Bug#873804: CVE-2017-11541

2017-08-31 Thread Romain Francoise
On Thu, Aug 31, 2017 at 01:26:46PM +0200, Guido Günther wrote: > O.k. Any idea when upstream will do this? Last week we were promised more details within one week, and an official release date in September. But these things take time... -- Romain Francoise https://people.debian.org/~rfrancoise/

Bug#873804: CVE-2017-11541

2017-08-31 Thread Guido Günther
Hi Romain, Thanks for the prompt reply! On Thu, Aug 31, 2017 at 01:16:35PM +0200, Romain Francoise wrote: > Hi, > > On Thu, Aug 31, 2017 at 12:52:12PM +0200, Guido Günther wrote: > > I've sent the attached patch upstream. I'd like to incorporate this into > > an upload to wheezy at one point. Sh

Bug#873804: CVE-2017-11541

2017-08-31 Thread Romain Francoise
Hi, On Thu, Aug 31, 2017 at 12:52:12PM +0200, Guido Günther wrote: > I've sent the attached patch upstream. I'd like to incorporate this into > an upload to wheezy at one point. Shall I handle sid, stretch or jessie > as well? No, thank you. This vulnerability and the others have already been fix

Bug#873804: CVE-2017-11541

2017-08-31 Thread Guido Günther
Hi, On Thu, Aug 31, 2017 at 12:39:17PM +0200, Guido Günther wrote: > Package: tcpdump > X-Debbugs-CC: t...@security.debian.org > secure-testing-t...@lists.alioth.debian.org > Severity: important > Tags: security > > Hi, > > the following vulnerability was published for tcpdump. > > CVE-2017-115

Bug#873804: CVE-2017-11541

2017-08-31 Thread Guido Günther
Package: tcpdump X-Debbugs-CC: t...@security.debian.org secure-testing-t...@lists.alioth.debian.org Severity: important Tags: security Hi, the following vulnerability was published for tcpdump. CVE-2017-11541[0]: | tcpdump 4.9.0 has a heap-based buffer over-read in the lldp_print | function in