From: Benjamin Kaduk Date: Wed, 28 Oct 2015 15:45:27 +0000 (-0400) Subject: Import openafs-1.6.9-2+deb8u3 by unpacking the source package X-Git-Tag: debian/1.6.9-2+deb8u6~6 X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=8890b057059b816e66fbab8a943a65b3009ab9b8;p=packages%2Fo%2Fopenafs.git Import openafs-1.6.9-2+deb8u3 by unpacking the source package The actual security upload was done out-of-band from this source repository, so bring things back into synchronization before beginning additional work. Only changes in debian/ need to be imported, since the source code changes are handled via debian/patches and not made directly in the repository. --- diff --git a/debian/changelog b/debian/changelog index 81b4d65f4..c2c43fbc9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,18 +1,19 @@ openafs (1.6.9-2+deb8u3) jessie-security; urgency=high - * Apply upstream security deltas from the 1.6.13 release: - - 14a4e5bf OPENAFS-SA-2015-001: vos leaks stack data onto the wire - when creating vldb entries - - eea46650 OPENAFS-SA-2015-002: bos commands can be spoofed, including - some which alter server state - - d4cd5780 OPENAFS-SA-2015-003: pioctls leak kernel memory contents - - 06a5b0bd OPENAFS-SA-2015-004: kernel pioctl support for OSD command - parsing can trigger a panic - - 63087b33 OPENAFS-SA-2015-006: Buffer overflow in OpenAFS vlserver + * Apply upstream security patches from the 1.6.13 release (thanks to + Benjamin Kaduk for providing the patches): + - OPENAFS-SA-2015-001 (CVE-2015-3282): vos leaks stack data onto the wire when creating + vldb entries + - OPENAFS-SA-2015-002 (CVE-2015-3283): bos commands can be spoofed, including some + which alter server state + - OPENAFS-SA-2015-003 (CVE-2015-3284): pioctls leak kernel memory contents + - OPENAFS-SA-2015-004 (CVE-2015-3285): kernel pioctl support for OSD command parsing + can trigger a panic + - OPENAFS-SA-2015-006 (CVE-2015-3287): Buffer overflow in OpenAFS vlserver * The patch for OPENAFS-SA-2015-005 is not applied, since that vulnerability is limited to the Solaris kernel module - -- Benjamin Kaduk Thu, 30 Jul 2015 02:47:21 -0400 + -- Sebastien Delafond Thu, 30 Jul 2015 11:53:25 +0200 openafs (1.6.9-2+deb8u2) testing; urgency=high