-
quagga (1.0.20160315-2ubuntu0.1) yakkety-security; urgency=medium
* SECURITY UPDATE: denial of service via stack overrun in IPv6 RA receive
code
- debian/patches/CVE-2016-1245.patch: use proper buffer size in
zebra/rtadv.c.
- CVE-2016-1245
-- Marc Deslauriers <email address hidden> Tue, 18 Oct 2016 15:14:31 +0200
-
quagga (1.0.20160315-2build1) yakkety; urgency=medium
* No-change rebuild for readline soname change.
-- Matthias Klose <email address hidden> Sat, 17 Sep 2016 12:08:29 +0000
-
quagga (1.0.20160315-2) unstable; urgency=high
* QA upload.
* Run wrap-and-sort.
* debian/control:
- Set QA group as maintainer, as Christian orphaned the package (see
#837358).
- Bump Standards-Version to 3.9.8.
* SECURITY:
- CVE-2016-4049: Missing size check in bgp_dump_routes_func in
bgpd/bgp_dump.c allowing DoS (Closes: #822787).
- CVE-2016-4036: World readable sensitive files in /etc/quagga
(Closes: #835223).
-- Hugo Lefeuvre <email address hidden> Sun, 11 Sep 2016 21:37:00 +0200
-
quagga (1.0.20160315-1) unstable; urgency=high
* SECURITY:
CVE-2016-2342: VPNv4 NLRI parses memcpys to stack on unchecked length
(Closes: #819179)
* New upstream release
* babeld has been removed from the Quagga upstream project.
There is a implementation available in the Debian "babeld" package.
* Removed no longer recognized configure options: --enable-ospf-te,
--enable-opaque-lsa and --enable-ipv6
* Removed configure options that are now default: --enable-pimd and
--enable-vtysh
-- Christian Brunotte <email address hidden> Wed, 30 Mar 2016 23:34:33 +0200
-
quagga (0.99.24.1-2ubuntu1) xenial; urgency=medium
* SECURITY UPDATE: denial of service or arbitrary code execution via
Labeled-VPN SAFI and crafted packet
- debian/patches/CVE-2016-2342.patch: sanity check lengths in
bgpd/bgp_mplsvpn.c.
- CVE-2016-2342
-- Marc Deslauriers <email address hidden> Wed, 23 Mar 2016 08:09:49 -0400
