[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: fixing CVE-2010-0395 for testing



Hi,
* Rene Engelhard <rene@debian.org> [2010-06-06 14:49]:
> same procesdure like last time. A few dasys (here: 2) before security
> disclosure something happens[1] which blocks sid->testing migration
> (and thus the security fix) for unknown time.
> 
> I could have uploaded 1:3.2.1-11 to sid just it won't go into testing
> due to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584545 and even
> if that would be fixed we'd wait behind gcc-defaults which waits for
> gcc-4.4 which waits for eglibc. And OOo 3.2.1 also has important fixes,
> so I decided to upload that to sid directly.
> 
> As said, I am fixing sid using 1:3.2.1-1 (currently uploading) and would
> like to upload the following changes (diff attached) to t-p-u or t-s
> (whatever is more appropriate) to get the security fix (and the other
> important stuff there) fixed asap in testing, too.
> 
> openoffice.org (1:3.2.0-11) unstable; urgency=high
[...] 
> Note that -10 added a build-dep on  the external mythes lib, so we'd
> need mythes migrated to testing.
> 
> Comments?

Would it be possible to upload a minimal version only carrying the security 
patch to testing-security? Otherwise I'd propose to upload your -11 version to 
t-p-u.

Btw the testing-security team has an embargoed queue as well, so next time it 
should also work to upload a fixed version prior to disclosure if the 
migration is a common show stopper for this package.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: pgpngjhDVgv3u.pgp
Description: PGP signature


Reply to: