We can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :
- bind9 1:9.7.3-1~squeeze11 corrects which problem ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityWe can found on the debian's website CPE/Aliases List, CVE List related to packages. But I can't figure out where can we know which patch of packages correct which vulnerabilities ? For instance :
You go to the package's QA page. For this, you either use the source package name (here "bind9"):
http://packages.qa.debian.org/bind9
Or you use the binary package name (e.g. "bind9-host"):
http://packages.debian.org/bind9-host
If you used the binary one, click on the package in a distro (e.g. oldstable
)¹, then on “Developer Information (PTS)” on the “Debian Resources:” box on the right, which redirects you to the QA page.
① This page conveniently has “[ Source: bind9 ]” in the upper-left corner, which tells you the source package name for the binary package. You will need that below.
Once on the QA page, you see the “news” box in the centre of the page. This will have the changelogs for each individual upload. You click on “[2013-08-10] Accepted 1:9.7.3.dfsg-1~squeeze11 in squeeze-security (high) (Salvatore Bonaccorso)” and get redirected here which shows CVE-2013-4854. All changes of prior versions also apply, normally.
Finally, there's the security tracker where you can search for source package names. (If you have only the binary package name, see above.) Entering “bind9” redirects you to…
https://security-tracker.debian.org/tracker/source-package/bind9
… where you, again, have all the CVEs and DSAs. Clicking one (either of them) will show an overview page where you see which packages fix the problems in which distros.
If you want to know what security (and other) problems a particular version of a Debian package corrects, check its changelog. All changelogs are online; for example, for bind9
in squeeze, navigate to https://packages.debian.org/squeeze/bind9 (http://packages.debian.org/RELEASE/PACKAGE
) and click the “Debian Changelog” link. If you know the exact package version (or a more recent version number), you can navigate to http://metadata.ftp-master.debian.org/changelogs/main/b/bind9/bind9_9.7.3.dfsg-1~squeeze11_changelog (http://metadata.ftp-master.debian.org/changelogs/DISTRIBUTION/FIRST_LETTER/SOURCE_PACKAGE_NAME/BINARY_PACKAGE_NAME_BINARY_PACKAGE_VERSION_changelog
).
If you want to know what Debian package version fixes a particular security advisory, you can look it up in the Debian security bug tracker (enter the CVE name in the search box) or navigate directly to
https://security-tracker.debian.org/tracker/CVE-2013-4854 (http://security-tracker.debian.org/tracker/NAME
).