[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Audit of Debian/Ubuntu for unfixed vulnerabilities because of embedded code copies

On Mon, July 2, 2012 13:38, Silvio Cesare wrote:
> On Mon, Jul 2, 2012 at 8:27 PM, Bernd Zeimetz <bernd@bzed.de> wrote:

>> The ia32-libs stuff are all false positives (assuming the package was
>> updated after the security fixes came out, I'm not 100% sure about that
>> :) And the openssl source is expected to contain the openssl source.

> Last I checked, ia32-libs on squeeze didn't have the openssl patches for
> 0.9.8. I may have to check more thoroughly to be sure.

Yes. ia32-libs is usually only updated shortly before stable point
releases, so there's commonly a small delta of security updates that have
not been incorporated into it, yet. This is hence 'expected'.


Reply to: