Preparation of Debian GNU/Linux 3.0r1

Try to sync architectures.

There is an m68k package hooked up in testing-proposed-updates as well.

The arm package was built on July 4th, but didn't make it into the archive, strangely.

DSA-187 apache - several vulnerabilities

DSA-195 apache-perl - several vulnerabilities

DSA-188 apache-ssl - several vulnerabilities

Guido writes:

- it don't lets failures to read from an ext2 fs completely crash the loader (like when you enter a non existent partition in the prom)

- it introduces tip22 as a separate binary package[1], a "piggyback" style tftp loader that is used to pack kernel and initrd into one ecoff file which can be tftpbooted. This finally solves the whole initrd issues on mips. Without that mips will not be able to use kernels > 2.4.16 since Ralf revamped head.S(among others) which breaks our current addinitrd method completely. Agreed, we could revert the head.S changes but I'd rather like to avoid that because we might trip on unwanted side effects. I already have a 2 line patch against bootfloppies to use tip22 but don't want to commit it until it's sure tip22 can go into r1.

Package broken in woody

DSA-173 bugzilla - privilege escalation

Upstream reported: Due to license issues with the libedc_ecc library that is used by and distributed with cdrdao I have to temporarily freeze this project. All releases have been removed.

See http://sourceforge.net/forum/forum.php?forum_id=213313

See http://bugs.debian.org/162788

DSA-197 courier - buffer overflow

* Added default path so the upgrade will work fine. Thanks to Donovan Baarda <abo@minkirri.apana.org.au> for pointing out the problem. Closes: #158869.

Rationale: Without the path, this package doesn't run out of the box on woody anymore.

On a machine which was upgraded from potato to woody a couple of months before release, there is a wrong entry in transitional.cat, which causes debiandoc to be unusable. My opinion is, it is bad enough (and simple enough to fix) so that it must go into 3.0r1.

* debian/postinst: added invocation of 'install-sgmlcatalog --remove debiandoc-sgml' to clean up cruft potentially left over from the SGML catalog transition in a potato -> woody upgrade (closes: Bug#154737)

* Rebuild of 0.1.17.8 for woody to pull in race condition fix and missing package dependency fixes, among others.

I've been pestered that boot-floppies/debian-installer people need this.

woody does not need µdeb's though. Branden Robinson agreed to upload a "fixed" version that doesn't produce the µdeb. However that hasn't yet happened.

Update: James said that udebs won't be visible in stable, so they should not cause problems. Let's hope he is correct.

* ext2.c: Gracefully fail on filesystems with journals (closes: #118635). This fixes a bug that causes filesystem corruption when defrag is run on ext3 filesystems.

DSA-146 dietlibc - integer overflow

Don't depend on obsolete library anymore.

This bug is just an incorrect dependency in the control file, which makes docbook-xml-slides insist on pulling the obsolete docbook-xsl-stylesheets instead of recent docbook-xsl. This in turns causes other packages to be uninstallable, because they correctly depend on the new one.

Get architectures in sync (IA-64 is missing, though, but the package doesn't seem to compile at all on that arch)

DSA-156 epic4-script-light - arbitrary script execution

Fixed a typo that broke image creation with mkisofs if only the image was being created, ie if not part of create image/burn operation

DSA-162 ethereal - buffer overflow

DSA-154 fam - privilege escalation

DSA-171 fetchmail - buffer overflows

DSA-171 fetchmail - buffer overflows

DSA-201 freeswan - denial of service

DSA-158 gaim - arbitrary program execution

DSA-138 gallery - remote exploit

DSA-149 glibc - integer overflow

DSA-179 gnome-gv - buffer overflow

According to the bug reports mentioned in the changelog, one program from this package crashed upon startup, rendering it useless. Hence, an update.

* Fixing RC bugs: + Closes: #145411: Gnomecal segfaults upon start + Closes: #145517: gnomecal segfaults at startup + Closes: #151781 (for stable): Problem loading GnomeCal conduit + Closes: #155221: Gnomecal segfaults upon start and no fixed version of gnome-pim is available in stable

DSA-205 gtetrinet - buffer overflow

DSA-176 gv - buffer overflow

DSA-174 heartbeat - buffer overflow

DSA-169 htcheck - cross site scripting

DSA-192 html2ps - arbitrary code execution

Get architectures back in sync

DSA-148 hylafax - buffer overflows and format string vulnerabilities

DSA-202 im - insecure temporary files

Lots of intrusive changes, only one is priority high and it only affects people with ataraid. Suited for unstable.

Automatic module loading is broken from 2.4.19 upwards, which means that the initrd-tools in stable will NOT work. This version is the first one that uses pivot_root which works around this and doesn't contain any major bugs unlike all previous versions uploaded to unstable.

DSA-150 interchange - illegal file exposition

DSA-157 irssi-text - denial of service

non-US

Get architectures in sync.

DSA-182 kdegraphics - buffer overflow

DSA-155 kdelibs - privacy escalation with Konqueror

DSA-167 kdelibs - cross site scripting

DSA-204 kdelibs - arbitrary program execution

Fixed i386 lcall DoS (Petr Vandrovec).

New upstream source with several fixes.

* Integrated a new kernel-patch from the IBM Developerworks website (released on 2002.06.12). This patch fixes the DASD deadlock problem and some other severe problems. * Removed NMU DASD deadlock fix. * Integrated a new kernel-patch from the IBM Developerworks website (released on 2002.08.16). This patch fixes a problem related to the IUCV driver.

This sounds like a more or less regular update to me, which should not target the stable release.

Gerhard Tonn wrote: This is not true. The woody kernel is definitely broken on s390, deadlock in I/O code. Fortunately we have a working kernel as part of the boot-floppies, so that most of our users didn't notice it, but we had already several problems with the kernel when users build their own. So please accept the update. We need not only the kernel-patch, but also an update of the kernel-image. It wasn't accepted by katie, probably because katie accepts only one .udeb per package and architecture.

New kernel with security updates

The files in stable should be removed, i.e. updated by the new ones.

* Integrated a new kernel-patch from the IBM Developerworks website (released on 2002.06.12). This patch fixes the DASD deadlock problem and some other severe problems. * Removed NMU DASD deadlock fix. * Integrated a new kernel-patch from the IBM Developerworks website (released on 2002.08.16). This patch fixes a problem related to the IUCV driver.

This sounds like a more or less regular update to me, which should not target the stable release.

Gerhard Tonn wrote: This is not true. The woody kernel is definitely broken on s390, deadlock in I/O code. Fortunately we have a working kernel as part of the boot-floppies, so that most of our users didn't notice it, but we had already several problems with the kernel when users build their own. So please accept the update. We need not only the kernel-patch, but also an update of the kernel-image. It wasn't accepted by katie, probably because katie accepts only one .udeb per package and architecture.

Kernel with security fixes

New kernel with security corrections. The new package should supersede an older one.

DSA-143 krb5 - integer overflow

DSA-183 krb5 - buffer overflow

DSA-152 l2tpd - missing random seed

* "Major Brown Bag"-release. * Make shlibs depend on libgd1-noxpm (not the non-existing libgd1- xpm). This closes: bug#143856 - thanks to Ben Finney <bignose@zip.com.au> for being awake when I am not. * Set urgency=high - same reasoning as -16.

woody2 fix uninstallable on ia32 due to broken dependencies, fixed packages are to be uploaded soon.

Move from non-US to main.

DSA-140 libpng - buffer overflow

Backported change for C code from unstable version (1.4.6) to fix major brokenness (Closes: #162385)

The changes are too instrusive and large for me to check or author them. An inquiry to the bug reporter is sent and should help clarification.

DSA-186 log2mail - buffer overflow

* Backported fix for file-existence-error bug from unstable version. (Closes: #153414). Release manager: this is just a one-character change from 'test -f' to 'test -L', where the latter is the right thing to do, is being done so for the other three cases, and works as is for a few months now in unstable

The bug report demonstrates that the package is not installable under certain circumstances without this fix.

DSA-189 luxman - local root exploit

DSA-147 mailman - cross-site scripting

Plus: Fix a permission bug that renders the package uninstallable (upgrade with corrected perms would work, though)

DSA-153 mantis - cross site code execution and privilege escalation

DSA-161 mantis - privilege escalation

DSA-194 masqmail - buffer overflows

DSA-163 mhonarc - cross site scripting

DSA-199 mhonarc - cross site scripting

DSA-137 mm - insecure temporary files

DSA-141 mpack - buffer overflow

Rebuilt against current atlas-dev from stable to fix broken dependencies (similar to octave2.1)

Doesn't build on alpha due to lapack problems, but alpha packages didn't suffer from the atlas brokeness anyway, so that's no problem.

MISSING alpha

The woody package was useless since the path was changed.

Corrected the logfile security fix.

The package in woody will break violently if you are installing it on a kernel without hotplug support, and will refuse to be removed if your kernel doesn't have hotplug support.

nano.c: hardcode a --disable-wrapping-as-root backport to the stable version. If, as root, you want to enable wrapping, use the Meta-W toggle to enable it after starting nano (fixes: #127634 + 5 more).

Why do people think µdebs are good for woody? They aren't. Try again.

Update: James said that udebs won't be visible in stable, so they should not cause problems. Let's hope he is correct.

Get architectures in sync (despite BNMU)

DSA-180 nis - information leak

DSA-198 nullmailer - denial of service

Fixed postinst-ocamlld so it will now do its work also when upgrading a package, and not only when removing it.

Rebuilt against current atlas*-dev package with corrected shlibs.default to ensure proper handling of virtual depends on blas2 with default of blas and atlas2-base

DSA-142 openafs - integer overflow

Get architectures in sync

Built for kernel-image-2.2.22-*.

There should probably be a reiserfs update as well, but it's currently missing. Older packages should be replaced.

DSA-168 php - bypassing safe_mode, CRLF injection

DSA-168 php - bypassing safe_mode, CRLF injection

-6 is: Backport fix from 4.2.3 to avoid using pread() and pwrite() functions from glibc, as they are broken on many architectures in Debian.

Get architectures in sync

DSA-166 purity - buffer overflows

DSA-159 python - insecure temporary files

qpopper couldn't work with Eudora clients and openssl 0.9.6c-2.woody.1 that was provided in DSA-136. This verison fixed that bug.

* Include debconf templates (backported fix for Bug#158578). Their omission caused installation to fail on non-devfs systems, unless the /dev/usb/rio500 device node had already been created.

DSA-200 samba - remote exploit

DSA-160 scrollkeeper - insecure temporary file creation

The silo I've uploaded to proposed-updates adds a patch from DaveM to support the newest UltraSPARC III+ machines. Without it, they cannot be booted from disk.

Add patch for UltraSPARC III+ (Cheetah+) support from DaveM.

I was told that snort doesn't work in woody, so the update is accepted.

Changelog says:

+ Mandatory upload to stable because the previous package had serious problems that were fixed only one package release later that JUST didn't get into woody.

! Fixed 'snort.debian.conf is empty at fresh install'

+ New 'snort-stat' included, fixes 'Empty subject' bugs

+ Fixes to daily cronjob's email thingy. Now honours DEBIAN_SNORT_STAT_TRESHOLD

DSA-191 squirrelmail - cross site scripting

DSA-139 super - format string vulnerability

Package in woody was uninstallable due to a mising dependency

DSA-206 tcpdump - denial of service

Don't copy runtime files.

This was a GCC license violation.

DSA-207 tetex-bin - arbitrary command execution

DSA-145 tinyproxy - doubly freed memory

DSA-172 tkmail - insecure temporary files

DSA-170 tomcat4 - source code disclosure

Fixed upgrade path from potato (Closes: #157918)

This does not warrant an updated package, though. Hmm, this could be considered as data desctruction during upgrade, hence it may warrant an upgrade.

Really fixed the mkstemp patch which could make weex core dump.

DSA-144 wwwoffle - improper input handling

DSA-151 xinetd - pipe exposure

Fixed a regular expression to parse the current BTS. Please consider for stable: old version does not work anymore, and this is a one-character change.

DSA-196 bind - several vulnerabilities

MISSING arm

There is a race condition with the receiving of SIGCHLD before select is called.

1.16.1woody0 consumed infinite CPU power. It should be fixed in 1.16.2woody0 which happens to be just another version from sid recompiled. That's a reason to delay it alone, this requires testing!

MISSING s390

Important update for ARM and S/390 systems.

MISSING mips
MISSING mipsel
MISSING sparc

Fixed i386 lcall DoS (Petr Vandrovec).

New upstream source with several fixes.

Important updates

The µdebs should not enter stable, though.

The stable packages above should be removed when the new kernel packages are added. Hope that works...

There's still kernel-image-2.4.18-bf2.4 and kernel-headers-2.4.18-bf2.4. Eduard Bloch told me that they need to stay.

Junichi says: that leaves ALSA etc. modules out of sync, doesn't it? There are several module packages that would be made uninstallable if you remove those kernel packages.

Hence, we'll need to wait for all modules packages to appear as well until the kernel may be installed.

More or less important updates...

The µdebs should not enter stable, though. Needs a rebuild.

Need a kernel to remove from woody, though.

Update: James said that udebs won't be visible in stable, so they should not cause problems. Let's hope he is correct.

New kernel with security fixes and S/390 specific corrections or improvements. This package should supersede an older one.

Gerhard Tonn: as long as the kernel image 2.4.19 for s390 hasn't been accepted, the kernel-patch for 2.4.17 shouldn't be removed.

Joey: There is no kernel image 2.4.19 for s390 yet, hence postponing.

New kernel with security updates. Should replace the current packages.

Junichi says: that leaves ALSA etc. modules out of sync, doesn't it? There are several module packages that would be made uninstallable if you remove those kernel packages.

Hence, we'll need to wait for all modules packages to appear as well until the kernel may be installed.

DSA-184 krb4 - buffer overflow

The sparc upload got lost somehow. Katie broken, won't accept it, ftpmaster informed on Nov 2nd.

* The bugs #156381 is also in the stable version of the package. Since it renders basic packages like debconf unusable when it's installed, I'm providing this updated package to fix it. * Added the include <libintl.h> in the .xs file this time. * Really stupid version number to have a version number lower than 1.01-11bis which is in unstable...

The bug report demonstrates that this problem may render an entire installation/upgrade broken. Hence, an update is required.

MISSING mips

DSA-140 libpng - buffer overflow

MISSING s390

Too intrusive changes

* Support LSB 1.2 in woody. Includes all changes through 1.2-6 in sid.

* Fix call to shadowconfig in postinst. (Closed: #166041)

* Add text to the debconf template that lets the user know that shadow passwords are not needed by most LSB applications.

* Remove duplicate --retry 5 from start-stop-daemon call. (Closed: #165395)

* Fix bugs in the init script registry code. (Closed: #165038)

* Support more specifications for the signal in "killproc". (Closed: #163109)

* Return non-zero exit status if "pidofproc" can't find the process. (Closed: #157314)

* Fix silly typos in install_initd. (Closed: #152544)

* Fix duplicated --retry 5. (Closed: #152552)

* Added support for facilities introduced in gLSB 1.2. (Closed: #148568) - $time: start >= S24, stop <= K21 - $portmap: start >= S19, stop <= K34

* Removed support for the $netdaemons facility, which vanished from the specification. Hopefully nobody is using it...

* Call pidof if it's available and /var/run/$1.pid doesn't exist.

The Changelog says:

* Please see 3.23.51-1woody2 for reasons that justify the woody update! * As ps doesn't work on all autobuilders (maybe no /proc in chroot) I now disabled this check in ./configure as our target system will be the same Linux anyway.

Christian Hammers explained that 3.23.50 contains a fix against a bug resulting in a segementation fault that was fixed upstream. 3.23.51 also has some scripts changed.

Creating a diff through both versions is not possible. Many differences are made in documentation and file locations, and the source package was renamed as well. I'm not convinced this should go into stable.

Apart from that, arm and sparc ar mising, and .changes files for alpha, i386, ia64, mips, mipsel, powerpc and s390 are missing as well.

MISSING arm
MISSING sparc

* Backported upstream's patch for MacOS X partition issue from 1.6 series. The patch is simply a 2 line addition which comments out a check that the boot region starts at the start of the partition. Since the MacOS X doesn't have the boot region at the start of the partition, this check caused a fatal error on all MacOS X / Debian systems, and means that the parted-using PGI can't be used to install the system. (closes: 145214)

MISSING s390

Amaya: The version in stable didn't build from source or install. This upload fixes that. No changes in the orignial package, just in the debian/ dir. No new features, no new bugs.

MISSING mipsel

Due to a maintainer bug the package libsnmpkit1 did not only contain libsnmpkit2.so.* but also lacked the libsnmpkit2.so link. Hence, it's not exactly usable in woody. In turn this renders packages like pconf-detect, gnulpr and printtool useless.

Buildds are hopefully catching up.

MISSING sparc
MISSING sparc

Changelog only says:

* Fixed postrm script to not barf on purge (closes: Bug#153718).

* Fixed segfault when opening a directory not readable by user.

* Fixed permissions on newly-created directories (closes: Bug#153517).

MISSING sparc

Previous version was causing Debian menu system breakage when installed.

MISSING arm

DSA-164 cacti - arbitrary code execution

0.6.7-3 contains a tempfile race condition

0.6.7-2.1 would've been the version from security.debian.org, bummer.

Intrusive changes. New upstream version. Changed libraries. Changed behaviour. Moved from non-US to main for no apparent reason. Missing .changes files.

Changelog says:

* "No, restart Fvwm" command correction. Previous was to run /usr/bin/X11/fvwm2, even fvwm is in /usr/bin since 2.4.5-2 (closes: #153983)

This upload only corrects the path in the Debian menu. The correction looks clean. However, this problem only occurs to rather few people who restart fvwm. This upload does not correct the font problem mentioned in the same bug report (not sure if it's fvwm's fault at all, though). This problem is not critical enough for a fix to be included in a stable update

MISSING sparc

Rebuild for woody against new mozilla package (closes: #170331)

There is no new Mozilla package.

* for stable, same as 3.1.20.0-1, urgency low

Probably no package that needs to be required in stable

MISSING arm

Fixed i386 lcall DoS (Petr Vandrovec).

Superseded by kernel-image-2.2.22

There's still kernel-image-2.4.18-bf2.4 and kernel-headers-2.4.18-bf2.4 in woody. Eduard Bloch told me that they need to stay, so new packages can't go i..

New upstream release includes security update.

New upstream release is a nogo for a beast like Mozilla.

0.9.6c-2.woody.0: DSA-136 openssl - multiple remote exploits

0.9.6c-2.woody.1: DSA-136 openssl - multiple remote exploits (update on security.debian.org)

0.9.6g-0.woody.1 says:

* new upstream version

* fix manpage names (closes: #156717, #156718, #156719, #156721)

* Use proper error handling instead of 'assertions' in buffer overflow checks added in 0.9.6e. This prevents DoS (the assertions could call abort()). (closes: #155985, #156495)

* Fix ASN1 checks. Check for overflow by comparing with LONG_MAX and get fix the header length calculation.

* include support for new sh* architectures (closes: #155117)

MISSING m68k

Changelog says:

* This package doesn't contains documentation so, the call to install-docs fails. Now, install-docs it's only called if there are something in /usr/share/doc-base. Closes: #155023

* Last package was a critical bug that becomes it on uninstable. The problem was on a non existant directory needed by the postinstall script. This package closes: #153835

The package in woody installs, upgrades and reinstalls fine, so no upgrade is required.

Security update for Safe.pm

Will be superseded by a DSA in week 50

Version 7.2.1-2woody2 would be DSA-165 postgresql - buffer overflows

Version 7.2.2-0.woody.1 is a new upstream version and hence not authorized .

Files from DSA-165 got lost though

DSA 159-1: 2.1.3-3.1, 2.2.1-4.1 DSA 159-2: 2.1.3-3.2, 2.2.1-4.2

python2.1_2.1.3-3.2 is missing for 8 architectures, which got lost during the transfer from security.debian.org to ftp-master.

The packages are completely fucked up except for python 1.5, hence, separated. I guess we need mechanisms to avoid such situations. Random maintainers uploading packages with higher versions than security updates, partially render the packages from security.debian.org unreachable and hence unusable.

New upstream version.

Changelog only says:

* changed priority of libsocks4 to optional

* fix building of rtelnet

MISSING arm
MISSING m68k

Version 1.5.15-1.1 would be DSA-175 syslog-ng - buffer overflow

Version 1.5.15-3 is not an authorized version.

Files from DSA-175 got lost though

fixed manpages which were corrupted in stable. Closes: 153065

Documentation fixes don't justify an upload to stable.

Changelog says:

* Explicitly depend on libfreetype6, and changed Wine code to look for libfreetype.so.6 instead of libfreetype.so. Closes: #147571.

* Removed README.Debian reference to my old apt repository on WineHQ; since they no longer run Debian, I can't host it there anymore.

* Merged a few other small packaging fixes from unstable:

- doubled size of MAX_FONTS

- fixed wine-doc.doc-base

- updated debconf template translations

DSA-190 wmaker - buffer overflow

Broken security update, requires an update