[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

May Report


May 2018 was my 21th month as a payed Debian LTS contributor.

I was allocated 24.25 hours. I have spent all of them in the following

* Continue my tiff work:

  Continue investigations on CVE-2018-8905. Prepare a patch draft, but
  in the end upstream published its own patch before I could submit mine.
  Prepare a wheezy upload shipping upstream's patch and test it:
  DLA 1377-1 and 1378-1.

* Continue my libav work:

  Ask vulnerability reporters to communicate their reproducers. Also,
  take a look at CVE-2018-9841 (not affecting Wheezy/Jessie) and start
  working on CVE-2017-9987, but coming to a mergeable patch is going to
  be quite long.

* Continue my lame work:

  Contact security team and prepare Jessie update 3.99.5+repack1-7+deb8u2
  together with Fabian Greffrath, test it and submit it to the security
  team. Still waiting for their approval for upload.

* Continue my ming work:

 - Prepare, test and upload ming 1:0.4.4-1.1+deb7u9 (DLA-1386-1) fixing
   a new batch of security issues.

 - Reproduce CVE-2018-9132, CVE-2018-9009, CVE-2018-7876, CVE-2018-7866,
   and CVE-2018-7873, prepare patches for these issues and submit them
   to upstream.

 - Take a look at CVE-2018-8964, CVE-2018-8963, CVE-2018-8962, CVE-2018-8961,
   CVE-2018-8807, CVE-2018-7874, and CVE-2018-8806 which are already fixed in
   3a000c7 shipped in 1:0.4.4-1.1+deb7u8. Also take a look at CVE-2018-7877,
   which was already fixed in eea2a55, also shipped in 1:0.4.4-1.1+deb7u8.

 - Take a look at memory leak issues CVE-2017-11705, CVE-2017-11703 and
   CVE-2018-7869 and mark them ignored.

 - Take a look at CVE-2018-11226, start to develop a patch but second part
   of the issue is pretty complex, still working on it.

* Also, I've had a look at the removed packages glitch in the tracker[0].
  In the end Salvatore declared it is not a bug, so I stopped working on it.

* Test Roberto's apache2 update.

Best Regards,

[0] https://lists.debian.org/debian-lts/2018/05/msg00039.html

             Hugo Lefeuvre (hle)    |    www.owl.eu.com
4096/ 9C4F C8BF A4B0 8FC5 48EB 56B8 1962 765B B9A8 BACA

Attachment: signature.asc
Description: PGP signature

Reply to: