From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marius Bakke Subject: Re: Tcpdump security update Date: Mon, 30 Jan 2017 21:11:56 +0100 Message-ID: <871svk1f5f.fsf@kirby.i-did-not-set--mail-host-address--so-tickle-me> References: <20170130200302.GA27562@jasmine> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:51642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cYIJ1-0002t5-Fe for guix-devel@gnu.org; Mon, 30 Jan 2017 15:12:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cYIIy-0003xX-A2 for guix-devel@gnu.org; Mon, 30 Jan 2017 15:12:03 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:37711) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cYIIy-0003xG-3Y for guix-devel@gnu.org; Mon, 30 Jan 2017 15:12:00 -0500 In-Reply-To: <20170130200302.GA27562@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari , guix-devel@gnu.org --=-=-= Content-Type: text/plain Leo Famulari writes: > I communicated with the tcpdump team and verified that the Debian > tarball provides the same data (same SHA256 hash) as what's provided > directly by upstream. But the upstream link is still considered private > so I'm using the Debian source URL as a courtesy. Thanks for doing that! Please add a comment with the Debian URL specifying that it's temporary due to this fix. Otherwise LGTM. > The Debian security advisory is here: > > https://www.debian.org/security/2017/dsa-3775 > From 06b23b7747dedf6fc2386b3fc86bc459999ffa88 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Mon, 30 Jan 2017 14:50:23 -0500 > Subject: [PATCH] gnu: tcpdump: Update to 4.9.0 [security fixes]. > > Fixes CVE-2016-{7922,7923,7924,7925,7926,7927,7928,7929,7930,7931,7932,7933 > 7934,7935,7936,7937,7938,7939,7940,7973,7974,7975,7983,7984,7985,7986,7992,7993, > 8574,8575} and CVE-2017-{5202,5203,5204,5205,5341,5342,5482,5483,5484,5485, > 5486}. Wow! --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAliPngwACgkQoqBt8qM6 VPrBMQgAqeP0waVG8kvQzbVZMjayHq/q9T8O4zwL9FooGMyTe1ODOtdoauwHgLKf DyAOg2MeYxG0KcVVDr2dkS4w4mR1A60dOqusN/mRMdfWJXZGvZaXkaE9ANoK7rWv oiwQXBznJAu6KlN3FnZTVL9FDmSoEB0yc/iH5kubLg9vNL0bYI2durjR/Cqj1nOO 0ABFjThNCQuq5wZF71PCcIj0x4+FlQUadIsu8BU3LrY9/PYwtFWSGH1iRgIRed2I Re8lx0GYpsXV5O51aVS0QzWmgY+Q2Wo5xuzCAY1CmeVxgyHLJjJwPokt8hhvpM+j 6ULR9i5jzndCow247XLnphoAarhmRg== =fKY0 -----END PGP SIGNATURE----- --=-=-=--