[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Accepted fuse 2.8.4-1.1+deb6u1 (source amd64) into squeeze-lts

Hi László,

On  Fr 05 Jun 2015 21:03:03 CEST, László Böszörményi (GCS) wrote:

Hi all,

On Thu, Jun 4, 2015 at 11:18 AM, Mike Gabriel
<mike.gabriel@das-netzwerkteam.de> wrote:
On  Mi 03 Jun 2015 16:12:19 CEST, Holger Levsen wrote:
On Dienstag, 2. Juni 2015, Laszlo Boszormenyi wrote:
Source: fuse
Version: 2.8.4-1.1+deb6u1

there was no DLA for this upload, could you please prepare one and send it
the list?! Thanks already.
 You mean to debian-lts-announce, right?

Let me know if you need a hand with this.
 Please review the following, I'm open for suggestions.
-- cut --
Subject: [DLA 238-1] fuse security update

Package        : fuse
Version        : 2.8.4-1.1+deb6u1
CVE ID         : CVE-2015-3202
Debian Bug     : #786439

Tavis Ormandy discovered that FUSE, a Filesystem in USErspace, does not
scrub the environment before executing mount or umount with elevated
privileges. A local user can take advantage of this flaw to overwrite
arbitrary files and gain elevated privileges by accessing debugging
features via the environment that would not normally be safe for
unprivileged users.

For the old-oldstable distribution (squeeze-lts), this problem has been fixed
in version 2.8.4-1.1+deb6u1.

We recommend that you upgrade your fuse packages.

The announcement is ok. But...

Please request the DLA (here DLA-238-1) via bin/genDLA and immediately commit the resulting change to the secure-testing SVN repo. Once the DLA has been securely requested and has been documented in SVN, you can take your time with writing the announcement mail.

Santiago and I recently had the issue that we sent out mails for the same DLA and both committed the change to secure-testing SVN _after_ sending. Which caused some confusion.

At the moment DLA 238-1 is still available in secure-testing SVN, so please commit the change to secure-testing SVN asap and only then go ahead with sending your announcement mail.


mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de


Attachment: pgpVsZor6jegy.pgp
Description: Digitale PGP-Signatur

Reply to: