Bug#831857: Security update for libupnp (CVE-2016-6255, CVE-2016-8863)

2016-12-13 Thread Sébastien Delafond
On Dec/13, Uwe Kleine-König wrote: > I had the impression that the 2nd might be bad, too. There is no > public exploit available, but AFAIK writing to unallocated memory is > dangerous? Yes, it is, you're right. But the first one is such an obvious flaw, that it doesn't require any sort of

Bug#831857: Security update for libupnp (CVE-2016-6255, CVE-2016-8863)

2016-12-13 Thread Sébastien Delafond
On Dec/13, Uwe Kleine-König wrote: > Do you consider CVE-2016-6255 and CVE-2016-8863 bad enough to make a > security update for it? If so, I suggest the following debdiff. Yes, the first one is bad, so let's fix both via a DSA. Could you please provide a debdiff with

Bug#831857: Security update for libupnp (CVE-2016-6255, CVE-2016-8863)

2016-12-13 Thread Uwe Kleine-König
Hello, Do you consider CVE-2016-6255 and CVE-2016-8863 bad enough to make a security update for it? If so, I suggest the following debdiff. Best regards Uwe diff -Nru libupnp-1.6.19+git20141001/debian/changelog libupnp-1.6.19+git20141001/debian/changelog ---