Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5038

Re: Robustify manager_dispatch_notify_fd()

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello Michael,

On 16-10-03 12:11:48, Michael Biebl wrote:
> > https://security-tracker.debian.org/tracker/CVE-2016-7796 says all
> > but the version in sid are vulnerable to CVE-2016-7796 and reading
>
> No, sid is not vulnerable. It has been fixed in 231-9

I wrote 'all but the version in sid', English not being my mother tongue
this seemed to me the correct way to express exactly that, i.e. 'sid is
not vulnerable', but maybe I'm wrong.

> > https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
> > 
> > this sounds still rather serious, so a security upload would be
> > appreciated.
> > 
> 
> This bugs is *not* about CVE-2016-7796 and as I wrote, stable is not
> affected by the crash.

You didn't write about which CVE the bug is (or maybe I missed that),
just that the 'news about systemd crashing when getting a zero sized
message on the notification socket made the rounds recently'.

> Are you a member of the security team?

No, I never said I am, but it seems you noticed your error or were
pointed to it.

And thanks to Florian and Salvatore for reading the same information
that I did and taking this seriously in a polite manner.

Cheers
Wolfgang

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:40 +0200
  Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-02 22:50 +0200
  Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 08:30 +0200
    Re: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:20 +0200
      Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:40 +0200
      Bug#839607: Robustify manager_dispatch_notify_fd() Michael Biebl <biebl@debian.org> - 2016-10-03 12:50 +0200
        Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 13:00 +0200
          Bug#839607: Robustify manager_dispatch_notify_fd() Salvatore Bonaccorso <carnil@debian.org> - 2016-10-03 14:00 +0200
            Bug#839607: Robustify manager_dispatch_notify_fd() Florian Weimer <fw@deneb.enyo.de> - 2016-10-03 14:00 +0200
      Re: Robustify manager_dispatch_notify_fd() Wolfgang Karall <lists+debian-security@karall-edv.at> - 2016-10-03 14:40 +0200

csiph-web