Have we got this fixed? Also... When will we have a public mailing list (security-announce@lists.debian.org or some such) that people can subscribe to and get news of security issues and patches for Debian??? This is badly needed! John -- John Goerzen | Running Debian GNU/Linux (www.debian.org) Custom Programming | jgoerzen@complete.org |
--- Begin Message ---
- To: BUGTRAQ@NETSPACE.ORG
- Subject: [linux-security] URGENT: Update to ld.so advisory
- From: "KSR\[T\]" <ksrt@dec.net>
- Date: Fri, 18 Jul 1997 06:01:19 -0700 (PDT)
- Cc: linux-security@redhat.com
- Reply-to: linux-security@redhat.com
- Resent-cc: recipient list not shown: ;
- Resent-date: 18 Jul 1997 14:48:16 -0000
- Resent-from: linux-security@redhat.com
- Resent-message-id: <"McVR13.0.JA6.j8upp"@mail2.redhat.com>
- Resent-sender: linux-security-request@redhat.com
Update to KSR[T] Advisory #002 Our advisory contained one serious piece of mis-information. The latest version of ld.so that we tested (1.9.2) still appeared to be vulnerable to this overflow. We strongly recommend that anyone running linux install the patch distributed with the advisory, or wait for your vendor to release an updated ld.so package and install that as soon as possible. The patch is available from our web site (http://www.dec.net/ksrt). We apologize for any confusion this might have caused. KSR[T] Team ----- KSR[T] Website : http://www.dec.net/ksrt E-mail: ksrt@dec.net
--- End Message ---