[Secure-testing-commits] r47280 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2016-12-21 15:34:38 +0000 (Wed, 21 Dec 2016)
New Revision: 47280

Modified:
   data/CVE/list
Log:
Update references for CVE-2016-10012

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2016-12-21 15:29:38 UTC (rev 47279)
+++ data/CVE/list	2016-12-21 15:34:38 UTC (rev 47280)
@@ -239,10 +239,9 @@
 	NOTE: https://xenbits.xen.org/xsa/advisory-204.html
 CVE-2016-10012 [sshd(8): shared memory manager bounds checks that could be elided by some optimising compilers potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process]
 	- openssh <unfixed> (bug #848717)
-	NOTE: Fixed in upstream 7.4
-	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.c
-	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.h
-	NOTE: https://www.openssh.com/txt/release-7.4
+	NOTE: Fixed in upstream 7.4: https://www.openssh.com/txt/release-7.4
+	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.c.diff?r1=1.165&r2=1.166
+	NOTE: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/monitor.h.diff?r1=1.19&r2=1.20
 	TODO: check affected versions
 CVE-2016-10011 [sshd(8): theoretical leak of host private key material to privilege-separated child processes via realloc()]
 	- openssh <unfixed> (low; bug #848716)