Change:
Here are all the vulnerabilities from since our . of these were probably resolved the last hunt, as I believe 10 of the issues got dropped at some point. I don't know how, but I'm thinking this list will go quickly. 19 of these issues are new. reports have been roughly grouped by the package name. This isn't perfect, but is intended to help identify if a whole group of reports is resolved already. issues will be duplicated, because it affects multiple packages. For example, there are sometimes problems that impact thunderbird, and firefox. LWN might report in one vulnerability "thunderbird firefox". These names have been split to make sure both packages get addressed. each issue is a link to code search for the package name, and a Github search by filename. These are to help, but may not return results when we do in fact package the software. If a search doesn't turn up, please try altering the search criteria or looking in nixpkgs manually before asserting we don't have it. a report: If we don't have the software or our version isn't vulnerable, tick the box or add a comment with the report number, stating it isn't vulnerable. the issue: If we do have the software and it is vulnerable, either leave a comment on this issue saying so, even open a pull request with the fix. If you open a PR, make sure to tag this issue so we can coordinate. an entire section is completed, move the section to the "Triaged and Resolved Issues" block below. Without further ado... (, ) mozilla: denial of service (, ) python-tornado: side-channel attack (, ) OpenVPN: multiple vulnerabilities (, ) qemu: multiple vulnerabilities (, ) mactelnet: code execution (, ) wordpress: multiple vulnerabilities (, ) mozilla: denial of service (, ) systemd: two vulnerabilities (, ) python-django: cross-site request forgery (, ) bind: denial of service (, ) bash: code execution (, ) policycoreutils: sandbox escape (, ) rubygem-bundler: installs malicious gem files (, ) cups: buffer overflow (, ) shiro: access control bypass (, ) openvas-libraries: multiple vulnerabilities (, ) nghttp2: denial of service (, ) putty: code execution (, ) openvas-scanner: denial of service (, ) poco: SSL server spoofing (, ) imagemagick: code execution (, ) postgresql: two vulnerabilities (, ) dwarfutils: two vulnerabilities (, ) borgbackup: directory traversal (, ) proftpd: weak key usage (, ) wireshark: denial of service (, ) freerdp: denial of service (, ) freerdp: two vulnerabilities (, ) openssl: denial of service (, ) openssl: multiple vulnerabilities
This one took under an hour :)
openvpn: unstable has 2.3.12 stable has 2.3.10 the cve report talks update an update to openvpn-2.3.4 openvpn 2.3.11: says "Fixed port-share bug with DoS potential" -so this upgrade might be worse UPDATE, oh I was to slow :)
Thanks, 16.03 has 2.3.10? we should probably backport that. Would you like to do the honors?
Upgrade straight to 2.3.12? There were mostly bug fixes in this version.
do you know if there is an RSS/Atom feed for the LWN vulnerabilities? I couldn't find one.
I don't think there is one. if you want to chat more, I'd rather talk about it over IRC? gchristensen
yep, straight to 2.3.12.
done:

Discussion:
{ stdenv, fetchurl, gmp }: stdenv.mkDerivation rec { <del> name = "ikarus-0.0.3"; </del> <ins> version = "0.0.3"; name = "ikarus-${version}"; </ins> src = fetchurl { <del> url = "http://ikarus-scheme.org/${name}.tar.gz"; </del> <ins> url = "http://launchpad.net/ikarus/0.0/${version}/+download/${name}.tar.gz"; </ins> sha256 = "0d4vqwqfnj39l0gar2di021kcf6bfpkc6g40yapkmxm6sxpdcvjv"; };