tcpdump missing some CVEs

Hello,

Please note that Ubuntu, much like Debian, SuSE, and Red Hat, backport security fixes to the versions that we have shipped, so comparing version numbers alone isn't a reliable way to determine which vulnerabilities, if any, are still open for a given package. For more information, see our FAQ and Debian's FAQ entries (the Debian faq doesn't apply directly, but I like this specific entry.) https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions and https://www.debian.org/security/faq#version)

You can see that this CVE is still not handled yet:
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-2155.html
and that tcpdump has several more known security issues that need to be fixed:
http://people.canonical.com/~ubuntu-security/cve/pkg/tcpdump.html

Our CVE tracking database can be queried at http://people.canonical.com/~ubuntu-security/cve/

We can't fix every issue immediately, and we have to prioritize our work based on the severity of the issue and how common the tools are, how much user interaction might be necessary to make exploits work. etc.

Thanks

This bug was fixed in the package tcpdump - 4.6.2-1ubuntu1.2

---------------
tcpdump (4.6.2-1ubuntu1.2) utopic-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible code execution via
    multiple issues (LP: #1444363)
    - debian/patches/60_cve-2015-0261.diff: check lengths in
      print-mobility.c.
    - debian/patches/60_cve-2015-2153.diff: check length in
      print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2153-fix-regression.diff: more length
      checks in print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2154.diff: check lengths in
      print-isoclns.c.
    - debian/patches/60_cve-2015-2155.diff: make sure ops->print is valid
      in print-forces.c.
    - CVE-2015-0261
    - CVE-2015-2153
    - CVE-2015-2154
    - CVE-2015-2155
 -- Marc Deslauriers <email address hidden> Fri, 24 Apr 2015 12:51:00 -0400

This bug was fixed in the package tcpdump - 4.5.1-2ubuntu1.2

---------------
tcpdump (4.5.1-2ubuntu1.2) trusty-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible code execution via
    multiple issues (LP: #1444363)
    - debian/patches/60_cve-2015-0261.diff: check lengths in
      print-mobility.c.
    - debian/patches/60_cve-2015-2153.diff: check length in
      print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2153-fix-regression.diff: more length
      checks in print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2154.diff: check lengths in
      print-isoclns.c.
    - debian/patches/60_cve-2015-2155.diff: make sure ops->print is valid
      in print-forces.c.
    - CVE-2015-0261
    - CVE-2015-2153
    - CVE-2015-2154
    - CVE-2015-2155
 -- Marc Deslauriers <email address hidden> Fri, 24 Apr 2015 13:06:07 -0400

This bug was fixed in the package tcpdump - 4.2.1-1ubuntu2.2

---------------
tcpdump (4.2.1-1ubuntu2.2) precise-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible code execution via
    multiple issues (LP: #1444363)
    - debian/patches/60_cve-2015-0261.diff: check lengths in
      print-mobility.c.
    - debian/patches/60_cve-2015-2153.diff: check length in
      print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2153-fix-regression.diff: more length
      checks in print-rpki-rtr.c.
    - debian/patches/60_cve-2015-2154.diff: check lengths in
      print-isoclns.c.
    - debian/patches/60_cve-2015-2155.diff: make sure ops->print is valid
      in print-forces.c.
    - CVE-2015-0261
    - CVE-2015-2153
    - CVE-2015-2154
    - CVE-2015-2155
 -- Marc Deslauriers <email address hidden> Fri, 24 Apr 2015 15:15:57 -0400

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".