Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #811852 > unrolled thread

Bug#857119: unblock: wireshark/2.2.5+g440fd4d-2

Started byBalint Reczey <balint@balintreczey.hu>
First post2017-03-08 10:00 +0100
Last post2017-03-10 08:40 +0100
Articles 3 — 3 participants

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#857119: unblock: wireshark/2.2.5+g440fd4d-2 Balint Reczey <balint@balintreczey.hu> - 2017-03-08 10:00 +0100
    Bug#857119: unblock: wireshark/2.2.5+g440fd4d-2 Emilio Pozuelo Monfort <pochu@debian.org> - 2017-03-09 09:40 +0100
      Bug#857119: unblock: wireshark/2.2.5+g440fd4d-2 Bálint Réczey <balint@balintreczey.hu> - 2017-03-10 08:40 +0100

#811852 — Bug#857119: unblock: wireshark/2.2.5+g440fd4d-2

FromBalint Reczey <balint@balintreczey.hu>
Date2017-03-08 10:00 +0100
SubjectBug#857119: unblock: wireshark/2.2.5+g440fd4d-2
Message-ID<tiFBT-3WM-1@gated-at.bofh.it>
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
Tags: patch

Dear Release Team,

I have prepared wireshark 2.2.5+g440fd4d-1 in experimental which fixes
9 vulnerabilities and other bugs which are not listed here, just on
the release notes link.

Changes:
 wireshark (2.2.5+g440fd4d-1) experimental; urgency=medium
 .
   * New upstream release
     - release notes:
       https://www.wireshark.org/docs/relnotes/wireshark-2.2.5.html
     - security fixes:
       - The STANAG 4607 file parser could go into an infinite loop
         (CVE-2017-6014)
       - The NetScaler file parser could go into an infinite loop
         (CVE-2017-6467)
       - The NetScaler file parser could crash (CVE-2017-6468)
       - The LDSS dissector could crash (CVE-2017-6469)
       - The IAX2 dissector could go into an infinite loop
         (CVE-2017-6470)
       - The WSP dissector could go into an infinite loop (CVE-2017-6471)
       - The RTMTP dissector could go into an infinite loop
         (CVE-2017-6472)
       - The K12 file parser could crash (CVE-2017-6473)
       - The NetScaler file parser could go into an infinite loop
         (CVE-2017-6474)
   * Update symbols file for libwireshark8

I believe wireshark point releases very rarely cause regressions due
to the heavy testing performed upstream and I think it would be safe
to upload this point release to unstable and let it migrate to
testing.

If you wouldn't like to accept the full point release to Stretch I
will happily backport the security fixes to 2.2.4 and upload that to
unstable.

Please find the patch in the following link because it was too big for
inclusion in the email:

https://people.debian.org/~rbalint/wireshark_2.2.5+g440fd4d-1.patch

Please share your preference regarding the next upload.

Cheers,
Balint

unblock wireshark/2.2.5+g440fd4d-2

[toc] | [next] | [standalone]

#812098

FromEmilio Pozuelo Monfort <pochu@debian.org>
Date2017-03-09 09:40 +0100
Message-ID<tj1M6-2AN-3@gated-at.bofh.it>
In reply to#811852
Control: tags -1 confirmed moreninfo

On 08/03/17 09:52, Balint Reczey wrote:
> Package: release.debian.org
> Severity: normal
> User: release.debian.org@packages.debian.org
> Usertags: unblock
> Tags: patch
> 
> Dear Release Team,
> 
> I have prepared wireshark 2.2.5+g440fd4d-1 in experimental which fixes
> 9 vulnerabilities and other bugs which are not listed here, just on
> the release notes link.
> 
> Changes:
>  wireshark (2.2.5+g440fd4d-1) experimental; urgency=medium
>  .
>    * New upstream release
>      - release notes:
>        https://www.wireshark.org/docs/relnotes/wireshark-2.2.5.html
>      - security fixes:
>        - The STANAG 4607 file parser could go into an infinite loop
>          (CVE-2017-6014)
>        - The NetScaler file parser could go into an infinite loop
>          (CVE-2017-6467)
>        - The NetScaler file parser could crash (CVE-2017-6468)
>        - The LDSS dissector could crash (CVE-2017-6469)
>        - The IAX2 dissector could go into an infinite loop
>          (CVE-2017-6470)
>        - The WSP dissector could go into an infinite loop (CVE-2017-6471)
>        - The RTMTP dissector could go into an infinite loop
>          (CVE-2017-6472)
>        - The K12 file parser could crash (CVE-2017-6473)
>        - The NetScaler file parser could go into an infinite loop
>          (CVE-2017-6474)
>    * Update symbols file for libwireshark8
> 
> I believe wireshark point releases very rarely cause regressions due
> to the heavy testing performed upstream and I think it would be safe
> to upload this point release to unstable and let it migrate to
> testing.
> 
> If you wouldn't like to accept the full point release to Stretch I
> will happily backport the security fixes to 2.2.4 and upload that to
> unstable.

Please go ahead with 2.2.5, and remove the moreinfo tag once it is accepted and
built on all release architectures.

Cheers,
Emilio

[toc] | [prev] | [next] | [standalone]

#812291

FromBálint Réczey <balint@balintreczey.hu>
Date2017-03-10 08:40 +0100
Message-ID<tjnjz-qU-7@gated-at.bofh.it>
In reply to#812098
Control: tags -1 -moreinfo

2017-03-09 9:27 GMT+01:00 Emilio Pozuelo Monfort <pochu@debian.org>:
> Control: tags -1 confirmed moreninfo
>
> On 08/03/17 09:52, Balint Reczey wrote:
>> Package: release.debian.org
>> Severity: normal
>> User: release.debian.org@packages.debian.org
>> Usertags: unblock
>> Tags: patch
>>
>> Dear Release Team,
>>
>> I have prepared wireshark 2.2.5+g440fd4d-1 in experimental which fixes
>> 9 vulnerabilities and other bugs which are not listed here, just on
>> the release notes link.
>>
>> Changes:
>>  wireshark (2.2.5+g440fd4d-1) experimental; urgency=medium
>>  .
>>    * New upstream release
>>      - release notes:
>>        https://www.wireshark.org/docs/relnotes/wireshark-2.2.5.html
>>      - security fixes:
>>        - The STANAG 4607 file parser could go into an infinite loop
>>          (CVE-2017-6014)
>>        - The NetScaler file parser could go into an infinite loop
>>          (CVE-2017-6467)
>>        - The NetScaler file parser could crash (CVE-2017-6468)
>>        - The LDSS dissector could crash (CVE-2017-6469)
>>        - The IAX2 dissector could go into an infinite loop
>>          (CVE-2017-6470)
>>        - The WSP dissector could go into an infinite loop (CVE-2017-6471)
>>        - The RTMTP dissector could go into an infinite loop
>>          (CVE-2017-6472)
>>        - The K12 file parser could crash (CVE-2017-6473)
>>        - The NetScaler file parser could go into an infinite loop
>>          (CVE-2017-6474)
>>    * Update symbols file for libwireshark8
>>
>> I believe wireshark point releases very rarely cause regressions due
>> to the heavy testing performed upstream and I think it would be safe
>> to upload this point release to unstable and let it migrate to
>> testing.
>>
>> If you wouldn't like to accept the full point release to Stretch I
>> will happily backport the security fixes to 2.2.4 and upload that to
>> unstable.
>
> Please go ahead with 2.2.5, and remove the moreinfo tag once it is accepted and
> built on all release architectures.

Accepted and built.

Cheers,
Balint

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web