My Free Software Activities in December 2018

Welcome to Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

  • I used this month to polish some of my team-maintained packages and to slightly improve the debian packaging in openyahtzee, monopd, opencity, pangzero, powermanga, ri-li, tecnoballz, whichwayisup, atanks, ufoai and dreamchess.
  • I fixed RC bug #915453 in supertuxkart.
  • I released a new version of debian-games,  a collection of metapackages to ease the installation of games in Debian. I plan to do another update in January. This one will then almost be the final state for Buster but there is usually another last minor update during deep freeze to include even the latest changes.
  • I also packaged a new upstream version of enemylines3, which was merely a bug fix release though. Nevertheless I could drop two Debian patches. Yeah.

Debian Java


  • I updated osmo, tofrodos and iftop and applied a patch by Andreas Henriksson for wbar to  fix a reproducibility issue on merged-usr systems.
  • The browser extension privacybadger was updated to version 2018.12.17.
  • I prepared a security update of libarchive for Stretch released as DSA-4360-1.
  • I reported a FTBFS that got recently fixed in moria. (#916030)


Debian LTS

This was my thirty-fourth month as a paid contributor and I have been paid to work 30 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

  • From 17.12.2018 until 06.01.2019 I was in charge of our LTS frontdesk. I investigated and triaged CVE in graphiscmagick, sqlite3, libvncserver, pspp, yara, terminology, sssd, libarchive, freecol, rabbitmq-server, hoteldruid, libraw, nagios3, gnupg2, igraph, python3.4, radare2, imagemagick, tar, poppler, tcpreplay,  libcaca, binutils, liblas, mxml, jasper, aria2, systemd, libpff, libsixel, libspring-security-2.0-java, nasm, yaml-cpp and yaml-cpp0.3.
  • DLA-1630-1. I triaged and investigated 39 CVE in libav. Later I issued a security update for libav fixing 14 of them.
  • DLA-1612-1. Issued a security update for libarchive fixing 2 CVE.
  • DLA-1615-1. Issued a security update for nagios3 fixing 5 CVE.
  • DLA-1616-1. Issued a security update for libextractor fixing 2 CVE.
  • DLA-1628-1. Issued a security update for jasper fixing 8 CVE (announced 9). It turned out that CVE-2018-19139 has not been fixed yet.


Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my seventh month and I have been paid to work 15 hours on ELTS.

  • I was in charge of our ELTS frontdesk from 17.12.2018 until 06.01.2019 and I triaged CVE in libarchive, gnutls26, rabbitmq-server, binutils, wget, tar, krb5, jasper and systemd.
  • ELA-72-1. Issued a security update for jasper fixing 5 CVE. I analyzed the remaining open issues, prepared patches myself and forwarded them upstream.
  • ELA-73-1. Issued a security update for libcaca fixing 4 CVE.
  • ELA-74-1. Issued a security update for sqlite3 fixing 3 CVE.

Thanks for reading and see you next time.

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert.

Diese Website verwendet Akismet, um Spam zu reduzieren. Erfahre mehr darüber, wie deine Kommentardaten verarbeitet werden.