[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: ntp security update

On Sun, Oct 25, 2015 at 11:19:03AM +0100, Kurt Roeckx wrote:
> On Sun, Oct 25, 2015 at 01:30:18PM +0900, Ben Hutchings wrote:
> > I've looked through the upstream repository for the patches that fix he
> > recently announced issues.  Quite a few of them turned out not to apply
> > to squeeze, or the newer stable releases, and I've updated the security
> > tracker accordingly.
> > 
> > I backported the remaining fixes as best I can, and uploaded the source
> > package to:
> > https://people.debian.org/~benh/packages/squeeze-lts/
> > 
> > Would you be willing to review this package?
> > 
> > I noticed that you entirely reverted the upstream patch that was
> > supposed to fix CVE-2015-7704 and -7705, and then applied a different
> > fix for -7704.  I think this means -7705 isn't fixed in sid, though the
> > security tracker currently says it is.  Who's right?
> I can't seem to ge getting much information out of anything from
> upstream.  Lots of things don't seem to be affecting the 4.2.6
> version.
> From what I currently understand the following don't apply to the
> 4.2.6 versions:
> CVE-2015-5196

So it seems they renamed CVE-2015-5196 to CVE-2015-7703.  Your
patch probably makes sense and I should get that fixed in jessie
and wheezy too.

I'm just wondering why you didn't move the T_Pidfile like upstream
did, that part seems to apply.

(I have to go now, will look at it later again.)


Reply to: