Bug 44410 - eject: Multiple issues (4.2)
eject: Multiple issues (4.2)
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.2
Other Linux
: P5 normal (vote)
: UCS 4.2-1-errata
Assigned To: Philipp Hahn
Arvid Requate
Depends on:
Blocks: 44409
  Show dependency treegraph
Reported: 2017-04-19 16:07 CEST by Arvid Requate
Modified: 2017-07-05 13:06 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
requate: Patch_Available+


Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2017-04-19 16:07:40 CEST
Upstream Debian package version 2.1.5+deb1+cvs20081104-13.1+deb8u1 fixes:

* dmcrypt-get-device does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-device to execute code, which was intended to run as an unprivileged user, as root. (CVE-2017-6964)
Comment 1 Philipp Hahn univentionstaff 2017-06-30 17:57:39 CEST
Semi-Automatically imported through Bug #44451

Package: eject
Version: 2.1.5+deb1+cvs20081104-13.A~
Branch: ucs_4.2-0
Scope: errata4.2-1

r80749 | Bug #44410: eject.yaml
Comment 2 Arvid Requate univentionstaff 2017-07-04 20:42:56 CEST
Ok, I've trimmed down the advisory text a bit and adjusted the version field to also cover errata4.2-0.
Comment 3 Janek Walkenhorst univentionstaff 2017-07-05 13:06:37 CEST