Bug 36167 – shim: Multiple issues (4.0)

Bug 36167 - shim: Multiple issues (4.0)


Summary:	shim: Multiple issues (4.0)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.0
Assigned To:	Janek Walkenhorst
QA Contact:	Stefan Gohmann

URL:
Keywords:	interim-4

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2014-10-14 12:41 CEST by Moritz Muehlenhoff
Modified:	2017-10-26 13:54 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Moritz Muehlenhoff

2014-10-14 12:41:52 CEST

CVE-2014-3675 CVE-2014-3676 CVE-2014-3677  

This only affects 4.0. While the open issues for 4.0 are not yet systematicaly tracked, I'm filing this bug ahead and setting it to 4.0:

Two of the are rather minor since we've learned in UCC how intricate UEFI boots are, but we should fix this for 4.0:

Patches and further details:
http://seclists.org/oss-sec/2014/q4/311

Comment 1 Janek Walkenhorst

2014-10-30 12:35:33 CET

The patches are
 e253c2a2c07bc526de1528ed9839b2b584025fa2
and
 034466b7734a2749346151d903bbd7c8a1288db1
.

Comment 2 Janek Walkenhorst

2014-10-30 16:47:31 CET

shim (0.7-5) unstable; urgency=medium

  * fix CVE-2014-3675 (Bug #36167)
  * fix CVE-2014-3676 (Bug #36167)
  * fix CVE-2014-3677 (Bug #36167)

Comment 3 Stefan Gohmann

2014-11-07 09:05:53 CET

OK, looks good and works.

Please add a changelog entry.

Comment 4 Janek Walkenhorst

2014-11-07 18:40:25 CET

(In reply to Stefan Gohmann from comment #3)
> Please add a changelog entry.
Added.

Comment 5 Stefan Gohmann

2014-11-08 19:01:33 CET

OK

Comment 6 Stefan Gohmann

2014-11-26 06:53:52 CET

UCS 4.0-0 has been released:
 http://docs.univention.de/release-notes-4.0-0-en.html
 http://docs.univention.de/release-notes-4.0-0-de.html

If this error occurs again, please use "Clone This Bug".