Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4328 > unrolled thread

Bug#794466: Virtualbox might not be suitable for Stretch

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#794466: Virtualbox might not be suitable for Stretch Gianfranco Costamagna <costamagnagianfranco@yahoo.it> - 2015-08-10 09:30 +0200
    Bug#794466: Virtualbox might not be suitable for Stretch Ritesh Raj Sarraf <rrs@debian.org> - 2015-08-10 10:20 +0200
    Bug#794466: Virtualbox might not be suitable for Stretch Moritz Mühlenhoff <jmm@inutil.org> - 2015-08-15 22:00 +0200

#4328 — Bug#794466: Virtualbox might not be suitable for Stretch

Hi,

>Debian Security Team:


>These are what we have currently in Debian:
>
>oldstable: 4.1.18
>stable: 4.3.18
>testing: 4.3.30



I would add (as Ben requested)

old-old-stable 3.2.10 --> 3.2.28
(this will fix AFAICS all the CVEs on o-o-stable, but not the latest one)


https://www.virtualbox.org/wiki/Changelog-3.2
>So, to keep the stable version secure in the Oracle way, we'll need to
>push it to 4.3.30. Please look at: 
>https://www.virtualbox.org/wiki/Changelog-4.3 for the 4.3.x changelog.
>
>Similarly, 4.1.x here: https://www.virtualbox.org/wiki/Changelog-4.1
>
>The good thing is that Oracle declares these as "Maintenance release".
>So usual sane practise for them too, should be, to only update it with
>Security Fixes. Though this has not been the case in the past. There
>have been regressions.


I do not recall any regressions there, at least between stable minor releases
(I recall regressions between 4.1.x and 4.3.x)

However the changelogs mentions a couple of them, so must be right :)

>But if the security team can agree up with this release model, then the
>VBox team could just keep it up-to-date.



Yes, otherwise the points remains:

1) leave the oracle with CVEs in stable releases

or

2) have an exception from Security Team and/or Release Team

or

3) wait and hope Oracle will change the model or make an exception

----


1) means a disappear of VBox from Testing I'm afraid

2) We will continue to provide security new releases, and fix almost all the CVEs around here
(except for one in o-o-stable)
3) this is kind of impossible right now I guess (even if Oracle employees are continuing
to try to have it)


BTW having the "stable maintenance releases" on Debian stable releases, will allow people to be able to rebuild
kernel modules on their own, because usually people upgrade
their kernel while running stable, and virtualbox usually don't compile anymore
with them.

Ubuntu followed a slightly different model, they started embedding in linux kernel
the virtualbox modules, while with Debian we are forced to update virtualbox on stable,
or close the bugs reported with "notfix" (and ask people to run it from testing instead).

So the annoying kernel module rebuilds might be fixed too here :)


cheers,

Gianfranco


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

[toc] | [next] | [standalone]

#4329

[Multipart message — attachments visible in raw view] — view raw

On Mon, 2015-08-10 at 07:16 +0000, Gianfranco Costamagna wrote:
> >But if the security team can agree up with this release model, then 
> the
> >VBox team could just keep it up-to-date.
> 
> 
> 
> Yes, otherwise the points remains:
> 
> 1) leave the oracle with CVEs in stable releases
> 
> or
> 
> 2) have an exception from Security Team and/or Release Team
> 
> or
> 
> 3) wait and hope Oracle will change the model or make an exception
> 
> ----
> 
> 
> 1) means a disappear of VBox from Testing I'm afraid
> 
> 2) We will continue to provide security new releases, and fix almost 
> all the CVEs around here
> (except for one in o-o-stable)
> 3) this is kind of impossible right now I guess (even if Oracle 
> employees are continuing
> to try to have it)


Does anyone know what Fedora project's stand is on VBox ?
From what I've checked so far, Fedora does not ship VBox. But I'm not
sure what their reasons are.......


-- 
Ritesh Raj Sarraf | http://people.debian.org/~rrs
Debian - The Universal Operating System

[toc] | [prev] | [next] | [standalone]

#4330

On Mon, Aug 10, 2015 at 07:16:59AM +0000, Gianfranco Costamagna wrote:
> Yes, otherwise the points remains:
> 
> 1) leave the oracle with CVEs in stable releases
> 
> or
> 
> 2) have an exception from Security Team and/or Release Team
> 
> or
> 
> 3) wait and hope Oracle will change the model or make an exception

We'll have a security team meeting at DebConf and will discuss
virtualbox as well.

Cheers,
        Moritz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web