[ubuntu-hardened] 16.04 LTS (i386/x86): the lack of a kernel hardening patches and config options? (Meltdown and Spectre attacks).

[Seth Arnold]

On Mon, Mar 12, 2018 at 07:29:16PM +0000, daniel curtis wrote:
> I'm so sorry for such a long time without answer, but I'm still busy
> etc. Yes, I know, that 'intel-microcode' package published on 22.
> January, 2018 does not have any mitigations for Meltdown or
> Spectre_v12. So, I will wait for a proper package and updates.

Hello Daniel, good news, we have new intel-microcode packages from Intel:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

If feedback from users shows no problems we'll probably release this
Monday.

> Quite a lot. Seth, what do You think about this? Why these CVE are not
> available in GIMP version from "Xenial" release? And what should be
> done in such a case: write an email to Developer or create a bug

The gimp package is in main in 14.04 LTS but in universe in 16.04 LTS
and newer. Because gimp is in universe it is community supported. No
one in the community has provided us with debdiffs for gimp for Xenial
and newer, so it remains unfixed. If you have the time and inclination to
provide fixes for it, you can find some guidance on:

https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Thanks
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20180315/a0cd1832/attachment.sig>