On 9 October 2012 11:45, Paul Dwerryhouse <paul@dwerryhouse.com.au> wrote:
On 09/10/12 10:51, Andrew Worsley wrote:
1. Apparently there are *LOTS* of vulnerabilities which are unpatched vulnerabilities in debian stable but presumably people just live with it or am I missing some part of the picture? - See below
How reliable is debsecan? I just ran it on one of my systems, and among many of the problems it found, was this one, which I picked at random:
CVE-2011-1148 php5-mysql (remotely exploitable, high urgency)
The description of this vulnerability is:
"Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments."
(from http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1148)
But the php5-mysql package I have installed is 5.4.4-4, which is definitely later than 5.3.6:
Package: php5-mysql Version: 5.4.4-4
Debian security tracker reports this is fixed in squeeze(5.3.3-7) but *NOT* in wheezy (5.4.4-7)- see http://security-tracker.debian.org/tracker/CVE-2011-1148 You can enter CVEs into the box at the bottom to search by CVEs (and apparently packages - but I think the name has to be just right). Andrew