2016-02-19 3:35 GMT+01:00 Kevin Kofler kevin.kofler@chello.at:
Hi,
I have built an updated glibc package for Fedora 21, with (alleged) fixes for the following security issues:
- CVE-2015-7547 (CRITICAL)
- CVE-2015-1781
- CVE-2015-8777
- glibc PR17269
- glibc PR18032
backported from Fedora 22 or forward-ported from CentOS 7. (To the best of my knowledge, the patches I backported do indeed address the above issues, but I cannot provide any kind of guarantees for that.)
You can find it in the following repository: https://repos.fedorapeople.org/kkofler/f21-security/ (I had to use the old repos.fedorapeople.org infrastructure because the Copr maintainers "helpfully" deleted the Fedora 21 buildroots, making Copr entirely useless for the purpose of building security updates for distributions Fedora no longer provides them for. I consider this a very bad idea and an absolutely counterproductive practice.)
As specified in the .repo file, the packages are signed with my CalcForge GPG key, available over HTTPS (with a valid certificate from Let's Encrypt): https://www.calcforge.org/RPM-GPG-KEY-calcforge
This repository is provided "AS IS", in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. In particular, NO warrants of any kind are made for completeness of security fix coverage.
Currently, glibc is the ONLY package that has an update available in the above repository.
Kevin Kofler
/me wearing his FESCO member hat.
Please remember that F21 has reached End of Life and is *not* supported by fedoraproject.org Though these packages may fix a very critical CVE, we cannot guarantee that CVEs in other packages are also fixed.
So no warranties from fp.o if you keep using F21 with or without these packages.
/me removing his FESCO member hat
Thank you Kevin for your effort to provided a very critical bugfix to people who may use F21, though they shouldn't. At least, I appreciate that you shared your efforts with a larger set of people.
Regards, H.