[debian-mysql] Request for release team decision on MySQL and MariaDB [was: Re: Bug#793316: Bug#793316: transition: mysql-5.6]

[Norvald H. Ryeng]

On Mon, 28 Dec 2015 13:28:18 +0100, Otto Kekäläinen <otto at seravo.fi> wrote:

> Hello!
>
> 2015-12-23 16:39 GMT+02:00 Norvald H. Ryeng <norvald.ryeng at oracle.com>:
> ..
>> I know we are a bit tight with info about security issues upstream, but  
>> all
>> security bugfixes are available at  
>> https://github.com/mysql/mysql-server as
>> individual commits, and a list of CVEs fixed is reported quarterly  
>> according
>> to a published schedule. Apparently that's not enough.
>
> As a side note related to this, can you please tell us in what commit
> CVE-2015-4913 and CVE-2015-4737 were fixed? You probably have access to  
> some
> internal security tracker where you can look this up, and both CVEs are
> already relatively old, so you would not be releasing any sensitive  
> security
> info.

All I have is what is public: CVE-2015-4913 was included in the latest  
Critical Patch Update in October and was fixed in 5.5.46 and 5.6.27.  
CVE-2015-4737 was included in the July Critical Patch Update and was fixed  
in 5.5.44 and 5.6.24. Since Debian is already at 5.5.46, these don't  
affect Debian any more.

If you're asking because you want to know if these have been fixed in  
MariaDB, I think you should ask MariaDB upstream instead.

Regards,

Norvald