Re: [SECURITY] [DSA 3482-1] libreoffice security update

2016-02-17 Thread Salvatore Bonaccorso
Hi Rene, On Wed, Feb 17, 2016 at 11:40:17PM +0100, Rene Engelhard wrote: > On Wed, Feb 17, 2016 at 07:29:59PM +, Sebastien Delafond wrote: > > For the testing (stretch) and unstable (sid) distributions, these > > problems have been fixed in version 1:5.1.1~rc1-1. > > Actually, as I said (and

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Dominic Hargreaves
On Wed, Feb 17, 2016 at 07:31:49PM +0100, Thomas Hager wrote: > On Wed, 2016-02-17 at 10:55 +, Dominic Hargreaves wrote: > > "Mitigating factors for UDP include [...] > > - A local resolver (that drops non-compliant responses)." > > > > "- A back of the envelope analysis shows that it shou

Re: [SECURITY] [DSA 3482-1] libreoffice security update

2016-02-17 Thread Rene Engelhard
On Wed, Feb 17, 2016 at 07:29:59PM +, Sebastien Delafond wrote: > For the testing (stretch) and unstable (sid) distributions, these > problems have been fixed in version 1:5.1.1~rc1-1. Actually, as I said (and as said upstream, it's fixed in 5.0.5 release), it's fixed since 5.0.5 rc1, so the v

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Thomas Hager
On Wed, 2016-02-17 at 10:55 +, Dominic Hargreaves wrote: > "Mitigating factors for UDP include [...] > - A local resolver (that drops non-compliant responses)." > > "- A back of the envelope analysis shows that it should be possible > to >   write correctly formed DNS responses with attack

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Michael Stone
On Wed, Feb 17, 2016 at 10:58:01AM +0100, Jan Lühr wrote: Comparing the age (2015-07) and the severity: Can you give some details on the situation? Why was the bug fixed so late? https://sourceware.org/bugzilla/show_bug.cgi?id=18665 Mike Stone

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Lupe Christoph
On Wednesday, 2016-02-17 at 10:58:01 +0100, Jan Lühr wrote: > Am 02/16/2016 um 03:18 PM schrieb Salvatore Bonaccorso: > > CVE-2015-7547 > > The Google Security Team and Red Hat discovered that the glibc > Comparing the age (2015-07) and the severity: Can you give some details > on the situat

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Dominic Hargreaves
On Tue, Feb 16, 2016 at 04:32:00PM +0100, Peter Ludikovsky wrote: > Hello, > > A question to those more knowledgeable: we're using our own DNS > servers for all lookups, and those do recursive lookup for any > external addresses. Am I right to assume that Bind9 uses it's own > implementation for D

Re: [SECURITY] [DSA 3481-1] glibc security update

2016-02-17 Thread Jan Lühr
Hello folks, thanks for providing a patch in Debian. One question: Am 02/16/2016 um 03:18 PM schrieb Salvatore Bonaccorso: > CVE-2015-7547 > > The Google Security Team and Red Hat discovered that the glibc Comparing the age (2015-07) and the severity: Can you give some details on the situa