[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with Stardict in Debian stable releases



On Sun, 19 Oct 2025 22:28:14 +0800
xiao sheng wen(肖盛文) <atzlinux@debian.org> wrote:

> Hi,
> 
> 在 2025/10/18 06:35, Aaron Rainbolt 写道:
> > On Fri, 17 Oct 2025 23:27:09 +0100
> > Simon McVittie <smcv@debian.org> wrote:
> >   
> >> On Fri, 17 Oct 2025 at 14:27:32 -0500, Aaron Rainbolt wrote:  
> >>> The Debian Policy manual states in section 2.2.1:
> >>>    
> >>>> In addition, the packages in main
> >>>> ...
> >>>> * must not be so buggy that we refuse to support them...    
> >>>
> >>> I would argue Stardict is this buggy.    
> >>
> >> If that's the case, the first place to report it would be a RC bug 
> >> against the stardict package (and if the stardict maintainer
> >> downgrades the severity of RC bugs in a way that is contrary to
> >> project consensus, the group that can overrule them is the release
> >> team or the technical committee).  
> > 
> > This has already happened. See
> > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110370, which was
> > filed with severity "critical" and tag "security", and which the
> > maintainer changed to severity "wishlist" and removed the "security"
> > tag from. The maintainer later upgraded the severity to "Important",
> > but still did not leave it release-critical, thus why the
> > vulnerability still exists in Trixie.  
> 
> About fix this vulnerability in Trixie, Please see:
> 
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113750
> 
> The Debian Release Team will review it before next stable point
> release.

I had overlooked that, thank you for pointing it out.

I guess the central "goal" of my email was to try to find a way to keep
password or similar leaks. In your opinion, do you think this issue or
a similar one has a high chance of occurring again in the future, or do
you think that this probably won't be a problem in the long run for
Forky and later? If it isn't going to resurface, then I don't think
there's any good reason for my initial request for package removal to
be considered.

Thanks for your time.

--
Aaron

> Regards,
> 

Attachment: pgpkVCwRgS8hY.pgp
Description: OpenPGP digital signature


Reply to: