[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#287201: [SECURITY] [DSA 631-1] New kdlibs packages fix arbitrary FTP command execution



> Package        : kdelibs
> Debian Bug     : 287201
> ...
> For the stable distribution (woody) this problem has been fixed in
> version 2.2.2-13.woody.13.

This fails to upgrade for me.  It seems I don't have libarts
installed.  This package introduces four new files and a change and
increase in dependencies to now include new libraries.

This breaks 'upgrade' semantics.  It now requires a 'dist-upgrade'.
This surely was not intentional.

Here is what debdiff says.

  debdiff kdelibs3_2.2.2-13.woody.12_i386.deb kdelibs3_2.2.2-13.woody.13_i386.deb

  Files in second .deb but not in first
  -------------------------------------
  /usr/lib/libgmcop.la
  /usr/lib/libgmcop.so
  /usr/lib/libgmcop.so.0
  /usr/lib/libgmcop.so.0.0.0

  The following lines in the control files differ (wdiff output format):
  ----------------------------------------------------------------------
  Version: [-4:2.2.2-13.woody.12-] {+4:2.2.2-13.woody.13+}
  Depends: {+libarts (>= 4:2.2.2-1) | libarts-alsa (>= 4:2.2.2-1),+} libbz2-1.0, libc6 (>= 2.2.4-4), libfam0, {+libglib2.0-0 (>= 2.0.1),+} libjpeg62, libpcre3, libpng2(>=1.0.12), libqt2 (>= 3:2.3.1-1), libstdc++2.10-glibc2.2 (>= 1:2.95.4-0.010810), libtiff3g, libxml2 (>= 2.4.19-4), libxslt1 (>= 1.0.16), xlibs (>> 4.1.0), zlib1g (>= 1:1.1.4), kdelibs3-bin | kdelibs-bin, xbase-clients
  Installed-Size: [-23972-] {+24032+}

Should a new update with a correction be issued?

Bob

P.S. By the way, note the misspelled "kdlibs" in the subject.

Attachment: signature.asc
Description: Digital signature


Reply to: