Re: Query on db package security vurnerablity

[Moritz Mühlenhoff <jmm@inutil.org>]

On Mon, Feb 25, 2019 at 05:40:28PM +0530, Sathishkumar N wrote:
> Hi ,
> 
> Can you guys tell why the below listed cves mentioned as NOT-FOR-US in
> debian security tracker?. Is it possible to provide fix for this?

These are all fixed by Oracle for DB 6, which can't be packaged in
Debian or other distros (which are all using 5) and Oracle doesn't
disclose any vulnerability information which allows us to classify
whether 5 is affected. If you have specific information that any of
them affects DB 5 as packaged in Debian, please file a bug against
the db5.3 package.

Cheers,
        Moritz