From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kei Kebreau Subject: Re: [PATCH 0/1] Dbus update 1.10.12 for core-updates Date: Mon, 10 Oct 2016 14:10:24 -0400 Message-ID: <871szohy7j.fsf@openmailbox.org> References: Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48700) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1btf2E-0001L5-Jc for guix-devel@gnu.org; Mon, 10 Oct 2016 14:10:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1btf2B-0003K2-9O for guix-devel@gnu.org; Mon, 10 Oct 2016 14:10:46 -0400 Received: from mail2.openmailbox.org ([62.4.1.33]:50463) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1btf2B-0003Im-0C for guix-devel@gnu.org; Mon, 10 Oct 2016 14:10:43 -0400 In-Reply-To: (Leo Famulari's message of "Mon, 10 Oct 2016 13:44:16 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Leo Famulari writes: > There's a format string vulnerability (with unknown impact) in our dbus: > > http://seclists.org/oss-sec/2016/q4/85 > > Please read that message and the linked bug report. > > My understanding of the upsream analysis of the format string > vulnerability is that only the bus owner can trigger it. So, if the > vulnerability allows arbitrary code execution, it would mean that root > could execute arbitrary code via the system bus... not a huge problem. > But still undesirable. > > What do you think? Should we update this on core-updates? Should we > graft it on master? > > Leo Famulari (1): > gnu: dbus: Update to 1.10.12. > > gnu/packages/glib.scm | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) Excuse my ignorance, but when is a patch considered significant enough to be updated on core-updates instead of master? Put another way, what is the purpose of core-updates? --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJX+9mQAAoJEOal7jwZRnoNrX0P/iImWIWRJz2yMIcGnyqRi/gN hnTRUVYoYSsdDG+sYlpKwX6I5KqdOFYtZAVqS5dI+8fFE5qFcpupDUo9dPkfhIgu a/g3CesBz3jEKYpppQcGAXcOxsWRJXq+X3NTtBfLSJ0KAM7wAv67MXEseRs1uDK7 QLjYZHWoyiZ8q/1LVPjkoOS3pkODnEtohDf7Nf2MGpUBs8dVfbgVPR68pYQgoq6I hrEPw8TqsTn/Y/e2WQlcM7Itq2IVWV49uB7Q6t0f5KoqH3iw3QSha5aGSLtDxUQ+ nniId+CJeQX5ilOE+ibUxDBMRFCy6/RcjambIK4aQ7gd229Ru7OQLPVe/9WxqKVz mLGb7Pr3olFyV/TkqplNgLZJ/5cU3hK9a/r1vdRkkaU3D2DF2jZGidt7LpfTSaqe W0Ew6LhVX1gqTv3ctLjr8s/02+x7WTaK4t/Ju57htpVZ1rtBrXtyXRnPssGPSXOI O+usEvVSnekQPgjYfxbrKJyvaZh9Kc9z15zScTjwFAndHcQooeelSq1LhjU0FOZH jvt1qxTUhbDtoJMt2/wwr1LDKXWzoF9E7zNMHGO6I8Acq9SGNjruZcRgXse9EpFp h4Calnjzr7rYeINfbSvCAEzYHuAYVTpaJ2rvcsPRXBbuZEE40l5qezjkOBK6p8ul PPUHalQge6NPc9qcmqHn =lVJX -----END PGP SIGNATURE----- --=-=-=--