Bug#911493: tcpreplay: CVE-2018-18408

2018-10-22 Thread Christoph Biedl
Salvatore Bonaccorso wrote... > [Disclaimer, not the Debian maintainer here for tcpreplay, who is > Christoph Biedl, only did report the issues downstream in the bug > tracker]. Yeah, I'm here, sorry for not reacting earlier. I'll dive into the things that have been done so far and will try to re

Bug#911493: tcpreplay: CVE-2018-18408

2018-10-21 Thread Fredrick Klassen
Thanks. Yes, this addressed my issues. Every issue identified by your team exists in 3.4.4 code. I took over the maintenance of Tcpreplay starting at 4.0.0, and inherited these issues. I agree that these issues are not serious. They are mostly brought on by invalid PCAP files, and I have not se

Bug#911493: tcpreplay: CVE-2018-18408

2018-10-20 Thread Salvatore Bonaccorso
Hi Fredrick, [Disclaimer, not the Debian maintainer here for tcpreplay, who is Christoph Biedl, only did report the issues downstream in the bug tracker]. On Sat, Oct 20, 2018 at 02:42:30PM -0700, Fredrick Klassen wrote: > Salvatore, > > I have been creating and testing fixes. I also have update

Bug#911493: tcpreplay: CVE-2018-18408

2018-10-20 Thread Fredrick Klassen
Salvatore, I have been creating and testing fixes. I also have updated CHANGELOG a suggested below. Currently my fixes are in Beta. Can you tell me what "Please adjust the affected versions in the BTS as needed” means? Does that mean that I have to do something other than closing the bug in Gi

Bug#911493: tcpreplay: CVE-2018-18408

2018-10-20 Thread Salvatore Bonaccorso
Source: tcpreplay Version: 4.2.6-1 Severity: important Tags: security upstream Forwarded: https://github.com/appneta/tcpreplay/issues/489 Hi, The following vulnerability was published for tcpreplay. CVE-2018-18408[0]: | A use-after-free was discovered in the tcpbridge binary of Tcpreplay | 4.3.0