Bug#780424: Emedded ZendDb component affected by several security issues

[David Prévot]

[Ssorry about the charset mess on my (webmail) side]

> Believe me, I was not proud of that commit, but still hopping to have
> galette-8.0 in jessie, I didn't considered to package or ask for
> packaging ZendDB V2...

Way too late for accepting a new package at this late state of the freeze
(according to my understanding of the deep freeze), but feel free to call
for help if needed to backport security fixes (I didn’t plan to handle
those in Jessie, but might be convinced otherwise [emphasis on *might*]).

> I've filled an upstream bug for that issue :

Thanks for the quick follow up!

> Do you think, in between, it's worth to make a package which remove the
> upstream embedded ZendDB and embed a proper (let says 2.3.6) version of
> it.

Sure, but:
1: I’m not thrilled to patch a non existing package before introducing in
Debian.
2: Even if I’m happy to help introducing php-zend-db in Debian and handle
it during (at least) a stable lifetime, it seems way too late for Jessie
(if the RT says otherwise, and the FTP team follows, I’d be happy to
comply right now).


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org