OpenSuSE has issued an advisory today (March 11): http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html Patches checked into Cauldron SVN. Freeze push requested. Patches do not apply cleanly to the version we have in Mageia 4. Reproducible: Steps to Reproduce:
URL: (none) => http://lwn.net/Vulnerabilities/636271/
autofs-5.1.0-4.mga5 uploaded for Cauldron.
CC: (none) => mageiaAssignee: bugsquad => shlomif
(In reply to David Walser from comment #0) > OpenSuSE has issued an advisory today (March 11): > http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html > > Patches checked into Cauldron SVN. Freeze push requested. > > Patches do not apply cleanly to the version we have in Mageia 4. > Do you know if this bug happens at all in the autofs version in Mageia 4? Regards, -- Shlomi Fish > Reproducible: > > Steps to Reproduce:
(In reply to Shlomi Fish from comment #2) > Do you know if this bug happens at all in the autofs version in Mageia 4? Why wouldn't it? autofs 5.0.7 also supports executable automounter maps.
(In reply to David Walser from comment #3) > (In reply to Shlomi Fish from comment #2) > > Do you know if this bug happens at all in the autofs version in Mageia 4? > > Why wouldn't it? autofs 5.0.7 also supports executable automounter maps. I see. Maybe we can ask upstream if they can provide an equivalent patch for autofs version 5.0.7.
Adding "NEEDHELP"/"OK" to the whiteboard.
Whiteboard: (none) => NEEDHELP OK
David: according to the autofs README: <QUOTE> If you use or want to help develop autofs, please join the autofs mailing list by sending an email to: majordomo@vger.kernel.org With the body text: subscribe autofs Once subscribed you can send patches to: autofs@vger.kernel.org The autofs mailing list archive can be viewed on gmane: http://news.gmane.org/gmane.linux.kernel.autofs http://blog.gmane.org/gmane.linux.kernel.autofs (END) </QUOTE> Now, I cannot subscribe and post there because I'm banned from the @vger.kernel.org E-mail domain. Can you please subscribe there and ask the question there? Regards, -- Shlomi Fish
According to Ubuntu, the issue was introduced in 5.0.8. 5.0.7 is not affected: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-8169.html Closing as FIXED for Cauldron.
Status: NEW => RESOLVEDVersion: 4 => CauldronResolution: (none) => FIXEDWhiteboard: NEEDHELP OK => (none)