Bug#824239: [DLA] fixes for dla-20,38,53,54

Package: www.debian.org
Severity: normal
Tags: patch
X-Debbugs-CC: [email protected]

* wrong references in dla-20
* missing wireshirk advisory (dla-38), no one sent to d-d-a
* wrong dla ID for "dla-54" sent and created as dla-53
* missing "real" dla-54

see the bottom of the mail

p.s.: 
scripts are not all-round genius;
scripts cannot decide if the source is valid,
scripts cannot fix issues in the source,
scripts do just as instructed.
then, YOU NEED CHECK AND FIX YOURSELF THE GENERATED CONTENTS

-- 
victory
no need to CC me :-)

Index: english/security/2014/dla-20.wml
===================================================================
--- english/security/2014/dla-20.wml	(revision 193)
+++ english/security/2014/dla-20.wml	(working copy)
@@ -8,9 +8,9 @@
   (Closes: #679897), closes <a href="https://security-tracker.debian.org/tracker/CVE-2012-3512">CVE-2012-3512</a>.</li>
 <li>plugins: use runtime $ENV{MUNIN_PLUGSTATE}. So all properly written
   plugins will use /var/lib/munin-node/plugin-state/$uid/$some_file now   please report plugins that are still using /var/lib/munin/plugin-state/   as those  might pose a security risk!</li>
-<li>Validate multigraph plugin name, <a href="https://security-tracker.debian.org/tracker/CVE-2013-6048">CVE-2013-6048</a>.</li>
 <li>Don't abort data collection for a node due to malicious node, fixing
-  munin#1397, <a href="https://security-tracker.debian.org/tracker/CVE-2013-6359">CVE-2013-6359</a>.</li>
+  munin#1397, <a href="https://security-tracker.debian.org/tracker/CVE-2013-6048">CVE-2013-6048</a>.</li>
+<li>Validate multigraph plugin name, <a href="https://security-tracker.debian.org/tracker/CVE-2013-6359">CVE-2013-6359</a>.</li>
 </ul>
 
 <p>For Debian 6 <q>Squeeze</q>, these issues have been fixed in munin version 1.4.5-3+deb6u1</p>
Index: english/security/2014/dla-38.data
===================================================================
--- english/security/2014/dla-38.data	(nonexistent)
+++ english/security/2014/dla-38.data	(working copy)
@@ -0,0 +1,10 @@
+<define-tag pagetitle>DLA-38-1 wireshark</define-tag>
+<define-tag report_date>2014-8-20</define-tag>
+<define-tag secrefs>CVE-2014-5161 CVE-2014-5162 CVE-2014-5163</define-tag>
+<define-tag packages>wireshark</define-tag>
+<define-tag isvulnerable>yes</define-tag>
+<define-tag fixed>yes</define-tag>
+<define-tag fixed-section>no</define-tag>
+
+#use wml::debian::security
+
Index: english/security/2014/dla-38.wml
===================================================================
--- english/security/2014/dla-38.wml	(nonexistent)
+++ english/security/2014/dla-38.wml	(working copy)
@@ -0,0 +1,25 @@
+<define-tag description>LTS security update</define-tag>
+<define-tag moreinfo>
+
+<ul>
+    <li><a href="https://security-tracker.debian.org/tracker/CVE-2014-5161">CVE-2014-5161</a>,
+    <a href="https://security-tracker.debian.org/tracker/CVE-2014-5162">CVE-2014-5162</a>:
+
+    <p>The Catapult DCT2000 and IrDA dissectors could underrun a buffer.
+    It may be possible to make Wireshark crash by injecting a malformed packet onto 
+    the wire or by convincing someone to read a malformed packet trace file.</p></li>
+
+    <li><a href="https://security-tracker.debian.org/tracker/CVE-2014-5163">CVE-2014-5163</a>:
+
+    <p>The GSM Management dissector could crash.
+    It may be possible to make Wireshark crash by injecting a malformed packet onto
+    the wire or by convincing someone to read a malformed packet trace file.</p></li>
+</ul>
+
+<p>For Debian 6 <q>Squeeze</q>, these issues have been fixed in wireshark version 1.2.11-6+squeeze15</p>
+
+</define-tag>
+
+# do not modify the following line
+#include "$(ENGLISHDIR)/security/2014/dla-38.data"
+# $Id: $
Index: english/security/2014/dla-53.data
===================================================================
--- english/security/2014/dla-53.data	(revision 193)
+++ english/security/2014/dla-53.data	(working copy)
@@ -1,10 +1,10 @@
-<define-tag pagetitle>DLA-53-1 gnupg</define-tag>
-<define-tag report_date>2014-9-14</define-tag>
-<define-tag secrefs>CVE-2014-5270</define-tag>
-<define-tag packages>gnupg</define-tag>
-<define-tag isvulnerable>yes</define-tag>
-<define-tag fixed>yes</define-tag>
-<define-tag fixed-section>no</define-tag>
-
-#use wml::debian::security
-
+<define-tag pagetitle>DLA-53-1 apt</define-tag>
+<define-tag report_date>2014-9-3</define-tag>
+<define-tag secrefs>CVE-2014-0487 CVE-2014-0488 CVE-2014-0489</define-tag>
+<define-tag packages>apt</define-tag>
+<define-tag isvulnerable>yes</define-tag>
+<define-tag fixed>yes</define-tag>
+<define-tag fixed-section>no</define-tag>
+
+#use wml::debian::security
+
Index: english/security/2014/dla-53.wml
===================================================================
--- english/security/2014/dla-53.wml	(revision 193)
+++ english/security/2014/dla-53.wml	(working copy)
@@ -1,15 +1,16 @@
 <define-tag description>LTS security update</define-tag>
 <define-tag moreinfo>
-<p>Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal
-encryption subkeys (<a href="https://security-tracker.debian.org/tracker/CVE-2014-5270">CVE-2014-5270</a>).</p>
+<p>It was discovered that APT, the high level package manager, does not
+properly invalidate unauthenticated data (<a
+href="https://security-tracker.debian.org/tracker/CVE-2014-0488">CVE-2014-0488</a>),
+performs incorrect verification of 304 replies (<a
+href="https://security-tracker.debian.org/tracker/CVE-2014-0487">CVE-2014-0487</a>)
+and does not perform the checksum check when the Acquire::GzipIndexes option is used
+(<a href="https://security-tracker.debian.org/tracker/CVE-2014-0489">CVE-2014-0489</a>).</p>
 
-<p>In addition, this update hardens GnuPG's behaviour when treating keyserver
-responses; GnuPG now filters keyserver responses to only accepts those
-keyids actually requested by the user.</p>
-
-<p>For Debian 6 <q>Squeeze</q>, these issues have been fixed in gnupg version 1.4.10-4+squeeze6</p>
+<p>For Debian 6 <q>Squeeze</q>, these issues have been fixed in apt version 0.8.10.3+squeeze3</p>
 </define-tag>
 
 # do not modify the following line
 #include "$(ENGLISHDIR)/security/2014/dla-53.data"
-# $Id: dla-53.wml,v 1.2 2016/04/08 20:32:21 djpig Exp $
+# $Id: $
Index: english/security/2014/dla-54.data
===================================================================
--- english/security/2014/dla-54.data	(nonexistent)
+++ english/security/2014/dla-54.data	(working copy)
@@ -0,0 +1,10 @@
+<define-tag pagetitle>DLA-53-1 gnupg</define-tag>
+<define-tag report_date>2014-9-14</define-tag>
+<define-tag secrefs>CVE-2014-5270</define-tag>
+<define-tag packages>gnupg</define-tag>
+<define-tag isvulnerable>yes</define-tag>
+<define-tag fixed>yes</define-tag>
+<define-tag fixed-section>no</define-tag>
+
+#use wml::debian::security
+
Index: english/security/2014/dla-54.wml
===================================================================
--- english/security/2014/dla-54.wml	(nonexistent)
+++ english/security/2014/dla-54.wml	(working copy)
@@ -0,0 +1,15 @@
+<define-tag description>LTS security update</define-tag>
+<define-tag moreinfo>
+<p>Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal
+encryption subkeys (<a href="https://security-tracker.debian.org/tracker/CVE-2014-5270">CVE-2014-5270</a>).</p>
+
+<p>In addition, this update hardens GnuPG's behaviour when treating keyserver
+responses; GnuPG now filters keyserver responses to only accepts those
+keyids actually requested by the user.</p>
+
+<p>For Debian 6 <q>Squeeze</q>, these issues have been fixed in gnupg version 1.4.10-4+squeeze6</p>
+</define-tag>
+
+# do not modify the following line
+#include "$(ENGLISHDIR)/security/2014/dla-53.data"
+# $Id: dla-53.wml,v 1.2 2016/04/08 20:32:21 djpig Exp $