CVE-2015-5477 patch for centos 6

[smkkannan]

hi,

when can we get patch for CVE-2015-5477 for centos 6

[TrevorH]

It's already available but since we are in mid 6.6-6.7 you will need to enable the CR repo and install from there.

http://wiki.centos.org/AdditionalResour ... itories/CR

[GrantPedersen]

I understand the patch is already available in the continuous release repo, and from what I understand it will be moved to the normal repo once 6.7 is released. However since 6.6 --> 6.7 is still in middle of QA there is no estimate on when it will be moved.

I noticed on CentOS 5 and CentOS 7, the patch for this CVE-2015-5477 was released in the normal repo and not in the continuous release.

Does anyone know if there are plans to move this before 6.7 is released or why CentOS 5 and 7 have this available without enabling the CR repo but CentOS 6 does not?

[gerald_clark]

Because 5 and 7 are not in the middle of a release QA.
When a new RHEL version is released, the previous release is frozen. There will be no further updates to 6.6.
While CentOS 6.7 is being built, critical updates appear int the CR repo. Once 6.7 is released, the CR repo will be emptied and updates will come from 6.7 base and updates.

[benjamin88]

Hello,

I've enabled the CR Repo on my CentOS 6.2, 6.0 and 6.5 machines to get the packages for updating BIND but it looks like I don't get any new packages..
No Packages marked for Update

The CR Repo is enabled, I've checked on the CentOS-CR.repo file

I'm not an expert on CentOS as you can see so I need your help

[TrevorH]

If you have configured yum-plugin-priorities to assign priority=1 to base and updates then you need to set the CR repo to the same priority or the updates there will be ignored.

[leonardo.ortiz]

Well, should we update to 9.10 (from here http://www.five-ten-sg.com/mapper/bind ) or use the update provided by Centos ? What version is recomended ?

[avij]

If you ask here, the recommendation is to use the CentOS packages. If you decide to use something else, you are on your own and such discussion should be conducted somewhere else than on this forum.

[avij]

Now that CentOS 6.7 has been released, you can get your fixed version of bind with a simple yum update.