Re: Security support incomplete?

From	"Pedro M. Jorge" <pmjorge@lip.pt>
Newsgroups	linux.debian.security
Subject	Re: Security support incomplete?
Date	2016-02-02 18:50 +0100
Message-ID	<qXNft-6ut-19@gated-at.bofh.it> (permalink)
References	<qVxou-3nT-19@gated-at.bofh.it> <qXFKW-BP-15@gated-at.bofh.it> <qXG4h-ZH-7@gated-at.bofh.it> <qXLdD-51l-9@gated-at.bofh.it> <qXLQm-5Be-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 2016-02-02 16:14, Yves-Alexis Perez wrote:
> On mar., 2016-02-02 at 17:37 +0200, Wolfgang Jeltsch wrote:
>> Can anyone please clarify? In particular, I would like to know what 
>> the
>> exact policies regarding coverage of security support are, and what
>> issues have not been fixed intentionally in oldstable (and maybe even
>> stable).
> 
> Everything is in the tracker.
> 
> Regards,

Hi,

Even the tracker has its issues.

Looking at the DSA in the announcement
https://security-tracker.debian.org/tracker/DSA-3455-1
"Debian/oldstable	not known to be vulnerable."
but looking at the matching CVE
https://security-tracker.debian.org/tracker/CVE-2016-0755
"Debian/oldstable	package curl is vulnerable."

Pointing me to the tracker just brought me the unpleasant news that I 
was already vulnerable to the older
https://security-tracker.debian.org/tracker/CVE-2015-3153
"Debian/oldstable	package curl is vulnerable."
https://security-tracker.debian.org/tracker/DSA-3240-1
"Debian/oldstable	not known to be vulnerable."

Thanks for the work, anyway.

Pedro.

Thread

Re: [SECURITY] [DSA 3455-1] curl security update Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 10:50 +0100
  Re: [SECURITY] [DSA 3455-1] curl security update Freddy Spierenburg <freddy@snarl.nl> - 2016-02-02 11:10 +0100
    Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl  security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 16:40 +0100
      Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 17:20 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Wolfgang Jeltsch <7o2lccqg@acme.softbase.org> - 2016-02-02 17:30 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1] curl security update) Holger Levsen <holger@layer-acht.org> - 2016-02-02 18:20 +0100
          Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Sébastien NOBILI <sebnewsletter@free.fr> - 2016-02-02 18:50 +0100
          Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 22:30 +0100
            Re: Security support incomplete? Davide Prina <davide.prina@gmail.com> - 2016-02-02 23:10 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Marc Haber <mh+debian-security@zugschlus.de> - 2016-02-02 18:00 +0100
        Re: Security support incomplete? (was: Re: [SECURITY] [DSA 3455-1]  curl security update) Lupe Christoph <lupe@lupe-christoph.de> - 2016-02-02 18:10 +0100
        Re: Security support incomplete? "Pedro M. Jorge" <pmjorge@lip.pt> - 2016-02-02 18:50 +0100
          Re: Security support incomplete? Yves-Alexis Perez <corsac@debian.org> - 2016-02-02 19:10 +0100

csiph-web