CVE-2015-0859 arbitrary code execution

[Matt Johnston]

It looks like the Ubuntu package needs the fix from https://www.debian.org/security/2015/dsa-3405

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "smokeping_2.6.8-2+deb7u1.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Tyler Hicks (tyhicks)]

Hi Matt - Thanks for the bug report. Unfortunately, the debdiff is simply the Debian debdiff and not a proper debdiff for the smokeping packages in the various Ubuntu stable releases. This means that the debdiff doesn't apply and, because of that, it means that there's been no testing of this debdiff applied against the Ubuntu smokeping packages.

Please see this wiki page for information on preparing a set of debdiffs for Ubuntu:

  https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging

Once that is done, please perform testing and then resubscribe ubuntu-security-sponsors to this bug and set the status to 'NEW'. Also, please mention the testing that you performed.

Thank you!