Roberto C. Sánchez pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
31eb7e61 by Roberto C. Sánchez at 2025-06-20T17:43:25-04:00
LTS: remove <not-affected> from CVE-2025-40775/bind9, also add bind9 to
dla-needed.txt
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -9025,7 +9025,6 @@ CVE-2024-12561 (The Affiliate Sales in Google Analytics
and other tools plugin f
CVE-2025-40775 (When an incoming DNS protocol message includes a Transaction
Signature ...)
- bind9 1:9.20.9-1
[bookworm] - bind9 <not-affected> (Vulnerable code not present)
- [bullseye] - bind9 <not-affected> (Vulnerable code not present)
NOTE: https://kb.isc.org/docs/cve-2025-40775
NOTE: Fixed by:
https://gitlab.isc.org/isc-projects/bind9/-/commit/b8c198ac5cae674acf96e2c0f3be9abe5b630ede
(v9.20.9)
CVE-2025-5013 (A vulnerability, which was classified as problematic, was found
in HkC ...)
=====================================
data/dla-needed.txt
=====================================
@@ -48,6 +48,12 @@ ansible
arm-trusted-firmware
NOTE: 20250303: Added by Front-Desk (rouca)
--
+bind9
+ NOTE: 20250620: Added by coordinator (roberto)
+ NOTE: 20250620: I have dug into CVE-2025-40775 and based on the description
in the upstream
+ NOTE: 20250620: issue linked from the tracker, the abort is still reached in
the bullseye
+ NOTE: 20250620: version like this: name.c:dns_name_toregion() -> REQUIRE()
-> abort() (roberto)
+--
busybox
NOTE: 20250425: Added by Front-Desk (rouca)
NOTE: 20250519: Asked maintainers about any pending work and offered help.
(spwhitton)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/31eb7e61b8fd9c0bb9c5d2d6be8d98ac51bac8cb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/31eb7e61b8fd9c0bb9c5d2d6be8d98ac51bac8cb
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
