Re: Wheezy update of bash?

2016-10-07 Thread Ola Lundqvist
Hi Balint It was the default shell that made the difference. Thanks again for this suggestion. I can reproduce the problem now. Very good. An interesting note is that it is only possible to escalate the privilege to root. If I change the owner of the file to www-data (and the setuid to 33) the id

Re: Wheezy update for qemu ?

2016-10-07 Thread Guido Günther
On Fri, Oct 07, 2016 at 01:09:29PM +0200, Hugo Lefeuvre wrote: > Hi, > > > I'll prepare a patch adding the usb_xhci_exit function and will > > perform some more tests. > > Well, here is what I got after taking some hours to try to produce a > patch for CVE-2016-7466[0]: > > * It is not possible

Re: [Debian-ha-maintainers] Wheezy update of pacemaker?

2016-10-07 Thread Ferenc Wágner
wf...@niif.hu (Ferenc Wágner) writes: > Thorsten Alteholz writes: > >> the Debian LTS team would like to fix the security issues which are >> currently open in the Wheezy version of pacemaker: >> https://security-tracker.debian.org/tracker/CVE-2016-7797 > > I don't see how this affects 1.1.7 (the

Re: systemd CVE-2016-7796

2016-10-07 Thread Ben Hutchings
On Fri, 2016-10-07 at 17:52 +1100, Brian May wrote: > > Ben Hutchings writes: > > > > It looks like this patch does three things > > > > > > * It removes "assert(n > 0)". > > > > > > * It removes the now unused n parameter from the > > >   manager_invoke_notify_message() function. > > > > > >

Re: version number when packaging a new upstream release

2016-10-07 Thread Raphael Hertzog
On Fri, 07 Oct 2016, Adrian Bunk wrote: > > So while it has been used it's not the only one in use in the context > > of the security team. > > It is a different version numbering than the MySQL 5.5 case because it > is a different situation. > > This OpenJDK DSA is not a packaging of a new vers

Re: Wheezy update for qemu ?

2016-10-07 Thread Hugo Lefeuvre
Hi, > I'll prepare a patch adding the usb_xhci_exit function and will > perform some more tests. Well, here is what I got after taking some hours to try to produce a patch for CVE-2016-7466[0]: * It is not possible to introduce the usb_xhci_exit function in qemu v1.1.2 as it has been done in

Re: version number when packaging a new upstream release

2016-10-07 Thread Adrian Bunk
On Fri, Oct 07, 2016 at 09:11:15AM +0200, Raphael Hertzog wrote: > Hi, > > On Thu, 06 Oct 2016, Adrian Bunk wrote: > > On Thu, Oct 06, 2016 at 06:16:37PM +0200, Raphael Hertzog wrote: > > > On Thu, 06 Oct 2016, Adrian Bunk wrote: > > >... > > > > Do you have any rationale why you think -1~deb7u1 w

Re: version number when packaging a new upstream release

2016-10-07 Thread Salvatore Bonaccorso
Hi Raphael, On Fri, Oct 07, 2016 at 09:11:15AM +0200, Raphael Hertzog wrote: > Hi, > > On Thu, 06 Oct 2016, Adrian Bunk wrote: > > On Thu, Oct 06, 2016 at 06:16:37PM +0200, Raphael Hertzog wrote: > > > On Thu, 06 Oct 2016, Adrian Bunk wrote: > > >... > > > > Do you have any rationale why you thin

Re: Wheezy update of bash?

2016-10-07 Thread Bálint Réczey
Hi, 2016-10-07 8:10 GMT+02:00 Ola Lundqvist : > Hi Balint > > Ah, it could be the default shell. I'll try that. Thanks for the suggestion. > > Merely that the command id is executed is not a reproduction. It has to be > executed as another user than the one one executing the binary to be a > secur

Re: version number when packaging a new upstream release

2016-10-07 Thread Raphael Hertzog
Hi, On Thu, 06 Oct 2016, Adrian Bunk wrote: > On Thu, Oct 06, 2016 at 06:16:37PM +0200, Raphael Hertzog wrote: > > On Thu, 06 Oct 2016, Adrian Bunk wrote: > >... > > > Do you have any rationale why you think -1~deb7u1 would be better > > > than -0+deb7u1? > > > > My preference goes for the former

Re: systemd CVE-2016-7796

2016-10-07 Thread Brian May
Ben Hutchings writes: >> It looks like this patch does three things >> >> * It removes "assert(n > 0)". >> >> * It removes the now unused n parameter from the >>   manager_invoke_notify_message() function. >> >> * It removes the return(0) if n==0. This looks like the only relevant part. >> >>