[kernel-sec-discuss] r4932 - active

Ben Hutchings benh at moszumanska.debian.org
Wed Feb 15 18:52:48 UTC 2017 

Author: benh
Date: 2017-02-15 18:52:48 +0000 (Wed, 15 Feb 2017)
New Revision: 4932

Modified:
   active/CVE-2012-6704
   active/CVE-2014-9888
   active/CVE-2014-9895
   active/CVE-2015-8962
   active/CVE-2015-8963
   active/CVE-2015-8964
   active/CVE-2016-10088
   active/CVE-2016-6786
   active/CVE-2016-6787
   active/CVE-2016-7911
   active/CVE-2016-7912
   active/CVE-2016-7915
   active/CVE-2016-7917
   active/CVE-2016-8399
   active/CVE-2016-8405
   active/CVE-2016-8645
   active/CVE-2016-8650
   active/CVE-2016-8655
   active/CVE-2016-9120
   active/CVE-2016-9178
   active/CVE-2016-9191
   active/CVE-2016-9555
   active/CVE-2016-9576
   active/CVE-2016-9756
   active/CVE-2016-9793
   active/CVE-2016-9794
Log:
Mark issues pending for stable

Modified: active/CVE-2012-6704
===================================================================
--- active/CVE-2012-6704	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2012-6704	2017-02-15 18:52:48 UTC (rev 4932)
@@ -16,7 +16,7 @@
 Bugs:
 upstream: released (3.5-rc1) [82981930125abfd39d7c8378a9cfdf5e1be2002b]
 3.16-upstream-stable: N/A "Fixed before initial 3.16 release"
-3.2-upstream-stable: needed
+3.2-upstream-stable: pending (3.2.85) [net-cleanups-in-sock_setsockopt.patch]
 sid: released (3.8.11-1)
 3.16-jessie-security: N/A "Fixed before initial 3.16 release"
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/net-cleanups-in-sock_setsockopt.patch]

Modified: active/CVE-2014-9888
===================================================================
--- active/CVE-2014-9888	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2014-9888	2017-02-15 18:52:48 UTC (rev 4932)
@@ -7,7 +7,7 @@
 Bugs:
 upstream: released (3.13-rc1) [0ea1ec713f04bdfac343c9702b21cd3a7c711826]
 3.16-upstream-stable: N/A
-3.2-upstream-stable:
+3.2-upstream-stable: pending (3.2.85) [arm-dma-mapping-don-t-allow-dma-mappings-to-be-marked-executable.patch]
 sid: released (3.13.4-1)
 3.16-jessie-security: N/A
-3.2-wheezy-security:
+3.2-wheezy-security: needed

Modified: active/CVE-2014-9895
===================================================================
--- active/CVE-2014-9895	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2014-9895	2017-02-15 18:52:48 UTC (rev 4932)
@@ -6,7 +6,7 @@
 Bugs:
 upstream: released (3.11-rc1) [c88e739b1fad662240e99ecbd0bdaac871717987]
 3.16-upstream-stable: N/A
-3.2-upstream-stable:
+3.2-upstream-stable: pending (3.2.85) [media-info-leak-in-__media_device_enum_links.patch]
 sid: released (3.11.5-1)
 3.16-jessie-security: N/A
-3.2-wheezy-security: 
+3.2-wheezy-security: needed

Modified: active/CVE-2015-8962
===================================================================
--- active/CVE-2015-8962	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2015-8962	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.4-rc1) [f3951a3709ff50990bf3e188c27d346792103432]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [sg-fix-double-free-when-drives-detach-during-sg_io.patch]
+3.2-upstream-stable: pending (3.2.85) [sg-fix-double-free-when-drives-detach-during-sg_io.patch]
 sid: released (4.4.2-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg-fix-double-free-when-drives-detach-during-sg_io.patch]

Modified: active/CVE-2015-8963
===================================================================
--- active/CVE-2015-8963	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2015-8963	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.4) [12ca6ad2e3a896256f086497a7c7406a547ee373]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [perf-fix-race-in-swevent-hash.patch]
+3.2-upstream-stable: pending (3.2.85) [perf-fix-race-in-swevent-hash.patch]
 sid: released (4.4.2-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/perf-fix-race-in-swevent-hash.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/perf-fix-race-in-swevent-hash.patch]

Modified: active/CVE-2015-8964
===================================================================
--- active/CVE-2015-8964	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2015-8964	2017-02-15 18:52:48 UTC (rev 4932)
@@ -11,8 +11,8 @@
  bwh> regression.
 Bugs:
 upstream: released (4.5-rc1) [dd42bf1197144ede075a9d4793123f7689e164bc]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch]
+3.2-upstream-stable: pending (3.2.85) [tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch]
 sid: released (4.5.1-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/tty-prevent-ldisc-drivers-from-re-using-stale-tty-fi.patch]

Modified: active/CVE-2016-10088
===================================================================
--- active/CVE-2016-10088	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-10088	2017-02-15 18:52:48 UTC (rev 4932)
@@ -7,8 +7,8 @@
  bwh> This is the vulnerabilbility left after fixing CVE-2016-9576.
 Bugs:
 upstream: released (4.10-rc1) [128394eff343fc6d2f32172f03e24829539c5835]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [sg_write-bsg_write-is-not-fit-to-be-called-under-kernel_ds.patch]
+3.2-upstream-stable: pending (3.2.85) [sg_write-bsg_write-is-not-fit-to-be-called-under-kernel_ds.patch]
 sid: released (4.8.15-2) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch]
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]

Modified: active/CVE-2016-6786
===================================================================
--- active/CVE-2016-6786	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-6786	2017-02-15 18:52:48 UTC (rev 4932)
@@ -6,8 +6,8 @@
 Bugs:
  https://bugzilla.redhat.com/show_bug.cgi?id=1403842
 upstream: released (4.0-rc1) [f63a8daa5812afef4f06c962351687e1ff9ccb2b]
-3.16-upstream-stable:
-3.2-upstream-stable:
+3.16-upstream-stable: pending (3.16.40) [perf-fix-event-ctx-locking.patch]
+3.2-upstream-stable: pending (3.2.85) [perf-fix-event-ctx-locking.patch]
 sid: released (4.0.2-1)
-3.16-jessie-security:
-3.2-wheezy-security:
+3.16-jessie-security: needed
+3.2-wheezy-security: needed

Modified: active/CVE-2016-6787
===================================================================
--- active/CVE-2016-6787	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-6787	2017-02-15 18:52:48 UTC (rev 4932)
@@ -1,11 +1,13 @@
 Description: Possible privilege escalation due to lack of locking around changing event->ctx
 References:
 Notes:
+ bwh> The upstream fix was not complete; see commit 321027c1fe77 "perf/core:
+ bwh> Fix concurrent sys_perf_event_open() vs. 'move_group' race"
 Bugs:
  https://bugzilla.redhat.com/show_bug.cgi?id=1403842
 upstream: released (4.0-rc1) [f63a8daa5812afef4f06c962351687e1ff9ccb2b]
-3.16-upstream-stable:
-3.2-upstream-stable:
+3.16-upstream-stable: pending (3.16.40) [perf-fix-event-ctx-locking.patch]
+3.2-upstream-stable: pending (3.2.85) [perf-fix-event-ctx-locking.patch]
 sid: released (4.0.2-1)
-3.16-jessie-security:
-3.2-wheezy-security:
+3.16-jessie-security: needed
+3.2-wheezy-security: needed

Modified: active/CVE-2016-7911
===================================================================
--- active/CVE-2016-7911	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-7911	2017-02-15 18:52:48 UTC (rev 4932)
@@ -5,7 +5,7 @@
 Bugs:
 upstream: released (4.7-rc7) 8ba8682107ee2ca3347354e018865d8e1967c5f4]
 3.16-upstream-stable: released (3.16.37)
-3.2-upstream-stable: needed
+3.2-upstream-stable: pending (3.2.85) [block-fix-use-after-free-in-sys_ioprio_get.patch]
 sid: released (4.7.2-1)
 3.16-jessie-security: released (3.16.39-1)
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/block-fix-use-after-free-in-sys_ioprio_get.patch]

Modified: active/CVE-2016-7912
===================================================================
--- active/CVE-2016-7912	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-7912	2017-02-15 18:52:48 UTC (rev 4932)
@@ -5,7 +5,7 @@
  carnil> but might have been backported.
 Bugs:
 upstream: released (4.6-rc5) [38740a5b87d53ceb89eb2c970150f6e94e00373a]
-3.16-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [usb-gadget-f_fs-fix-use-after-free.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.5.3-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/usb-gadget-f_fs-fix-use-after-free.patch]

Modified: active/CVE-2016-7915
===================================================================
--- active/CVE-2016-7915	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-7915	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.6-rc1) [50220dead1650609206efe91f0cc116132d59b3f]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [hid-core-prevent-out-of-bound-readings.patch]
+3.2-upstream-stable: pending (3.2.85) [hid-core-prevent-out-of-bound-readings.patch]
 sid: released (4.6.1-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/hid-core-prevent-out-of-bound-readings.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/hid-core-prevent-out-of-bound-readings.patch]

Modified: active/CVE-2016-7917
===================================================================
--- active/CVE-2016-7917	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-7917	2017-02-15 18:52:48 UTC (rev 4932)
@@ -12,7 +12,7 @@
  bwh> stable branches)
 Bugs:
 upstream: released (4.5-rc6) [c58d6c93680f28ac58984af61d0a7ebf4319c241]
-3.16-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [netfilter-nfnetlink-correctly-validate-length-of-batch-messages.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.5.1-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/netfilter-nfnetlink-correctly-validate-length-of-bat.patch]

Modified: active/CVE-2016-8399
===================================================================
--- active/CVE-2016-8399	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-8399	2017-02-15 18:52:48 UTC (rev 4932)
@@ -6,8 +6,8 @@
  bwh> don't change that default and this is not exploitable.
 Bugs:
 upstream: released (4.9) [0eab121ef8750a5c8637d51534d5e9143fb0633f]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [net-ping-check-minimum-size-on-icmp-header-length.patch]
+3.2-upstream-stable: pending (3.2.85) [net-ping-check-minimum-size-on-icmp-header-length.patch]
 sid: released (4.8.15-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/net-ping-check-minimum-size-on-icmp-header-length.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/net-ping-check-minimum-size-on-icmp-header-length.patch]

Modified: active/CVE-2016-8405
===================================================================
--- active/CVE-2016-8405	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-8405	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.10-rc6) [2dc705a9930b4806250fbf5a76e55266e59389f2]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [fbdev-color-map-copying-bounds-checking.patch]
+3.2-upstream-stable: pending (3.2.85) [fbdev-color-map-copying-bounds-checking.patch]
 sid: released (4.9.6-1) [bugfix/all/fbdev-color-map-coying-bounds-checking.patch]
 3.16-jessie-security: needed
 3.2-wheezy-security: needed

Modified: active/CVE-2016-8645
===================================================================
--- active/CVE-2016-8645	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-8645	2017-02-15 18:52:48 UTC (rev 4932)
@@ -18,8 +18,8 @@
  bwh> Only the specific case found by syzkaller seems to depend on it.
 Bugs:
 upstream: released (4.9-rc6) [ac6e780070e30e4c35bd395acfe9191e6268bdd3]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [tcp-take-care-of-truncations-done-by-sk_filter.patch]
+3.2-upstream-stable: pending (3.2.85) [tcp-take-care-of-truncations-done-by-sk_filter.patch]
 sid: released (4.8.11-1) [2b5f22e4f7fd208c8d392e5c3755cea1f562cb98]
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch]

Modified: active/CVE-2016-8650
===================================================================
--- active/CVE-2016-8650	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-8650	2017-02-15 18:52:48 UTC (rev 4932)
@@ -5,7 +5,7 @@
 Notes:
 Bugs:
 upstream: released (4.9-rc7) [f5527fffff3f002b0a6b376163613b82f69de073]
-3.16-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [mpi-fix-null-ptr-dereference-in-mpi_powm.patch]
 3.2-upstream-stable: N/A "Vulnerable code introduced in 3.3-rc1 with cdec9cb5167ab1113ba9c58e395f664d9d3f9acb"
 sid: released (4.8.11-1) [bugfix/all/mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch]
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch]

Modified: active/CVE-2016-8655
===================================================================
--- active/CVE-2016-8655	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-8655	2017-02-15 18:52:48 UTC (rev 4932)
@@ -7,8 +7,8 @@
  bwh> vulnerability without unprivileged user namespaces enabled.
 Bugs:
 upstream: released (4.9-rc8) [84ac7260236a49c79eede91617700174c2c19b0c]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [packet-fix-race-condition-in-packet_set_ring.patch]
+3.2-upstream-stable: pending (3.2.85) [packet-fix-race-condition-in-packet_set_ring.patch]
 sid: released (4.8.15-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch]

Modified: active/CVE-2016-9120
===================================================================
--- active/CVE-2016-9120	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9120	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,7 +3,7 @@
 Notes:
 Bugs:
 upstream: released (4.6-rc1) [9590232bb4f4cc824f3425a6e1349afbe6d6d2b7]
-3.16-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [staging-android-ion-fix-a-race-condition-in-the-ion-driver.patch]
 3.2-upstream-stable: N/A "Vulnerable code not present"
 sid: released (4.6.1-1)
 3.16-jessie-security: ignored "Debian is not Android"

Modified: active/CVE-2016-9178
===================================================================
--- active/CVE-2016-9178	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9178	2017-02-15 18:52:48 UTC (rev 4932)
@@ -10,8 +10,8 @@
  jmm> Linus prepared a backport for 4.4.31: dc1555e670c373bfa4ca2e1e2f839d5fe2b4501a
 Bugs:
 upstream: released (4.8-rc7) [1c109fabbd51863475cd12ac206bdd249aee35af]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [fix-potential-infoleak-in-older-kernels.patch]
+3.2-upstream-stable: pending (3.2.85) [fix-potential-infoleak-in-older-kernels.patch]
 sid: released (4.7.5-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/x86/fix-potential-infoleak-in-older-kernels.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/x86/fix-potential-infoleak-in-older-kernels.patch]

Modified: active/CVE-2016-9191
===================================================================
--- active/CVE-2016-9191	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9191	2017-02-15 18:52:48 UTC (rev 4932)
@@ -5,7 +5,7 @@
  Introduced with f0c3b5093addc8bfe9fe3a5b01acb7ec7969eafa in 3.11-rc1
 Bugs:
 upstream: released (4.10-rc4) [93362fa47fe98b62e4a34ab408c4a418432e7939]
-3.16-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch]
 3.2-upstream-stable: N/A "Vulnerable code introduced in 3.11-rc1"
 sid: released (4.9.6-1)
 3.16-jessie-security: needed

Modified: active/CVE-2016-9555
===================================================================
--- active/CVE-2016-9555	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9555	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.9-rc4) [bf911e985d6bbaa328c20c3e05f4eb03de11fdd6]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [sctp-validate-chunk-len-before-actually-using-it.patch]
+3.2-upstream-stable: pending (3.2.85) [sctp-validate-chunk-len-before-actually-using-it.patch]
 sid: released (4.8.11-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/sctp-validate-chunk-len-before-actually-using-it.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sctp-validate-chunk-len-before-actually-using-it.patch]

Modified: active/CVE-2016-9576
===================================================================
--- active/CVE-2016-9576	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9576	2017-02-15 18:52:48 UTC (rev 4932)
@@ -11,8 +11,8 @@
  bwh> complete fix for both CVEs.
 Bugs:
 upstream: released (4.9) [a0ac402cfcdc904f9772e1762b3fda112dcc56a0]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [sg_write-bsg_write-is-not-fit-to-be-called-under-kernel_ds.patch]
+3.2-upstream-stable: pending (3.2.85) [sg_write-bsg_write-is-not-fit-to-be-called-under-kernel_ds.patch]
 sid: released (4.8.15-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-ker.patch]

Modified: active/CVE-2016-9756
===================================================================
--- active/CVE-2016-9756	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9756	2017-02-15 18:52:48 UTC (rev 4932)
@@ -4,8 +4,8 @@
 Bugs:
  https://bugzilla.redhat.com/show_bug.cgi?id=1400468
 upstream: released (4.9-rc7) [2117d5398c81554fbf803f5fd1dc55eb78216c0c]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret_far.patch]
+3.2-upstream-stable: pending (3.2.85) [kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret_far.patch]
 sid: released (4.8.15-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/x86/kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/x86/kvm-x86-drop-error-recovery-in-em_jmp_far-and-em_ret.patch]

Modified: active/CVE-2016-9793
===================================================================
--- active/CVE-2016-9793	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9793	2017-02-15 18:52:48 UTC (rev 4932)
@@ -6,8 +6,8 @@
  bwh> to fix CVE-2012-6704, so this will be needed on those branches too.
 Bugs:
 upstream: released (4.9-rc8) [b98b0bc8c431e3ceb4b26b0dfc8db509518fb290]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]
+3.2-upstream-stable: pending (3.2.85) [net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]
 sid: released (4.8.15-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/net-avoid-signed-overflows-for-so_-snd-rcv-bufforce.patch]

Modified: active/CVE-2016-9794
===================================================================
--- active/CVE-2016-9794	2017-02-15 17:39:33 UTC (rev 4931)
+++ active/CVE-2016-9794	2017-02-15 18:52:48 UTC (rev 4932)
@@ -3,8 +3,8 @@
 Notes:
 Bugs:
 upstream: released (4.7-rc1) [3aa02cb664c5fb1042958c8d1aa8c35055a2ebc4]
-3.16-upstream-stable: needed
-3.2-upstream-stable: needed
+3.16-upstream-stable: pending (3.16.40) [alsa-pcm-call-kill_fasync-in-stream-lock.patch]
+3.2-upstream-stable: pending (3.2.85) [alsa-pcm-call-kill_fasync-in-stream-lock.patch]
 sid: released (4.7.2-1)
 3.16-jessie-security: released (3.16.39-1) [bugfix/all/alsa-pcm-call-kill_fasync-in-stream-lock.patch]
 3.2-wheezy-security: released (3.2.84-1) [bugfix/all/alsa-pcm-call-kill_fasync-in-stream-lock.patch]

More information about the kernel-sec-discuss mailing list