[kernel] r5329 - patch-tracking

[Moritz Muehlenhoff]

Author: jmm-guest
Date: Fri Jan  6 23:18:13 2006
New Revision: 5329

Modified:
   patch-tracking/CVE-2003-0465
   patch-tracking/CVE-2004-0181
   patch-tracking/CVE-2004-0816
Log:
CVE-2003-0465 resolved for Sarge
CVE-2004-0816 resolved for all
CVE-2004-0181 resolved for all


Modified: patch-tracking/CVE-2003-0465
==============================================================================
--- patch-tracking/CVE-2003-0465	(original)
+++ patch-tracking/CVE-2003-0465	Fri Jan  6 23:18:13 2006
@@ -17,12 +17,15 @@
  .
  dannf> Since this is minor, I'm gonna consider the existing patch "good enough"
  dannf> and mark the 2.4 issues as complete.
+ jmm> Alan Cox wrote in above URL that these will be addressed during the 2.5
+ jmm> cycle, so I guess it's pretty safe to make all the 2.6 kernels as fixed
+ jmm> The ramifications are minor anyway
 Bugs: 
 upstream: 
-linux-2.6: 
-2.6.8-sarge-security: 
+linux-2.6: N/A
+2.6.8-sarge-security: N/A
 2.4.27-sarge-security: released (2.4.27-8)
-2.6.8: 
+2.6.8: N/A
 2.4.19-woody-security: pending (2.4.19-4.woody3)
 2.4.18-woody-security: pending (2.4.18-14.5)
 2.4.17-woody-security: pending (2.4.17-1woody4)

Modified: patch-tracking/CVE-2004-0181
==============================================================================
--- patch-tracking/CVE-2004-0181	(original)
+++ patch-tracking/CVE-2004-0181	Fri Jan  6 23:18:13 2006
@@ -1,4 +1,4 @@
-Candidate: CVE-2005-0181
+Candidate: CVE-2004-0181
 References: 
  http://www.linuxsecurity.com/advisories/engarde_advisory-4285.html
  http://security.gentoo.org/glsa/glsa-200407-02.xml
@@ -12,15 +12,17 @@
  in-memory data is written to the device for the JFS file system, which allows
  local users to obtain sensitive information by reading the raw device.
 Notes: 
+ jmm> JFS was merged into the 2.4 kernel in 2.4.20-pre4 and into 2.6 at 2.6.5-rc2,
+ jmm> so I'm marking all versions N/A
 Bugs: 
-upstream: released (2.4.26-pre5)
-linux-2.6:
-2.6.8-sarge-security: 
+upstream: released (2.4.26-pre5), released (2.6.5-rc2)
+linux-2.6: N/A
+2.6.8-sarge-security: N/A
 2.4.27-sarge-security: N/A
-2.6.8: 
-2.4.19-woody-security: 
-2.4.18-woody-security: 
-2.4.17-woody-security: 
-2.4.16-woody-security: 
-2.4.17-woody-security-hppa: 
-2.4.17-woody-security-ia64: 
+2.6.8: N/A
+2.4.19-woody-security: N/A
+2.4.18-woody-security: N/A
+2.4.17-woody-security: N/A
+2.4.16-woody-security: N/A
+2.4.17-woody-security-hppa: N/A
+2.4.17-woody-security-ia64: N/A

Modified: patch-tracking/CVE-2004-0816
==============================================================================
--- patch-tracking/CVE-2004-0816	(original)
+++ patch-tracking/CVE-2004-0816	Fri Jan  6 23:18:13 2006
@@ -14,17 +14,23 @@
  Integer underflow in the firewall logging rules for iptables in Linux before
  2.6.8 allows remote attackers to cause a denial of service (application crash)
  via a malformed IP packet.
-Notes: 
+Notes:
+ jmm> Quoting from http://groups.google.com/group/nz.comp/msg/71ec927b491f247d: 
+ jmm>   The bug, discovered by Richard Hart, does not affect the 2.4 series kernel
+ jmm> Quoting from http://www.novell.com/linux/security/advisories/2004_37_kernel.html:
+ jmm>   This problem has already been fixed in the 2.6.8 upstream Linux kernel,
+ jmm>   this update contains a backport of the fix.
+ jmm> So I'm marking all kernels N/A
 Bugs: 
 upstream: 
-linux-2.6: 
-2.6.8-sarge-security: 
-2.4.27-sarge-security: 
-2.6.8: 
-2.4.19-woody-security: 
-2.4.18-woody-security: 
-2.4.17-woody-security: 
-2.4.16-woody-security: 
-2.4.17-woody-security-hppa: 
-2.4.17-woody-security-ia64: 
-2.4.18-woody-security-hppa: 
+linux-2.6: N/A
+2.6.8-sarge-security: N/A
+2.4.27-sarge-security: N/A
+2.6.8: N/A
+2.4.19-woody-security: N/A
+2.4.18-woody-security: N/A
+2.4.17-woody-security: N/A
+2.4.16-woody-security: N/A
+2.4.17-woody-security-hppa: N/A
+2.4.17-woody-security-ia64: N/A
+2.4.18-woody-security-hppa: N/A