July 2014 - Arch-security - lists.archlinux.org

[arch-security] CVE-2014-507
by Mark Lee 26 Jul '14

26 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 To All, It has been mentioned on OSS-security that there's a null pointer dereference flaw in the Stream Control Transmission Protocol in the Linux kernel. Currently Arch Linux builds this option as a module. I've already filed a bug report at : <https://bugs.archlinux.org/task/41346> Regards, Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iF4EAREIAAYFAlPTG7MACgkQZ/Z80n6+J/Y0kgEAgNUyMioU8wmch3jTdiDegjVU G2+1JljcQ/TnvnOZFCABAIUehzWBDhpJ2vsX3VSjGQgwRQEpXsJHgfulKNYrjhqT =ziEQ -----END PGP SIGNATURE-----

1 0

[arch-security] net: SCTP: NULL pointer dereference
by Mark Lee 24 Jul '14

24 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 To all, A net SCTP null pointer dereference has been discovered in linux kernel; it can result in a DoS. See bug report :https://bugs.archlinux.org/task/41329 Regards, Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlPROToACgkQZ/Z80n6+J/ZxlQEAjzCaj3I3xDLVLVk1SVdqxfNt taoD1v0i4k0qjv/pLmgA/As2PL2xn5wRlIC0KsD5VTHhNF6NN19WZR4DqRWdxa81 =Pigy -----END PGP SIGNATURE-----

1 0

[arch-security] How to properly report vulnerabilities
by Karol Blazewicz 08 Jul '14

08 Jul '14

Should I open a bug report saying that e.g. some Arch package has certain vulnerability, mark the report as critical and wait for someone to set it as private? How do we deal with such sensitive information? I've looked in the wiki, but neither https://wiki.archlinux.org/index.php/Arch_CVE_Monitoring_Team nor https://wiki.archlinux.org/index.php/CVE-2014 has any info on this.

4 7

[arch-security] DBUS vulnerability in Arch Repo
by Mark Lee 02 Jul '14

02 Jul '14

To all, A recent vulnerability in all 1.3 < dbus < 1.8.6 was reported on oss-security. While I normally only look at kernel bugs, I found this important. See : [fd.o#79694] https://bugs.freedesktop.org/show_bug.cgi?id=79694 [fd.o#80469] https://bugs.freedesktop.org/show_bug.cgi?id=80469 [fd.o#80163] https://bugs.freedesktop.org/show_bug.cgi?id=80163. Regards, Mark

1 0