Bug#698231: memcached: CVE-2013-0179

2013-01-29 Thread Jonathan Wiltshire
Package: memcached Dear maintainer, Recently you fixed one or more security problems and as a result you closed this bug. These problems were not serious enough for a Debian Security Advisory, so they are now on my radar for fixing in the following suites through point releases: squeeze (6.0.7)

Bug#698231: memcached: CVE-2013-0179

2013-01-19 Thread Salvatore Bonaccorso
Hi Attached is a proposed debdiff for #698231. Any comments? Regards, Salvatore diff -Nru memcached-1.4.13/debian/changelog memcached-1.4.13/debian/changelog --- memcached-1.4.13/debian/changelog 2012-05-08 19:25:25.0 +0200 +++ memcached-1.4.13/debian/changelog 2013-01-19 20:37:32.00

Bug#698231: memcached: CVE-2013-0179

2013-01-19 Thread Arno Töll
On 19.01.2013 16:16, Salvatore Bonaccorso wrote: > > The only thing is if Release Team is happy with it to have it updated > as it is (i.e. native Debian package). Yes, my bad. I wasn't careful enough with that as 1.0 packages make it pretty easy to produce a native package accidentally. I'll ask

Bug#698231: memcached: CVE-2013-0179

2013-01-19 Thread Salvatore Bonaccorso
Hi Arno On Sat, Jan 19, 2013 at 03:21:39PM +0100, Arno Töll wrote: > looking at the current upload history, I don't think the current > maintainer will prepare a patch for s-p-u. Salvatore, given you asked > yesterday: Are you working on this? > > If nobody steps in, I'll NMU the version in unsta

Bug#698231: memcached: CVE-2013-0179

2013-01-19 Thread Arno Töll
Hi, looking at the current upload history, I don't think the current maintainer will prepare a patch for s-p-u. Salvatore, given you asked yesterday: Are you working on this? If nobody steps in, I'll NMU the version in unstable at very least, although I cannot promise this will happen within the

Bug#698231: memcached: CVE-2013-0179

2013-01-15 Thread Moritz Muehlenhoff
Package: memcached Severity: grave Tags: security Justification: user security hole A minor security issue was found in memcached: http://www.openwall.com/lists/oss-security/2013/01/14/6 This doesn't warrant a DSA, but you could fix it through a point update. For Wheezy a minimal fix should be m