Re: Recent flex security announcement

2016-08-26 Thread Mark Fletcher
On Fri, Aug 26, 2016 at 9:52 PM Greg Wooledge wrote: > On Fri, Aug 26, 2016 at 12:41:54PM +, Mark Fletcher wrote: > > Stretch and sid are quoting version 2.6.1 and I can't see where they got > > that from, as upstream (sourceforge) latest version seems to be 2.6.0. > And > > 2.6.1 claims to b

Re: Recent flex security announcement

2016-08-26 Thread Greg Wooledge
On Fri, Aug 26, 2016 at 12:41:54PM +, Mark Fletcher wrote: > Stretch and sid are quoting version 2.6.1 and I can't see where they got > that from, as upstream (sourceforge) latest version seems to be 2.6.0. And > 2.6.1 claims to be the version with the fix. *sigh* ... it just figures, as soon

Re: Recent flex security announcement

2016-08-26 Thread Mark Fletcher
On Fri, Aug 26, 2016 at 9:19 PM Greg Wooledge wrote: > On Fri, Aug 26, 2016 at 12:11:30AM +, Mark Fletcher wrote: > > However I also have Linux machines that don't use a package management > > system, and there I also have a version of flex with the vulnerability, > so > > I wanted to get the

Re: Recent flex security announcement

2016-08-26 Thread Greg Wooledge
On Fri, Aug 26, 2016 at 12:11:30AM +, Mark Fletcher wrote: > However I also have Linux machines that don't use a package management > system, and there I also have a version of flex with the vulnerability, so > I wanted to get the source tarball of the fixed version (v2.6.1) so I could > build