1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
|
An LTS security update is needed for the following source packages.
When you add a new entry, please keep the list alphabetically sorted.
The specific CVE IDs do not need to be listed, they can be gathered in an up-to-date manner from
https://security-tracker.debian.org/tracker/source-package/SOURCEPACKAGE
when working on an update.
To pick an issue, simply add your name behind it. To learn more about how
this list is updated have a look at
https://wiki.debian.org/LTS/Development#Triage_new_security_issues
To make it easier to see the entire history of an update, please append notes
rather than remove/replace existing ones.
--
adminer (Chris Lamb)
NOTE: 20220409: please recheck whether Stretch is really vulnerable (Thorsten Alteholz)
NOTE: 20220414: https://sourceforge.net/p/adminer/discussion/960419/thread/1b64510b71/?limit=25#2971 (lamby)
NOTE: 20220421: pinged upstream (lamby)
--
ansible
NOTE: 20210411: As discussed with the maintainer I will update Buster first and
NOTE: 20210411: after that LTS. (apo)
NOTE: 20210426: https://people.debian.org/~apo/lts/ansible/
NOTE: 20220427: Lee Garrett (maintainer) took over the work a while ago. See
NOTE: 20220427: https://salsa.debian.org/debian/ansible/-/commits/stretch/
--
asterisk
--
cgal
NOTE: 20220421: many no-dsa issues, please check, whether it is possible to fix them without an uploading of a new upstream release (Anton)
--
ckeditor
NOTE: 20220402: multiple pendings vulnerabilities (Beuc)
--
debian-security-support (Utkarsh)
NOTE: 20220402: need to update the list of unsupported packages (Beuc)
NOTE: 20220402: check debian/README.source, sync with h01ger, and announce EOL'd packages (Beuc)
NOTE: 20220402: context: https://lists.debian.org/debian-lts/2022/04/msg00000.html (Beuc)
NOTE: 20220419: backport prepped, will contact Holger for more details. (utkarsh)
--
epiphany-browser
NOTE: 20220422: please try to reproduce and be careful with the patch applying.
NOTE: 20220422: It cannot be applied one-to-one, but affected lines can be found. (Anton)
NOTE: 20220423: Is stretch really affected? - I can reproduce with Buster and
NOTE: 20220423: Bullseye versions, but not Stretch - error seems to be caused
NOTE: 20220423: by https://gitlab.gnome.org/GNOME/epiphany/-/commit/232c613472b38ff0d0d97338f366024ddb9cd228
NOTE: 20220423: (May 21, 2018), while the stretch version is from 2017. (Andreas)
--
firmware-nonfree
NOTE: 20210731: WIP: https://salsa.debian.org/lts-team/packages/firmware-nonfree
NOTE: 20210828: Most CVEs are difficult to backport. Contacted Ben regarding possible "ignore" tag
NOTE: 20211207: Intend to release this week.
--
gerbv
NOTE: 20220321: WIP https://salsa.debian.org/lts-team/packages/gerbv (Anton)
NOTE: 20220326: CVE-2021-40401 is fixed https://salsa.debian.org/lts-team/packages/gerbv/-/blob/debian/stretch/debian/patches/CVE-2021-40401.patch (Anton)
NOTE: 20220326: CVE-2021-4040{0,2,3} do not have confirmed upstream fixes yet. (Anton)
--
ghostscript (Markus Koschany)
--
golang-go.crypto
NOTE: 20220331: rebuild reverse-dependencies if needed, e.g. DLA-2402-1 -> DLA-2453-1/DLA-2454-1/DLA-2455-1; also check buster status (Beuc)
--
gpac (Roberto C. Sánchez)
NOTE: 20211101: coordinating with secteam for s-p-u since stretch/buster versions match (roberto)
NOTE: 20211120: received OK from secteam for buster update, working on stretch/buster in parallel (roberto)
NOTE: 20211228: Returning to active work on this now that llvm/rustc update is complete (roberto)
NOTE: 20220305: There are many dozens of open CVEs, it will take a while yet (roberto)
NOTE: 20220413: New CVEs continue flooding in (roberto)
NOTE: 20220427: Preparing to work with security team to declare EOL (roberto)
--
icingaweb2 (Abhijith PA)
--
intel-microcode
NOTE: 20220213: please recheck
--
jackson-databind
NOTE: 20220320: wait for complete upstream fix (apo)
--
kicad
--
kvmtool
NOTE: 20220402: stretch-specific, orphaned package (Beuc)
NOTE: 20220402: CVE-2021-45464 looks critical, check with upstream for acknowledgments/fixes (Beuc)
--
libarchive (Thorsten Alteholz)
NOTE: 20220423: still testing, some tests still fail
--
liblouis
NOTE: 20220320: no patch available yet. Reproducible memory leaks with ASAN
NOTE: 20220320: and POC. Consider fixing CVE-2018-17294 too.
--
libpgjava
--
libvirt (Thorsten Alteholz)
NOTE: 20220423: wait for upload in newer releases, dependency loop seems to be resolved now
--
libz-mingw-w64
NOTE: 20220231: upcoming DSA (Beuc)
--
linux (Ben Hutchings)
--
linux-4.19 (Ben Hutchings)
--
mariadb-10.1
NOTE: 20220222: Can be risky. Please consider backporting mariadb-10.3. See discussion https://lists.debian.org/debian-lts/2022/02/msg00005.html and coordinate with maintainer (Anton)
--
mbedtls (Utkarsh)
NOTE: 20220404: update prepared, needs testing. (utkarsh)
NOTE: 20220419: waiting for a quick feedback from carnil. (utkarsh)
--
mruby
--
mutt (Utkarsh)
--
nvidia-cuda-toolkit
NOTE: 20220331: package is in non-free but also in packages-to-support (Beuc)
--
nvidia-graphics-drivers
NOTE: 20220203: package is in non-free but also in packages-to-support (Beuc)
NOTE: 20220209: monitor nvidia-graphics-drivers-legacy-390xx for a potential
NOTE: 20220209: backport (apo)
--
openjdk-8 (pochu)
--
openvpn (Emilio)
NOTE: 20220402: harmonize with buster/10.10 (Beuc)
--
pdns
NOTE: 20220402: harmonize with buster/10.8 (Beuc)
--
puma
--
puppet-module-puppetlabs-firewall
NOTE: 20220402: no Debian maintainers activity since 2018 (Beuc)
--
ring (Abhijith PA)
NOTE: 20220314: https://people.debian.org/~abhijith/upload/vda/ring_20161221.2.7bd7d91~dfsg1-1+deb9u2.dsc
NOTE: 20220404: package in archive is faulty. New regs can't be done due (abhijith)
NOTE: 20220404: a network error (abhijith)
--
ruby-devise-two-factor
NOTE: 20220427: Patch does not apply cleanly to LTS version, may be due to this being the result
NOTE: 20220427: of an incomplete fix to CVE-2015-7225. Will require some investigation. (lamby)
--
salt
--
samba
NOTE: 20211128: WIP https://salsa.debian.org/lts-team/packages/samba/
NOTE: 20211212: Fix is too large, coordination with ELTS-upload (anton)
NOTE: 20220110: fix applied, but will need a second opinion. (utkarsh)
NOTE: 20220125: ftbfs, wip. (utkarsh)
--
smarty3
--
snapd
NOTE: 20220308: seems vulnerable at least to setup_private_mount,
NOTE: 20220308: but double check (pochu)
--
sox
NOTE: 20220326: CVE-2019-13590 is fixed in git (Anton)
NOTE: 20220326: fix for CVE-2021-40426 is not yet available (Anton)
--
subversion (Roberto C. Sánchez)
NOTE: 20220422: Upstream's patch for CVE-2021-28544 does not cleanly apply (eg. "copyfrom_path = apr_pstrdup(...)" assignment)
NOTE: 20220422: and, once applied manually, appears to break multiple and possibly unrelated parts of the testsuite. (lamby)
--
tiff (Utkarsh)
NOTE: 20220404: jessie upload at https://salsa.debian.org/lts-team/packages/tiff.
NOTE: 20220404: if that works out well, I'll roll the same for stretch. (utkarsh)
NOTE: 20220419: new CVE reported; waiting to see if there are more. (utkarsh)
--
twig
NOTE: 20220402: cf. DSA-5107-1; similar code in lib/Twig/Extension/Core.php (Beuc)
--
twisted (Stefano Rivera)
--
unzip
NOTE: 20220319: no patches yet but reproducible (apo)
NOTE: 20220429: CVE-2022-0530: reported #1010355 with a proposed patch (enrico)
NOTE: 20220429: CVE-2022-0529: sent a proposed patch to sanvila and team@s.d.o (enrico)
--
vim (Markus Koschany)
--
waitress
NOTE: 20220320: I am not sure if we should ignore CVE-2022-24761 as it is
NOTE: 20220320: basically another HTTP parsing error and a workaround exists
NOTE: 20220320: or if we should overhaul the package and fix everything
NOTE: 20220320: instead. Someone with more Python knowledge should take another look
NOTE: 20220320: at it. (apo)
--
|
