Re: Status of brk vulnerability in kernel-source-2.4.20-11, 2.4.21-5, 2.4.22-3?
On Wed, Dec 03, 2003 at 05:38:11PM -0500, Nathanael Nerode wrote:
> The security advisory does not mention these (the current 2.4.x kernels
> available in sarge), and the upstream fix is apparently not until 2.4.23.
No offense... but (a) why would the DSA mention Sarge, and (b) isn't it
obvious that the kernels in Sarge are affected, as (1) there has been no
opportunity to move a patched kernel to Sarge, and (2) Sarge doesn't have
security updates in the first place?
It seems to me that all Sarge kernels have the vulnerability, and that you
should proceed on that assumption.
--
Marc Wilson | If there is no God, who pops up the next Kleenex?
msw@cox.net | -- Art Hoppe
Reply to: