How can we know which debian package correct which CVE

Question

We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :

• bind9 1:9.7.3-1~squeeze11 corrects which problem ?

Answer 1

PTS/QA

You go to the package's QA page. For this, you either use the source package name (here "bind9"):

http://packages.qa.debian.org/bind9

Or you use the binary package name (e.g. "bind9-host"):

http://packages.debian.org/bind9-host

If you used the binary one, click on the package in a distro (e.g. oldstable)¹, then on “Developer Information (PTS)” on the “Debian Resources:” box on the right, which redirects you to the QA page.

① This page conveniently has “[ Source: bind9 ]” in the upper-left corner, which tells you the source package name for the binary package. You will need that below.

Once on the QA page, you see the “news” box in the centre of the page. This will have the changelogs for each individual upload. You click on “[2013-08-10] Accepted 1:9.7.3.dfsg-1~squeeze11 in squeeze-security (high) (Salvatore Bonaccorso)” and get redirected here which shows CVE-2013-4854. All changes of prior versions also apply, normally.

Security Tracker

Finally, there's the security tracker where you can search for source package names. (If you have only the binary package name, see above.) Entering “bind9” redirects you to…

https://security-tracker.debian.org/tracker/source-package/bind9

… where you, again, have all the CVEs and DSAs. Clicking one (either of them) will show an overview page where you see which packages fix the problems in which distros.

Answer 2

If you want to know what security (and other) problems a particular version of a Debian package corrects, check its changelog. All changelogs are online; for example, for bind9 in squeeze, navigate to https://packages.debian.org/squeeze/bind9 (http://packages.debian.org/RELEASE/PACKAGE) and click the “Debian Changelog” link. If you know the exact package version (or a more recent version number), you can navigate to http://metadata.ftp-master.debian.org/changelogs/main/b/bind9/bind9_9.7.3.dfsg-1~squeeze11_changelog (http://metadata.ftp-master.debian.org/changelogs/DISTRIBUTION/FIRST_LETTER/SOURCE_PACKAGE_NAME/BINARY_PACKAGE_NAME_BINARY_PACKAGE_VERSION_changelog).

If you want to know what Debian package version fixes a particular security advisory, you can look it up in the Debian security bug tracker (enter the CVE name in the search box) or navigate directly to https://security-tracker.debian.org/tracker/CVE-2013-4854 (http://security-tracker.debian.org/tracker/NAME).