Re: [Fwd: Shotwell update]

[Michael Catanzaro <mcatanzaro gnome org>]

On Wed, 2016-01-06 at 10:50 -0600, Michael Catanzaro wrote:
> Hi distributors,
>
> You may want to consider packaging a git snapshot of Shotwell. See
> the
> attached message.
>
> Michael

Perhaps my language in this mail was not strong enough, as I see most
major distributors have not issued Shotwell updates. This is a severe
issue affecting the security of your users' accounts on Facebook,
Google, Flickr, and various other online services, and you really ought
to update to a git snapshot of Shotwell. (Shotwell is unmaintained and
nobody plans to do further releases.)

This issue has been assigned DWF-2016-89001. DWF is a new project
releasing CVE-compatible vulnerability identifiers in response to
recent difficulties in receiving CVE allocations. I have yet to receive
a response to my CVE request for this issue despite three months of
waiting.

If one representative from each distro on this list could please
respond privately to this mail, that would be great, as I am curious to
see which distros are following this list.

Michael