Quoting Alexander Wirt (formorer@debian.org): > You ask me for a new BSA number - which would be 003 - after that you follow > the instructions from http://backports.debian.org/Contribute/#index3h2 and > send a gpg inline signed mail to the backports-announce mailinglist. > Following the template at the url. Please replace the XXX with the 003 and > and everything which has to be replaced (Package name, CVE number and so on). > > Thats all > > Alex Let's see if I get it right. What I should send should then be something like: From: Christian PERRIER <bubulle@debian.org> To: debian-backports-announce@lists.debian.org Subject: BSA-003 Security Update for samba Christian Perrier uploaded new packages for samba which fixed the following security problems: CVE-2010-3069 A vulnerability has been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The sid_parse() function does not correctly check its input lengths when reading a binary representation of a Windows SID (Security ID). This allows a malicious client to send a sid that can overflow the stack variable that is being used to store the SID in the Samba smbd server. For the lenny-backports distribution the problems have been fixed in version 2:3.5.5~dfsg-1~bpo50+1. Upgrade instructions -------------------- If you don't use pinning (see [1]) you have to update the package manually via "apt-get -t lenny-backports install <packagelist>" with the packagelist of your installed packages affected by this update. [1] <http://backports.debian.org/Instructions> We recommend to pin the backports repository to 200 so that new versions of installed backports will be installed automatically. Package: * Pin: release a=lenny-backports Pin-Priority: 200 -- --
Attachment:
signature.asc
Description: Digital signature