add CVE-2014-7206 to 1.0.9.2
methods/rsh.cc: replace strcat with std::string

Instead of using strcat use a C++ std::string to avoid overflowing
this buffer. Thanks to David Garfield

Closes: #76442
Update Status field values handling

Remove long obsolete (hold, hold-reinstreq, removal-failed) or just
wrong (post-inst-failed vs postinst-failed) values, that have been
autoconverted by dpkg at run-time to their new equivalents, so there
should not be any such instance in any recent system (removal-failed
since dpkg 1.1.4 in Apr 1996, hold and hold-reinstreq since dpkg
1.2.0 in May 1996). dpkg even stopped doing the mapping in 1.15.4
and 1.15.8 respectively.

At the same time sort the list in the same order as they appear in
the dpkg code.
don't cleanup cdrom files in apt-get update

Regression from merging 801745284905e7962aa77a9f37a6b4e7fcdc19d0 and
b0f4b486e6850c5f98520ccf19da71d0ed748ae4. While fine by itself, merged
the part fixing the filename is skipped if a cdrom source is
encountered, so that our list-cleanup removes what seems to be orphaned
files.

Closes: 765458
releasing package apt version 1.0.9.3