Comment 1 Quality Assurance 2020-04-20 10:00:17 CEST

--- mirror/ftp/4.4/unmaintained/4.4-4/source/git_2.11.0-3+deb9u5.dsc
+++ apt/ucs_4.4-0-errata4.4-4/source/git_2.11.0-3+deb9u6.dsc
@@ -1,3 +1,63 @@
+1:2.11.0-3+deb9u6 [Sun, 12 Apr 2020 17:49:00 -0700] Jonathan Nieder <jrnieder@gmail.com>:
+
+  [ Salvatore Bonaccorso ]
+  * Apply patches from 2.20.3 to address the security issue
+    CVE-2020-5260.
+
+    With a crafted URL that contains a newline, the credential
+    helper machinery can be fooled to supply credential information
+    for the wrong host.  The attack has been made impossible by
+    forbidding a newline character in any value passed via the
+    credential protocol.
+
+    Thanks to Felix Wilhelm of Google Project Zero for finding
+    this vulnerability and Jeff King for fixing it.
+
+  [ Jonathan Nieder ]
+  * Apply security-relevant changes from 2.11.1:
+    * doc: mention transfer data leaks in more places (thx to Matt
+      McCutchen).
+    * remote-curl: don't hang when a server dies before any output
+      (thx to David Turner).
+    * merge: avoid crlf handling related NULL dereference (thx to
+      Markus Klein and Johannes Schindelin).
+    * http: avoid private repository theft by mixing repositories
+      (thx to Jann Horn of Google Project Zero).
+    * avoid under-allocation in shallow clone code (thx to Rasmus
+      Villemoes).
+    * git-svn: allow "0" in SVN path components (thx to Eric Wong).
+    * config: handle errors from fstat (thx to Josh Bleecher Snyder
+      and Nguyễn Thái Ngọc Duy).
+    * git_exec_path: do not return the result of getenv (thx to Jeff
+      King).
+  * Apply security-relevant changes from 2.12.1, 2.12.2, 2.12.3:
+    * show-branch: avoid buffer overflow on long current branch name
+      (thx to Jeff King).
+    * ident: handle NULL email when complaining of empty name (thx to
+      Jeff King).
+    * log -L: use COPY_ARRAY to fix mis-sized memcpy on ILP32 systems
+      (thx to Vegard Nossum).
+    * dumb http: fix buffer underflow processing remote alternates
+      (thx to Jeff King).
+    * log -S: avoid out-of-bounds read with -S --pickaxe-regex (thx
+      to SZEDER Gábor).
+  * Apply security- and portability-relevant changes from 2.13.1,
+    2.13.3, 2.13.4:
+    * checkout, am: avoid NULL pointer dereference when HEAD is
+      invalid (thx to René Scharfe).
+    * pack-bitmap: don't perform unaligned memory access (thx to
+      James Clarke).
+    * apply: avoid out of bounds reads when processing malformed
+      patches (thx to Vegard Nossum and René Scharfe).
+    * log -g: avoid use-after-free when reading empty reflog in
+      date order (thx to Jeff King).
+  * Apply security-relevant changes from 2.14.3:
+    * avoid reading uninitialized memory when HEAD is too short
+      (thx to Jeff King).
+    * fsck: avoid NULL pointer dereference when encountering
+      objects of unexpected type (thx to SZEDER Gábor and René
+      Scharfe).
+
 1:2.11.0-3+deb9u5 [Tue, 10 Dec 2019 08:14:58 +0000] Jonathan Nieder <jrnieder@gmail.com>:
 
   * Apply patches addressing the security issues CVE-2019-1348,

<http://10.200.17.11/4.4-4/#748036788755847658>

Comment 2 Erik Damrose 2020-04-21 09:22:08 CEST

OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

Comment 3 Erik Damrose 2020-04-22 15:30:51 CEST

<http://errata.software-univention.de/ucs/4.4/529.html>