3 ms·
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104 https://www.debian.org/security/2018/dsa-4104
by chungy 9y ago
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104 https://www.debian.org/security/2018/dsa-4104
- landave 9y agoThat's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969. [0]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ https://landave.io/2018/01/7-zip-multiple-memory-corruptions...
- carey 9y agoThe Debian security team doesn’t patch packages from the non-free repository, like the 7-Zip RAR support: https://www.debian.org/security/faq#contrib https://www.debian.org/security/faq#contrib That would have to wait for the maintainer to upload a new version and get it into a stable release.
- fulafel 9y agoUbuntu doesn't get these patches, unless some non-Canonical volunteer puts in the effort to prepare a package and get a sponsor from Canonical. Future version of ubuntu will eventually get the fix because Ubuntu it will be forked off from a sufficiently new version of Debian. here's the status of your DSA's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-17969.html https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2... Here's the status of the post's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10115.html https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2...