[Git][security-tracker-team/security-tracker][master] Update information for CVE-2016-2779/util-linux

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b95b3ab8 by Salvatore Bonaccorso at 2018-08-08T19:12:47Z
Update information for CVE-2016-2779/util-linux

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -114723,7 +114723,7 @@ CVE-2016-2781 (chroot in GNU coreutils, when used with --userspec, allows local 
 	NOTE: Fixing this issue via setsid() would introduce regressions:
 	NOTE: https://www.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes
 CVE-2016-2779 (runuser in util-linux allows local users to escape to the parent ...)
-	- util-linux <unfixed> (bug #815922)
+	- util-linux 2.31.1-0.1 (bug #815922)
 	[stretch] - util-linux <no-dsa> (Minor issue)
 	[jessie] - util-linux <no-dsa> (Minor issue)
 	[wheezy] - util-linux <not-affected> (runuser[.c] not yet present)
@@ -114731,6 +114731,8 @@ CVE-2016-2779 (runuser in util-linux allows local users to escape to the parent 
 	NOTE: Restricting ioctl on the kernel side seems the better approach, patches have been posted to kernel-hardening list
 	NOTE: http://www.openwall.com/lists/oss-security/2016/02/27/1
 	NOTE: https://marc.info/?l=util-linux-ng&m=145694736107128&w=2
+	NOTE: 2.31 introduces a new --pty option to separate privileged and unprivileged
+	NOTE: shells (not enabled by default and the cli switch is necessary).
 CVE-2016-XXXX [Partial SMAP bypass on 64-bit Linux kernels]
 	- linux 4.4.4-1
 	[jessie] - linux 3.16.7-ckt25-2+deb8u1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/b95b3ab83b108dbe2550d0bdd7fb71b582c4d30e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/b95b3ab83b108dbe2550d0bdd7fb71b582c4d30e
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180808/3728750e/attachment.html>