<html><body bgcolor="#FFFFFF"><div>forcemerge <span class="Apple-style-span" style="font-family: sans-serif; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); font-size: 21px; color: rgb(104, 104, 104); "><a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631286" style="color: rgb(27, 86, 206); font-weight: bold; ">631286</a> 631347</span></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);">tags 631286 +squeeze wheezy sid</span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);">Thank you</span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><br></span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);">Hi,</span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><br></span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);">I already notice the bug when you reported it in postgresql and cloned the bug.</span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><br></span></font></div><div><font class="Apple-style-span" color="#686868" face="sans-serif" size="6"><span class="Apple-style-span" style="font-size: 21px; line-height: 27px; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);">Yes, the php5 is affected, but only squeeze and onwards (writing this from top of my head, so I will better double check).</span></font></div><div><br></div><div>Security team, can you remove the last not yet published security upload of php5? I'll bundle this CVE in and we will finally release the security update.</div><div><br>Ondřej Surý</div><div><br>On 23.6.2011, at 5:37, Luciano Bello <<a href="mailto:luciano@debian.org">luciano@debian.org</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div><span>Package: php5</span><br><span>Severity: serious</span><br><span>Tags: security</span><br><span></span><br><span>Hi,</span><br><span>A bug in crypt_blowfish was reported [1,2,3]. The RH report [4] may be useful </span><br><span>too.</span><br><span></span><br><span>The function BF_set_key in ./ext/standard/crypt_blowfish.c is vulnerable. Can </span><br><span>you confirm that the bug affects the Debian packages?</span><br><span></span><br><span>If so, please, considerer providing patches for stable and oldstable besides </span><br><span>sid.</span><br><span></span><br><span>The CVE (Common Vulnerabilities & Exposures) assigned is CVE-2011-2483.</span><br><span>If you fix the vulnerability please also make sure to include the</span><br><span>CVE id in your changelog entry.</span><br><span></span><br><span>[1] <a href="http://www.openwall.com/lists/oss-security/2011/06/20/2"><a href="http://www.openwall.com/lists/oss-security/2011/06/20/2">http://www.openwall.com/lists/oss-security/2011/06/20/2</a></a></span><br><span>[2] <a href="http://www.openwall.com/lists/john-dev/2011/06/20/3"><a href="http://www.openwall.com/lists/john-dev/2011/06/20/3">http://www.openwall.com/lists/john-dev/2011/06/20/3</a></a></span><br><span>[3] <a href="http://www.openwall.com/lists/john-dev/2011/06/20/5"><a href="http://www.openwall.com/lists/john-dev/2011/06/20/5">http://www.openwall.com/lists/john-dev/2011/06/20/5</a></a></span><br><span>[4] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=715025"><a href="https://bugzilla.redhat.com/show_bug.cgi?id=715025">https://bugzilla.redhat.com/show_bug.cgi?id=715025</a></a></span><br><span></span><br><span>-luciano</span><br><span></span><br><span></span><br><span></span><br><span>_______________________________________________</span><br><span>pkg-php-maint mailing list</span><br><span><a href="mailto:pkg-php-maint@lists.alioth.debian.org">pkg-php-maint@lists.alioth.debian.org</a></span><br><span><a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint</a></span><br></div></blockquote></body></html>