Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6328 > unrolled thread

CVE applicability

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  CVE applicability Arul Anand MM <arulanandkk1@gmail.com> - 2024-06-18 21:00 +0200
    Re: CVE applicability Salvatore Bonaccorso <carnil@debian.org> - 2024-06-19 08:00 +0200
    Re: CVE applicability Thomas Hochstein <thh@thh.name> - 2024-06-19 23:50 +0200

#6328 — CVE applicability

[Multipart message — attachments visible in raw view] — view raw

Hello Debian Security Team,

This is regarding Debian advisory
https://security-tracker.debian.org/tracker/CVE-2023-3390.

I would like to confirm whether version 5.10.191-1 is impacted by the UAF
and LPE.

Advisory page on September 14
https://web.archive.org/web/20230924174231/https://security-tracker.debian.org/tracker/CVE-2023-3390
states the issue is fixed in 5.10.191-1 but the current version of advisory
states "5.10.209-2" as the fixed version. Is there any information on the
impacted version changes for CVE-2023-3390?

Thanks.

[toc] | [next] | [standalone]

#6329

Hi,

On Wed, Jun 19, 2024 at 12:04:45AM +0530, Arul Anand MM wrote:
> Hello Debian Security Team,
> 
> This is regarding Debian advisory
> https://security-tracker.debian.org/tracker/CVE-2023-3390.
> 
> I would like to confirm whether version 5.10.191-1 is impacted by the UAF
> and LPE.
> 
> Advisory page on September 14
> https://web.archive.org/web/20230924174231/https://security-tracker.debian.org/tracker/CVE-2023-3390
> states the issue is fixed in 5.10.191-1 but the current version of advisory
> states "5.10.209-2" as the fixed version. Is there any information on the
> impacted version changes for CVE-2023-3390?

All the version information required is actually on
https://security-tracker.debian.org/tracker/CVE-2023-3390 . In the
lower table you see where the fix landed, In the table above you see
the current available versions in the suites, with their status.

But maybe I'm missunderstanding the question?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#6330

Arul Anand MM wrote:

> Advisory page on September 14
> https://web.archive.org/web/20230924174231/https://security-tracker.debian.org/tracker/CVE-2023-3390
> states the issue is fixed in 5.10.191-1

No, it doesn't.

It states the issue was fixed - for bullseye, i.e. oldstable - in
5.10.179-3 (lower table).

It also states that 5.10.191-1 was the current version in "bullseye
(security)", so that suite was not vulnerable.

> but the current version of advisory
> states "5.10.209-2" as the fixed version.

No, it doesn't. :-)

It still states the issue was fixed in 5.10.179-3 (lower table).

The current version in "bullseye (security)" is now 5.10.218-1, and in
"bullseye" it's 5.10.209-2, so neither suite is vulnerable.

The fixed version doesn't change. The current version in suites that still
get updates does, of course.

-thh

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web