From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38242) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMMFx-0001vC-JV for guix-patches@gnu.org; Tue, 05 Dec 2017 18:04:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eMMFu-00058C-Et for guix-patches@gnu.org; Tue, 05 Dec 2017 18:04:05 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:39531) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1eMMFu-00057z-Be for guix-patches@gnu.org; Tue, 05 Dec 2017 18:04:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1eMMFu-0008M3-0A for guix-patches@gnu.org; Tue, 05 Dec 2017 18:04:02 -0500 Subject: [bug#29490] [PATCH] Revert "gnu: glibc: Fix CVE-2017-15670, CVE-2017-15671." Resent-Message-ID: From: Marius Bakke In-Reply-To: <87374pe8kk.fsf@gnu.org> References: <20171128170937.31110-1-mbakke@fastmail.com> <87374pe8kk.fsf@gnu.org> Date: Wed, 06 Dec 2017 00:03:39 +0100 Message-ID: <87zi6wydys.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: Ludovic =?UTF-8?Q?Court=C3=A8s?= Cc: 29490@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ludovic Court=C3=A8s writes: > Hello, > > Marius Bakke skribis: > >> These issues has been classified as minor by Debian: >> >> https://security-tracker.debian.org/tracker/CVE-2017-15670 >> https://security-tracker.debian.org/tracker/CVE-2017-15671 >> >> ...and is not worth the cost of grafting and maintaining this patch. > > I don=E2=80=99t see Debian=E2=80=99s classification as =E2=80=9Cminor=E2= =80=9D, but I see NVD severity > =E2=80=9Chigh=E2=80=9D and =E2=80=9Cmedium=E2=80=9D (I personally fail to= imagine concrete remote > exploitation scenarios, but I largely lack the mental muscles for this.) At the bottom of the page is the status for the stable releases, which didn't get a DSA due to being a minor issue. The recent update of glibc on core-updates included a fix for a similar problem: https://security-tracker.debian.org/tracker/CVE-2017-15671 I suppose we can graft that too, but would prefer to just drop them. We get the fixes when we merge core-updates in a few weeks anyway. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlonJcsACgkQoqBt8qM6 VPoH0Qf+JKQ6gaHehoAJIReZ9kqlmx0ooRZJ8b5KZO2ej3xth01mHGtwwcdjLyFz ox7eMF3eWQwLCnbD68Fy+uxzyeNgiOD+reZ6niAjYpTZB9M0TDtj+RnKYYT2uLB/ HgDJQT7UKLF8sizPYqG5VrqU3ETDkzGcUnvEqldG8WpiEjeYizTiT1ne7FvVdL7U 0T2GnNaEGNJaa5gcEXnLn6zCyIvdlJHCBwo2PzVik2xx5Yumkqjgj6IIgjh6+UMa +LPJEazbfOtGVU16NjlGNKtTZZHN3KRyoHknAUd8g8JPuo1kp9khv0LocRqfCZHh gZkmBwvEt/nYKjgnFJ7MUFI9hgdo0w== =zPxY -----END PGP SIGNATURE----- --=-=-=--