Package: release.debian.org
Severity: normal
User: release.debian....@packages.debian.org
Usertags: unblock
Please unblock package kde-runtime.
The new version includes the upstream patch that fixes CVE-2014-8600 [1] parts
related to kde-runtime.
[1]: https://security-tracker.debian.org/tracker/CVE-2014-8600
Happy releasing. :)
unblock kde-runtime/4:4.14.2-2
-- System Information:
Debian Release: 8.0
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
diff -Nru kde-runtime-4.14.2/debian/changelog kde-runtime-4.14.2/debian/changelog
--- kde-runtime-4.14.2/debian/changelog 2014-10-21 19:12:40.000000000 +0200
+++ kde-runtime-4.14.2/debian/changelog 2014-12-10 20:23:02.000000000 +0100
@@ -1,3 +1,14 @@
+kde-runtime (4:4.14.2-2) unstable; urgency=medium
+
+ [ Lisandro Damián Nicanor Pérez Meyer ]
+ * Remove myself from Uploaders.
+
+ [ Maximiliano Curia ]
+ * New upstream patch: upstream_sanitize_path, fixes CVE-2014-8600
+ (Closes: #769632) Thanks to Salvatore Bonaccorso
+
+ -- Maximiliano Curia <m...@debian.org> Wed, 10 Dec 2014 20:23:02 +0100
+
kde-runtime (4:4.14.2-1) unstable; urgency=medium
* Add Suggests of libcanberra-pulse and sound-theme-freedesktop, used
diff -Nru kde-runtime-4.14.2/debian/control kde-runtime-4.14.2/debian/control
--- kde-runtime-4.14.2/debian/control 2014-10-21 19:12:40.000000000 +0200
+++ kde-runtime-4.14.2/debian/control 2014-12-10 20:23:02.000000000 +0100
@@ -7,7 +7,6 @@
Modestas Vainius <mo...@debian.org>,
George Kiagiadakis <kiagiadakis.geo...@gmail.com>,
Eshat Cakar <i...@eshat.de>,
- Lisandro Damián Nicanor Pérez Meyer <lisan...@debian.org>,
Maximiliano Curia <m...@debian.org>
Build-Depends: cmake,
debhelper (>= 9),
diff -Nru kde-runtime-4.14.2/debian/patches/series kde-runtime-4.14.2/debian/patches/series
--- kde-runtime-4.14.2/debian/patches/series 2014-10-21 19:12:40.000000000 +0200
+++ kde-runtime-4.14.2/debian/patches/series 2014-12-10 20:23:02.000000000 +0100
@@ -4,3 +4,4 @@
use_the_correct_locale.patch
disable_flacky_tests
disable_kwalletd_autotests
+upstream_sanitize_path
diff -Nru kde-runtime-4.14.2/debian/patches/upstream_sanitize_path kde-runtime-4.14.2/debian/patches/upstream_sanitize_path
--- kde-runtime-4.14.2/debian/patches/upstream_sanitize_path 1970-01-01 01:00:00.000000000 +0100
+++ kde-runtime-4.14.2/debian/patches/upstream_sanitize_path 2014-12-10 20:23:02.000000000 +0100
@@ -0,0 +1,27 @@
+commit d68703900edc8416fbcd2550cd336cbbb76decb9
+Author: Martin Sandsmark <martin.sandsm...@kde.org>
+Date: Thu Nov 13 13:29:01 2014 +0100
+
+ Sanitize path
+
+diff --git a/kioslave/bookmarks/kio_bookmarks.cpp b/kioslave/bookmarks/kio_bookmarks.cpp
+index 750495d..53c8aa3 100644
+--- a/kioslave/bookmarks/kio_bookmarks.cpp
++++ b/kioslave/bookmarks/kio_bookmarks.cpp
+@@ -22,6 +22,7 @@
+ #include <stdlib.h>
+
+ #include <qregexp.h>
++#include <qtextdocument.h>
+
+ #include <kapplication.h>
+ #include <kcmdlineargs.h>
+@@ -197,7 +198,7 @@ void BookmarksProtocol::get( const KUrl& url )
+ echoImage(regexp.cap(1), regexp.cap(2), url.queryItem("size"));
+ } else {
+ echoHead();
+- echo("<p class=\"message\">" + i18n("Wrong request: %1",path) + "</p>");
++ echo("<p class=\"message\">" + i18n("Bad request: %1", Qt::escape(Qt::escape(url.prettyUrl()))) + "</p>");
+ }
+ finished();
+ }
