Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #171464

Re: Any idea when CVE-2016-5696 is going to get fixed?

Show all headers | View raw

On Friday 26 August 2016 16:13:09 Mark Fletcher wrote:
> On Sat, Aug 27, 2016 at 12:04 AM Perry E. Metzger <perry@piermont.com>
>
> wrote:
> > According to:
> >
> > https://security-tracker.debian.org/tracker/CVE-2016-5696
> >
> > Wheezy and Jessie are still vulnerable. The attack in question is
> > kind of bad (it allows blind injection of arbitrary data into
> > things like http downloads) and has been known for a few weeks now to
> > the general public.
> >
> > Any idea out there when updates to the kernels in question will be
> > released?
>
> I could have sworn I saw a fix for this sometime last week, as I would only
> have become aware of it when the security advisory was published. I built a
> new kernel based on 4.7 for my non-debian boxes last weekend, and assumed
> the regular updates would take care of Debian. I've long since deleted the
> email of course, but I am not sure how I would have even known there was an
> issue unless there had been one of the usual mails saying "this issue is
> fixed in...". But I agree that is not how the CVE item you linked to makes
> it look. Could there be a duplicate, with all the updates on the other one?

The "fix" seems not to have been dealt with yet, but the list has published a 
workaround at some length in this thread:

https://lists.debian.org/msgid-search/slrnnqp80d.67r.curty@einstein.electron.org

These in particular discuss the "solution":
 https://lists.debian.org/msgid-search/20160811162119.GA19111@e1030
 
https://lists.debian.org/msgid-search/28cd04df-18a6-caa9-d4ff-b4761c3f7dd7@gmail.com

https://lists.debian.org/msgid-search/slrnnqr3sv.3uk.curty@einstein.electron.org

Lisi

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 17:10 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-26 17:20 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-26 18:40 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-26 19:50 +0200
  Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-26 21:10 +0200
    Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-27 05:20 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? "John T. Haggerty" <jpcookie@gmail.com> - 2016-08-27 05:30 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2016-08-27 17:50 +0200
      Re: Any idea when CVE-2016-5696 is going to get fixed? Frederic Marchal <frederic.marchal@wowtechnology.com> - 2016-08-28 14:40 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-28 21:40 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-28 23:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Tixy <tixy@yxit.co.uk> - 2016-08-29 13:00 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Gene Heskett <gheskett@shentel.net> - 2016-08-29 18:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Thomas Schmitt" <scdbackup@gmx.net> - 2016-08-29 19:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 20:30 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? deloptes <deloptes@gmail.com> - 2016-08-29 23:50 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-30 00:40 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? Charlie <ariestao1@ipstarmail.com.au> - 2016-08-30 06:50 +0200
        Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 03:30 +0200
          Re: Any idea when CVE-2016-5696 is going to get fixed? Mark Fletcher <mark27q1@gmail.com> - 2016-08-29 05:50 +0200
            Re: Any idea when CVE-2016-5696 is going to get fixed? "Neal P. Murphy" <neal.p.murphy@alum.wpi.edu> - 2016-08-29 07:10 +0200
              Re: Any idea when CVE-2016-5696 is going to get fixed? Salvatore Bonaccorso <carnil@debian.org> - 2016-08-29 07:30 +0200
                Re: Any idea when CVE-2016-5696 is going to get fixed? "Perry E. Metzger" <perry@piermont.com> - 2016-08-29 18:20 +0200

csiph-web