Please backport wesnoth 1.2.8-1 from Hardy. Fixes 3 CVEs

[Emilio Pozuelo Monfort]

Please backport wesnoth 1.2.8-1 from Hardy.

feisty-backports has version 1.2.5, which is vulnerable to 3 CVEs.

https://bugs.edge.launchpad.net/bugs/cve/2007-3917
https://bugs.edge.launchpad.net/bugs/cve/2007-5742
https://bugs.edge.launchpad.net/bugs/cve/2007-6201

Thanks.

[Jérôme Guelfucci (jerome-guelfucci-deactivatedaccount)]

I asked for the sync of the next release of wesnoth (bug #175068), we could wait until it's done.

[Emilio Pozuelo Monfort (pochu)]

No need to wait, as it won't be synced, since 1.3.x is unstable.

I'd appreciate (well, not me, but backports users) a backport of 1.2.8.

Thanks

[Jérôme Guelfucci (jerome-guelfucci-deactivatedaccount)]

To apologize I tested the build and install :) , everything works fine and the saved missions seem to work. It's safe to backport this.

[Jérôme Guelfucci (jerome-guelfucci-deactivatedaccount)]

I also forgot to say I also tested for Gutsy, and everything is fine.

[Emilio Pozuelo Monfort (pochu)]

Thanks Jérôme for the testing!

I've opened the Edgy request here, let's track all of them in the same bug.

[Jérôme Guelfucci (jerome-guelfucci-deactivatedaccount)]

i can't test for edgy as I don't have it anymore :)

[Scott Kitterman (kitterman)]

The CVEs must be fixed in -security uploads not via backports unless someone can convince me it's impossible.

[Jérôme Guelfucci (jerome-guelfucci-deactivatedaccount)]

Scott Kitterman: even if the CVEs are in the backported package ? (1.2.5 is in feisty backports) I thought -security was for packages that were in the main-universe-multiverse archive.

[Scott Kitterman (kitterman)]

Sorry. Missed that they were already fixed.

[Scott Kitterman (kitterman)]

Ack from ubuntu-backporters for Feisty.

[Scott Kitterman (kitterman)]

Ack from ubuntu-bakcporters for Gutsy.

[Jonathan Riddell (jr)]

 * Trying to backport wesnoth...
  - <wesnoth_1.2.8.orig.tar.gz: downloading from librarian>
  - <wesnoth_1.2.8-1.diff.gz: downloading from librarian>
  - <wesnoth_1.2.8-1.dsc: downloading from librarian>
I: Extracting wesnoth_1.2.8-1.dsc ... done.
I: Building backport of wesnoth-1.2.8 as 1:1.2.8-1~feisty1 ...

[Jonathan Riddell (jr)]

 * Trying to backport wesnoth...
  - <wesnoth_1.2.8.orig.tar.gz: downloading from librarian>
  - <wesnoth_1.2.8-1.diff.gz: downloading from librarian>
  - <wesnoth_1.2.8-1.dsc: downloading from librarian>
I: Extracting wesnoth_1.2.8-1.dsc ... done.
I: Building backport of wesnoth-1.2.8 as 1:1.2.8-1~gutsy1 ...

[Martin Pitt (pitti)]

Unsub'ing ubuntu-archive. Please resubscribe if/when edgy gets ack'ed.

[Michael Casadevall (mcasadevall)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

status invalid
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: http://getfiregpg.org

iEYEARECAAYFAkiyPv4ACgkQpblTBJ2i2pt2tACeKMfuWXBOwHbH3Qnw3VMqFioX
H8AAnjrzHUYmv2SNyCUndmYV0zT4pK0d
=hA6P
-----END PGP SIGNATURE-----