This bug was fixed in the package tcpdump - 4.9.0-1ubuntu1~ubuntu12.04.1 --------------- tcpdump (4.9.0-1ubuntu1~ubuntu12.04.1) precise-security; urgency=medium [ Gianfranco Costamagna ] * Backport to precise to fix CVEs (LP: #1662177). * Reset libpcap dependency to precise version * Enable crypto support, dropped in zesty because of openssl. * Disable some tests failing with older pcap versions tcpdump (4.9.0-1ubuntu1) zesty; urgency=low * Merge from Debian unstable. Remaining changes: - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump, install, rules, patches/patches/90_man_apparmor.diff}: + Add AppArmor profile. - debian/usr.sbin.tcpdump: + Allow capability net_admin to support '-j'. tcpdump (4.9.0-1) unstable; urgency=high * New upstream security release, fixing the following: + CVE-2016-7922: buffer overflow in print-ah.c:ah_print(). + CVE-2016-7923: buffer overflow in print-arp.c:arp_print(). + CVE-2016-7924: buffer overflow in print-atm.c:oam_print(). + CVE-2016-7925: buffer overflow in print-sl.c:sl_if_print(). + CVE-2016-7926: buffer overflow in print-ether.c:ethertype_print(). + CVE-2016-7927: buffer overflow in print-802_11.c:ieee802_11_radio_print(). + CVE-2016-7928: buffer overflow in print-ipcomp.c:ipcomp_print(). + CVE-2016-7929: buffer overflow in print-juniper.c:juniper_parse_header(). + CVE-2016-7930: buffer overflow in print-llc.c:llc_print(). + CVE-2016-7931: buffer overflow in print-mpls.c:mpls_print(). + CVE-2016-7932: buffer overflow in print-pim.c:pimv2_check_checksum(). + CVE-2016-7933: buffer overflow in print-ppp.c:ppp_hdlc_if_print(). + CVE-2016-7934: buffer overflow in print-udp.c:rtcp_print(). + CVE-2016-7935: buffer overflow in print-udp.c:rtp_print(). + CVE-2016-7936: buffer overflow in print-udp.c:udp_print(). + CVE-2016-7937: buffer overflow in print-udp.c:vat_print(). + CVE-2016-7938: integer overflow in print-zeromq.c:zmtp1_print_frame(). + CVE-2016-7939: buffer overflow in print-gre.c, multiple functions. + CVE-2016-7940: buffer overflow in print-stp.c, multiple functions. + CVE-2016-7973: buffer overflow in print-atalk.c, multiple functions. + CVE-2016-7974: buffer overflow in print-ip.c, multiple functions. + CVE-2016-7975: buffer overflow in print-tcp.c:tcp_print(). + CVE-2016-7983: buffer overflow in print-bootp.c:bootp_print(). + CVE-2016-7984: buffer overflow in print-tftp.c:tftp_print(). + CVE-2016-7985: buffer overflow in print-calm-fast.c:calm_fast_print(). + CVE-2016-7986: buffer overflow in print-geonet.c, multiple functions. + CVE-2016-7992: buffer overflow in print-cip.c:cip_if_print(). + CVE-2016-7993: a bug in util-print.c:relts_print() could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM). + CVE-2016-8574: buffer overflow in print-fr.c:frf15_print(). + CVE-2016-8575: buffer overflow in print-fr.c:q933_print(). + CVE-2017-5202: buffer overflow in print-isoclns.c:clnp_print(). + CVE-2017-5203: buffer overflow in print-bootp.c:bootp_print(). + CVE-2017-5204: buffer overflow in print-ip6.c:ip6_print(). + CVE-2017-5205: buffer overflow in print-isakmp.c:ikev2_e_print(). + CVE-2017-5341: buffer overflow in print-otv.c:otv_print(). + CVE-2017-5342: a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print(). + CVE-2017-5482: buffer overflow in print-fr.c:q933_print(). + CVE-2017-5483: buffer overflow in print-snmp.c:asn1_parse(). + CVE-2017-5484: buffer overflow in print-atm.c:sig_print(). + CVE-2017-5485: buffer overflow in addrtoname.c:lookup_nsap(). + CVE-2017-5486: buffer overflow in print-isoclns.c:clnp_print(). * Re-enable all tests and bump build-dep on libpcap0.8-dev to >= 1.8 accordingly. * Switch Vcs-Git URL to the https one. * Adjust lintian override name about dh 9. tcpdump (4.8.1-2ubuntu1) zesty; urgency=low * Merge from Debian unstable. Remaining changes: - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump, install, rules, patches/patches/90_man_apparmor.diff}: + Add AppArmor profile. - debian/usr.sbin.tcpdump: + Allow capability net_admin to support '-j'. tcpdump (4.8.1-2) unstable; urgency=medium * Disable new HNCP test, which fails on some buildds for some as-of-yet unexplained reason. tcpdump (4.8.1-1) unstable; urgency=medium * New upstream release. * Re-enable Geneve tests (disabled in 4.7.4-1) and bump build-dep on libpcap0.8-dev to >= 1.7 accordingly. * Disable new pcap version tests which require libpcap 1.8+. tcpdump (4.7.4-3ubuntu1) zesty; urgency=medium * Merge from Debian unstable. (LP: #1624633) Remaining changes: - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump, install, rules, patches/patches/90_man_apparmor.diff}: + Add AppArmor profile. - debian/usr.sbin.tcpdump: + Allow capability net_admin to support '-j'. - fix 2015-0261 test with upstream e32088572e960f7d5e1baac2f530793ed7f42e4d tcpdump (4.7.4-3) unstable; urgency=medium * Use dh-autoreconf instead of calling autoconf directly and patching config.{guess,sub}. * Call dh_auto_configure instead of configure in override target, patch by Helmut Grohne (closes: #837951). tcpdump (4.7.4-2) unstable; urgency=medium * Disable crypto support as it causes FTBFS with OpenSSL 1.1.x and we don't have a working fix upstream yet (closes: #828569). * Bump Standards-Version to 3.9.8. * Use cgit URL for Vcs-Browser. tcpdump (4.7.4-1ubuntu1.16.10.1) yakkety; urgency=medium * debian/usr.sbin.tcpdump: Allow the tcpdump binary to be mapped as required by version 4.8 and newer kernels. tcpdump was immediately segfaulting when used inside of LXD containers before this AppArmor profile change. (LP: #1632399) tcpdump (4.7.4-1ubuntu1) wily; urgency=low * Merge from Debian unstable. (LP: #1460170) Remaining changes: - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump, install, rules, patches/patches/90_man_apparmor.diff}: + Add AppArmor profile. - debian/usr.sbin.tcpdump: + Allow capability net_admin to support '-j'. - Drop 60_cve-2015-2153-fix-regression.diff: upstream tcpdump (4.7.4-1) unstable; urgency=medium * New upstream release. * Disable two geneve tests that require libpcap 1.7+. * Bump Standards-Version to 3.9.6. tcpdump (4.6.2-5) unstable; urgency=high * Cherry-pick commit fb6e5377f3 from upstream Git to fix regressions in the RPKI/RTR printer after the CVE-2015-2153 changes. Thanks to Artur Rona from Ubuntu for the heads-up (closes: #781362). tcpdump (4.6.2-4ubuntu1) vivid; urgency=low * Merge from Debian unstable. (LP: #1433815) Remaining changes: - debian/{control, README.Debian, tcpdump.dirs, usr.sbin.tcpdump, install, rules, patches/patches/90_man_apparmor.diff}: + Add AppArmor profile. - debian/usr.sbin.tcpdump: + Allow capability net_admin to support '-j'. * debian/patches/60_cve-2015-2153-fix-regression.diff: - Fix regression due to 60_cve-2015-2153.diff tcpdump (4.6.2-4) unstable; urgency=high * Cherry-pick changes from upstream Git to fix the following security issues: + CVE-2015-0261: missing bounds checks in IPv6 Mobility printer. + CVE-2015-2153: missing bounds checks in RPKI/RTR printer. + CVE-2015-2154: missing bounds checks in ISOCLNS printer. + CVE-2015-2155: missing bounds checks in ForCES printer. tcpdump (4.6.2-3ubuntu1) vivid; urgency=low * Merge from Debian unstable (LP: #1397558). Remaining changes: * debian/control: - Build-Depends on dh-apparmor. - Suggests apparmor * debian/README.Debian, debian/tcpdump.dirs, debian/usr.sbin.tcpdump, debian/patches/patches/90_man_apparmor.diff, debian/install, debian/rules: - Install enforcing AppArmor profile. * debian/usr.sbin.tcpdump: allow capability net_admin to support '-j'. Patch thanks to Graeme Hewson. (LP: #1229664) tcpdump (4.6.2-3) unstable; urgency=high * Cherry-pick commit 0f95d441e4 from upstream Git to fix a buffer overflow in the PPP dissector (CVE-2014-9140). tcpdump (4.6.2-2) unstable; urgency=high * Urgency high due to security fixes. * Add three patches extracted from various upstream commits fixing vulnerabilities in three dissectors: + CVE-2014-8767: missing bounds checks in OLSR dissector (closes: #770434). + CVE-2014-8768: missing bounds checks in Geonet dissector (closes: #770415). + CVE-2014-8769: missing bounds checks in AOVD dissector (closes: #770424). tcpdump (4.6.2-1ubuntu1) utopic; urgency=low * Merge from Debian unstable (LP; #1367260). Remaining changes: * debian/control: - Build-Depends on dh-apparmor. - Suggests apparmor * debian/README.Debian, debian/tcpdump.dirs, debian/usr.sbin.tcpdump, debian/patches/patches/90_man_apparmor.diff, debian/install, debian/rules: - Install enforcing AppArmor profile. * debian/usr.sbin.tcpdump: allow capability net_admin to support '-j'. Patch thanks to Graeme Hewson. (LP: #1229664) tcpdump (4.6.2-1) unstable; urgency=medium * New upstream release. tcpdump (4.6.1-3) unstable; urgency=medium * Bump build-dep on libpcap0.8-dev to >= 1.5 as the pppoes_id test case requires a pcap version that supports PPPoE session ID filtering. tcpdump (4.6.1-2ubuntu1) utopic; urgency=low * Merge from Debian unstable (LP: #1352750). Remaining changes: * debian/control: - Build-Depends on dh-apparmor. - Suggests apparmor * debian/README.Debian, debian/tcpdump.dirs, debian/usr.sbin.tcpdump, debian/patches/patches/90_man_apparmor.diff, debian/install, debian/rules: - Install enforcing AppArmor profile. * debian/usr.sbin.tcpdump: allow capability net_admin to support '-j'. Patch thanks to Graeme Hewson. (LP: #1229664) tcpdump (4.6.1-2) unstable; urgency=medium * Expand configure check for net/pfvar.h to also check for existence of net/if_pflog.h to fix build on GNU/kFreeBSD, which ships the former but not the latter, see #756553 (closes: #756790). tcpdump (4.6.1-1) unstable; urgency=medium * New upstream release. * debian/control: Mark tcpdump 'Multi-Arch: foreign' (closes: #700727). tcpdump (4.5.1-2ubuntu2) utopic; urgency=medium * debian/usr.sbin.tcpdump: allow capability net_admin to support '-j'. Patch thanks to Graeme Hewson. (LP: #1229664) tcpdump (4.5.1-2ubuntu1) trusty; urgency=medium * Resynchronize on Debian remaining differences: * debian/control: - Build-Depends on dh-apparmor. - Suggests apparmor * debian/README.Debian, debian/tcpdump.dirs, debian/usr.sbin.tcpdump, debian/patches/patches/90_man_apparmor.diff, debian/install, debian/rules: - Install enforcing AppArmor profile. tcpdump (4.5.1-2) unstable; urgency=low * Disable nflog-e testcase, the NFLOG header length is specified in host byte order which makes capture files order-dependent (closes: #731031). tcpdump (4.5.1-1) unstable; urgency=low * New upstream release. * Disable new pppoes testcase which uses a new pcap feature to avoid tying the two upstream versions together. * debian/control: Set Standards-Version to 3.9.5. tcpdump (4.4.0-1ubuntu1) saucy; urgency=low * Resynchronize on Debian remaining differences: * debian/control: - Build-Depends on dh-apparmor. - Suggests apparmor * debian/README.Debian, debian/tcpdump.dirs, debian/usr.sbin.tcpdump, debian/patches/patches/90_man_apparmor.diff, debian/install, debian/rules: - Install enforcing AppArmor profile. tcpdump (4.4.0-1) unstable; urgency=low * New upstream release: + Fixes format error in NTP printer (closes: #686276). + Rewords -e description (closes: #648768). * debian/control: Set Standards-Version to 3.9.4. * Use canonical locations in Vcs-* fields. tcpdump (4.3.0-1ubuntu1) quantal; urgency=low * Merge from Debian unstable. Remaining changes: - Add enforcing AppArmor profile. - debian/control: Build-Depends on dh-apparmor. tcpdump (4.3.0-1) unstable; urgency=low * New upstream release. * Re-enable test suite. tcpdump (4.2.1-3) unstable; urgency=low * Fix CPPFLAGS handling in upstream configure.in to avoid losing hardening flags, patch by Simon Ruderich