 to 2.0.7-4 broke printing (from windows clients) on our misc server [..]