-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 27 Apr 2024 19:24:07 +0200
Source: frr
Architecture: source
Version: 7.5.1-1.1+deb10u2
Distribution: buster-security
Urgency: medium
Maintainer: David Lamparter <equinox-debian@diac24.net>
Changed-By: Tobias Frost <tobi@debian.org>
Closes: 1008010 1016978 1055852
Changes:
frr (7.5.1-1.1+deb10u2) buster-security; urgency=medium
.
* Non-maintainer upload by the LTS team.
* d/clean: Remove generated files on rebuild.
* Backport fixed for several vuffer overflow vulnerabilties:
CVE-2022-26125, CVE-2022-26126, CVE-2022-26127 (Closes: #1008010)
CVE-2022-26128, CVE-2022-26129
* Enabling patching of the fuzz test vectors with quilt
- Add patch to build system disabling handling the fuzz testvectors.
- Introduce the fuzz testvectors as patch, as upstream shipped it only
compressed and we need to patch it, otherwise the fix for CVE-2022-26125
would break the tests.
* CVE-2022-37035 - Racy use after free (Closes: #1016978)
* CVE-2023-38406 - "flowspec overflow."
* CVE-2023-38407 - Buffer overread (Closes: #1055852)
* Backport fixes for several vulnerabilties:
- DoS (crash) CVE-2023-46752, CVE-2023-46753, CVE-2023-47234, CVE-2023-47235
(Also filed in #1055852), CVE-2024-31948 and
- CVE-2024-31949 - DoS causing an infinite loop
Checksums-Sha1:
6235d6f5bf8baf722de3888552fae11d24228167 2644 frr_7.5.1-1.1+deb10u2.dsc
3c3a07fce8e8c4627d3897bf4e753aebfb8a4bd2 114540 frr_7.5.1-1.1+deb10u2.debian.tar.xz
faa91469acecc5e3272e08c21106fdcc0b8424b6 11689 frr_7.5.1-1.1+deb10u2_amd64.buildinfo
Checksums-Sha256:
ec7ca293cb270940f118a97658e9afb2de4e2820b67b8461d6f519ccbee9eb28 2644 frr_7.5.1-1.1+deb10u2.dsc
05267196197e0094e8f8fa1e00c4573c8fa3c59150f4d4af135342746765d79f 114540 frr_7.5.1-1.1+deb10u2.debian.tar.xz
96d801d3d65e5039dd6584838e86bd280a21798783d5147b95025dbf8e44c75d 11689 frr_7.5.1-1.1+deb10u2_amd64.buildinfo
Files:
8d7a7957c49edd703cb0abee87227f7d 2644 net optional frr_7.5.1-1.1+deb10u2.dsc
27971459eb5d47684a3f7262adcd72a9 114540 net optional frr_7.5.1-1.1+deb10u2.debian.tar.xz
461accef944d0dc6a9d1e2797ce1e8ae 11689 net optional frr_7.5.1-1.1+deb10u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmYtNh8ACgkQkWT6HRe9
XTZwCg/9HtGBjRu6WSZtaSTFOakm1rUdo8MHKffxTTvzLZChO2bwRP4NXD/8NB/g
kZQVHdgXwB9euK6OcyU3M0PRnU5LxyYikPndxFFZPW99L+AqPaMQmxyR8+ufwk/B
ILv2plY+HJyPmS8I+Hzt8SkRcfwWvGs3M6mzOjcAL6ye3LLzruM6R1w7Yv/zMm0L
ruvezszxa3bwihJP02/W5nHLNj74nkg4GaSuzPmWg/xS7H54aCgwiAAQDK9Nj7KB
DMy3Fbn5WL6hmnA1bkx8gT0u1Jkl2s/wkOHjtnp+wUNjtLwpNOa35KaB0/cUivjm
5XYT5FPZjUqkjvIQMmV6W93MLq4oC7puVr7/KQoYajE1p8ADFFkFWYMn0lgCE6pL
aO2lvyXQzCLUS3HktSA2Lxcct/VttZlQ2sobY8D+ZtLDTkJ+YMd+8c73msXvym6d
EPefuObbTnlbZRQefDRFHTYUAP3sBwFvcQ5hcpzy9VVQEzv7QUPCjmS0Z2V/+2fk
BqAOdeIvhud1F/7f3Q4Hq5SFYFRU1YFzN/7K7QUFaZSXW1YE1mR6Rx4eG2bGBBl5
m9brjyJthZeNeXKhqof5wyTrMG4jTsIS/AQIT8vTonTzoFGp4UIXJDZo3denxopE
KFzwzb0BNg+SZKLd9PIV7174NB7G26+6P+WuNI3TD5ULEuAM9rc=
=IQbK
-----END PGP SIGNATURE-----
Attachment:
pgp6VOlESuPIW.pgp
Description: PGP signature