Re: stable vs. testing: same versions, different status
On Sat, 4 Jul 2009 17:33:08 +0200 Francesco Poli wrote:
> I was going to file an RC bug against linux-2.6 for the following 7
> vulnerabilities that are fixed in testing, but not in unstable,
> according to the security tracker:
>
> http://security-tracker.debian.net/tracker/CVE-2009-1758
> http://security-tracker.debian.net/tracker/CVE-2009-1633
> http://security-tracker.debian.net/tracker/CVE-2009-1630
> http://security-tracker.debian.net/tracker/CVE-2009-1338
> http://security-tracker.debian.net/tracker/CVE-2009-1242
> http://security-tracker.debian.net/tracker/CVE-2009-0835
> http://security-tracker.debian.net/tracker/CVE-2009-0834
>
> However, while reviewing the CVE descriptions on http://cve.mitre.org/,
> I noticed that all of them seem to only affect Linux kernel upstream
> versions < 2.6.30.
>
> Could someone check that linux-2.6/2.6.30-1 (currently in unstable) is
> really fixed w.r.t. to the above-mentioned CVEs and possibly update the
> security tracker to reflect reality?
this kind of triage would really help out the kernel-sec team, but i
don't think i'll be able to find the time to do it myself soon. it
would be great if you could help out with this. it should be fairly
straightforward:
1. download the debian kernel source package from unstable
2. find the relevant patch (this is the diff link on the git.kernel.org
page linked from the mitre CVE page)
3. compare patch to debian kernel source and make sure that it is
present
4. file RC bugs for unfixed issues and send a message with your findings
mike
Reply to: