+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508392 508392]
+in [http://packages.debian.org/lenny/dpkg dpkg]
+"Handling of conflicting conffiles broken"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508565 508565]
+in [http://packages.debian.org/lenny/f2c f2c]
+"f2c: does not translate properly in EMT64 machines"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508551 508551]
+in [http://packages.debian.org/lenny/merkaartor merkaartor]
+"merkaartor: crash on startup: QPaintEngine::setSystemClip: Should not be change
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502845 502845]
+in [http://packages.debian.org/lenny/open-iscsi open-iscsi]
+"open-iscsi: no login using amd64"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508589 508589]
+in [http://packages.debian.org/lenny/linux-2.6 linux-2.6]
+"ppp: USB Modem removal after PPP exits kills keyboard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508635 508635]
+in [http://packages.debian.org/lenny/libexif-gtk-dev libexif-gtk-dev]
+"libexif-gtk-dev: References no longer existing libXcursor.la"
+
+= Mostly solved? =
+
+These look like good progress is being made and they'll get fixed
+soon. Do we need a DD to do an NMU on any of these?
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504283 504283]
+in [http://packages.debian.org/lenny/egroupware-core egroupware-core]
+"CVE-2007-3215: phpmailer issue (embedded code-copy)"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507316 507316]
+in [http://packages.debian.org/lenny/smarty smarty]
+"smarty: Non-free logo included in package"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=332782 332782]
+in [http://packages.debian.org/lenny/release-notes release-notes]
+"release-notes: Where's the license?"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475958 475958]
+in [http://packages.debian.org/lenny/release-notes release-notes]
+"document procedure to recover from "/dev/hda became /dev/sda" boot failure"
+[[BR]](Note: looks done, just not closed.)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506883 506883]
+in [http://packages.debian.org/lenny/tuxguitar tuxguitar]
+"tuxguitar: hard-codes dependencies on libraries"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495178 495178]
+in [http://packages.debian.org/lenny/libjs-jquery libjs-jquery]
+"libjs-jquery: Should compile jquery.min.js and jquery.pack.js from jquery.js"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507059 507059]
+in [http://packages.debian.org/lenny/initramfs-tools initramfs-tools]
+"initramfs-tools: Wrong check for udevadm in functions"
+[[BR]](No maintainer activity since it was reported 2 weeks ago; One-line patch attached.)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496334 496334]
+in [http://packages.debian.org/lenny/mdadm mdadm]
+"mdadm segfault on --assemble --force with raid10"
+[[BR]]Seems to be fixed and uploaded, but got reopened for some reason?
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374644 374644] in [http://packages.debian.org/lenny/xine-ui xine-ui]
+"xine-ui: ctrl/shift key press emulation implementation broken"
+[[BR]](Note: There's a patch that may be good enough -- blocking on some guy responding)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505237 505237]
+in [http://packages.debian.org/lenny/snmpd snmpd]
+"/etc/init.d/snmpd start reports error if already running"
+(Note: fixed, waiting on an upload?)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508257 508257]
+in [http://packages.debian.org/lenny/twiki twiki]
+"CVE-2008-5305: TWiki SEARCH variable allows arbitrary shell command execution"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508026 508026]
+in [http://packages.debian.org/lenny/phppgadmin phppgadmin]
+"phpPgAdmin: Local File Inclusion Vulnerability"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501800 501800]
+in [http://packages.debian.org/lenny/bind9 bind9]
+"bind9: bind crashes with a list for allow-update"
+
+
+= Not much of use one can do =
+
+(this one looks like it'll be removed from Lenny or have amd64 disabled)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507021 507021]
+in [http://packages.debian.org/lenny/helpdeco helpdeco]
+"Fails to work on amd64"
+
+(this one looks the maintainer has labeled unreproducible)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507242 507242]
+in [http://packages.debian.org/lenny/amule-daemon amule-daemon]
+"amule-daemon: causes OOM's by leaking lots of memory"
+
+(waiting on upstream)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506652 506652]
+in [http://packages.debian.org/lenny/xml2rfc xml2rfc]
+"Yet another boilerplate change"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490999 490999]
+in [http://packages.debian.org/lenny/libqt3-mt libqt3-mt]
+"kicker: crashes on startup"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507947 507947]
+in [http://packages.debian.org/lenny/moodle moodle]
+"moodle: html2text.php is not DFSG-free"
+
+(misc)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508091 508091]
+in [http://packages.debian.org/lenny/tuxguitar tuxguitar]
+"maintainer address bounces"
+
+(legal issue involving non-free file)
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502751 502751]
+in [http://packages.debian.org/lenny/clamav-getfiles clamav-getfiles]
+"clamav-getfiles: piuparts test fails: eicar.com md5sum mismatch, file needs downloading"
+
+= Flamewars =
+
+You might enjoy reading these, but they may not be good targets to fix.
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475737 475737]
+in [http://packages.debian.org/lenny/otrs2 otrs2]
+"otrs2 - makes files in /usr writable by non-root"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504771 504771]
+in [http://packages.debian.org/lenny/wordpress wordpress]
+"wordpress can be subject of delayed attacks via cookies"
+
+For this one, the actual flameware is off the bug report log.
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497823 497823]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"longstanding DFSG violations in linux-2.6 package"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504747 504747]
+in [http://packages.debian.org/lenny/gnu-fdisk gnu-fdisk]
+"gnu-fdisk: wipes out MBR when used on GPT partitions"
+
+= Would have been fun =
+
+Entertaining to read but sadly already fixed.
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506961 506961]
+in auctex
+"auctex: reuses old logfile on emacsen upgrades, enabling symlink attack"
+
+
+= Special team bugs =
+
+These bugs are probably not good targets because the work involved with them at this point is to be done by someone on a special Debian team.
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=451628 451628]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"Packages might enter the archive from security without source"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506152 506152]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libept0 should have priority important"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507675 507675]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"python2.5 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507678 507678]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libsqlite3-0 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507775 507775]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libkeyutils1 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507778 507778]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libldap-2.4-2 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507779 507779]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"[Priorities] libustr-1.0-1 -> standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507780 507780]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"python-sepolgen should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507783 507783]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libxml2 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507784 507784]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"python2.5-minimal should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507796 507796]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libisccfg40 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507797 507797]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libisccc40 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507798 507798]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libedit2 should have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507799 507799]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libgssglue1 must have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507800 507800]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"ucf must have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507801 507801]
+in [http://packages.debian.org/lenny/ftp.debian.org ftp.debian.org]
+"libpci3 must have priority standard"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497471 497471]
+in [http://packages.debian.org/lenny/cdimage.debian.org cdimage.debian.org]
+"sarge images have syslinux binaries without source"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506977 506977]
+in [http://packages.debian.org/lenny/release.debian.org release.debian.org]
+"FPC: copyright infringement in pre 2.2.2 sources"
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507239 507239]
+in [http://packages.debian.org/lenny/release.debian.org release.debian.org]
+"RM: astrolog/stable -- RoQA; orphaned long time, non-free, contains potentially undistributable code"
+
+This one is fixed in experimental:
+
+[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503907 503907]
+in [http://packages.debian.org/lenny/libwebkit-1.0-1 libwebkit-1.0-1]
+"epiphany-webkit: Crashes at startup whenever I go to a site."