<table cellspacing="0" cellpadding="0" border="0"><tr><td valign="top">Hi Ben,<br><br><div id="yMail_cursorElementTracker_0.43765676603652537">sorry for the late answer, but I need to understand how Oracle will continue to play the Open Source game.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">They generally refuse to give CVE patches.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">Oracle forbids employes to give commit id to Developers who want to cherry-pick a patch for a CVE.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">Months ago Frank (from Oracle) helped us a lot, and now he is on VAC, and nobody so far helped us in fixing the latest CVE in Jessie.</div><div
 id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">Another CVE has been fixed with a patch from a community member in vbox mail list, because my request hasn't been answered from official developers.</div><div id="yMail_cursorElementTracker_0.43765676603652537">(actually the patch was a cherry-pick and it was correct to my checks, and upstream rejected my tweaks, so I applied it as-is)</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">If they want to have the package in Debian they need to learn how to help people in packaging it.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">Vbox developers don't want to have work troubles by giving patches to us, so for now I just asked for a policy exception for Debian.</div><div
 id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">That said I'll probably ask for a removal of virtualbox, if we can't guarantee a CVE free stable version.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">So, sorry for the long mail, but I have no manpower to maintain this huge package if upstram doesn't help me.</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">If somebody want to take a look is free to do, I won't look at it probably for 15 days or more. (I'm really busy with other packages much easier to maintain).</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">(I know you maintain the linux package, I know it is much harder than virtualbox, this
 is why I'll try to fix the package as soon as possible)</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">(sorry for typos and top posting)</div><div id="yMail_cursorElementTracker_0.43765676603652537">cheers,</div><div id="yMail_cursorElementTracker_0.43765676603652537"><br></div><div id="yMail_cursorElementTracker_0.43765676603652537">Gianfranco<br><p><a href="https://overview.mail.yahoo.com/mobile/?.src=Android">Sent from Yahoo Mail on Android</a></p> <hr><table cellspacing="0" cellpadding="0" border="0"> <tbody> <tr> <td valign="top"> <div style="font-family:Roboto, sans-serif;color:#7e7d80;"><b>From</b>:"Ben Hutchings" <benh@debian.org><br><b>Date</b>:Thu, 16 Jul, 2015 at 20:40<br><b>Subject</b>:squeeze update of virtualbox-ose?<br><br></div> <div id="msgSandbox_ACIJDNkAAByGVaf6ow69cCf2RXw" class="msgSandbox" style="padding: 1.5em 0.5em 0.5em 1.2em; word-wrap:
 break-word;">Hello dear maintainer(s),<br><br>the Debian LTS team would like to fix the security issues which are<br>currently open in the Squeeze version of virtualbox-ose:<br><a href="https://security-tracker.debian.org/tracker/CVE-2012-3221" target="_blank">https://security-tracker.debian.org/tracker/CVE-2012-3221</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2013-3792" target="_blank">https://security-tracker.debian.org/tracker/CVE-2013-3792</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2013-5892" target="_blank">https://security-tracker.debian.org/tracker/CVE-2013-5892</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-0404" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-0404</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-0406" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-0406</a><br><a
 href="https://security-tracker.debian.org/tracker/CVE-2014-0407" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-0407</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-0981" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-0981</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-0983" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-0983</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-2486" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-2486</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-2488" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-2488</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2014-2489" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-2489</a><br><a href="https://security-tracker.debian.org/tracker/CVE-2015-2594"
 target="_blank">https://security-tracker.debian.org/tracker/CVE-2015-2594</a><br><br>Would you like to take care of this yourself? We are still understaffed so<br>any help is always highly appreciated.<br><br>If yes, please follow the workflow we have defined here:<br><a href="http://wiki.debian.org/LTS/Development" target="_blank">http://wiki.debian.org/LTS/Development</a><br><br>If that workflow is a burden to you, feel free to just prepare an<br>updated source package and send it to <a ymailto="mailto:debian-lts@lists.debian.org" href="javascript:return">debian-lts@lists.debian.org</a><br>(via a debdiff, or with an URL pointing to the the source package,<br>or even with a pointer to your packaging repository), and the members<br>of the LTS team will take care of the rest. Indicate clearly whether you<br>have tested the updated package or not.<br><br>If you don't want to take care of this update, it's not a problem, we<br>will do our best with your
 package. Just let us know whether you would<br>like to review and/or test the updated package before it gets released.<br><br>Thank you very much.<br><br>Ben Hutchings,<br>  on behalf of the Debian LTS team.<br><br>PS: A member of the LTS team might start working on this update at<br>any point in time. You can verify whether someone is registered<br>on this update in this file:<br><a href="https://anonscm.debian.org/viewvc/secure-testing/data/dla-needed.txt?view=markup" target="_blank">https://anonscm.debian.org/viewvc/secure-testing/data/dla-needed.txt?view=markup</a><br><br><br>-- <br>Ben Hutchings - Debian developer, member of Linux kernel and LTS teams<br></div></td>  </tr>   </tbody>   </table></div></td></tr></table>