Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :

  • bind9 1:9.7.3-1~squeeze11 corrects which problem ?
share|improve this question
    
I really want to help, but it's extremely difficult to understand your question. Please consider rewording your question, so we can actually read it. Just a helpful hint. –  Daisetsu Feb 11 at 21:29

2 Answers 2

PTS/QA

You go to the package's QA page. For this, you either use the source package name (here "bind9"):

http://packages.qa.debian.org/bind9

Or you use the binary package name (e.g. "bind9-host"):

http://packages.debian.org/bind9-host

If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” on the “Debian Resources:” box on the right, which redirects you to the QA page.

① This page conveniently has “[ Source: bind9 ]” in the upper-left corner, which tells you the source package name for the binary package. You will need that below.

Once on the QA page, you see the “news” box in the centre of the page. This will have the changelogs for each individual upload. You click on “[2013-08-10] Accepted 1:9.7.3.dfsg-1~squeeze11 in squeeze-security (high) (Salvatore Bonaccorso)” and get redirected here which shows CVE-2013-4854. All changes of prior versions also apply, normally.

Security Tracker

Finally, there's the security tracker where you can search for source package names. (If you have only the binary package name, see above.) Entering “bind9” redirects you to…

https://security-tracker.debian.org/tracker/source-package/bind9

… where you, again, have all the CVEs and DSAs. Clicking one (either of them) will show an overview page where you see which packages fix the problems in which distros.

share|improve this answer

If you want to know what security (and other) problems a particular version of a Debian package corrects, check its changelog. All changelogs are online; for example, for bind9 in squeeze, navigate to https://packages.debian.org/squeeze/bind9 (http://packages.debian.org/RELEASE/PACKAGE) and click the “Debian Changelog” link. If you know the exact package version (or a more recent version number), you can navigate to http://metadata.ftp-master.debian.org/changelogs/main/b/bind9/bind9_9.7.3.dfsg-1~squeeze11_changelog (http://metadata.ftp-master.debian.org/changelogs/DISTRIBUTION/FIRST_LETTER/SOURCE_PACKAGE_NAME/BINARY_PACKAGE_NAME_BINARY_PACKAGE_VERSION_changelog).

If you want to know what Debian package version fixes a particular security advisory, you can look it up in the Debian security bug tracker (enter the CVE name in the search box) or navigate directly to https://security-tracker.debian.org/tracker/CVE-2013-4854 (http://security-tracker.debian.org/tracker/NAME).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.