Re: CVE-2020-10938/graphicsmagick and additional upstream change

[Roberto C. Sánchez <roberto@debian.org>]

On Mon, Apr 13, 2020 at 03:43:04PM +0200, Moritz Mühlenhoff wrote:
> On Mon, Mar 30, 2020 at 10:26:35AM -0400, Roberto C. Sánchez wrote:
> >  2. Leave the change set intact with both functional changes, and:
> >     a. mention only CVE-2020-10938 in debian/changelog and the
> >        associated advisories
> 
> I think that one makes the most sense, it's common that related changes
> get cherrypicked alongside after all.
> 
Hi Moritz,

Thanks for the guidance.  I will proceed with preparing the update for
jessie, stretch, and buster.  I will then publish the package and
advisory for jessie and will submit the stretch and buster debdiffs to
the security team for review before proceeding with any action relative
to stretch and buster.

Regards,

-Roberto

-- 
Roberto C. Sánchez