In relation to my quest to understand security (fixes) on deb/Raspbian I keep finding myself in dead ends! :(
For example: Another example happened today.. The openssl package openssl contains two vulnerabilities: CVE-2016-7052 & CVE-2016-6309. But for simplicity let's just focus on the latter (most severe) one. The Debian maintainers promptly responded and patched the package with the fix within 12 hours of the announcement (or at least since I read it), in version:
1.0.1e-2+deb7u20. So far so good (so it seems). But, once back home checking my Raspbian (wheezy) version, and I was surprised (as I have not updated the package, in the last couple of days) to find the installed package to be:
So here are my two questions about how they relate:
How is it possible that a newer version seems to be installed already: 1.0.1e-2+rvt+deb7u21 (Raspbian) vs. 1.0.1e-2+deb7u20 (official Debian)?
What does the
rvtstand for in 1.0.1e-2 +rvt+deb7u21 (on Rpi).
Could anyone clear this fog for me (I tried Googling but was unable to find asolid - or any tbh. - answers)?
- ad 1: Maybe it got patched by the Raspbian devs?
- ad 2: This could also explain the "rvt"?