xfsprogs: xfs_metadump information disclosure

[Daniel Bast]

Please see http://seclists.org/oss-sec/2015/q3/181 for details.

Fixed upstream in version 3.2.4, see http://oss.sgi.com/pipermail/xfs/2015-July/042726.html

Also fixed by that version in debian, see https://security-tracker.debian.org/tracker/CVE-2012-2150

Cheers,

Daniel

[Tyler Hicks (tyhicks)]

Hi Daniel - Thanks for the bug report. We are aware of this issue and have triaged it in our CVE tracker:

  http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2150.html

We consider it to be low priority and will update xfsprogs in our stable releases once a higher priority issue is found.

[Colin Watson (cjwatson)]

This bug was fixed in the package xfsprogs - 4.2.0

---------------
xfsprogs (4.2.0) unstable; urgency=low

  * New upstream release

 -- Nathan Scott <email address hidden> Mon, 07 Sep 2015 10:13:54 +1000

xfsprogs (3.2.4) unstable; urgency=low

  * New upstream release
  * Fix xfs_metadump information leak (CVE-2012-2150)

 -- Nathan Scott <email address hidden> Wed, 29 Jul 2015 15:31:27 +1000

xfsprogs (3.2.3) unstable; urgency=low

  * New upstream release

 -- Nathan Scott <email address hidden> Mon, 01 Jun 2015 11:35:02 +1000

xfsprogs (3.2.2) unstable; urgency=low

  * New upstream release
  * Rework dh-autoreconf invocation (closes: #757455)
  * Update licensing words for headers (closes: #751511)

 -- Nathan Scott <email address hidden> Mon, 10 Nov 2014 20:35:27 +1100

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release