Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock
Dear release team,
The glibc package in version 2.28-9 currently in sid mostly updates the
git-updates.diff patch to the latest upstream stable branch:
- Fix security issue CVE-2019-9169.
- Support for the new Reiwa era to the ja_JP which seems to be something
quite important for Japanese people.
- Support for vector instructions related hwcap on s390x to allow one to
provide shared libraries (not) tuned for the corresponding platforms.
- Fix for a riscv specific issue in a file which is not used on other
architectures, so with no risk for them.
- Fix for memusagestat's Makefile related code, which has no impact on
the generated code.
In addition to that it includes a fix for a bug in dlopen introduced by
an arm patch, but affecting all architectures.
I believe that all the above changes are suitable for buster. If you
agree, could you please unblock package glibc:
unblock glibc/2.28-9
Thanks,
Aurelien
-- System Information:
Debian Release: buster/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE=fr
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
diff --git a/debian/changelog b/debian/changelog
index 24a46054..711bb67a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,18 @@
+glibc (2.28-9) unstable; urgency=medium
+
+ [ Aurelien Jarno ]
+ * debian/patches/git-updates.diff: update from upstream stable branch:
+- Fix heap-based buffer over-read in regular-expression matching
+ (CVE-2019-9169). Closes: #924612.
+- Add entry for the new Japanese era to the ja_JP locale. Closes:
+ #927914.
+
+ [ Adam Conrad ]
+ * debian/patches/arm/unsubmitted-ldso-abi-check.diff: Fix rtld segv in
+dl_open() introduced via merge with upstream at 2.28 (LP: #1821677)
+
+ -- Aurelien Jarno Thu, 25 Apr 2019 21:12:03 +0200
+
glibc (2.28-8) unstable; urgency=medium
[ Aurelien Jarno ]
diff --git a/debian/patches/arm/unsubmitted-ldso-abi-check.diff
b/debian/patches/arm/unsubmitted-ldso-abi-check.diff
index 6c78c674..8a7cab12 100644
--- a/debian/patches/arm/unsubmitted-ldso-abi-check.diff
+++ b/debian/patches/arm/unsubmitted-ldso-abi-check.diff
@@ -222,10 +222,10 @@
if (ph->p_type == PT_NOTE && ph->p_filesz >= 32 && ph->p_align >= 4)
{
ElfW(Addr) size = ph->p_filesz;
-@@ -1751,6 +1955,21 @@
+@@ -1751,6 +1955,20 @@
+
+ break;
}
- free (abi_note_malloced);
- }
+ if (-1 != fd)
+ {
+int error = arch_specific_checks(fd, name, ehdr);
@@ -239,8 +239,7 @@
+goto call_lose;
+ }
+ }
-+
-+}
++ }
+ free (abi_note_malloced);
+ }
- return fd;
- }
diff --git a/debian/patches/git-updates.diff b/debian/patches/git-updates.diff
index 50d4962c..a6722cc9 100644
--- a/debian/patches/git-updates.diff
+++ b/debian/patches/git-updates.diff
@@ -1,10 +1,44 @@
GIT update of https://sourceware.org/git/glibc.git/release/2.28/master from
glibc-2.28
diff --git a/ChangeLog b/ChangeLog
-index 08b42bd2f5..42fe0aeb1e 100644
+index 08b42bd2f5..609d5c1b19 100644
--- a/ChangeLog
+++ b/ChangeLog
-@@ -1,3 +1,784 @@
+@@ -1,3 +1,818 @@
++2019-04-24 Mike Frysinger
++
++ [BZ #18465]
++ * malloc/Makefile (others): Add memusagestat.
++ ($(objpfx)memusagestat): Delete rule.
++ (LDLIBS-memusagestat): New variable.
++
++2019-04-03 TAMUKI Shoichi
++
++ [BZ #22964]
++ * localedata/locales/ja_JP (LC_TIME): Add entry for the new Japanese
++ era.
++
++2019-03-21 Stefan Liebler
++
++ * sysdeps/s390/dl-procinfo.h (HWCAP_IMPORTANT):
++ Add HWCAP_S390_VX and HWCAP_S390_VXE.
++
++2019-01-31 Paul Eggert
++
++ CVE-2019-9169
++ regex: fix read overrun [BZ #24114]
++ Problem found by AddressSanitizer, reported by Hongxu Chen in:
++ https://debbugs.gnu.org/34140
++ * posix/regexec.c (proceed_next_node):
++ Do not read past end of input buffer.
++
++2018-11-07 Andreas Schwab
++
++ [BZ #23864]
++ * sysdeps/unix/sysv/linux/riscv/kernel-features.h
++ (__ASSUME_SET_ROBUST_LIST) [__LINUX_KERNEL_VERSION < 0x041400]:
++ Undef.
++
+2018-09-21 Adhemerval Zanella
+
+ * NEWS: Add note about new TLE support on powerpc64le.
@@ -807,15 +841,19 @@ index 608ffe648c..f5e81bdf5d 100644
# We might want to compile with some stack-protection flag.
ifneq ($(stack-protector),)
diff --git a/NEWS b/NEWS
-index 154ab22d7c..60b15116d6 100644
+index 154ab22d7c..e8030d499a 100644
--- a/NEWS
+++ b/NEWS
-@@ -5,6 +5,77 @@ See the end for copying conditions.
+@@ -5,
