On Wed, 2007-02-14 at 18:09 +0100, Robert Millan wrote:
> bochsbios is part of the bochs source package, so Bochs is always going
> to be in proper sync with it, no matter what we do.
>
> So, why not just updating bochs to CVS version?
Actually, after investigating a little further, it's not that
This is caused by qemu using the PC-BIOS from the bochsbios package
instead of the one packages with the qemu tarball. It's from bochs, but
a much more recent CVS version.
Marc.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Package: pbuilder
Version: 0.199
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu natty ubuntu-patch
*** /tmp/tmppAGg53
In Ubuntu, we've applied the attached patch to achieve the following:
* debian/rules: install temporary locale so man page tests don'
Whoops, I forgot to clean up the temporary directory. Here's a second
patch that does that.
Marc.
diff -Nru pbuilder-0.199ubuntu3/debian/rules pbuilder-0.199ubuntu4/debian/rules
--- pbuilder-0.199ubuntu3/debian/rules 2010-11-23 11:36:33.0 -0500
+++ pbuilder-0.199ubuntu4/debian/rules 2010
Package: gem2deb
Version: 0.6.0
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpeovyma/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* lib/gem2deb/dh_ruby.rb: properly handle test failures
Package: ca-certificates
Version: 20130906
Followup-For: Bug #683403
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpG_KsCC/bug_body
Openssl doesn't appear to correctly handle not having both versions
of the same signed roots. I have decided that we n
Package: hplip
Version: 3.13.11-1
Followup-For: Bug #731480
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
-- Package-specific info:
*** /tmp/tmp2P2w3P/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/non-shipped-files.t
Package: gnupg
Severity: normal
Tags: security
gnupg 1.4.15-2 claims to fix CVE-2013-4576, but the patch isn't actually
being applied during build. It is in the wrong directory, and isn't
listed in the series file.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a sub
Package: openssl
Version: 1.0.1e-4
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpVmJEAg/bug_body
OpenSSL uses rdrand exclusively if it is available.
http://seclists.org/fulldisclosure/2013/Dec/99
http://wiki.openssl.org
Package: ca-certificates
Severity: normal
Tags: security
Mozilla has released nss 3.15.3.1 that specifically distrusts
the AC DG Tresor SSL CA.
ca-certificates needs to be updated to the new certdata.txt.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of
Package: maven-javadoc-plugin
Version: 2.9.1-1
Severity: serious
Tags: patch
Justification: fails to build from source (but built successfully in the past)
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpvJaNhd/bug_body
In Ubuntu, the attached patch w
On 13-11-07 04:05 PM, Emmanuel Bourg wrote:
> The tests are ignored in maven-javadoc-plugin (maven.test.skip is set to
> true in debian/maven.properties), so adding this dependency will make no
> difference. Do you have a log of the build failure?
>
Here is the build log we were getting:
https:/
Thank you Emmanuel!
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: libcommons-fileupload-java
Version: 1.3-2
Followup-For: Bug #726601
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpA8shKI/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: arbitrary file overw
Package: python2.7
Version: 2.7.6-5
Severity: normal
Python 2.7 in Debian/Ubuntu has a patch that backports ssl.match_hostname().
Upstream has modified that function in recent python versions to match
RFC 6125 as a security improvement.
This should be added to the patch in the python2.7 package.
Package: scid
Version: 1:4.3.0.cvs20120311-1
Followup-For: Bug #738024
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu trusty ubuntu-patch
*** /tmp/tmpzrF_88/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* Added .desktop file (LP: #1277520)
Thanks
Package: opensc
Version: 0.13.0-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu utopic ubuntu-patch
*** /tmp/tmpsB0qMw/bug_body
OpenSC 0.13.0 does not list RSA public keys which are of 2048 bits in size on
a SmartCard-HSM smart card.
Although the keys
Package: opensc
Version: 0.13.0-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu utopic ubuntu-patch
*** /tmp/tmprA8Vep/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/0002-fix-epass2003-support-from-upst
Package: libssh
Version: 0.5.3-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu raring ubuntu-patch
*** /tmp/tmpWGDf6_/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service via NULL derefere
Package: tiff
Version: 4.0.2-4
Followup-For: Bug #692345
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu raring ubuntu-patch
*** /tmp/tmpm0_BMg/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service and possible code exec
FYI, as a security fix for our stable releases in Ubuntu, we plan on
disabling cupsd.conf modification in the web interface entirely.
Attached is the patch we plan on using.
Marc.
Description: fix privilege escalation by disabling config file editing via
the web interface
Author: Marc
On 12-11-27 03:51 PM, Didier 'OdyX' Raboud wrote:
> Le mardi, 27 novembre 2012 15.30:46, Marc Deslauriers a écrit :
>> FYI, as a security fix for our stable releases in Ubuntu, we plan on
>> disabling cupsd.conf modification in the web interface entirely.
>> Attache
Package: tomcat6
Version: 6.0.35-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpQZSwrL/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/0011-CVE-2012-0022-regression-fix.p
Package: dhcpcd
Version: 1:3.2.3-9
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpYPCJL7/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: dhcpcd before 5.2.12 allows re
-demand root cert loading is not working with mumble.
+Author: Marc Deslauriers
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/928296
+
+Index: mumble-1.2.3/src/SSL.cpp
+===
+--- mumble-1.2.3.orig/src/SSL.cpp 2012-02
Package: mumble
Version: 1.2.3-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpbbtG6M/bug_body
By default, Mumble creates it's config file and database with
world-readable permissions. The database may contain passwords.
Package: freemind
Version: 0.9.0+dfsg-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmpVn1uqL/bug_body
In Ubuntu, the attached patch was applied so users can double click
on data files and get the application to open them
Package: tiff
Version: 4.0.2-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmpgGHwFf/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: possible arbitrary code execution via
On Sat, 2012-07-21 at 20:57 -0400, Jay Berkenbilt wrote:
> Marc Deslauriers wrote:
>
> > *** /tmp/tmpgGHwFf/bug_body
> > In Ubuntu, the attached patch was applied to achieve the following:
> >
> > * SECURITY UPDATE: possible arbitrary code execution via hea
Package: ca-certificates
Version: 20111211
Severity: normal
Verisign shipped G1 PCA Roots with md2 signatures on them. At some point,
they resigned those roots using SHA1, but requested that the original certs
keep shipping in Mozilla's cert list as they had issued intermediates with
AKIs that poi
OK, I am now convinced that we don't need the md2 certs, applications
should be able to validate using the sha1 certs. I believe a bug in
libsoup/glib-networking is causing the sha1 certs to not be used.
We still should improve ca-certificates to make _sure_ that we're
shipping the sha1 certs inst
Package: policykit-1-gnome
Version: 0.105-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmpxkPNXr/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/08-fresh-x11-timestamps.pa
On 12-11-27 11:38 PM, Michael Sweet wrote:
> After looking at this patch in detail, it doesn't actually prevent users in
> the lpadmin group from modifying cupsd.conf and performing the specified
> privilege escalation.
>
> An alternate fix for cups-1.5 and earlier that specifically addresses th
On 12-11-29 05:30 AM, Didier 'OdyX' Raboud wrote:
> B) Disable any remote configuration by lpadmin users
>
> This has been attempted by Marc on [1]. For now, it is incomplete as it still
> allows lpadmin users to HTTP PUT updates to the configuration files.
>
> Pros: + Addresses the problem in a
Michael,
On 12-11-29 10:12 AM, Michael Sweet wrote:
>> So, your alternate fix doesn't actually solve the problem as I can still
>> do something like:
>>
>> PageLog /var/log/cups/../../../etc/shadow
>
> Adding a check for "../" in the path will catch that, easy fix...
>
>> Also, there are a lot o
Here's what I did...not sure if it's the best way to fix it though:
--- libxcb-1.8.1.orig/tests/Makefile.am
+++ libxcb-1.8.1/tests/Makefile.am
@@ -12,9 +12,6 @@
check_PROGRAMS = check_all
check_all_SOURCES = check_all.c check_suites.h check_public.c
-all-local::
- $(RM) CheckLog*.xml
-
Package: cfingerd
Version: 1.4.3-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu raring ubuntu-patch
*** /tmp/tmpntc4Ea/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: fix buffer overflow in rfc1413 (i
severity 700098 grave
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: quilt
Version: 0.60-7
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu raring ubuntu-patch
*** /tmp/tmprMnRKR/bug_body
The push_timeskew patch leaves behind temp files in /tmp when
quilt push is used.
In Ubuntu, the attached patch was applied to
Package: rkhunter
Version: 1.3.6-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu lucid ubuntu-patch
*** /tmp/tmpxR3xQ8
In Ubuntu, we've applied the attached patch to achieve the following:
* debian/patches/20_fix_strings_check.diff: fix hdparm false
Package: gimp
Version: 2.6.11-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu oneiric ubuntu-patch
*** /tmp/tmphuxFni
In Ubuntu, the attached patch was applied to achieve the following security
fix:
* SECURITY UPDATE: denial of service and possible c
Package: gcstar
Severity: normal
Tags: sid
Upstream has released version 1.6.2 on july 10th. Please update
the version in unstable.
Thanks!
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: libmodplug
Version: 1:0.8.8.2-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu oneiric ubuntu-patch
*** /tmp/tmpNcrGvL
In Ubuntu, the attached patch was applied to fix the security issue:
* SECURITY UPDATE: multiple security issues in ABC loa
Package: apache2
Version: 2.4.4-6
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu saucy ubuntu-patch
*** /tmp/tmp5THIhe/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service via MERGE request
Package: apache2
Version: 2.4.6-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu saucy ubuntu-patch
*** /tmp/tmpJJNbzc/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* Fixed module dependencies (LP: #1205314)
- debia
Package: puppet
Version: 3.2.4-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu saucy ubuntu-patch
*** /tmp/tmpDyephT/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/tests/control: invert order of tests, or else
Package: ca-certificates
Version: 20130610
Severity: normal
The ca-certificates package ships certificates which are trusted
for either CKA_TRUST_SERVER_AUTH or CKA_TRUST_EMAIL_PROTECTION.
Some of those CA certs are only valid for one or the other, and
bundling them together is problematic.
For
Package: sudo
Version: 1.8.6p3-0ubuntu3
Severity: normal
Tags: security
Sudo treats filestamps set to epoch as invalid, so the init script should set
the contents of /var/lib/sudo to epoch, and not 19850101.
ie:
find /var/lib/sudo -exec touch -d @0 '{}' \;
instead of:
find /var/lib/sudo -exec t
FYI, I've just uploaded a gcstar 1.7.0 package to Ubuntu. It contains 1.7.0,
plus a couple of plugin fixes for the sites I use.
Perhaps you could base your Debian package on it.
Thanks,
Marc.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe"
Package: stereograph
Version: 0.30a-6
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu oneiric ubuntu-patch
*** /tmp/tmpbOzU85
In Ubuntu, the attached patch was applied to fix a FTBFS:
* Changed library references, changed and updated parameters
to
Package: gupnp-ui
Version: 0.1.1-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu oneiric ubuntu-patch
*** /tmp/tmp8b36Ny
In Ubuntu, the attached patch was applied to fix the FTBFS:
* configure, configure.ac: add libgupnp libraries to LIBS in
ord
Package: libgd2
Version: 2.1.0-1
Severity: important
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu saucy ubuntu-patch
*** /tmp/tmp_IJ9Y5/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/fix-compiled-in-version.patch: upda
4 15:52:46.0 -0500
@@ -0,0 +1,20 @@
+Description: fix path to the qemu-dm binary
+Author: Marc Deslauriers
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/virtinst/+bug/936048
+
+Index: virtinst-0.600.1/virtinst/Guest.py
+===
Package: tomcat6
Version: 6.0.32-6
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpibvEX2
In Ubuntu, the attached patch was applied to achieve the following:
Fixes two security issues (CVE-2011-1184 and CVE-2011-2526)
Package: libarchive
Version: 2.8.5-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmp_Ru6Y6
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: arbitrary code execution via iso9660 ove
I didn't submit the Ubuntu patch as the Debian synaptic package uses
su-to-root, and not gksu as Ubuntu does.
Would it be ok to unconditionally use pkexec as the wrapper instead of
su-to-root in Debian?
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "
atch 2011-12-14 15:21:35.0 -0500
@@ -0,0 +1,31 @@
+Description: Use system ca certificates, not the bundled ones
+Author: Marc Deslauriers
+Forwarded: No, distro-specific
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-httplib2/+bug/882027
+
+Index: python-htt
Here's a better patch for the issue. Thanks.
Description: Use system ca certificates, not the bundled ones
Author: Marc Deslauriers
Forwarded: No, distro-specific
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-httplib2/+bug/882027
Index: python-httplib2-0.7.2/python2/htt
Package: jasper
Version: 1.900.1-12
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpCx1dv3
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service and possible code execu
Looks like this:
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53;r2=1.54
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: libzip
Version: 0.10-1
Followup-For: Bug #664990
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu precise ubuntu-patch
*** /tmp/tmpvDE7OS/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: arbitrary code execution or information
On Sun, 2012-05-27 at 09:21 +0200, Niels Thykier wrote:
> tags 673451 + moreinfo
> thanks
>
>
> On 2012-05-18 20:50, Marc Deslauriers wrote:
> > [...]
> >
> > *** /tmp/tmpiekV9j/bug_body
> > In Ubuntu, the attached patch was applied to achieve the fol
Package: lintian
Version: 2.5.7
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmphAWAWQ/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* t/tests/binaries-hardening/debian/Makefile: stack pro
Package: lintian
Version: 2.5.7
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmpiekV9j/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* collection/objdump-info: objdump-info switched from o
Package: net-snmp
Version: 5.4.3~dfsg-2.4
Followup-For: Bug #672492
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
*** /tmp/tmp7KXNLG/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service via SNMP GE
Package: logrotate
Version: 3.8.7-2
Followup-For: Bug #775421
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu wily ubuntu-patch
*** /tmp/tmpaYlMlo/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/manpage.patch: fix state file path in F
We're hitting the same issue in Ubuntu:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1675698
"follow symlinks = no" is required to reproduce it.
Package: sudo
Version:
Severity: normal
Tags: security
Sudo 1.8.10 switched to a new time stamp file format that uses the monotonic
clock. Timestamp files moved from /var/lib/sudo to /var/lib/sudo/ts.
At boot, the contents of the /var/lib/sudo/ts directory needs to be deleted,
as per the warning
Package: icu
Version: 52.1-8
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu wily ubuntu-patch
*** /tmp/tmp8_oq5o/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: heap overflow via incorrect isolateCount
Package: sudo
Version: 1.8.12-1
Followup-For: Bug #786555
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu wily ubuntu-patch
*** /tmp/tmp8y8IwQ/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* Use tmpfs location to store timestamp files (LP: #1458031)
Package: graphviz
Version: 2.38.0-6
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmp5q_TKj/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: Format string vulnerability may a
Package: unzip
Version: 6.0-13
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmp7DfOwv/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: heap overflow via mismatched block siz
Package: nut
Version: 2.7.1-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmpvfdwEw/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
Default/sample ups.conf has maxretry setting at end. Above t
Package: tiff
Version: 4.0.3-12.3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmpy2ySAQ/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: Backport more security-relevant com
Package: openslp-dfsg
Version: 1.2.1-10
Followup-For: Bug #795429
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu wily ubuntu-patch
*** /tmp/tmpHzlE84/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: denial of service via double free
Package: putty
Version: 0.62-9+deb7u2
Severity: normal
Tags: security
-- System Information:
Debian Release: jessie/sid
APT prefers vivid-updates
APT policy: (500, 'vivid-updates'), (500, 'vivid-security'), (500,
'vivid-proposed'), (500, 'vivid'), (100, 'vivid-backports')
Architecture: amd6
Whoops, that's not the official repo, this is the right URL:
http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=commit;h=aa5bae89
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: tar
Version: 1.28-2
Followup-For: Bug #803012
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu xenial ubuntu-patch
*** /tmp/tmp70_1Po/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/use-sort-in-t-dir-tests.diff: upstream patch
I've attached a patch to the upstream bug I've filed about this issue:
https://bugzilla.gnome.org/show_bug.cgi?id=739895
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Package: pyserial
Version: 2.6-1.1
Followup-For: Bug #717058
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmpYJUV0X/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* Adding patch for accepting any speed (Debian #717058)
Package: chkrootkit
Version: 0.50-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmptrJm3i/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* debian/patches/fix-stack-smash.patch: Fix segfault
t-2.8.8/debian/patches/dont_force_sslv3.patch 2014-10-20 11:39:17.0 -0400
@@ -0,0 +1,32 @@
+Description: Don't force the use of SSLv3
+Author: Marc Deslauriers
+Bug: http://sourceforge.net/p/xchat/bugs/1598/
+Bug-Ubuntu: https://bugs.launchpad.net/xchat-gnome/+bug/1381484
+Forwarded:
2-31 19:00:00.0 -0500
+++ xchat-gnome-0.30.0~git20131003.d20b8d+really20110821/debian/patches/dont_force_sslv3.patch 2014-10-20 10:14:37.0 -0400
@@ -0,0 +1,28 @@
+Description: Don't force the use of SSLv3
+Author: Marc Deslauriers
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=73
Package: partman-efi
Version: 25
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu vivid ubuntu-patch
*** /tmp/tmpryAK4b/bug_body
In Ubuntu, the attached patch was applied to achieve the following:
* fstab.d/efi: force umask in mount options to ensure
Package: imagemagick
Version: 8:6.8.9.9-5+deb8u10
Severity: normal
Ubuntu imagemagick security updates are based on Debian security updates.
The latest round of jessie updates introduced a regression.
Please see the downstream bug report for a reproducer script:
https://bugs.launchpad.net/ubuntu
Here is the upstream commit:
http://git.gnome.org/cgit/pango/commit/?id=4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Here are the patches Ubuntu used:
http://patches.ubuntu.com/by-release/extracted/intrepid-security/p/poppler/0.8.7-1ubuntu0.2/64_security_jbig2.patch
http://patches.ubuntu.com/by-release/extracted/hardy-security/p/poppler/0.6.4-1ubuntu3.2/104_security_jbig2.patch
http://patches.ubuntu.com/by-relea
This is CVE-2009-1891:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891
Upstream patch:
http://svn.apache.org/viewvc?view=rev&revision=791454
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists
The SUSE update simply contains the patch from:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205#17
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
The patch included in 3.1.0-7 doesn't actually fix the problem. Normal
users can still set the ClientNameAlias by adding something like
"&override_ClientNameAlias=1&v_zZ_ClientNameAlias=" to their POST.
Marc.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a sub
Included is a patch that moves the previous fix to a location before the
settings get applied.
Marc.
diff -Naur backuppc-3.1.0.ori/lib/BackupPC/CGI/EditConfig.pm backuppc-3.1.0/lib/BackupPC/CGI/EditConfig.pm
--- backuppc-3.1.0.ori/lib/BackupPC/CGI/EditConfig.pm 2009-10-05 08:04:01.0 -040
Package: mimetex
Version: 1.50-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu karmic ubuntu-patch
*** /tmp/tmpXGbr7m
In Ubuntu, we've applied the attached patch to achieve the following:
* SECURITY UPDATE: arbitrary code execution via long picture,
Package: aide
Version: 0.13.1-10
Severity: wishlist
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu karmic ubuntu-patch
I have added a new feature to the aide package: a new option to remove
files that were changed by system updates from the daily e-mail report.
*** /tmp/t
2-2.2.12/debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 203_fix_legacy_ap_rputs_segfaults.dpatch by Marc Deslauriers
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Description: Fix
Here's the upstream patch that disables signature checking on
self-signed certs. This is needed when the CVE-2009-2409 patch is used.
http://marc.info/?l=openssl-cvs&m=124508133203041&w=2
Marc.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscri
Package: samba
Version: 2:3.4.0-3
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu lucid ubuntu-patch
*** /tmp/tmpUnTGqJ
In Ubuntu, we've applied the attached patch in our current releases:
* SECURITY UPDATE: privilege escalation via mount.cifs race
Package: liferea
Version: 1.6.3-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu maverick ubuntu-patch
*** /tmp/tmpHXo8qP
In Ubuntu, we've applied the attached patch to achieve the following:
* debian/patches/google-reader-auth.patch: fix Google reade
Package: ghostscript
Version: 8.63.dfsg.1-2
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu maverick ubuntu-patch
*** /tmp/tmpQ4x52y
In Ubuntu, we've applied the attached patch to achieve the following:
* SECURITY UPDATE: arbitrary code execution via u
Package: wget
Version: 1.12-1.1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu maverick ubuntu-patch
In Ubuntu, we've applied the attached patch to achieve the following:
* SECURITY UPDATE: arbitrary file overwrite via 3xx redirect
- debian/patches/
Package: sbuild
Version: 0.60.9-1
Severity: normal
Tags: patch
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu natty ubuntu-patch
*** /tmp/tmpVBaqZt
In Ubuntu, the attached patch was applied to achieve the following:
* lib/Sbuild/Build.pm: work around Lucid issue that has diff list
1 - 100 of 119 matches
Mail list logo
