Le 05/01/2012 23:37, Pascal Terjan a écrit :
Here is the output of a little script I just wrote.
Vulnerable version, please check that a patch was applied if needed
I tried to do it for bind, and dhcp, however I'm a bit confused about
the svn tree...
For bind, the updates/1/bind/current path contains a SPEC file
corresponding to a 9.8.1-6.P1 package, which doesn't exist anywhere on
the mirror:
9.8.1P1-1.mga1 for pending updates updates_testing
9.8.0-6.P4.mga1 for available updates
9.8.0-6.P1.mga1 for release
For dhcp, the updates/1/dhcp/current path contains a SPEC file
corresponding to the release package (3:4.2.1-0.P1.3):
3:4.2.1-0.P1.3.1.mga1 for pending updates
3:4.2.1-0.P1.3.mga1 for release
So, I guess 1/<foo>/current should match release package,
updates/1/<foo>/current should match latest available update, but where
is located pending updates package content ?
[..]
* openssl 1.0.0d
- CVE-2011-1945
- CVE-2011-3207
- CVE-2011-3210
+ CVE-2011-4108
+ CVE-2011-4109
+ CVE-2011-4576
+ CVE-2011-4577
+ CVE-2011-4619
+ CVE-2012-0027
--
BOFH excuse #11:
magnetic interference from money/credit cards
