Re: CVE-2009-1284
Hi,
Norbert Preining wrote:
> Dear security team,
>
> on the tracker page
> http://security-tracker.debian.org/tracker/CVE-2009-1284
> I see that texlive-bin 2009-1 is still listed as vulnerable.
>
> We did close the bug 520920, but probably we should add the CVE string
> to close this bug.
>
> Now my question: If for the next upload we edit the old changelog entry
> will that be enough, or is there anything else we should/need to do?
The bug submitter was not somebody from the team and apparently nobody
noticed it was fixed already, thanks for notifying. The tracker is manually
updated so that changes are reviewed.
If you modify the changelog to add a reference it won't make much a
difference.
>
> Then, for stable: Do you want us to prepare a security update for lenny?
>
It would be great if you could prepare uploads for oldstable and stable,
which would go through *-proposed-updates (and not via the security
queues). Thanks!
> For sid/testing I would prefer to just leave it like it is, since after
> a certain testing phase we want to get the 2009 packages into unstable
> anyway.
>
It's a minor issue, so it seems to be fine to wait.
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Reply to: