Re: CVE applicability

From	Thomas Hochstein <thh@thh.name>
Newsgroups	linux.debian.security
Subject	Re: CVE applicability
Date	2024-06-19 23:50 +0200
Message-ID	<IRblL-48rS-3@gated-at.bofh.it> (permalink)
References	<IQMdH-3RwF-9@gated-at.bofh.it> <IQMdH-3RwF-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Arul Anand MM wrote:

> Advisory page on September 14
> https://web.archive.org/web/20230924174231/https://security-tracker.debian.org/tracker/CVE-2023-3390
> states the issue is fixed in 5.10.191-1

No, it doesn't.

It states the issue was fixed - for bullseye, i.e. oldstable - in
5.10.179-3 (lower table).

It also states that 5.10.191-1 was the current version in "bullseye
(security)", so that suite was not vulnerable.

> but the current version of advisory
> states "5.10.209-2" as the fixed version.

No, it doesn't. :-)

It still states the issue was fixed in 5.10.179-3 (lower table).

The current version in "bullseye (security)" is now 5.10.218-1, and in
"bullseye" it's 5.10.209-2, so neither suite is vulnerable.

The fixed version doesn't change. The current version in suites that still
get updates does, of course.

-thh

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

CVE applicability Arul Anand MM <arulanandkk1@gmail.com> - 2024-06-18 21:00 +0200
  Re: CVE applicability Salvatore Bonaccorso <carnil@debian.org> - 2024-06-19 08:00 +0200
  Re: CVE applicability Thomas Hochstein <thh@thh.name> - 2024-06-19 23:50 +0200

csiph-web