Accepted quagga 0.99.22.4-1 (source amd64 all)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 24 Oct 2013 22:58:37 +0200
Source: quagga
Binary: quagga quagga-dbg quagga-doc
Architecture: source amd64 all
Version: 0.99.22.4-1
Distribution: unstable
Urgency: high
Maintainer: Christian Hammers <ch@debian.org>
Changed-By: Christian Hammers <ch@debian.org>
Description:
quagga - BGP/OSPF/RIP routing daemon
quagga-dbg - BGP/OSPF/RIP routing daemon (debug symbols)
quagga-doc - documentation files for quagga
Closes: 726724
Changes:
quagga (0.99.22.4-1) unstable; urgency=high
.
* SECURITY:
"ospfd: CVE-2013-2236, stack overrun in apiserver
.
the OSPF API-server (exporting the LSDB and allowing announcement of
Opaque-LSAs) writes past the end of fixed on-stack buffers. This leads
to an exploitable stack overflow.
.
For this condition to occur, the following two conditions must be true:
- Quagga is configured with --enable-opaque-lsa
- ospfd is started with the "-a" command line option
.
If either of these does not hold, the relevant code is not executed and
the issue does not get triggered."
Closes: #726724
.
* New upstream release
- ospfd: protect vs. VU#229804 (malformed Router-LSA)
(Quagga is said to be non-vulnerable but still adds some protection)
Checksums-Sha1:
061471c02b6d21bc26cba7f91aeb06277e6ab65c 1484 quagga_0.99.22.4-1.dsc
73019bf915ff4fe7cd497f11579c05f35fe09df5 2352406 quagga_0.99.22.4.orig.tar.gz
3dee9fe815ff1413af3633e403b21583dba870d4 39688 quagga_0.99.22.4-1.debian.tar.gz
9caccc4b5fa65a93d28ded5f68e50679ec0c115c 1104292 quagga_0.99.22.4-1_amd64.deb
a9f0fbf62ab9a7f78a7fba50b0010e899340cd44 1674196 quagga-dbg_0.99.22.4-1_amd64.deb
ee3f50e27998a295f9c73f687ed0b05fbcf8a08d 656596 quagga-doc_0.99.22.4-1_all.deb
Checksums-Sha256:
55119296a031d02927069f08ee04a0818c482c276fdfcbcdcaecb35f4fb040d5 1484 quagga_0.99.22.4-1.dsc
cbe48d5cc57bbaa07cfd8362ba598447dc94aa866ddc5794e57172709d36ba79 2352406 quagga_0.99.22.4.orig.tar.gz
64e2ca7fc664f606f6ffba38400639a8be05f4d623f43c260a6ba27f6e6f89dc 39688 quagga_0.99.22.4-1.debian.tar.gz
d686471950ecb3edf135df58e3351af7a7e98fc2cbfe94d4cadc2de96e05c608 1104292 quagga_0.99.22.4-1_amd64.deb
c49689d253eac5f76240485a87d73c5131c566af99ceb6db3fd7f6136c8a1f81 1674196 quagga-dbg_0.99.22.4-1_amd64.deb
db1acae350cf7cf35067750c6ddc72244a721753a01e63e77ed3ca78289277a6 656596 quagga-doc_0.99.22.4-1_all.deb
Files:
fc433383b84a5a02b039bde1e4746f41 1484 net optional quagga_0.99.22.4-1.dsc
27ef98abb1820bae19eb71f631a10853 2352406 net optional quagga_0.99.22.4.orig.tar.gz
789744be712f78c2ab9468e9b5eb60cd 39688 net optional quagga_0.99.22.4-1.debian.tar.gz
13a6ef49eacba2e8c32d35fb3f6e97a6 1104292 net optional quagga_0.99.22.4-1_amd64.deb
9eb699ce33657d706a9ffcc3e6eb5f08 1674196 debug extra quagga-dbg_0.99.22.4-1_amd64.deb
234393ba29852f1458fa01ab39bea3fe 656596 net optional quagga-doc_0.99.22.4-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iEYEARECAAYFAlJtk/EACgkQkR9K5oahGObTYwCfVQYzR2TBhXVwGYLINHjO72IK
Q/AAn0Tx+wG4tOZNl/Jv5o5U7A2rGDoM
=hqGQ
-----END PGP SIGNATURE-----
Reply to: