Bug#811277: kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01]

To: submit@bugs.debian.org
Subject: Bug#811277: kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01]
From: Steven Chamberlain <steven@pyro.eu.org>
Date: Sun, 17 Jan 2016 15:41:58 +0000
Message-id: <[🔎] 20160117154157.GA89333@pyro.eu.org>
Reply-to: Steven Chamberlain <steven@pyro.eu.org>, 811277@bugs.debian.org

Package: src:kfreebsd-10
Version: 10.1~svn274115-4+kbsd8u1
Severity: grave
Tags: security upstream                                                                                           
Control: found -1 10.1~svn274115-10

Specially crafted SCTP packets via IPv6 can trigger remote denial of
service in kfreebsd-10, even if SCTP sockets are not used.

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:01.sctp.asc

SCTP is disabled in wheezy's latest kfreebsd-9 package, otherwise it
would have been affected by this too.

Reply to:

Follow-Ups:
- Processed: kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01]
  - From: owner@bugs.debian.org (Debian Bug Tracking System)
- Bug#811277: marked as done (kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01])
  - From: owner@bugs.debian.org (Debian Bug Tracking System)

Prev by Date: Bug#811238: FTBFS: error: ld returned 1 exit status
Next by Date: Processed: kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01]
Previous by thread: Bug#811238: FTBFS: error: ld returned 1 exit status
Next by thread: Processed: kfreebsd-10: CVE-2016-1879: SCTP ICMPv6 error message vulnerability [SA-16:01]
Index(es):
- Date
- Thread