bugtraq - [SECURITY] [DSA 3175-2] kfreebsd-9 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 19 May 2015 00:07:25 +0200
From: Alessandro Ghedini <ghedo@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3175-2] kfreebsd-9 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3175-2                   security@...ian.org
http://www.debian.org/security/                        Alessandro Ghedini
May 18, 2015                           http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : kfreebsd-9
CVE ID         : CVE-2015-1414 CVE-2015-2923
Debian Bug     : 779201 782735

It was discovered that by sending crafted Router Advertisement packets,
an attacker on the local network could lower the Current Hop Limit and
cause the system to lose the ability to communicate with another IPv6
node on a different network.

Additionally, it was discovered that the patch applied to kfreebsd-9 in
DSA-3175-1 for CVE-2015-1414 was incomplete. For reference the original
advisory text follows:

Mateusz Kocielski and Marek Kroemeke discovered that an integer overflow
in IGMP processing may result in denial of service through malformed
IGMP packets.

For the oldstable distribution (wheezy), these problems have been fixed
in version 9.0-10+deb70.10.

We recommend that you upgrade your kfreebsd-9 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVWmKdAAoJEK+lG9bN5XPLK8cP/3bfRG2VV0679sy29qUvKlfo
Eerlh4LzH0pQYTV7gS2wP3w3XKPs1nWNm0z9YYk0NS6QRL1IX5qNDECJH0mPrFLE
vB4TcC3KFOlU9Jyc288J3RpuK+wRwvmGIWmKN8o2VQppnKJ5SpPS8hlUPFjaXnqT
OvJBZGLxeUt0ed1Q44dTDTWtrG4B8eBRkPsF63KYkKb8sINrki59+lkbGlVIHTP0
+JdYaOBs7qyUuO0N77suEiDpx5RpgsyEH3apoD5ON/WN8f8wb0cd/cLcWAYWIzx5
Ba5ptX/0mWuCrBQOXwQt/D4AtCabnND1WuF/d2EkNYGTXVRVLSfnZksrUL86IgPM
NTwacPkgNRuoawnizkXOxmzRuEHZ28S/y5ZzWskYlQHAjJdACMvcQPcv72CspCGg
j37q3tIP13cevYOpU62Kd3KCKdAqPADdwoP55gISttwkfzogYb9UppIjg//ZGqav
QRJPJ5N8Hk8BX0WzE2084iLm3/ukQ7Dyh/JihMmPm4bdJMihKjJryeA39fkdOEU3
E595zznbKCJRBuQBuGC06XDi8hZYO8vTLk72o3a6LJ1vfXS2VGns8FHy/bWG48pb
KpKPNzlxGczDAontK7PQbpJJZw84gOCAG+IU37NJsBy3G5wxUGkde53u+4/JvCPp
01srGuLt3m8KqVLrbgFB
=wnra
-----END PGP SIGNATURE-----