Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4482 > unrolled thread

Re: [SECURITY] [DSA 3448-1] linux security update

Started byJames Barrett <xucaen@gmail.com>
First post2016-01-19 19:50 +0100
Last post2016-01-20 01:30 +0100
Articles 5 — 4 participants

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3448-1] linux security update James Barrett <xucaen@gmail.com> - 2016-01-19 19:50 +0100
    Re: [SECURITY] [DSA 3448-1] linux security update hasan akgöz <hasanakgoz@gmail.com> - 2016-01-19 20:20 +0100
    Re: [SECURITY] [DSA 3448-1] linux security update "Luis E. Arevalo R." <arevalo@luchox.cl> - 2016-01-19 20:30 +0100
    Re: [SECURITY] [DSA 3448-1] linux security update James Barrett <xucaen@gmail.com> - 2016-01-20 00:40 +0100
      Re: [SECURITY] [DSA 3448-1] linux security update Povl Ole Haarlev Olsen <debian-security@stderr.dk> - 2016-01-20 01:30 +0100

#4482 — Re: [SECURITY] [DSA 3448-1] linux security update

FromJames Barrett <xucaen@gmail.com>
Date2016-01-19 19:50 +0100
SubjectRe: [SECURITY] [DSA 3448-1] linux security update
Message-ID<qSJvQ-3iH-3@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Please stop sending me these emails.
On Jan 19, 2016 7:40 AM, "Salvatore Bonaccorso" <carnil@debian.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3448-1                   security@debian.org
> https://www.debian.org/security/                     Salvatore Bonaccorso
> January 19, 2016                      https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : linux
> CVE ID         : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2016-0723
>                  CVE-2016-0728
>
> Several vulnerabilities have been discovered in the Linux kernel that
> may lead to a privilege escalation or denial-of-service.
>
> CVE-2013-4312
>
>     Tetsuo Handa discovered that it is possible for a process to open
>     far more files than the process' limit leading to denial-of-service
>     conditions.
>
> CVE-2015-7566
>
>     Ralf Spenneberg of OpenSource Security reported that the visor
>     driver crashes when a specially crafted USB device without bulk-out
>     endpoint is detected.
>
> CVE-2015-8767
>
>     An SCTP denial-of-service was discovered which can be triggered by a
>     local attacker during a heartbeat timeout event after the 4-way
>     handshake.
>
> CVE-2016-0723
>
>     A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
>     A local attacker could use this flaw for denial-of-service.
>
> CVE-2016-0728
>
>     The Perception Point research team discovered a use-after-free
>     vulnerability in the keyring facility, possibly leading to local
>     privilege escalation.
>
> For the stable distribution (jessie), these problems have been fixed in
> version 3.16.7-ckt20-1+deb8u3.
>
> We recommend that you upgrade your linux packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCgAGBQJWni1mAAoJEAVMuPMTQ89EYvkP/Rmqrwxv1M+z4qj3OmfF81Q+
> zj5Kd9nrvolH/asFac3URBHurSQby3JRgwxtqJuTrc68xBn147CQWaDM5nU9/HBi
> Dt3eceDxsGBo9W8FJEpE6Yk4a3NyNiEOnT7gLFfSjFkmyGr3a6+7b1VPAEcsDeBV
> FbA40UhrDnZYoeqqBFOGqedzFBioSafd+AQOYNqCjNByNq5i3SxMgS3XCECrruUr
> yGfR+0RD5EibvcUddzduuGOvjmaW+mPK6OTVir2f6AwJFdSOJEegkSZRkLeBJgYL
> Lfk131dlJ6gwelAaGOJA9wAqSPVIFe9h+jFh2DTQ6q5Lrg5dchkibbb2eSuoqRO1
> Fa1cXW33k8YSilTzvy7pO1Snrp2YhGKK3RPo5PNAsdmOiuzSkI9PUw+khz/TtJ9N
> XSKmOGd3ZT3R81UuEiXTdJVzVsRS+jLpgQ2jjOlvDb5ldQgn9tirL36/isSRcM64
> IGnJlLHxhzBv+GQyziVDy37ois2dYT3in6ls2tI7rHoYhaEyOwPyCn98/IJqPxea
> SIeLGxStaaCGqgDaFqCJbRuAZGFqpwZLKSd9/HycA7jTJbfrdzD74eDFc8LvGYly
> Il1vpT8Ekfxh9L4o+HkzVkme7dkYt5SmLGvN1euTUdjsuo87r3OwN0OKVhXrFoAV
> qaetOmH+fJB1/jo9jPLH
> =fylF
> -----END PGP SIGNATURE-----
>
>

[toc] | [next] | [standalone]

#4483

Fromhasan akgöz <hasanakgoz@gmail.com>
Date2016-01-19 20:20 +0100
Message-ID<qSJYS-3Il-1@gated-at.bofh.it>
In reply to#4482

[Multipart message — attachments visible in raw view] — view raw

Hi,
if you unsubscribe from mailing list, You can follow instructions on this
URL: https://www.debian.org/MailingLists/#subunsub
Or use this form : https://www.debian.org/MailingLists/unsubscribe

2016-01-19 20:46 GMT+02:00 James Barrett <xucaen@gmail.com>:

> Please stop sending me these emails.
> On Jan 19, 2016 7:40 AM, "Salvatore Bonaccorso" <carnil@debian.org> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> -
>> -------------------------------------------------------------------------
>> Debian Security Advisory DSA-3448-1                   security@debian.org
>> https://www.debian.org/security/                     Salvatore Bonaccorso
>> January 19, 2016                      https://www.debian.org/security/faq
>> -
>> -------------------------------------------------------------------------
>>
>> Package        : linux
>> CVE ID         : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2016-0723
>>                  CVE-2016-0728
>>
>> Several vulnerabilities have been discovered in the Linux kernel that
>> may lead to a privilege escalation or denial-of-service.
>>
>> CVE-2013-4312
>>
>>     Tetsuo Handa discovered that it is possible for a process to open
>>     far more files than the process' limit leading to denial-of-service
>>     conditions.
>>
>> CVE-2015-7566
>>
>>     Ralf Spenneberg of OpenSource Security reported that the visor
>>     driver crashes when a specially crafted USB device without bulk-out
>>     endpoint is detected.
>>
>> CVE-2015-8767
>>
>>     An SCTP denial-of-service was discovered which can be triggered by a
>>     local attacker during a heartbeat timeout event after the 4-way
>>     handshake.
>>
>> CVE-2016-0723
>>
>>     A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
>>     A local attacker could use this flaw for denial-of-service.
>>
>> CVE-2016-0728
>>
>>     The Perception Point research team discovered a use-after-free
>>     vulnerability in the keyring facility, possibly leading to local
>>     privilege escalation.
>>
>> For the stable distribution (jessie), these problems have been fixed in
>> version 3.16.7-ckt20-1+deb8u3.
>>
>> We recommend that you upgrade your linux packages.
>>
>> Further information about Debian Security Advisories, how to apply
>> these updates to your system and frequently asked questions can be
>> found at: https://www.debian.org/security/
>>
>> Mailing list: debian-security-announce@lists.debian.org
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>>
>> iQIcBAEBCgAGBQJWni1mAAoJEAVMuPMTQ89EYvkP/Rmqrwxv1M+z4qj3OmfF81Q+
>> zj5Kd9nrvolH/asFac3URBHurSQby3JRgwxtqJuTrc68xBn147CQWaDM5nU9/HBi
>> Dt3eceDxsGBo9W8FJEpE6Yk4a3NyNiEOnT7gLFfSjFkmyGr3a6+7b1VPAEcsDeBV
>> FbA40UhrDnZYoeqqBFOGqedzFBioSafd+AQOYNqCjNByNq5i3SxMgS3XCECrruUr
>> yGfR+0RD5EibvcUddzduuGOvjmaW+mPK6OTVir2f6AwJFdSOJEegkSZRkLeBJgYL
>> Lfk131dlJ6gwelAaGOJA9wAqSPVIFe9h+jFh2DTQ6q5Lrg5dchkibbb2eSuoqRO1
>> Fa1cXW33k8YSilTzvy7pO1Snrp2YhGKK3RPo5PNAsdmOiuzSkI9PUw+khz/TtJ9N
>> XSKmOGd3ZT3R81UuEiXTdJVzVsRS+jLpgQ2jjOlvDb5ldQgn9tirL36/isSRcM64
>> IGnJlLHxhzBv+GQyziVDy37ois2dYT3in6ls2tI7rHoYhaEyOwPyCn98/IJqPxea
>> SIeLGxStaaCGqgDaFqCJbRuAZGFqpwZLKSd9/HycA7jTJbfrdzD74eDFc8LvGYly
>> Il1vpT8Ekfxh9L4o+HkzVkme7dkYt5SmLGvN1euTUdjsuo87r3OwN0OKVhXrFoAV
>> qaetOmH+fJB1/jo9jPLH
>> =fylF
>> -----END PGP SIGNATURE-----
>>
>>


-- 
//selametle

Hasan AKGÖZ

http://www.hasanakgoz.com

[toc] | [prev] | [next] | [standalone]

#4484

From"Luis E. Arevalo R." <arevalo@luchox.cl>
Date2016-01-19 20:30 +0100
Message-ID<qSK8y-3LS-3@gated-at.bofh.it>
In reply to#4482

[Multipart message — attachments visible in raw view] — view raw

2016-01-19 15:46 GMT-03:00 James Barrett <xucaen@gmail.com>:

> Please stop sending me these emails.


These emails are not sent to your inbox, but to the mailing list
debian-security@lists.debian.org.

More information: https://lists.debian.org/debian-security/

-- 
Luis Eduardo Arevalo Reyes                    User #354770
http://linuxcounter.net
Fono +56 9 54012831
http://www.luchox.cl

[toc] | [prev] | [next] | [standalone]

#4485

FromJames Barrett <xucaen@gmail.com>
Date2016-01-20 00:40 +0100
Message-ID<qSO2u-6lC-13@gated-at.bofh.it>
In reply to#4482

[Multipart message — attachments visible in raw view] — view raw

So you are saying there is no one there smart enough to know how their
software works to remove me? all my other mails get sent back with errors,
so obviously you are wrong.

someone take my email off the list or I will report it as harassment.


On Tue, Jan 19, 2016 at 3:06 PM, Povl Ole Haarlev Olsen <
debian-security@stderr.dk> wrote:

> On Tue, 19 Jan 2016, James Barrett wrote:
>
>> It has been requested that the following address:
>>
>>        xucaen@gmail.com
>>
>> should be deleted from the debian-security mailing list.
>>
>> Sorry, but this address has NOT been found on the list.
>>
>
> That makes sense. You're trying to unsubscribe from the "debian-security"
> mailing list, not the "debian-security-ANNOUNCE" mailing list. Different
> mailing lists. You need to send your unsubscribe request to the correct
> address.
>
> Please check carefully the spelling of this address.
>> You may send an unsubscribe request with another address.
>> If the address is on the list you will receive a confirmation
>> message. A reply to this message will remove the address.
>>
>> It follows a copy of your unsubscribe request
>>
>> >From xucaen@gmail.com  Tue Jan 19 19:02:00 2016
>> >Return-Path: <xucaen@gmail.com>
>> >X-Original-To: lists-debian-security-request@bendel.debian.org
>> >Delivered-To: lists-debian-security-request@bendel.debian.org
>> >Received: from localhost (localhost [127.0.0.1])
>> >       by bendel.debian.org (Postfix) with ESMTP id E955B1B0
>> >       for <lists-debian-security-request@bendel.debian.org>; Tue, 19
>> Jan
>> 2016 19:02:00 +0000 (UTC)
>> >X-Virus-Scanned: at lists.debian.org with policy bank request
>> >X-Spam-Flag: NO
>> >X-Spam-Score: 2.202
>> >X-Spam-Level: **
>> >X-Spam-Status: No, score=2.202 tagged_above=-10000 required=5.3
>> >       tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
>> >       DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=2,
>> >       LDO_WHITELIST=-5, ONEWORD=2, ONEWORDALL=4, ONEWORDBODY=2,
>> >       RCVD_IN_DNSWL_LOW=-0.7, TVD_SPACE_RATIO=0.001]
>> >       autolearn=no autolearn_force=no
>> >Received: from bendel.debian.org ([127.0.0.1])
>> >       by localhost (lists.debian.org [127.0.0.1]) (amavisd-new, port
>> 2525)
>> >       with ESMTP id aVfmIcUDtuvc
>> >       for <lists-debian-security-request@bendel.debian.org>;
>> >       Tue, 19 Jan 2016 19:01:56 +0000 (UTC)
>> >X-policyd-weight:  NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5
>> CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-ig0-x234.google. -
>> helo-domain: .google.)  FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -7
>> >Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com
>> [IPv6:2607:f8b0:4001:c05::234])
>> >       (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128
>> bits))
>> >       (Client CN "smtp.gmail.com", Issuer "Google Internet Authority
>> G2"
>> (not verified))
>> >       by bendel.debian.org (Postfix) with ESMTPS id 4FEC0160
>> >       for <debian-security-request@lists.debian.org>; Tue, 19 Jan 2016
>> 19:01:55 +0000 (UTC)
>> >Received: by mail-ig0-x234.google.com with SMTP id mw1so74135302igb.1
>> >        for <debian-security-request@lists.debian.org>; Tue, 19 Jan 2016
>> 11:01:55 -0800 (PST)
>> >DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
>> >        d=gmail.com; s=20120113;
>> >        h=mime-version:date:message-id:subject:from:to:content-type;
>> >        bh=Vxkp8yZr4P8V6TzTleHZpzCcV9/B/xWQu0t2h/PE0lw=;
>> >
>> b=gcV/A4o9xD7DskikOnOySfUQctBVPu6x44FwD5+/oeHllLoUf9cQGcVpUn6eJW5f+L
>> >
>>  V+8/RSE5mGBLR6UaKnucOb4NYWY+97qYbRLy00j/DVjnA9mn3tOTWAkVPBDTp8xKLvis
>> >
>>  cX/Bq985R+J07C2rLfSe4GMSatf0WbVgE458zmFcD6yR/OMqLqV+PlNS8DzC9xdjG25a
>> >
>>  DgA0liape8MY+O5CTXdNMLVVc3opxv71NRtvctfeGSLggDVwwi8x7+PDrKc+pOVZX6e2
>> >
>>  BgGcCVNDd+NlefN/NZHR+qRDTd07JR3nghgbyhspTr5krGonLA47FoTYFfj0u0QFEORY
>> >         syXQ==
>> >X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
>> >        d=1e100.net; s=20130820;
>> >        h=x-gm-message-state:mime-version:date:message-id:subject:from:to
>> >         :content-type;
>> >        bh=Vxkp8yZr4P8V6TzTleHZpzCcV9/B/xWQu0t2h/PE0lw=;
>> >
>> b=dTsV7jV3xCPbABdx3CumvamvoRObLLl4fUHvSaQA/5dW+yt889YhpHSskHNUnjD4q4
>> >
>>  1OS88R5NPHe35J7asmaAFq8ACEmmtoQ+tb4seYHeCcS0NxYvQMPib/Bvacm3oxndyeFW
>> >
>>  nnfyQJXYUOaghxBm583ziOaF2NWDkkv4iNVpE/uLRrBqH1CVBdE7z+h1GxsAAr4IrHr5
>> >
>>  2ud5Qtfz+ZsFBNolDOs8Di1MyQGLWa1Iv2EZJgJ7MFFhDewWRr9ombcai+VSUycC0aEa
>> >
>>  mu1GxshJfIRbQYEGrn+ieAJN87surexWb5jdm1JJCRKYyko8VXiEZuy/9rsvJXyeNJ17
>> >         5CgQ==
>>
>> >X-Gm-Message-State:AG10YOS+CFl0ml8uf1yZaRKNYw9kOr9eDdKZWwpaqAp4BlGi2lPT/qB7f3KL1Q9wkwIDrTrc1TM
>> k9Oh55D482A==
>> >MIME-Version: 1.0
>> >X-Received: by 10.50.136.136 with SMTP id
>> qa8mr7111321igb.39.1453230112707;
>> > Tue, 19 Jan 2016 11:01:52 -0800 (PST)
>> >Received: by 10.36.204.65 with HTTP; Tue, 19 Jan 2016 11:01:52 -0800
>> (PST)
>> >Received: by 10.36.204.65 with HTTP; Tue, 19 Jan 2016 11:01:52 -0800
>> (PST)
>> >Date: Tue, 19 Jan 2016 14:01:52 -0500
>> >Message-ID:
>> <CAG9FBFo4_85Vk8eiFEak1p2MiwmZJTksk2YaZYMHL-Rv_yDU8g@mail.gmail.com>
>> >Subject: Unsubscribe
>> >From: James Barrett <xucaen@gmail.com>
>> >To: debian-security-request@lists.debian.org
>> >Content-Type: multipart/alternative;
>> boundary=089e01536f8ca521790529b480c7
>> >X-Rc-Virus: 2007-09-13_01
>> >X-Rc-Spam: 2008-11-04_01
>> >
>> >--089e01536f8ca521790529b480c7
>> >Content-Type: text/plain; charset=UTF-8
>> >
>> >Unsubscribe
>> >
>> >--089e01536f8ca521790529b480c7
>> >Content-Type: text/html; charset=UTF-8
>> >
>> ><p dir="ltr">Unsubscribe</p>
>> >
>> >--089e01536f8ca521790529b480c7--
>> >
>>
>> On Tue, Jan 19, 2016 at 2:58 PM, Povl Ole Haarlev Olsen
>> <debian-security@stderr.dk> wrote:
>>       On Tue, 19 Jan 2016, James Barrett wrote:
>>             Please stop sending me these emails.
>>
>>
>>       If you want to unsubscribe from the debian-security-announce
>>       mailinglist, you should check the mail headers. They'll tell you
>>       what to do.
>>
>>       Your message was sent to another mailinglist, the
>>       debian-security list (without the "announce" part). That
>>       mailinglist is a bit more high volume and there's a risk your
>>       mail won't be seen by anyone from Debian. In other words:
>>       Unsubscribe yourself. Don't count on others.
>>
>>       --
>>       Povl Ole
>>
>>
>>
>>
>>
> --
> Povl Ole

[toc] | [prev] | [next] | [standalone]

#4486

FromPovl Ole Haarlev Olsen <debian-security@stderr.dk>
Date2016-01-20 01:30 +0100
Message-ID<qSOOT-6Wg-61@gated-at.bofh.it>
In reply to#4485
On Tue, 19 Jan 2016, James Barrett wrote:
> So you are saying there is no one there smart enough to know how their
> software works to remove me? all my other mails get sent back with errors,

No, what I said was that sending an email to the "debian-security" 
mailinglist is not how you unsubscribe from the "debian-security-announce" 
mailinglist.

An email to the "debian-security-request" address won't unsubscribe you 
from "debian-security-announce" either. It will try to unsubscribe you 
from "debian-security", but that's another mailinglist and you might not 
even be on that list to begin with. That's why you got an error.

> so obviously you are wrong.

Ok, I was just trying to help you.

But if I were to take a wild guess, based on the CC:-headers on your mail, 
you still haven't tried to send an email to

 	debian-security-announce-request@lists.debian.org

with the word

 	unsubscribe

as the subject.

Try. It might help...

-- 
Povl Ole

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web