Secure testing team - Dec 2009 - stable/oldstable libtool updates

hi all,

i''ve prepared new libtool packages for stable and oldstable to address
CVE-2009-3736.  i think this should be released as a DSA; whereas all
the embedders should be released as proposed-updates.  i''ve already
uploaded the lenny package to mentors [0].  the etch package is also
ready, but mentors won''t allow two different packages with the same
name, so i will upload that as soon as you get the lenny files.  the
debdiffs for both are attached.

mike

[0] http://mentors.debian.net/debian/pool/main/l/libtool/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libtool-etch.debdiff
Type: application/octet-stream
Size: 3672 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20091212/cb0e1657/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libtool-lenny.debdiff
Type: application/octet-stream
Size: 3619 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20091212/cb0e1657/attachment-0001.obj>

Hi Michael,

Michael Gilbert wrote:
> hi all,
> 
> i''ve prepared new libtool packages for stable and oldstable to
address
> CVE-2009-3736.  i think this should be released as a DSA; whereas all
> the embedders should be released as proposed-updates.  i''ve
already
> uploaded the lenny package to mentors [0].  the etch package is also
> ready, but mentors won''t allow two different packages with the
same
> name, so i will upload that as soon as you get the lenny files.  the
> debdiffs for both are attached.
lenny-security and etch-security don''t exist, you need to use
stable-security and oldstable-security.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

On Mon, 14 Dec 2009 12:43:36 -0600, Raphael Geissert
wrote:
> Hi Michael,
> 
> Michael Gilbert wrote:
> > hi all,
> > 
> > i''ve prepared new libtool packages for stable and oldstable
to address
> > CVE-2009-3736.  i think this should be released as a DSA; whereas all
> > the embedders should be released as proposed-updates.  i''ve
already
> > uploaded the lenny package to mentors [0].  the etch package is also
> > ready, but mentors won''t allow two different packages with
the same
> > name, so i will upload that as soon as you get the lenny files.  the
> > debdiffs for both are attached.
> 
> lenny-security and etch-security don''t exist, you need to use
> stable-security and oldstable-security.
thanks for the pointer.  i''ll update these when i get home tonight.

mike

On Mon, 14 Dec 2009 12:43:36 -0600 Raphael Geissert wrote:
> Hi Michael,
> 
> Michael Gilbert wrote:
> > hi all,
> > 
> > i''ve prepared new libtool packages for stable and oldstable
to address
> > CVE-2009-3736.  i think this should be released as a DSA; whereas all
> > the embedders should be released as proposed-updates.  i''ve
already
> > uploaded the lenny package to mentors [0].  the etch package is also
> > ready, but mentors won''t allow two different packages with
the same
> > name, so i will upload that as soon as you get the lenny files.  the
> > debdiffs for both are attached.
> 
> lenny-security and etch-security don''t exist, you need to use
> stable-security and oldstable-security.
attached are the new debdiffs.  the lenny package on mentors has
also been updated.

mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libtool-etch.debdiff
Type: application/octet-stream
Size: 4419 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20091214/7f5382f3/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libtool-lenny.debdiff
Type: application/octet-stream
Size: 3666 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20091214/7f5382f3/attachment-0003.obj>

Michael Gilbert wrote:
> 
> attached are the new debdiffs.  the lenny package on mentors has
> also been updated.
I''m preparing the lenny package as I type (I fixed a typo:
s/priviledge/privilege). Could you please upload the etch package to
mentors (or alioth, whatever you prefer)?.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

On Tue, 15 Dec 2009 22:31:04 -0600, Raphael Geissert
wrote:
> Michael Gilbert wrote:
> > 
> > attached are the new debdiffs.  the lenny package on mentors has
> > also been updated.
> 
> I''m preparing the lenny package as I type (I fixed a typo:
> s/priviledge/privilege). Could you please upload the etch package to
> mentors (or alioth, whatever you prefer)?.
i was not aware that i could upload packages to alioth.  i would
actually prefer that if it allows me to upload multiple packages with
the same name. do i just change my dput destination to
alioth.debian.org/secure-testing?

mike

Michael Gilbert wrote:
> 
> i was not aware that i could upload packages to alioth.  i would
> actually prefer that if it allows me to upload multiple packages with
> the same name. do i just change my dput destination to
> alioth.debian.org/secure-testing?
> 
No, mkdir ~public_html, and upload there (you might want to touch index.html
to prevent directory listing, though). You can then upload files via scp.

Please upload it soon so that I can release the update tonight or tomorrow.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

On Wed, 16 Dec 2009 14:22:29 -0600, Raphael Geissert
wrote:
> Michael Gilbert wrote:
> > 
> > i was not aware that i could upload packages to alioth.  i would
> > actually prefer that if it allows me to upload multiple packages with
> > the same name. do i just change my dput destination to
> > alioth.debian.org/secure-testing?
> > 
> 
> No, mkdir ~public_html, and upload there (you might want to touch
index.html
> to prevent directory listing, though). You can then upload files via scp.
> 
> Please upload it soon so that I can release the update tonight or tomorrow.
ok, will do.  the earliest i can upload it is in about 3 hours from
now, which is when i''ll get home.

mike

On Wed, Dec 16, 2009 at 3:22 PM, Raphael Geissert wrote:
> Michael Gilbert wrote:
>>
>> i was not aware that i could upload packages to alioth. ?i would
>> actually prefer that if it allows me to upload multiple packages with
>> the same name. do i just change my dput destination to
>> alioth.debian.org/secure-testing?
>>
>
> No, mkdir ~public_html, and upload there (you might want to touch
index.html
> to prevent directory listing, though). You can then upload files via scp.
>
> Please upload it soon so that I can release the update tonight or tomorrow.
the etch packages are now up at
http://people.alioth.debian.org/~gilbert-guest/.  thanks for your help
and guidance!

mike

Michael Gilbert wrote:
> 
> the etch packages are now up at
> http://people.alioth.debian.org/~gilbert-guest/.  thanks for your help
> and guidance!
> 
Thanks.

Btw, you don''t need to add the ''people'' prefix.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net