Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Salvatore Bonaccorso
Source: systemd Version: 204-1 Severity: grave Tags: security upstream Justification: user security hole Control: found -1 232-25+deb9u6 Control: found -1 240-2 Hi, The following vulnerability was published for systemd. CVE-2018-16864[0]: memory corruption If you fix the vulnerability please al

Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Michael Biebl
On Wed, 09 Jan 2019 21:08:51 +0100 Salvatore Bonaccorso wrote: > Source: systemd > Version: 204-1 > Severity: grave > Tags: security upstream > Justification: user security hole > Control: found -1 232-25+deb9u6 > Control: found -1 240-2 > > Hi, > > The following vulnerability was published for

Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Michael Biebl
Am 09.01.19 um 22:45 schrieb Michael Biebl: > Should CVE-2018-16864, CVE-2018-16865 and CVE-2018-16866 be handled > separately, i.e. do you plan to file separate bug reports? Hm, for some reason I only received #918848 just now. So that part of my question is moot. Regards, Michael -- Why is it

Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Salvatore Bonaccorso
Hi, On Wed, Jan 09, 2019 at 10:50:32PM +0100, Michael Biebl wrote: > Am 09.01.19 um 22:45 schrieb Michael Biebl: > > Should CVE-2018-16864, CVE-2018-16865 and CVE-2018-16866 be handled > > separately, i.e. do you plan to file separate bug reports? > > Hm, for some reason I only received #918848 j

Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Michael Biebl
On Wed, 09 Jan 2019 21:08:51 +0100 Salvatore Bonaccorso wrote: > Source: systemd > Version: 204-1 > Severity: grave > Tags: security upstream > Justification: user security hole > Control: found -1 232-25+deb9u6 > Control: found -1 240-2 > > Hi, > > The following vulnerability was published for

Bug#918841: systemd: CVE-2018-16864

2019-01-09 Thread Salvatore Bonaccorso
Hi Michael, On Thu, Jan 10, 2019 at 01:41:17AM +0100, Michael Biebl wrote: > On Wed, 09 Jan 2019 21:08:51 +0100 Salvatore Bonaccorso > wrote: > > Source: systemd > > Version: 204-1 > > Severity: grave > > Tags: security upstream > > Justification: user security hole > > Control: found -1 232-25+d

Re: Bug#918841: systemd: CVE-2018-16864

2019-01-18 Thread Kai Bojens
>> Should we mark old-stable as not affected given the remark that the >> vulnerability is exploitable since v230? >> https://security-tracker.debian.org/tracker/CVE-2018-16864 > I do not think so, not-affected would mean the issue is not present. > CVE-2018-16864 though is introduced in v203 its