<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 17 September 2016 at 14:55, Zheng Ruoqin <span dir="ltr"><<a href="mailto:zhengrq.fnst@cn.fujitsu.com" target="_blank">zhengrq.fnst@cn.fujitsu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":yl" class="a3s aXjCH m157bbc92da16eacc">1.CVE-2016-2775.patch<br>
[security] getrrsetbyname with a non absolute name could<br>
trigger an infinite recursion bug in lwresd<br>
and named with lwres configured if when combined<br>
with a search list entry the resulting name is<br>
too long. (CVE-2016-2775) [RT #42694]<br>
<br>
2.CVE-2016-2776.patch<br>
[security] It was possible to trigger a assertion when rendering<br>
a message. (CVE-2016-2776) [RT #43139]<br>
<br>
Signed-off-by: zhengruoqin <<a href="mailto:zhengrq.fnst@cn.fujitsu.com">zhengrq.fnst@cn.fujitsu.com</a>></div></blockquote></div><br>The patches themselves need CVE, Signed-off-by, and Upstream-Status tags.</div><div class="gmail_extra"><br></div><div class="gmail_extra">The commit message needs a better short summary (at least, "fix two CVEs", ideally better).</div><div class="gmail_extra"><br></div><div class="gmail_extra">Ross</div></div>