unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
From: Marius Bakke <mbakke@fastmail.com>
To: Leo Famulari <leo@famulari.name>, guix-devel@gnu.org
Subject: Re: Tcpdump security update
Date: Mon, 30 Jan 2017 21:11:56 +0100	[thread overview]
Message-ID: <871svk1f5f.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> (raw)
In-Reply-To: <20170130200302.GA27562@jasmine>

[-- Attachment #1: Type: text/plain, Size: 1004 bytes --]

Leo Famulari <leo@famulari.name> writes:

> I communicated with the tcpdump team and verified that the Debian
> tarball provides the same data (same SHA256 hash) as what's provided
> directly by upstream. But the upstream link is still considered private
> so I'm using the Debian source URL as a courtesy.

Thanks for doing that! Please add a comment with the Debian URL
specifying that it's temporary due to this fix. Otherwise LGTM.

> The Debian security advisory is here:
>
> https://www.debian.org/security/2017/dsa-3775
> From 06b23b7747dedf6fc2386b3fc86bc459999ffa88 Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Mon, 30 Jan 2017 14:50:23 -0500
> Subject: [PATCH] gnu: tcpdump: Update to 4.9.0 [security fixes].
>
> Fixes CVE-2016-{7922,7923,7924,7925,7926,7927,7928,7929,7930,7931,7932,7933
> 7934,7935,7936,7937,7938,7939,7940,7973,7974,7975,7983,7984,7985,7986,7992,7993,
> 8574,8575} and CVE-2017-{5202,5203,5204,5205,5341,5342,5482,5483,5484,5485,
> 5486}.

Wow!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

  reply	other threads:[~2017-01-30 20:12 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-30 20:03 Tcpdump security update Leo Famulari
2017-01-30 20:11 ` Marius Bakke [this message]
2017-01-30 20:16 ` Marius Bakke
2017-01-30 20:51   ` Leo Famulari

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=871svk1f5f.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me \
    --to=mbakke@fastmail.com \
    --cc=guix-devel@gnu.org \
    --cc=leo@famulari.name \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).