On Mon, September 24, 2007 09:42, Gregory Colpart wrote: > I report that imp4/etch is *not* vulnerable for > CVE-2007-1515 (corrected in #415117). I add CVE-id to imp4's > changelog in our GNU Arch repository but I mention it here because no > upload is expected in next weeks. Thanks for letting us know. Could you briefly say why it's not vulnerable, e.g. the vulnerable code is not in that version, or some other reason? Thanks! Thijs