Re: Kernel Security Updates for Sarge

[Sven Luther <sven.luther@wanadoo.fr>]

On Thu, May 12, 2005 at 04:04:22PM +0900, Horms wrote:
> On Thu, May 12, 2005 at 03:08:51PM +0900, Horms wrote:
> > Hi Martin,
> > 
> > Steve Langasek asked me to get in contact with you in regards
> > to kernel security updates for sarge. I am happy to report
> > that I and other members of the kernel team have been keeping
> > the kernel-source for both 2.4.27 and 2.6.8 up to date in SVN.
> > And as of yesterday afternoon I have no outstanding security
> > bugs for either.
> 
> ... had no outstanding secuirty issues. 
> 
> I just noticed CAN-2005-1263, otherwise known as Bug #308724 and #308634
> I will work on getting this into SVN asap. I believe it applies
> to both 2.4.27 and 2.6.8, although I have not investigated.
> 
> There is also a quite severe problem with the header packages
> on powerpc, Sven Luther is working on a fix for this. When I say
> severe, I understand that they are completely broken.
> I think this applies to both 2.4.27 and 2.6.8. See Bug #308639.

Well, not broken, they just can't be used to build third party modules with
them.

Fix is trivial, and only involves adding a couple of symlinks in the right
place, no change to the binaries at all. In the extreme case, it could be
fixed by using an external package depending on both kernel-headers and
kernel-build and putting the symlink there, or with an errata giving the
script used to fix this issue.

Friendly,

Sven Luther