4 ms·
On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
by TekMol 5y ago
On Debian 10, "apt update && apt upgrade" says all packages are up to date.
Did the fixes not land in Debian yet?
- forbiddenlake 5y agoYou can check the status of vulnerabilities like this with a quick Google of "Debian" plus the CVE. Example for this one is https://security-tracker.debian.org/tracker/CVE-2021-33193 https://security-tracker.debian.org/tracker/CVE-2021-33193 . When a patch is released, the package may not say 2.4.49, but that page will have the exact version number with the fix.
- TekMol 5y agoThis page confused me. It seems to have bugs for Android? Example: https://security-tracker.debian.org/tracker/CVE-2021-30521 https://security-tracker.debian.org/tracker/CVE-2021-30521 "Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page."
- meibo 5y agoWhile bugs like that aren't "confirmed" to affect desktop versions of software, the underlying bug is still in the Desktop codebase and needs to be treated as a security issue.
- wccrawford 5y ago>All five flaws are resolved with HTTP Server 2.4.49. The WSL version of Ubuntu is reporting 2.4.41 for me still. I don't know about the real version.
- xxpor 5y agoWSL ubuntu uses the same repos as regular ubuntu so they should be in sync
- dtech 5y agoDebian back-ports patches. I guess they'll need some time although they are usually informed in advance
- beermonster 5y agoQuite often there are many vulnerabilities with no ‘fixed-in’ version (as it’s not yet fixed) and this can be for some time. https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... is one place to look through in the past I think there was a better link I used to use to find all vulnerable packages which were awaiting a fix - but I can’t seem to find it now.
- dspillett 5y agoCould be the case. Could also be that the bugs were never in Debian if they were introduced recently as Debian stable is relatively conservative about package updates other than for security purposes.
- atatatat 5y agoThe long(er) patch cycle is why I switched away from Debian. Decent privacy, questionable security vs stability if you're serious about it.