[gentoo-server] what happend to GLSA ?

[gentoo-server] what happend to GLSA ?

[Tomasz Lutelmowski]

The GLSA is not updating since 2007-12-25...

xxx etc # glsa-check -l | tail
[A] means this GLSA was already applied,
[U] means the system is not affected and
[N] indicates that the system might be affected.

200712-16 [U] Exiv2: Integer overflow ( media-gfx/exiv2 )
200712-17 [U] exiftags: Multiple vulnerabilities ( media-gfx/exiftags )
200712-18 [U] Multi-Threaded DAAP Daemon: Multiple vulnerabilities ( media-
sound/mt-daapd )
200712-19 [U] Syslog-ng: Denial of Service ( app-admin/syslog-ng )
200712-20 [U] ClamAV: Multiple vulnerabilities ( app-antivirus/clamav )
200712-21 [U] Mozilla Firefox, SeaMonkey: Multiple vulnerabilities ( www-
client/seamonkey  www-client/mozilla-firefox-bin  www-client/mozilla-
firefox ... )
200712-22 [U] Opera: Multiple vulnerabilities ( www-client/opera )
200712-23 [U] Wireshark: Multiple vulnerabilities ( net-analyzer/wireshark )
200712-24 [U] AMD64 x86 emulation GTK+ library: User-assisted execution of 
arbitrary code ( app-emulation/emul-linux-x86-gtklibs )
200712-25 [U] OpenOffice.org: User-assisted arbitrary code execution ( app-
office/openoffice  app-office/openoffice-bin  dev-db/hsqldb )

Is it temporary issue or Gentoo got new way of tracking vulnerabilities ?

Regards,
TOmek

-- 
gentoo-server@lists.gentoo.org mailing list

Re: [gentoo-server] what happend to GLSA ?

[Andrew Gaffney]

Tomasz Lutelmowski wrote:
> The GLSA is not updating since 2007-12-25...
> 
> 200712-25 [U] OpenOffice.org: User-assisted arbitrary code execution ( app-
> office/openoffice  app-office/openoffice-bin  dev-db/hsqldb )

The -25 isn't a date. It's the 25th GLSA for that month. That particular one was 
from 2007-12-30. And maybe there just haven't been any GLSAs released in the 
last 9 days?

-- 
Andrew Gaffney                                 http://dev.gentoo.org/~agaffney/
Gentoo Linux Developer             Catalyst/Installer + x86 release coordinator
-- 
gentoo-server@lists.gentoo.org mailing list

Re: [gentoo-server] what happend to GLSA ?

[mRyOuNg]

[-- Attachment #1: Type: text/plain, Size: 1815 bytes --]

Tomasz Lutelmowski wrote:
> The GLSA is not updating since 2007-12-25...
> 
> xxx etc # glsa-check -l | tail
> [A] means this GLSA was already applied,
> [U] means the system is not affected and
> [N] indicates that the system might be affected.
> 
> 200712-16 [U] Exiv2: Integer overflow ( media-gfx/exiv2 )
> 200712-17 [U] exiftags: Multiple vulnerabilities ( media-gfx/exiftags )
> 200712-18 [U] Multi-Threaded DAAP Daemon: Multiple vulnerabilities ( media-
> sound/mt-daapd )
> 200712-19 [U] Syslog-ng: Denial of Service ( app-admin/syslog-ng )
> 200712-20 [U] ClamAV: Multiple vulnerabilities ( app-antivirus/clamav )
> 200712-21 [U] Mozilla Firefox, SeaMonkey: Multiple vulnerabilities ( www-
> client/seamonkey  www-client/mozilla-firefox-bin  www-client/mozilla-
> firefox ... )
> 200712-22 [U] Opera: Multiple vulnerabilities ( www-client/opera )
> 200712-23 [U] Wireshark: Multiple vulnerabilities ( net-analyzer/wireshark )
> 200712-24 [U] AMD64 x86 emulation GTK+ library: User-assisted execution of 
> arbitrary code ( app-emulation/emul-linux-x86-gtklibs )
> 200712-25 [U] OpenOffice.org: User-assisted arbitrary code execution ( app-
> office/openoffice  app-office/openoffice-bin  dev-db/hsqldb )
> 
> Is it temporary issue or Gentoo got new way of tracking vulnerabilities ?
> 
> Regards,
> TOmek
> 

Hi there ...

Hmm, if i remember well, the last number has nothing todo with the day ...
200712-25 means ... 25th Security Advisory during December 2007

Maybe i'm wrong, but one sure thing is that the last number as nothing
to do with the day ...
for example
# glsa-check -d 200712-17 | grep "Announced"
Announced on:      December 29, 2007

cya!
-- 
. mRyOuNg :: [ SoundBomb . Syn[Rj] ] .
 mail: mryoung@soundbomb.net
 web : mryoung.soundbomb.net


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]

Re: [gentoo-server] what happend to GLSA ?

[Raphael Marichez]

[-- Attachment #1: Type: text/plain, Size: 1672 bytes --]

On Tue, 08 Jan 2008, Tomasz Lutelmowski wrote:

> 
> The GLSA is not updating since 2007-12-25...
> 
> xxx etc # glsa-check -l | tail
> [A] means this GLSA was already applied,
> [U] means the system is not affected and
> [N] indicates that the system might be affected.
> 
> 200712-16 [U] Exiv2: Integer overflow ( media-gfx/exiv2 )
> 200712-17 [U] exiftags: Multiple vulnerabilities ( media-gfx/exiftags )
> 200712-18 [U] Multi-Threaded DAAP Daemon: Multiple vulnerabilities ( media-
> sound/mt-daapd )
> 200712-19 [U] Syslog-ng: Denial of Service ( app-admin/syslog-ng )
> 200712-20 [U] ClamAV: Multiple vulnerabilities ( app-antivirus/clamav )
> 200712-21 [U] Mozilla Firefox, SeaMonkey: Multiple vulnerabilities ( www-
> client/seamonkey  www-client/mozilla-firefox-bin  www-client/mozilla-
> firefox ... )
> 200712-22 [U] Opera: Multiple vulnerabilities ( www-client/opera )
> 200712-23 [U] Wireshark: Multiple vulnerabilities ( net-analyzer/wireshark )
> 200712-24 [U] AMD64 x86 emulation GTK+ library: User-assisted execution of 
> arbitrary code ( app-emulation/emul-linux-x86-gtklibs )
> 200712-25 [U] OpenOffice.org: User-assisted arbitrary code execution ( app-
> office/openoffice  app-office/openoffice-bin  dev-db/hsqldb )
> 
> Is it temporary issue or Gentoo got new way of tracking vulnerabilities ?


indeed GLSA 200712-25 was sent 2007-12-30. After all, it was Chrismas
holidays...

We're still actively looking for helpers (which may become official
security members after a probation period) for wrangling security bugs
and writing GLSA. Mail to security@gentoo.org if interested.

-- 
Raphael Marichez aka Falco

[-- Attachment #2: Type: application/pgp-signature, Size: 481 bytes --]

RE: [gentoo-server] what happend to GLSA ?

[Olaf Niermann]

Hi Raphael,

Just use the command
# glsa-check -l |sort -n |tail

And you will see that glsa is up to date.

Regards,
Olaf Niermann


-----Original Message-----
From: Raphael Marichez [mailto:falco@gentoo.org] 
Sent: Friday, February 15, 2008 4:20 PM
To: gentoo-server@lists.gentoo.org
Subject: Re: [gentoo-server] what happend to GLSA ?


On Tue, 08 Jan 2008, Tomasz Lutelmowski wrote:

> 
> The GLSA is not updating since 2007-12-25...
> 
> xxx etc # glsa-check -l | tail
> [A] means this GLSA was already applied,
> [U] means the system is not affected and
> [N] indicates that the system might be affected.
> 
> 200712-16 [U] Exiv2: Integer overflow ( media-gfx/exiv2 )
> 200712-17 [U] exiftags: Multiple vulnerabilities ( media-gfx/exiftags )
> 200712-18 [U] Multi-Threaded DAAP Daemon: Multiple vulnerabilities (
media-
> sound/mt-daapd )
> 200712-19 [U] Syslog-ng: Denial of Service ( app-admin/syslog-ng )
> 200712-20 [U] ClamAV: Multiple vulnerabilities ( app-antivirus/clamav )
> 200712-21 [U] Mozilla Firefox, SeaMonkey: Multiple vulnerabilities ( www-
> client/seamonkey  www-client/mozilla-firefox-bin  www-client/mozilla-
> firefox ... )
> 200712-22 [U] Opera: Multiple vulnerabilities ( www-client/opera )
> 200712-23 [U] Wireshark: Multiple vulnerabilities ( net-analyzer/wireshark
)
> 200712-24 [U] AMD64 x86 emulation GTK+ library: User-assisted execution of

> arbitrary code ( app-emulation/emul-linux-x86-gtklibs )
> 200712-25 [U] OpenOffice.org: User-assisted arbitrary code execution (
app-
> office/openoffice  app-office/openoffice-bin  dev-db/hsqldb )
> 
> Is it temporary issue or Gentoo got new way of tracking vulnerabilities ?


indeed GLSA 200712-25 was sent 2007-12-30. After all, it was Chrismas
holidays...

We're still actively looking for helpers (which may become official
security members after a probation period) for wrangling security bugs
and writing GLSA. Mail to security@gentoo.org if interested.

-- 
Raphael Marichez aka Falco

--
gentoo-server@lists.gentoo.org mailing list

Re: [gentoo-server] what happend to GLSA ?

[Raphael Marichez]

[-- Attachment #1: Type: text/plain, Size: 302 bytes --]

On Fri, 15 Feb 2008, Olaf Niermann wrote:

> Hi Raphael,
> 
> Just use the command
> # glsa-check -l |sort -n |tail
> 
> And you will see that glsa is up to date.
> 

:)

nice to hear we're doing our job well :)))



-- 
Raphael Marichez aka Falco
Gentoo Linux Security Project Lead

[-- Attachment #2: Type: application/pgp-signature, Size: 481 bytes --]