[ubuntu/karmic-security] lftp, lftp_3.7.15-1ubuntu2.1_armel_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_lpia_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_ia64_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_i386_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_amd64_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_powerpc_translations.tar.gz, lftp_3.7.15-1ubuntu2.1_sparc_translations.tar.gz (delayed) 3.7.15-1ubuntu2.1 (Accepted)

[Ubuntu Installer]

lftp (3.7.15-1ubuntu2.1) karmic-security; urgency=low

  * SECURITY UPDATE: arbitrary file overwrite via dot file download
    - debian/patches/CVE-2010-2251.dpatch: don't use server-provided names
      in src/{FileAccess,FileCopy,GetJob,commands,resource}.cc.
    - This update changes previous behaviour by ignoring the filename
      supplied by the server in the Content-Disposition header. To
      re-enable previous behaviour, use the new xfer:auto-rename setting.
    - CVE-2010-2251

Date: Thu, 02 Sep 2010 15:34:40 -0400
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/karmic/+source/lftp/3.7.15-1ubuntu2.1
-------------- next part --------------
Format: 1.8
Date: Thu, 02 Sep 2010 15:34:40 -0400
Source: lftp
Binary: lftp
Architecture: source
Version: 3.7.15-1ubuntu2.1
Distribution: karmic-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 lftp       - Sophisticated command-line FTP/HTTP client programs
Changes: 
 lftp (3.7.15-1ubuntu2.1) karmic-security; urgency=low
 .
   * SECURITY UPDATE: arbitrary file overwrite via dot file download
     - debian/patches/CVE-2010-2251.dpatch: don't use server-provided names
       in src/{FileAccess,FileCopy,GetJob,commands,resource}.cc.
     - This update changes previous behaviour by ignoring the filename
       supplied by the server in the Content-Disposition header. To
       re-enable previous behaviour, use the new xfer:auto-rename setting.
     - CVE-2010-2251
Checksums-Sha1: 
 2cb4111cdc2f7b27bbe653417b8160381a58e8ad 1188 lftp_3.7.15-1ubuntu2.1.dsc
 2ebfe33a48af9ac305ac2a98f820bd7ebf6f21a6 15248 lftp_3.7.15-1ubuntu2.1.diff.gz
Checksums-Sha256: 
 5a8ad5597c24b4cff8626861035914f0a737cb383e3fa7fb38d1acd96b025611 1188 lftp_3.7.15-1ubuntu2.1.dsc
 dec0596caeb4934e2ab533455054c157e24858c3692eb966bfd1d89ba369e04b 15248 lftp_3.7.15-1ubuntu2.1.diff.gz
Files: 
 24cc77bbaaaf15083280ee374b74e952 1188 net optional lftp_3.7.15-1ubuntu2.1.dsc
 10d56523f7ca48b4f7ca7b12b54acdc0 15248 net optional lftp_3.7.15-1ubuntu2.1.diff.gz
Original-Maintainer: Noèl Köthe <noel at debian.org>