182918 2007-06-22 17:55 0000 net-dns/avahi Local DoS (CVE-2007-3372) 2007-08-25 22:11:07 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://avahi.org/milestone/Avahi%200.6.20 B3? [noglsa] jaervosz P2 normal --- 1 swegener@gentoo.org security@gentoo.org swegener@gentoo.org 2007-06-22 17:55:33 0000 From the ChangeLog: Fix a local DoS vulnerability, where an assert() could be hit by passing empty TXT data over D-Bus to the Avahi daemon. (Low Risk) I'm about to bump the package. jaervosz@gentoo.org 2007-06-23 21:33:23 0000 Arches please test and mark stable. Target keywords are: avahi-0.6.20.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86 ~x86-fbsd" remi@gentoo.org 2007-06-23 23:13:09 0000 Broken ATM, please don't stable yet jaervosz@gentoo.org 2007-06-24 10:40:40 0000 Let me know when a fixed version is ready for stable marking. swegener@gentoo.org 2007-06-27 21:17:07 0000 I added the patch to net-dns/avahi-0.6.19-r1. jaervosz@gentoo.org 2007-06-28 04:43:58 0000 We now have a fixed version not blocked by bug #182999. Arches please test and mark stable. Target keywords are: avahi-0.6.19-r1.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86 ~x86-fbsd" corsair@gentoo.org 2007-06-28 08:09:17 0000 ppc64 stable gustavoz@gentoo.org 2007-06-28 13:30:15 0000 sparc stable. armin76@gentoo.org 2007-06-28 16:36:49 0000 alpha/ia64/x86 stable dertobi123@gentoo.org 2007-06-28 18:41:55 0000 ppc stable jer@gentoo.org 2007-07-02 15:36:50 0000 Stable for HPPA. beandog@gentoo.org 2007-07-07 04:06:55 0000 amd64 stable py@gentoo.org 2007-07-14 21:50:41 0000 This one is ready for glsa decision. It seems that this DoS can only be triggered locally, so I vote NO. jaervosz@gentoo.org 2007-07-15 07:32:28 0000 Voting NO and closing.