Bug#628843: (forw) [Pkg-shadow-devel] Bug#628843: login: tty hijacking possible in "su" via TIOCSTI ioctl

2011-06-02 Thread Daniel Ruoso
On Thu, Jun 02, 2011 at 07:34:59AM +0200, Christian PERRIER wrote: > My expertise is, as you may expect, way outreached. So, in short, what > I need is someone with enough expertise to look at this bug report and > help deciding if adopting Redhat's patch is correct (assuming it > applies: I'm not

Bug#628843: login: tty hijacking possible in "su" via TIOCSTI ioctl

2011-06-01 Thread Daniel Ruoso
Package: login Version: 1:4.1.4.2+svn3283-2+squeeze1 Severity: critical After investigating why RedHat have a different behavior regarding "su -c" I found out that there was a patch in RedHat to prevent tty hijacking when using "su -c". What makes the hijacking possible is that "su -c" still give

Bug#504982: xqilla: diff for NMU version 2.0.0-2.3

2009-12-30 Thread Daniel Ruoso
Em Qua, 2009-12-30 às 11:39 +0100, Luca Falavigna escreveu: > Dear maintainer, > I've prepared an NMU for xqilla (versioned as 2.0.0-2.3) and > uploaded it to DELAYED/2. Please feel free to tell me if I > should delay it longer. Thanks for the patch, I could even say to have no delay at all. dani

Bug#515104: Proposed implementation of a xdg-launch utility

2009-02-20 Thread Daniel Ruoso
As part of the solution, here goes an implementation of a xdg-launch utility that would be used as shbang of the .desktop files. That way, we could simply remove any special treatment of .desktop files launching from nautilus, just making it execute it as a regular executable file. Then it can ad

Bug#515104: nautilus: potential exploits via application launchers

2009-02-19 Thread Daniel Ruoso
I'd also argue that keeping track of all the points that can create a .desktop with the x bit set is certainly a much more secure way of handling this, for instance, the DnD code could check: Should the permissions be preserved on DnD? Is the origin file: * not a .desktop file? force umask

Bug#515104: Bug in the upstream

2009-02-19 Thread Daniel Ruoso
I've posted this bug in the gnome bugzilla. http://bugzilla.gnome.org/show_bug.cgi?id=572203 I should note that iceweasel saves downloaded files in the Desktop by default (without much notice), evolution seems to remember the last path you used (which might be Desktop). In summary, there are ma

Bug#407055: Compiz breaks the X server if the other head doesn't have DRI

2007-03-01 Thread Daniel Ruoso
Qui, 2007-03-01 às 14:21 +0100, Brice Goglin escreveu: > Daniel Ruoso wrote: > > Well, the version in experimental also breaks, but it presents a > > different backtrace... > Do you onyl have compiz in experimental? Or also some other X packages? > Which xserver-xorg-

Bug#407055: Compiz breaks the X server if the other head doesn't have DRI

2007-03-01 Thread Daniel Ruoso
Qui, 2007-03-01 às 11:55 +, Daniel Ruoso escreveu: > Qui, 2007-03-01 às 12:46 +0100, Brice Goglin escreveu: > > On 3/1/07, Daniel Ruoso <[EMAIL PROTECTED]> wrote: > > >I'm attaching the log from the server just before the break, I think > > >this can h

Bug#407055: Compiz breaks the X server if the other head doesn't have DRI

2007-03-01 Thread Daniel Ruoso
Qui, 2007-03-01 às 12:46 +0100, Brice Goglin escreveu: > On 3/1/07, Daniel Ruoso <[EMAIL PROTECTED]> wrote: > >I'm attaching the log from the server just before the break, I think > >this can help. As this bug not only makes compiz unusable, but also > >affects a

Bug#396256: Patch in stable version

2007-02-08 Thread Daniel Ruoso
This version fixes the bug in the stable version. wv_1.0.2-0.1sarge1.diff.gz Description: GNU Zip compressed data Format: 1.0 Source: wv Version: 1.0.2-0.1sarge1 Binary: wv Maintainer: Matej Vela <[EMAIL PROTECTED]> Architecture: any Standards-Version: 3.5.8 Build-Depends: debhelper (>= 4), libgl

Bug#396360: Security fix patch isolated

2007-02-06 Thread Daniel Ruoso
Hi, I've isolated the patch that includes the security fix. This security fix is already in testing, so this bug only affects sarge. Daniel --- wv-1.2.2/lfo.c 2005-04-17 22:16:58.0 +0100 +++ wv-1.2.4/lfo.c 2006-10-20 02:48:47.0 +0100 @@ -32,6 +32,16 @@ followed by its correspondi

Bug#396360: Is this bugreport valid?

2007-02-06 Thread Daniel Ruoso
Seg, 2007-02-05 às 16:52 -0600, James Stansell escreveu: > My memory is fuzzy, but does the orig source file include a copy of > libwv? Yes, I just saw it. It includes version 0.6.0 of libwv inside it and it seems to static link it. I'll see if I can find out the diff that actually fix the bug in

Bug#396360: Is this bugreport valid?

2007-02-05 Thread Daniel Ruoso
Tag: moreinfo I've take a look at this bug, but I couldn't find any relationship between libwv and AbiWord. Could you ellaborate on that? Is there some way to reproduce the problem? daniel -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL P

Bug#289182: Some Additional Info

2005-01-22 Thread Daniel Ruoso
Well, Some time ago, actually in December 2003, I was trying to use kino on powerpc, and I got the exact same problem, I could see that Kino actually didn't care about the endian issue, I've made a little patch at that time that made the video ok, I submitted a bug report to kino, but no action wa