From steve.langasek at canonical.com Mon May 3 12:45:02 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:02 -0000 Subject: [ubuntu/precise-security] gnupg 1.4.11-3ubuntu2.12 (Accepted) Message-ID: <162004590232.5996.8016630998299889883.launchpad@ackee.canonical.com> gnupg (1.4.11-3ubuntu2.12) precise-security; urgency=medium * SECURITY UPDATE: full RSA key recovery via side-channel attack - debian/patches/CVE-2017-7526-part1.dpatch: simplify loop in mpi/mpi-pow.c. - debian/patches/CVE-2017-7526-part2.dpatch: use same computation for square and multiply in mpi/mpi-pow.c. - debian/patches/CVE-2017-7526-part3.dpatch: fix allocation size for mpi_pow - debian/patches/CVE-2017-7526-part4.dpatch: add exponent blinding in cipher/rsa.c. - debian/patches/CVE-2017-7526-part5.dpatch: allow different build directory - debian/patches/CVE-2017-7526-part6.dpatch: Reduce secmem pressure in cipher/rsa.c. - CVE-2017-7526 gnupg (1.4.11-3ubuntu2.11) precise-security; urgency=medium * SECURITY UPDATE: missing sanitization of verbose output - debian/patches/CVE-2018-12020.dpatch: Sanitize diagnostic with the original file name. - CVE-2018-12020 Date: 2018-08-15 15:37:12.612502+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.12 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:16 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:16 -0000 Subject: [ubuntu/precise-security] icu 4.8.1.1-3ubuntu0.10 (Accepted) Message-ID: <162004591657.6007.5952081591009378151.launchpad@ackee.canonical.com> icu (4.8.1.1-3ubuntu0.10) precise-security; urgency=medium * SECURITY UPDATE: Integer Overflow - debian/patches/CVE-2020-10531.patch: adds a int32_t overflow check when calculate a newLen in doReplace function in source/common/unistr.cpp. - CVE-2020-10531 icu (4.8.1.1-3ubuntu0.9) precise-security; urgency=medium * SECURITY UPDATE: double free - debian/patches/CVE-2017-14952.patch: fixes double free in createMetaZoneMappings() source/i18n/zonemeta.cpp. - CVE-2017-14952 icu (4.8.1.1-3ubuntu0.8) precise-security; urgency=medium * SECURITY UPDATE: out of bounds write in common/utext.cpp (LP: #1684298) - debian/patches/CVE-2017-786x.patch: properly handle hunk size in source/common/utext.cpp, added test to source/test/intltest/utxttest.cpp, source/test/intltest/utxttest.h. - debian/patches/CVE-2017-786x-additional.patch: this patch was originally typed to debian Wheezy and applied here in order to adapt the original fix to Precise. Thanks to Roberto C. Sànchez. - CVE-2017-7867 - CVE-2017-7868 Date: 2020-03-16 18:14:26.164013+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/icu/4.8.1.1-3ubuntu0.10 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:21 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:21 -0000 Subject: [ubuntu/precise-security] heimdal 1.6~git20120311.dfsg.1-2ubuntu0.2 (Accepted) Message-ID: <162004592128.5996.7499817786583262475.launchpad@ackee.canonical.com> heimdal (1.6~git20120311.dfsg.1-2ubuntu0.2) precise-security; urgency=medium * SECURITY UPDATE: avoiding impersonation and other attacks through unauthenticated portions of Kerberos tickets - debian/patches/CVE-2017-11103.patch: this patch assures that the KDC-REP service name is obtained from encrypted version. - CVE-2017-11103 Date: 2017-07-20 14:58:15.112340+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/heimdal/1.6~git20120311.dfsg.1-2ubuntu0.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:31 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:31 -0000 Subject: [ubuntu/precise-security] ipsec-tools 1:0.8.0-9ubuntu1.2 (Accepted) Message-ID: <162004593144.6007.6045205269812294503.launchpad@ackee.canonical.com> ipsec-tools (1:0.8.0-9ubuntu1.2) precise-security; urgency=medium * SECURITY UPDATE: remote attacker exploitable DoS - debian/patches/CVE-2016-10396.patch: fix remotely exploitable DoS in src/racoon/isakmp_frag.c, src/racoon/isakmp_inf.c, src/racoon/isakmp.c, src/racoon/handler.h. - CVE-2016-10396 Date: 2017-11-16 13:24:24.095842+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/ipsec-tools/1:0.8.0-9ubuntu1.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:33 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:33 -0000 Subject: [ubuntu/precise-security] jinja2 2.6-1ubuntu0.2 (Accepted) Message-ID: <162004593376.6008.1841353331853841194.launchpad@ackee.canonical.com> jinja2 (2.6-1ubuntu0.2) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: sandbox escape via str.format - debian/patches/CVE-2016-10745-1.patch: support sandboxing in format expressions in jinja2/nodes.py, jinja2/sandbox.py. - debian/patches/CVE-2016-10745-2.patch: fix a name error for an uncommon attribute access in the sandbox in jinja2/sandbox.py. - debian/patches/CVE-2016-10745-3.patch: adding types and EscapeFormatter class to support the fixes from this CVE in jinja2/sandbox.py. - CVE-2016-10745 * SECURITY UPDATE: sandbox escape via str.format_map - debian/patches/CVE-2019-10906.patch: properly sandbox format_map in jinja2/sandbox.py. - CVE-2019-10906 Date: 2019-05-15 16:45:18.086312+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/jinja2/2.6-1ubuntu0.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:34 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:34 -0000 Subject: [ubuntu/precise-security] isc-dhcp 4.1.ESV-R4-0ubuntu5.13 (Accepted) Message-ID: <162004593419.25021.18344856599402838071.launchpad@ackee.canonical.com> isc-dhcp (4.1.ESV-R4-0ubuntu5.13) precise-security; urgency=medium * SECURITY UPDATE: buffer overflow in dhclient - debian/patches/CVE-2018-573x.patch: check option data size in common/options.c. - CVE-2018-5732 * SECURITY UPDATE: reference counter overflow in dhcpd - debian/patches/CVE-2018-573x.patch: avoid overflow in common/options.c. - CVE-2018-5733 isc-dhcp (4.1.ESV-R4-0ubuntu5.12) precise; urgency=medium * ipv6: wait for duplicate address detection to finish (LP: #1633479). isc-dhcp (4.1.ESV-R4-0ubuntu5.11) precise; urgency=medium * Don't assume IPv6 prefix length of 64 (LP: #1609898). Pulled from debian commit c347ab8a43587164486ce1f104eedfd638594e59. Date: 2018-05-25 15:56:20.932427+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/isc-dhcp/4.1.ESV-R4-0ubuntu5.13 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:35 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:35 -0000 Subject: [ubuntu/precise-security] json-c 0.9-1ubuntu1.4 (Accepted) Message-ID: <162004593544.5996.17750020820735729136.launchpad@ackee.canonical.com> json-c (0.9-1ubuntu1.4) precise-security; urgency=medium * SECURITY UPDATE: Integer overflows - debian/patches/CVE-2020-12762-*.patch: fix a series of integer overflows adding checks in linkhash.c, printbuf.c, also adds the fix for the INT_MAX regression caused in previous update. - CVE-2020-12762 json-c (0.9-1ubuntu1.3) precise-security; urgency=medium * SECURITY REGRESSION: last update caused a series of regressions, revert to previous version, removing patches applied CVE-2020-12762-*.patch (LP: #1878723). json-c (0.9-1ubuntu1.2) precise-security; urgency=medium * SECURITY UPDATE: Integer overflows - debian/patches/CVE-2020-12762-*.patch: fix a series of integer overflows adding checks in linkhash.c, printbuf.c. - CVE-2020-12762 Date: 2020-05-27 16:54:10.158178+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/json-c/0.9-1ubuntu1.4 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:38 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:38 -0000 Subject: [ubuntu/precise-security] keepalived 1:1.2.2-3ubuntu1.2 (Accepted) Message-ID: <162004593803.5996.17790421762527165568.launchpad@ackee.canonical.com> keepalived (1:1.2.2-3ubuntu1.2) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-19115.patch: fix in lib/html.c. - CVE-2018-19115 Date: 2019-02-18 10:31:14.419104+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/keepalived/1:1.2.2-3ubuntu1.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:42 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:42 -0000 Subject: [ubuntu/precise-security] lcms 1.19.dfsg-1ubuntu3.1 (Accepted) Message-ID: <162004594205.6008.5687573770374750278.launchpad@ackee.canonical.com> lcms (1.19.dfsg-1ubuntu3.1) precise-security; urgency=medium * SECURITY UPDATE: Stack-based buffer overflow - fix in samples/icctrans.c, tifficc/tiffdiff.c. - CVE-2013-4276 * SECURITY UPDATE: Integer overflow - fix in src/cmscgats.c. - CVE-2018-16435 Date: 2018-09-19 13:02:19.269379+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/lcms/1.19.dfsg-1ubuntu3.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:45 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:45 -0000 Subject: [ubuntu/precise-security] lcms2 2.2+git20110628-2ubuntu3.3 (Accepted) Message-ID: <162004594514.6008.3781266564762001591.launchpad@ackee.canonical.com> lcms2 (2.2+git20110628-2ubuntu3.3) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2016-10165.patch: fix in src/cmstypes.c. - CVE-2016-10165 * SECURITY UPDATE: Integer overflow - debian/patches/CVE-2018-16435.patch: fix in src/cmscgats.c. - CVE-2018-16435 * Removing broken clean on debian/rules Date: 2018-09-20 11:30:12.812401+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/lcms2/2.2+git20110628-2ubuntu3.3 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:48 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:48 -0000 Subject: [ubuntu/precise-security] lftp 4.3.3-1ubuntu0.1 (Accepted) Message-ID: <162004594849.6008.13215869481069354738.launchpad@ackee.canonical.com> lftp (4.3.3-1ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Incorrectly sanitize remote file names - debian/patches/CVE-2018-10196.patch: fix in src/MirrorJob.cc. - CVE-2018-10196 Date: 2018-08-03 16:56:12.744254+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/lftp/4.3.3-1ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:51 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:51 -0000 Subject: [ubuntu/precise-security] libapache2-mod-perl2 2.0.5-5ubuntu1.1 (Accepted) Message-ID: <162004595181.5996.13419479413719540209.launchpad@ackee.canonical.com> libapache2-mod-perl2 (2.0.5-5ubuntu1.1) precise-security; urgency=medium * SECURITY UPDATE: arbitrary perl code execution via .htaccess file - debian/patches/CVE-2011-2767.patch: only allow perl and pod sections in server configuration and not per directory in src/modules/perl/mod_perl.c. - CVE-2011-2767 * Fix FTBFS caused by test failures due to Apache security updates. - debian/patches/370_http_syntax.patch - debian/patches/380_inject_header_line_terminators.patch * FIX FTBFS on hask_attack test - debian/patches/270_fix_hash_attack_test.patch Date: 2018-11-21 18:44:12.718096+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libapache2-mod-perl2/2.0.5-5ubuntu1.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:45:54 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:45:54 -0000 Subject: [ubuntu/precise-security] libarchive-zip-perl 1.30-6ubuntu0.1 (Accepted) Message-ID: <162004595475.5996.1965652063296803554.launchpad@ackee.canonical.com> libarchive-zip-perl (1.30-6ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Traversal path vulnerability - debian/patches/CVE-2018-10860.patch: fix in lib/Archive/Zip/Archive.pm and add test in t/25_traversal.t and some .zip files for test. - CVE-2018-10860 Date: 2018-07-03 14:58:14.490400+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libarchive-zip-perl/1.30-6ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:01 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:01 -0000 Subject: [ubuntu/precise-security] libbsd 0.3.0-2ubuntu0.1 (Accepted) Message-ID: <162004596152.5996.17637102367632465799.launchpad@ackee.canonical.com> libbsd (0.3.0-2ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Out-of-bounds - debian/patches/CVE-2019-20367.patch: make sure that there is a bounded comparison in src/nlist.c. - CVE-2019-20367 Date: 2020-01-16 12:38:15.638453+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libbsd/0.3.0-2ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:05 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:05 -0000 Subject: [ubuntu/precise-security] libcaca 0.99.beta17-2.1ubuntu2.1 (Accepted) Message-ID: <162004596506.5996.3362508027763158269.launchpad@ackee.canonical.com> libcaca (0.99.beta17-2.1ubuntu2.1) precise-security; urgency=medium * SECURITY UPDATE: Floating point exception - debian/patches/CVE-2018-20544.patch: fix in caca/dither.c. - CVE-2018-20544 * SECURITY UPDATE: Buffer over-write - debian/patches/CVE-2018-20545_20548_20549.patch: fix in src/common-image.h. - CVE-2018-20545 - CVE-2018-20548 - CVE-2018-20549 * SECURITY UPDATE: Buffer over-read - debian/patches/CVE-2018-20546_20547.patch: fix in caca/dither.c. - CVE-2018-20546 - CVE-2018-20547 Date: 2019-01-14 16:43:13.610481+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libcaca/0.99.beta17-2.1ubuntu2.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:10 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:10 -0000 Subject: [ubuntu/precise-security] libdbi-perl 1.616-1ubuntu0.3 (Accepted) Message-ID: <162004597009.5996.2769578957106710948.launchpad@ackee.canonical.com> libdbi-perl (1.616-1ubuntu0.3) precise-security; urgency=medium * Rebuild no change for fixing unmet dependency. Date: 2020-10-13 13:57:13.930917+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libdbi-perl/1.616-1ubuntu0.3 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:13 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:13 -0000 Subject: [ubuntu/precise-security] libexif 0.6.20-2ubuntu0.7 (Accepted) Message-ID: <162004597378.5996.12791344500208343871.launchpad@ackee.canonical.com> libexif (0.6.20-2ubuntu0.7) precise-security; urgency=medium * SECURITY UPDATE: Buffer overflow - debian/patches/CVE-2020-0452.patch: fixed a incorrect overflow check that could be optimized away in libexif/exif-entry.c. - CVE-2020-0452 libexif (0.6.20-2ubuntu0.6) precise-security; urgency=medium * SECURITY UPDATE: Out of bounds read - debian/patches/CVE-2020-0093.patch: fix read buffer overflow making sure the number of bytes being copied from does not exceed the source buffer size in libexif/exif-data.c. - CVE-2020-0093 * SECURITY UPDATE: Out of bounds read - debian/patches/CVE-2020-13112.patch: fix MakerNote tag size overflow check for a size overflow while reading tags in libexif/canon/exif-mnote-data-canon.c, libexif/fuji/exif/mnote-data-fuji.c, libexif/olympus/exif-mnote-data-olympus.c, libexif/pentax/exif-mnote-data-pentax.c. - CVE-2020-13112 * SECURITY UPDATE: Possibly crash and potential use-after-free - debian/patches/CVE-2020-13113.patch: ensures that an uninitialized pointer is not dereferenced later in the case where the number of components is 0 in libexif/canon/exif-mnote-data-canon.c, libexif/fuji/exif-mnote-data-fuji.c, libexif/olympus/exif-mnote-data-olympus.c, libexif/pentax/exif-mnote-data-pentax. - CVE-2020-13113 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2020-13114.patch: add a failsafe on the maximum number of Canon MakerNote subtags in libexif/canon/exif-mnote-data-canon.c. - CVE-2020-13114 * SECURITY UPDATE: Out of bounds read - debian/patches/CVE-2020-0182.patch: fix a buffer read overflow in exif_entry_get_value in libexif/exif-entry.c. - CVE-2020-0182 * SECURITY UPDATE: Integer overflow - debian/patches/CVE-2020-0198.patch: fix unsigned integer overflow in libexif/exif-data.c. - CVE-2020-0198 libexif (0.6.20-2ubuntu0.3) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-20030.patch: improve deep recursion detection in exif_data_load_data_content in libexif/exif-data.c. - CVE-2018-20030 * SECURITY UPDATE: Divinding by zero vulnerability - debian/patches/CVE-2020-12767.patch: check if d variable is not zeroed before use it in libexif/exif-entry.c - CVE-2020-12767 libexif (0.6.20-2ubuntu0.2) precise-security; urgency=medium * SECURITY UPDATE: Integer overflow - debian/patches/CVE-2016-6328.patch: fix int overflow while parsing MNOTE entry data of the input file in libexif/pentax/mnote-pentax-entry.c - CVE-2016-6328 * SECURITY UPDATE: Out-bouns heap read and denial of service - debian/patches/CVE-2017-7544.patch: fixes out-of-bounds heap read in exif_data_save_data_entry function in libexif/exif-data.c. - CVE-2017-7544 * SECURITY UPDATE: Out of bounds write - debian/patches/CVE-2019-9278.patch: avoid the use of unsafe int overflow checking constructs and check for the actual sizes to avoid integer overflows in libexif/exif-data.c. - CVE-2019-9278 Date: 2020-11-09 12:48:13.993928+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libexif/0.6.20-2ubuntu0.7 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:17 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:17 -0000 Subject: [ubuntu/precise-security] aptdaemon 0.43+bzr805-0ubuntu10.1 (Accepted) Message-ID: <162004597715.5996.14359685336189583120.launchpad@ackee.canonical.com> aptdaemon (0.43+bzr805-0ubuntu10.1) precise-security; urgency=medium * Fix compatibility with python-apt security update (LP: #1858973) Date: 2020-01-16 16:41:05.444536+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/aptdaemon/0.43+bzr805-0ubuntu10.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:17 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:17 -0000 Subject: [ubuntu/precise-security] apache2 2.2.22-1ubuntu1.15 (Accepted) Message-ID: <162004597720.6008.10588927958462508162.launchpad@ackee.canonical.com> apache2 (2.2.22-1ubuntu1.15) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig - debian/patches/CVE-2017-15710.patch: fix language long names detection as short name in modules/aaa/mod_authnz_ldap.c. - CVE-2017-15710 * SECURITY UPDATE: DoS via specially-crafted request - debian/patches/CVE-2018-1301.patch: ensure that read lines are NUL terminated on any error, not only on buffer full in server/protocol.c. - CVE-2018-1301 * SECURITY UPDATE: insecure nonce generation - debian/patches/CVE-2018-1312-*.patch: actually use the secret when generating nonces in modules/aaa/mod_auth_digest.c. - CVE-2018-1312 * SECURITY UPDATE: mod_auth_digest access control bypass - debian/patches/CVE-2019-0217.patch: fix a race condition in modules/aaa/mod_auth_digest.c. - CVE-2019-0217 apache2 (2.2.22-1ubuntu1.14) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: optionsbleed information leak - debian/patches/CVE-2017-9798.patch: disallow method registration at run time in server/core.c. - CVE-2017-9798 apache2 (2.2.22-1ubuntu1.13) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: uninitialized memory reflection in mod_auth_digest - debian/patches/CVE-2017-9788.patch: correct string scope in modules/aaa/mod_auth_digest.c. - CVE-2017-9788 apache2 (2.2.22-1ubuntu1.12) precise-security; urgency=medium * SECURITY UPDATE: authentication bypass in ap_get_basic_auth_pw() - debian/patches/CVE-2017-3167.patch: deprecate and replace ap_get_basic_auth_pw in include/ap_mm.h, include/http_protocol.h, server/protocol.c, server/request.c. - CVE-2017-3167 * SECURITY UPDATE: NULL pointer deref in ap_hook_process_connection() - debian/patches/CVE-2017-3169.patch: fix ctx passed to ssl_io_filter_error() in modules/ssl/ssl_engine_io.c. - CVE-2017-3169 * SECURITY UDPATE: denial of service and possible incorrect value return in HTTP strict parsing changes - debian/patches/CVE-2017-7668.patch: short-circuit on NULL in server/util.c. - CVE-2017-7668 * SECURITY UPDATE: mod_mime DoS via crafted Content-Type response header - debian/patches/CVE-2017-7679.patch: fix quoted pair scanning in modules/http/mod_mime.c. - CVE-2017-7679 * SECURITY UPDATE: response splitting and cache pollution issue via imcomplete RCF7230 HTTP request grammar enforcing - debian/patches/CVE-2016-8743*.patch: enforce stricter parsing in include/http_core.h, include/http_protocal.h, include/httpd.h, modules/http/http_filters.c, server/core.c, server/gen_test_char.c, server/protocol.c, server/util.c, server/vhost.c. This patch set were applied from Wheezy. Patch CVE-2016-8743-4.patch fix a possible regression. Thanks Antoine Beaupre. - CVE-2016-8743 * WARNING: The fix for CVE-2016-8743 introduces a behavioural change and may introduce compatibility issues with clients that do not strictly follow specifications. A new configuration directive, "HttpProtocolOptions Unsafe" can be used to re-enable some of the less strict parsing restrictions, at the expense of security. Date: 2019-04-09 20:19:10.482572+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.15 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:17 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:17 -0000 Subject: [ubuntu/precise-security] apport 2.0.1-0ubuntu17.16 (Accepted) Message-ID: <162004597737.25890.7558972587019071892.launchpad@ackee.canonical.com> apport (2.0.1-0ubuntu17.16) precise-security; urgency=medium * Disable apport as it is excluded from ESM. Date: 2017-10-27 21:22:15.516250+00:00 Changed-By: Brian Murray Maintainer: Martin Pitt Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/apport/2.0.1-0ubuntu17.16 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:19 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:19 -0000 Subject: [ubuntu/precise-security] aspell 0.60.7~20110707-1ubuntu0.1 (Accepted) Message-ID: <162004597996.6007.15921862004616330163.launchpad@ackee.canonical.com> aspell (0.60.7~20110707-1ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Stack-based buffer over-read - debian/patches/CVE-2019-17544.patch: add checks in common/config.cpp, common/file_util.cpp, common/getdata.cpp. - CVE-2019-17544 Date: 2019-10-15 13:02:15.001678+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/aspell/0.60.7~20110707-1ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:20 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:20 -0000 Subject: [ubuntu/precise-security] bash 4.2-2ubuntu2.9 (Accepted) Message-ID: <162004598070.6008.10874954465748826834.launchpad@ackee.canonical.com> bash (4.2-2ubuntu2.9) precise-security; urgency=medium * SECURITY UPDATE: Heap-based buffer overflow - debian/patches/CVE-2012-6711.patch: making u32cconv() return the number of bytes instead a negative value in lib/sh/unicode.c - CVE-2012-6711 bash (4.2-2ubuntu2.8) precise-security; urgency=medium * SECURITY UPDATE: rbash restriction bypass (LP: #1803441) - debian/patches/CVE-2019-9924.patch: if the shell is restricted, reject attempts to add pathnames containing slashes to the hash table in variables.c. - CVE-2019-9924 bash (4.2-2ubuntu2.7) precise-security; urgency=medium * SECURITY UPDATE: code execution via crafted SHELLOPTS and PS4 (LP: #1689304) - debian/patches/CVE-2016-7543.patch: check for root in variables.c. - CVE-2016-7543 Date: 2019-11-08 13:55:21.947800+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.9 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:22 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:22 -0000 Subject: [ubuntu/precise-security] avahi 0.6.30-5ubuntu2.3 (Accepted) Message-ID: <162004598276.5996.7244686912886769731.launchpad@ackee.canonical.com> avahi (0.6.30-5ubuntu2.3) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2017-6519-and-CVE-2018-1000845.patch: fix in avahi-core/server.c. - CVE-2017-6519 - CVE-2018-1000845 Date: 2019-01-30 18:00:16.841373+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/avahi/0.6.30-5ubuntu2.3 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:24 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:24 -0000 Subject: [ubuntu/precise-security] bind9 1:9.8.1.dfsg.P1-4ubuntu0.32 (Accepted) Message-ID: <162004598424.6007.6411565887512723412.launchpad@ackee.canonical.com> bind9 (1:9.8.1.dfsg.P1-4ubuntu0.32) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: off-by-one bug in ISC SPNEGO implementation - properly calculate length in lib/dns/spnego.c. - CVE-2020-8625 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.31) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: A truncated TSIG response can lead to an assertion failure - debian/patches/CVE-2020-8622.patch: move code in lib/dns/message.c. - CVE-2020-8622 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.30) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: BIND does not sufficiently limit the number of fetches performed when processing referrals - further limit the number of queries that can be triggered from a request in lib/dns/adb.c, lib/dns/include/dns/adb.h, lib/dns/resolver.c. - CVE-2020-8616 * SECURITY UPDATE: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c - don't allow replaying a TSIG BADTIME response in lib/dns/tsig.c. - CVE-2020-8617 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.29) precise-security; urgency=medium * Segfault: 'host' command could die if a UDP query timed out. commit adec9654d0177df1955a58409ab802106ac61bea at branch v9.8. bind9 (1:9.8.1.dfsg.P1-4ubuntu0.28) precise-security; urgency=medium * SECURITY UPDATE: limiting simultaneous TCP clients is ineffective - debian/patches/CVE-2018-5743.patch: add reference counting in bin/named/client.c, bin/named/include/named/client.h, bin/named/include/named/interfacemgr.h, bin/named/interfacemgr.c, lib/isc/include/isc/quota.h, lib/isc/quota.c, lib/isc/win32/libisc.def.in. - debian/patches/CVE-2018-5743-atomic-fix.patch: replace atomic operations with isc_refcount reference counting in bin/named/client.c, bin/named/include/named/interfacemgr.h, bin/named/interfacemgr.c. - CVE-2018-5743 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.27) precise-security; urgency=medium * SECURITY UPDATE: assertion failure when a trust anchor rolls over to an unsupported key algorithm when using managed-keys - lib/dns/zone.c: enhance rfc 5011 logging - lib/dns/include/dst/dst.h, lib/dns/zone.c: properly handle situations when the key tag cannot be computed. - CVE-2018-5745 * SECURITY UPDATE: Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable - bin/named/xfrout.c: handle zone transfers marked in the zone table as a DLZ zone. - CVE-2019-6465 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.26) precise-security; urgency=medium * SECURITY UPDATE: denial of service crash when deny-answer-aliases option is used - lib/dns/resolver.c: explicit DNAME query could trigger a crash if deny-answer-aliases was set - Patch backported from 9.9.13-P1. - CVE-2018-5740 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.25) precise-security; urgency=medium * SECURITY UPDATE: Assertion failure causing denial of service - lib/dns/validator.c and adds a couple of tests. - CVE-2018-5735 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.24) precise-security; urgency=medium * SECURITY UPDATE: assertion failure via improper cleanup - lib/dns/resolver.c: fix cleanup handling. - Patch backported from 9.9.11-P1. - CVE-2017-3145 bind9 (1:9.8.1.dfsg.P1-4ubuntu0.23) precise-security; urgency=medium * SECURITY UPDATE: TSIG authentication issues and regression - fix verification of TSIG signed TCP message sequences where not all the messages contain TSIG records in lib/dns/tsig.c, aded test to lib/dns/tests/Makefile.in, lib/dns/tests/tsig_test.c, lib/dns/dnssec.c, lib/dns/message.c. - 6fcdcabc11f18eb128167f7f7eca4a244bf75c52 - CVE-2017-3142 - CVE-2017-3143 * Update the built in managed keys to include the upcoming root KSK in bind.keys, bin/named/bind.keys.h. - 9543825c155c5c5ec42cc4d95fe6f0d52ef9b0a7 Date: 2021-02-26 17:19:10.680808+00:00 Changed-By: Avital Ostromich Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/bind9/1:9.8.1.dfsg.P1-4ubuntu0.32 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:24 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:24 -0000 Subject: [ubuntu/precise-security] libffi 3.0.11~rc1-5ubuntu0.1 (Accepted) Message-ID: <162004598415.6008.13076416828623858450.launchpad@ackee.canonical.com> libffi (3.0.11~rc1-5ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: executable stack - debian/patches/CVE-2017-1000376.patch: add missing GNU stack markings in src/x86/win32.S. - CVE-2017-1000376 Date: 2017-10-18 16:47:18.465718+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libffi/3.0.11~rc1-5ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:27 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:27 -0000 Subject: [ubuntu/precise-security] bzr 2.5.1-0ubuntu2.1 (Accepted) Message-ID: <162004598758.6008.4968725637743111175.launchpad@ackee.canonical.com> bzr (2.5.1-0ubuntu2.1) precise-security; urgency=medium * SECURITY UPDATE: Possible arbitrary code execution on clients through malicious bzr+ssh URLs - debian/patches/24_ssh_hostnames-lp1710979.patch: ensure that host arguments to ssh cannot be treated as ssh options. - debian/patches/fixing_test_fail.patch: test fails for test_smart_transport.py this patch comment the offended line out. - LP: #1710979 - CVE-2017-14176 Date: 2017-10-19 17:43:30.704361+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/bzr/2.5.1-0ubuntu2.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:28 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:28 -0000 Subject: [ubuntu/precise-security] ca-certificates 20190110~12.04.1 (Accepted) Message-ID: <162004598890.5996.12815263814204985823.launchpad@ackee.canonical.com> ca-certificates (20190110~12.04.1) precise-security; urgency=medium * Update ca-certificates database to 20190110: - backport certain changes from the Ubuntu 19.10 20190110 package * mozilla/blacklist.txt: blacklist expired AddTrust External Root CA. Date: 2020-06-01 14:53:28.453874+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/ca-certificates/20190110~12.04.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:29 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:29 -0000 Subject: [ubuntu/precise-security] bzip2 1.0.6-1ubuntu0.2 (Accepted) Message-ID: <162004598972.6007.11343094622027438008.launchpad@ackee.canonical.com> bzip2 (1.0.6-1ubuntu0.2) precise-security; urgency=medium * SECURITY REGRESSION: bzip2 update for CVE-2019-12900 causes some files raises incorrect CRC error. (LP: #1834494) - debian/patches/Accept-as-many-selectors-as-selectors*.patch Date: 2019-07-04 12:25:14.003554+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/bzip2/1.0.6-1ubuntu0.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:32 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:32 -0000 Subject: [ubuntu/precise-security] libgcrypt11 1.5.0-3ubuntu0.9 (Accepted) Message-ID: <162004599246.6007.4963408622202722809.launchpad@ackee.canonical.com> libgcrypt11 (1.5.0-3ubuntu0.9) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: ECDSA timing attack - debian/patches/CVE-2019-13627.patch: add mitigation against timing attack in cipher/ecc.c, mpi/ec.c. - CVE-2019-13627 libgcrypt11 (1.5.0-3ubuntu0.8) precise-security; urgency=medium * SECURITY UPDATE: memory-cache side-channel attack on ECDSA signatures - debian/patches/CVE-2018-0495.patch: add blinding for ECDSA in cipher/ecc. - CVE-2018-0495 libgcrypt11 (1.5.0-3ubuntu0.7) precise-security; urgency=medium * SECURITY UPDATE: full RSA key recovery via side-channel attack - debian/patches/CVE-2017-7526-1.patch: simplify loop in mpi/mpi-pow.c. - debian/patches/CVE-2017-7526-2.patch: use same computation for square and multiply in mpi/mpi-pow.c. - debian/patches/CVE-2017-7526-3.patch: add exponent blinding in cipher/rsa.c. - debian/patches/CVE-2017-7526-4.patch: add free to cipher/rsa.c. - debian/patches/CVE-2017-7526-5.patch: add free to cipher/rsa.c. - CVE-2017-7526 Date: 2020-01-28 15:47:24.609573+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libgcrypt11/1.5.0-3ubuntu0.9 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:34 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:34 -0000 Subject: [ubuntu/precise-security] cpio 2.11-7ubuntu3.3 (Accepted) Message-ID: <162004599466.6007.5172765616396165226.launchpad@ackee.canonical.com> cpio (2.11-7ubuntu3.3) precise-security; urgency=medium * SECURITY UPDATE: Improper input validation - debian/patches/CVE-2019-14866.patch: improve diagnostics, remove to_oct_or_error, adding new macro in src/copyout.c, src/extern.h, src/tar.c. - CVE-2019-14866 Date: 2019-11-05 15:58:15.114914+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/cpio/2.11-7ubuntu3.3 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:35 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:35 -0000 Subject: [ubuntu/precise-security] clamav 0.102.4+dfsg-0ubuntu0.12.04.1 (Accepted) Message-ID: <162004599576.5996.16815610626290781407.launchpad@ackee.canonical.com> clamav (0.102.4+dfsg-0ubuntu0.12.04.1) precise-security; urgency=medium * Updated to 0.102.2 to fix security issues - debian/libclamav9.symbols: updated for new version. - debian/rules: bumped CL_FLEVEL to 115. - CVE-2020-3327 - CVE-2020-3350 - CVE-2020-3481 clamav (0.102.3+dfsg-0ubuntu0.12.04.1) precise-security; urgency=medium * Updated to 0.102.2 to fix security issues - debian/libclamav9.symbols: updated for new version. - debian/rules: bumped CL_FLEVEL to 114. - CVE-2020-3327 - CVE-2020-3341 clamav (0.102.2+dfsg-0ubuntu0.12.04.1) precise-security; urgency=medium * Updated to 0.102.2 to fix security issue (CVE-2020-3123) - debian/patches/*: synced patches with 0.102.2+dfsg-1. - debian/libclamav9.symbols: updated for new version. - debian/rules: bumped CL_FLEVEL to 113. - debian/clamav-daemon.config.in, clamav-daemon.postinst.in: Removing ScanOnAccess option. * d/clamav-daemon.config.in: Correct error from ScanOnAccess option removal so that setting LogFile options via DebConf works again (Closes: #950296) (LP: #1860217) clamav (0.102.1+dfsg-0ubuntu0.12.04.1) precise-security; urgency=medium * Updated to 0.102.1 to fix security issue (CVE-2019-15961) - debian/patches/*: synced patches with 0.102.1+dfsg-1ubuntu1. - debian/clamav-daemon.postinst.in,clamav-freshclam.postinst.in: added new configuration options. - debian/clamav-docs.*: removed missing docs. - debian/libclamav9.install: added libfreshclam.so.2. - debian/libclamav9.symbols: updated for new version. - debian/rules: bumped CL_FLEVEL to 112.* - debian/control: adding libcurl4-openssl-dev as a new dependency for build freshclam, clamsubmit - See NEWS.md file. clamav (0.101.4+dfsg-0ubuntu0.12.04.1) precise-security; urgency=medium * Updated to version 0.101.4 to fix security issues. - debian/patches/*: sync patches with 0.101.4+dfsg-1ubuntu1. - debian/clamav-daemon.postinst.in: removed DetectBrokenExecutables, added MaxScanTime, HeuristicAlerts, Alert*. - debian/*: updated for new library version. - debian/libclamav9.symbols: updated for new version. - debian/clamav-docs*, debian/rules: fix doc file locations. - debian/libclam-dev.install: include new header file. - debian/rules, debian/control: build with --with autoreconf. - debian/rules: build with --with-system-libmspack. - CVE-2019-12625 - CVE-2019-12900 clamav (0.100.3+dfsg-1ubuntu0.12.04.2) precise-security; urgency=medium * SECURITY UPDATE: Buffer overflow - debian/patches/CVE-2019-1010305.patch: length checks when looking for control files in libclamav/libmspack-0.5alpha/mspack/chmd.c. - CVE-2019-1010305 clamav (0.100.3+dfsg-1ubuntu0.12.04.1) precise-security; urgency=medium * Updated to version 0.100.3 to fix security issues. (LP: #1822503) - debian/libclamav7.symbols: updated to new version. - CVE-2019-1787 - CVE-2019-1788 - CVE-2019-1789 clamav (0.100.2+dfsg-1ubuntu0.12.04.2) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-18585.patch: Ensure file names are valid in libclamav/libmspack-0.5alpha/mspack/chmd.c - CVE-2018-18585 * SECURITY UPDATE: One byte buffer overflow - - debian/patches/CVE-2018-18584.patch: Ensure input buffer is large enough in libclamav/libmspack-0.5alpha/mspack/cab.h - CVE-2018-18584 clamav (0.100.2+dfsg-1ubuntu0.12.04.1) precise-security; urgency=medium * Updated to version 0.100.2 to fix security issue. - CVE-2018-15378 * Bump to new symbol version - debian/rules: set CL_FLEVEL 93. - debian/libclamav7.symbols: updated to new version. * Removed patches included in new version: - debian/patches/CVE-2018-14679-and-CVE-2018-14680.patch - debian/patches/CVE-2018-14681.patch - debian/patches/CVE-2018-14682.patch clamav (0.100.1+dfsg-1ubuntu0.12.04.4) precise-security; urgency=medium [ Marc Deslauriers ] * debian/clamav-daemon.config.in: fix infinite loop during dpkg-reconfigure (LP: #1792051) clamav (0.100.1+dfsg-1ubuntu0.12.04.3) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14679-and-CVE-2018-14680.patch: fix in libclamav/libmspack-0.5alpha/mspack/cchmd.c. - CVE-2018-14679 - CVE-2018-14680 * SECURITY UPDATE: Bytes overwire with bad KWAJ file extension - debian/patches/CVE-2018-14681.patch: fix in libclamav/libmspack-0.5alpha/mspack/kwajd.c. - CVE-2018-14681 * SECURITY UPDATE: Off-by-one error - debian/patches/CVE-2018-14682.patch: fix in libclamav/libmspack-0.5alpha/mspack/chmd.c. - CVE-2018-14682 clamav (0.100.1+dfsg-1ubuntu0.12.04.2) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY REGRESSION: clamav-daemon fails to start due to options removed in new version and manually edited configuration file. (LP: #1783632) - debian/patches/Deprecate-unused-options-instead-of-removing-it.patch: add patch from Debian stretch to simply warn about removed options. clamav (0.100.1+dfsg-1ubuntu0.12.04.1) precise-security; urgency=medium * Rebuild as security update for 12.04 to fix multiple issues - CVE-2018-0360 - CVE-2018-0361 * Disabling LLVM support: - debian/control: removing llvm-3.6-dev - debian/rules: removing llvm * Removing patches that adds LLVM support: - debian/patches/Add-support-for-LLVM-3.*.patch * Removing dependency for procps >= 1:3:3.2: - debian/control - debian/clamav-daemon.ini.in - debian/clamav-freshclam.ini.in clamav (0.100.1+dfsg-1ubuntu0.14.04.1) trusty-security; urgency=medium * Rebuild as security update for 14.04 to fix multiple issues - CVE-2018-0360 - CVE-2018-0361 * Re-enable LLVM support: - debian/control: add llvm-3.6-dev to BuildDepends. - debian/rules: add llvm back. * debian/clamav-daemon.postinst.in: updated version to drop support for clamav-daemon.socket. * debian/control: switch libtfm-dev to libtommath-dev, remove dh-strip-nondeterminism, electric-fence, and libsystemd-dev. * Use internal libmspack: - debian/control: remove libmspack-dev. - debian/rules: remove --with-system-libmspack. - debian/libclamav7.install: add libclammspack.so.0*. - debian/libclamav-dev.install: add libclammspack.so. * Revert to Debhelper in 14.04: - debian/compat: set to 8 - debian/control: set debhelper to 8.9.7 * debian/{libclamav7,libclamav-dev}.install: fix file locations * debian/rules: modify to not use dpkg-parsechangelog -S * debian/control: remove Multi-Arch and Rules-Requires-Root tags. * Don't built with json and curl: - debian/rules: remove --with-libjson and --with-libcurl=/usr. - debian/control: remove libjson-c-dev, libcurl4-openssl-dev. - debian/clamav.install: remove clamsubmit. - debian/clamav.manpages: remove clamsubmit.1. * Removed clamdscan package: - debian/control: removed package section - debian/clamdscan.*: removed and added files to clamav-daemon.* * Added clamav-dbg package: - debian/control: added package section - debian/rules: use --dbg-package, not --dbgsym-migration * debian/control: updated clamav-daemon Breaks versions. clamav (0.100.1+dfsg-1ubuntu1) cosmic; urgency=medium * debian/control: switch Build-Depends from libpcre2-dev to libpcre3-dev as pcre2 is in Universe. clamav (0.100.1+dfsg-1) unstable; urgency=medium [ Scott Kitterman ] * Only create clamav user during clamav-base install if it does not exist (LP: #121872) - Thanks to Shane Williams for the patch * Remove spurious debian/changelog entry for the above change from the 0.100.0~beta+dfsg-1 entry since the change was not actually included [ Sebastian Andrzej Siewior ] * Import new upstream. * Bump symbol version due to new version. * Add read permission for freshclam on /var/log in the apparmor profile. Thanks to Robie Basak (Closes: #902601). * Bump standards-version to 4.1.5 without further change clamav (0.100.0+dfsg-1) unstable; urgency=medium * New upstream release. - remove various documentation files including Changelog from the file list because they are no longer included in upstream archive. clamav (0.100.0~beta+dfsg-2) unstable; urgency=medium * Switch to pcre2 which is newer (Closes: #891195). * Cherry pick patches referenced in bb#11973 and bb#11980 to fix CVE-2018-0202. * Use compat level 11. clamav (0.100.0~beta+dfsg-1) unstable; urgency=medium [ Scott Kitterman ] * Add lintian override for clamav-freshclam: duplicate-updaterc.d-calls-in- postinst clamav-freshclam * New upstream beta release * Bump standards-version to 4.1.3 without further change * Update README.Debian to describe how to disable apparmor for clamav-daemon and clamav-freshclam (Closes: #884707) [ Sebastian Andrzej Siewior ] * Point Vcs-* tags to salsa. clamav (0.99.3~beta2+dfsg-1) unstable; urgency=medium * Update upstream's signing gpg key * Update to beta2: - freshclam does not complain that clamav is outdated (Closes: #876429). clamav (0.99.3~beta1+dfsg-4) unstable; urgency=medium * Ignore errors from update-rc.d in freshclam postins (Closes: #882323). * Drop dh-systemd & autoreconf from B-D. clamav (0.99.3~beta1+dfsg-3) unstable; urgency=medium * Drop "demime = *" from Debian.README for clamav, this option is gone from exim (Closes: #881634). * Use "ucf" instead "ucp" in clamav-milter's postinst. * Disable LLVM support due to 3.8 removal (Closes: #873401). * Disable the freshclam service if changed to `manual' mode so it does not start again after system reboot with systemd (Closes: #881780). * Bump standards version to 4.1.1 without further change. * Allow to build as non root user. * Update dh compat level 10 clamav (0.99.3~beta1+dfsg-2) unstable; urgency=medium * Build again against system's libmspack (dropped by accident) (Closes: #872594). * Don't replace config file with sample config after debconf gets disabled (in milter and daemon (Closes: #870253). * Update standards to 4.0.1 - use invoke-rc.d instead of /etc/init.d. - drop priority extra from clamav-milter. * Add bytecode.c(l|v)d to log clamav-freshclam.logcheck.ignore.server. Patch by Václav Ovsík (Closes: #868766). clamav (0.99.3~beta1+dfsg-1) unstable; urgency=medium * Upload to unstable * update to official beta1 release: - drop fts-no-use-AC_TRY_RUN.patch, applied upstream. clamav (0.99.3~snapshot20170704+dfsg-1) experimental; urgency=medium * Update to upstream snapshot (commit 144ef69462427b63a650294257c892b047601aac): - add config options - boost symbol file - drop applied patches: - Allow-M-suffix-for-PCREMaxFileSize.patch - bb11549-fix-temp-file-cleanup-issue.patch - clamav_add_private_fts_implementation.patch - drop-AllowSupplementaryGroups-option-and-make-it-def.patch - fix-ssize_t-size_t-off_t-printf-modifier.patch - libclamav-use-libmspack.patch - make_it_compile_against_openssl_1_1_0.patch - add new ones: - fts-no-use-AC_TRY_RUN.patch - clamsubmit-add-JSON-libs-to-clamsubmit.patch clamav (0.99.2+dfsg-6) unstable; urgency=medium * Fix detection of curl. Patch by Reiner Herrmann (Closes: #852894). clamav (0.99.2+dfsg-5) unstable; urgency=medium [ Andreas Cadhalpun ] * Add patches to support LLVM 3.7-3.9. * Re-enable llvm support. * Update embedded-library lintian override for multiarch locations. * Update standards version to 3.9.8. (no changes needed) * Mark clamav-docs and clamav-testfiles as Multi-Arch foreign and libclamav7 as same. * Fix spelling errors in the debian files. (Closes: #825055) * Remove unused package-contains-timestamped-gzip lintian-override. * Fix wildcard-matches-nothing-in-dep5-copyright lintian warning. [ Sebastian Andrzej Siewior ] * Remove clamav-daemon.service.d on purge (Closes: #842074). * Fix FTCBFS: Annotate interpreter dependencies with :native. Patch by Helmut Grohne (Closes: #844066). * Drop bc from B-D, it seems we no longer need it. * Cherry-pick patch from bb11549 to fix a temp file cleanup issue (Closes: #824196). clamav (0.99.2+dfsg-4) unstable; urgency=medium * Remove Stephen Gran as Uploader and thank you for your work (Closes: #838405). * Drop llvm supported for now. The bytecode will be interpreted by clamav instead of llvm's JIT - there is no loss in functionality. It will come back once we llvm support again (Closes: #839850). clamav (0.99.2+dfsg-3) unstable; urgency=medium * BD on dh-strip-nondeterminism. * get it compiled against openssl 1.1.0 (Closes: #828083). * Drop support for clamav-daemon.socket. Should avoid restart loops if clamd crashes on start (via OOM for instance). (Closes: #824042). clamav (0.99.2+dfsg-2) unstable; urgency=medium * Ensure the users of PRIVATE symbols (clamd + freshclam) do not fall behind a upstream version (Closes: #824485). clamav (0.99.2+dfsg-1) unstable; urgency=medium [ Sebastian Andrzej Siewior ] * also remove bytecode.cld on purge * Update to new upstream release 0.99.2 * Drop AllowSupplementaryGroups option which is default now (Closes: #822444). * Let the LSB init script have more consistent output. Patch by Guillem Jover (Closes: #823074). Date: 2020-07-24 18:00:18.826063+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/clamav/0.102.4+dfsg-0ubuntu0.12.04.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:37 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:37 -0000 Subject: [ubuntu/precise-security] curl 7.22.0-3ubuntu4.29 (Accepted) Message-ID: <162004599708.6007.7498136545330549347.launchpad@ackee.canonical.com> curl (7.22.0-3ubuntu4.29) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: FTP redirect to malicious host via PASV response - debian/patches/CVE-2020-8284.patch: use CURLOPT_FTP_SKIP_PASV_IP by default in lib/url.c, src/main.c. - CVE-2020-8284 * SECURITY UPDATE: FTP wildcard stack buffer overflow in libcurl - debian/patches/CVE-2020-8285.patch: make wc_statemach loop instead of recurse in lib/ftp.c. - CVE-2020-8285 curl (7.22.0-3ubuntu4.28) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: curl overwrite local file with -J - debian/patches/CVE-2020-8177.patch: -i is not OK if -J is used in src/tool_cb_hdr.c, src/tool_getparam.c. - CVE-2020-8177 curl (7.22.0-3ubuntu4.27) precise-security; urgency=medium [ Alex Murray ] * SECURITY UPDATE: heap buffer overflow when receiving TFTP data may cause denial-of-service or remote code-execution - debian/patches/CVE-2019-5482.patch: ensure to use the correct block size when calling recvfrom() if the server returns an OACK without specifying a block size in lib/tftp.c - CVE-2019-5482 curl (7.22.0-3ubuntu4.26) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: TFTP receive buffer overflow - debian/patches/CVE-2019-5436.patch: use the current blksize in lib/tftp.c. - CVE-2019-5436 curl (7.22.0-3ubuntu4.24) precise-security; urgency=medium * SECURITY UPDATE: warning message out-of-buffer read - debian/patches/CVE-2018-16842.patch: fix bad arithmetic in src/tool_msgs.c. - CVE-2018-16842 curl (7.22.0-3ubuntu4.23) precise-security; urgency=medium * SECURITY UPDATE: Buffer overrun - debian/patches/CVE-2018-14618.patch: fix in lib/curl_ntlm_core.c. - CVE-2018-14618 curl (7.22.0-3ubuntu4.21) precise-security; urgency=medium * SECURITY UPDATE: Buffer overflow in FTP URL handling - debian/patches/CVE-2018-1000120.patch: fix in lib/ftp.c, add test test/data/test340. - CVE-2018-1000120 * SECURITY UPDATE: LDAP NULL pointer dereference - debian/patches/CVE-2018-1000121.patch: check ldap_get_attribute_ber() results for NULL before using in lib/openldap.c. - CVE-2018-1000121 * SECURITY UPDATE: RTSP RTP buffer over-read - debian/patches/CVE-2018-1000122.patch: make sure excess reads don't go beyond buffer end in lib/transfer.c. - CVE-2018-1000122 * SECURITY UPDATE: RTSP bad headers buffer over-read - debian/patches/CVE-2018-1000301.patch: restore buffer pointer when bad response-line is parsed in lib/http.c. - CVE-2018-1000301 curl (7.22.0-3ubuntu4.20) precise-security; urgency=medium * SECURITY UPDATE: leak authentication data - debian/patches/CVE-2018-1000007.patch: prevent custom authorization headers in redirects in lib/http.c, lib/url.c, lib/urldata.h, tests/data/Makefile.in, tests/data/test317, tests/data/test318. - CVE-2018-1000007 curl (7.22.0-3ubuntu4.19) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: FTP wildcard out of bounds read - debian/patches/CVE-2017-8817.patch: fix heap buffer overflow in setcharset in lib/curl_fnmatch.c, added tests to tests/data/Makefile.inc, tests/data/test1163. - CVE-2017-8817 curl (7.22.0-3ubuntu4.18) precise-security; urgency=medium * SECURITY UPDATE: printf floating point buffer overflow - debian/patches/CVE-2016-9586.patch: fix floating point buffer overflow issues in lib/mprintf.c, added test to tests/data/test557, tests/libtest/lib557.c. - CVE-2016-9586 * SECURITY UPDATE: TFTP sends more than buffer size - debian/patches/CVE-2017-1000100.patch: reject file name lengths that don't fit in lib/tftp.c. - CVE-2017-1000100 * SECURITY UPDATE: FTP PWD response parser out of bounds read - debian/patches/CVE-2017-1000254.patch: zero terminate the entry path even on bad input in lib/ftp.c, added test to tests/data/Makefile.am, tests/data/test1152. - CVE-2017-1000254 * SECURITY UPDATE: --write-out out of buffer read - debian/patches/CVE-2017-7407-1.patch: fix a buffer read overrun in src/writeout.c added test to tests/data/Makefile.am, tests/data/test1440, tests/data/test1441. - debian/patches/CVE-2017-7407-2.patch: check for end of input in src/_writeout.c added test to tests/data/Makefile.am, tests/data/test1442. - CVE-2017-7407 * SECURITY UPDATE: IMAP FETCH response out of bounds read - debian/patches/CVE-2017-1000257.patch: check size in lib/imap.c. - CVE-2017-1000257 Date: 2020-12-04 15:08:43.959595+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/curl/7.22.0-3ubuntu4.29 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:39 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:39 -0000 Subject: [ubuntu/precise-security] davfs2 1.4.6-1ubuntu3.1 (Accepted) Message-ID: <162004599996.6007.8821329559278386321.launchpad@ackee.canonical.com> davfs2 (1.4.6-1ubuntu3.1) precise-security; urgency=medium * SECURITY UPDATE: Added missing '\r' in constant none_match_header - webdav.c: fix missing '\r'. This update is required since apache2 fails for davfs2 test after CVE-2016-8743 update. Date: 2017-07-31 14:43:18.942319+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/davfs2/1.4.6-1ubuntu3.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:41 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:41 -0000 Subject: [ubuntu/precise-security] cyrus-sasl2 2.1.25.dfsg1-3ubuntu0.2 (Accepted) Message-ID: <162004600105.5996.1754961301548969467.launchpad@ackee.canonical.com> cyrus-sasl2 (2.1.25.dfsg1-3ubuntu0.2) precise-security; urgency=medium * SECURITY UPDATE: Off-by-one - debian/patches/CVE-2019-19906.patch: fix in _sasl_add_string function - CVE-2019-19906 * Thanks Debian for the patch provide that (Closes: #947043) Date: 2020-01-28 11:13:32.992067+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/cyrus-sasl2/2.1.25.dfsg1-3ubuntu0.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:44 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:44 -0000 Subject: [ubuntu/precise-security] db4.8 4.8.30-11ubuntu1.1 (Accepted) Message-ID: <162004600498.5996.1900592307604851940.launchpad@ackee.canonical.com> db4.8 (4.8.30-11ubuntu1.1) precise-security; urgency=medium * SECURITY UPDATE: Berkeley DB reads DB_CONFIG from cwd - debian/patches/CVE-2017-10140.patch in src/env/env_open.c. - CVE-2017-10140 Date: 2017-11-16 20:03:26.317501+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/db4.8/4.8.30-11ubuntu1.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:45 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:45 -0000 Subject: [ubuntu/precise-security] db 5.1.25-11ubuntu0.1 (Accepted) Message-ID: <162004600544.6007.3859874343226222457.launchpad@ackee.canonical.com> db (5.1.25-11ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Berkeley DB reads DB_CONFIG from cwd - debian/patches/CVE-2017-10140.patch in src/env/env_open.c. - CVE-2017-10140 Date: 2017-11-16 20:57:22.375737+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/db/5.1.25-11ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:44 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:44 -0000 Subject: [ubuntu/precise-security] libgd2 2.0.36~rc1~dfsg-6ubuntu2.6 (Accepted) Message-ID: <162004600444.6008.14383689895124783772.launchpad@ackee.canonical.com> libgd2 (2.0.36~rc1~dfsg-6ubuntu2.6) precise-security; urgency=medium * SECURITY UPDATE: Double-free memory - debian/patches/CVE-2017-6362.patch: introduces a static helper to check failure or success in gd_png.c. - CVE-2017-6362 libgd2 (2.0.36~rc1~dfsg-6ubuntu2.5) precise-security; urgency=medium * SECURITY UPDATE: memory read vulnerability in GIF - debian/patches/CVE-2017-7890.patch: zeroing buffers to avoid information leak in src/gd_gif_in.c, - CVE-2017-7890 Date: 2017-09-05 13:34:14.293349+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libgd2/2.0.36~rc1~dfsg-6ubuntu2.6 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:48 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:48 -0000 Subject: [ubuntu/precise-security] dbus 1.4.18-1ubuntu1.10 (Accepted) Message-ID: <162004600843.5996.843378809279436710.launchpad@ackee.canonical.com> dbus (1.4.18-1ubuntu1.10) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: DoS via file descriptor leak - debian/patches/CVE-2020-12049.patch: on MSG_CTRUNC, close the fds we did receive in dbus/dbus-sysdeps-unix.c. - CVE-2020-12049 dbus (1.4.18-1ubuntu1.9) precise-security; urgency=medium * SECURITY UPDATE: DBUS_COOKIE_SHA1 implementation flaw - debian/patches/CVE-2019-12749*.patch: reject DBUS_COOKIE_SHA1 for users other than the server owner in dbus/dbus-auth.c, enforce hardening EXTERNAL auth in bus/session.conf.in, cmake/CMakeLists.txt, configure.ac. - CVE-2019-12749 Date: 2020-06-15 19:11:14.457832+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/dbus/1.4.18-1ubuntu1.10 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:49 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:49 -0000 Subject: [ubuntu/precise-security] libidn 1.23-2ubuntu0.2 (Accepted) Message-ID: <162004600957.6007.18119707043272810277.launchpad@ackee.canonical.com> libidn (1.23-2ubuntu0.2) precise-security; urgency=medium [ Marc Deslauries ] * SECURITY UPDATE: Integer overflow - debian/patches/CVE-2017-14062.patch: fix integer overflow in punycode.c. - CVE-2017-14062 Date: 2017-10-17 20:40:43.672418+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libidn/1.23-2ubuntu0.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:50 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:50 -0000 Subject: [ubuntu/precise-security] distro-info 0.8.2ubuntu1 (Accepted) Message-ID: <162004601051.6008.13454281206980536384.launchpad@ackee.canonical.com> distro-info (0.8.2ubuntu1) precise; urgency=medium * Provide support for the milestone eol-esm and add filters for supported-esm to ubuntu-distro-info along with the python and perl modules. (LP: #1808038, LP: #1825553) Date: 2019-04-23 10:45:16.615500+00:00 Changed-By: Adam Conrad Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/distro-info/0.8.2ubuntu1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:53 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:53 -0000 Subject: [ubuntu/precise-security] libjpeg-turbo 1.1.90+svn733-0ubuntu4.6 (Accepted) Message-ID: <162004601344.6008.15180026981334096312.launchpad@ackee.canonical.com> libjpeg-turbo (1.1.90+svn733-0ubuntu4.6) precise-security; urgency=medium * SECURITY UPDATE: Heap-based buffer over-read - debian/patches/CVE-2020-13790.patch: fix buf overrun caused by bad binary PPM in rdppm.c. - CVE-2020-13790 libjpeg-turbo (1.1.90+svn733-0ubuntu4.5) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: denial of service via JPEG file - debian/patches/CVE-2014-9092.patch: adjust size in jchuff.c. - CVE-2014-9092 * SECURITY UPDATE: denial of service via crafted file - debian/patches/CVE-2016-3616.patch: check range of integer values in PPM text file in cderror.h, rdppm.c. - CVE-2016-3616 - CVE-2018-11213 - CVE-2018-11214 * SECURITY UPDATE: divide-by-zero via crafted file - debian/patches/CVE-2018-11212.patch: check image size in rdtarga.c. - CVE-2018-11212 * SECURITY UPDATE: division by zero via BMP image - debian/patches/CVE-2018-1152.patch: add size check in rdbmp.c. - CVE-2018-1152 libjpeg-turbo (1.1.90+svn733-0ubuntu4.4) precise; urgency=medium * Updated FixLibraryStartup.patch to properly close /proc/self/auxv. (LP: #1189939) Date: 2020-06-08 12:40:15.395092+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libjpeg-turbo/1.1.90+svn733-0ubuntu4.6 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:54 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:54 -0000 Subject: [ubuntu/precise-security] distro-info-data 0.8ubuntu0.21 (Accepted) Message-ID: <162004601402.6007.1966566908312495730.launchpad@ackee.canonical.com> distro-info-data (0.8ubuntu0.21) precise-security; urgency=medium * Add Ubuntu 20.10, Groovy Gorilla. (LP: #1874843) distro-info-data (0.8ubuntu0.20) precise-security; urgency=medium * Add Ubuntu 21.04, Hirsute Hippo (LP: #1901361). distro-info-data (0.8ubuntu0.19) precise; urgency=medium * Copy data from 0.40ubuntu3: - Add Ubuntu 20.04 LTS, with 5 years LTS and 10 years ESM. (LP: #1848688) distro-info-data (0.8ubuntu0.18) precise; urgency=medium * Replace EANIMAL placeholder with Ermine. distro-info-data (0.8ubuntu0.17) precise; urgency=medium * Add in eol-server and eol-esm dates for all Ubuntu LTS releases. (LP: #1814976, LP: #1808038) * Correct EOL dates for trusty (LP: #1825553) distro-info-data (0.8ubuntu0.16) precise; urgency=medium * Copy data from 0.39ubuntu2: - Add Ubuntu 19.10 Eoan EANIMAL. (LP: #1825379) distro-info-data (0.8ubuntu0.15) precise; urgency=medium * Copy data from 0.39: - Add Ubuntu 19.04 Disco Dingo. (LP: #1800656) distro-info-data (0.8ubuntu0.14) precise; urgency=medium * Copy data from 0.38: - Add Ubuntu 18.10 Cosmic Cuttlefish. (LP: #1769992) - Correct EOL date for zesty. (LP: #1743936) - Adjust provisional creation date for Debian 11 Bullseye to August 2019. The release-team expects Buster to release "some time mid-2019". - Add Debian 12 Bookworm, with a provisional creation date. distro-info-data (0.8ubuntu0.13) precise; urgency=medium * Copy data from 0.37 (LP: #1727046) - Set EOL date for Debian Wheezy. - Set (provisional) EOL date for Debian Jessie. - Set release date for Stretch (and matching creation date for Buster). - Add Ubuntu 18.04 LTS Bionic Beaver. Date: 2020-11-04 22:22:13.642805+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/distro-info-data/0.8ubuntu0.21 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:46:58 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:46:58 -0000 Subject: [ubuntu/precise-security] dovecot 1:2.0.19-0ubuntu2.8 (Accepted) Message-ID: <162004601844.6008.14821520719268301932.launchpad@ackee.canonical.com> dovecot (1:2.0.19-0ubuntu2.8) precise-security; urgency=medium * SECURITY REGRESSION: updating CVE-2019-11500-3.patch with the right check dovecot (1:2.0.19-0ubuntu2.7) precise-security; urgency=medium * SECURITY UPDATE: IMAP do not properly handled NULL byte - bounds heap memory writes - debian/patches/CVE-2019-11500-*.patch: doesn't accept strings with NULs in src/lib-imap/imap-parser.c and pigeonhole/src/lib-managesieve/managesieve-parser.c, make sure str_unescape won't be writing past allocated memory in src/lib-imap/imap-parser.c and pieonhole/src/lig-managesieve/managesieve-parser.c. - CVE-2019-11500 dovecot (1:2.0.19-0ubuntu2.6) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: incorrect client certificate validation - debian/patches/CVE-2019-3814-1.patch: do not import empty certificate username in src/auth/auth-request.c. - debian/patches/CVE-2019-3814-2.patch: fail authentication if certificate username was unexpectedly missing in src/auth/auth-request-handler.c. - debian/patches/CVE-2019-3814-3.patch: ensure we get username from certificate in src/login-common/sasl-server.c. - CVE-2019-3814 dovecot (1:2.0.19-0ubuntu2.5) precise-security; urgency=medium * SECURITY UPDATE: rfc822_parse_domain Information Leak Vulnerability - debian/patches/CVE-2017-14461/*.patch: upstream parsing fixes. - CVE-2017-14461 * SECURITY UPDATE: TLS SNI config lookups DoS - debian/patches/CVE-2017-15130/*.patch: upstream config filtering fix. - CVE-2017-15130 dovecot (1:2.0.19-0ubuntu2.4) precise-security; urgency=medium * SECURITY UPDATE: passdb exploitable throuh checkpassword - debian/patches/CVE-2013-6171.patch: refuse to run checkpassword script insecurely by default in src/auth/checkpassword-reply.c, src/auth/db-checkpassword.c. - CVE-2013-6171 * SECURITY UPDATE: Memory leak that can cause crash due to memory exhaustion - debian/patches/CVE-2017-15132.patch: fix memory leak in auth_client_request_abort() in src/lib-auth/auth-client-request.c. - debian/patches/CVE-2017-15132-additional.patch: remove request after abort in src/lib-auth/auth-client-request.c, src/lib-auth/auth-server-connection.c, src/lib-auth/auth-serser-connection.h. - CVE-2017-15132 dovecot (1:2.0.19-0ubuntu2.2) precise; urgency=medium * Backport support for the ssl_protocols setting to easily allow disabling SSLv3. (LP: #1381537) - debian/patches/backport_ssl_protocols.patch: added new setting to src/login-common/login-settings.c, src/login-common/login-settings.h, src/login-common/ssl-proxy-openssl.c, src/config/all-settings.c. Date: 2019-08-28 17:13:27.534455+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/dovecot/1:2.0.19-0ubuntu2.8 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:01 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:01 -0000 Subject: [ubuntu/precise-security] dnsmasq 2.59-4ubuntu0.4 (Accepted) Message-ID: <162004602180.6007.15194211158926451171.launchpad@ackee.canonical.com> dnsmasq (2.59-4ubuntu0.4) precise-security; urgency=medium * REGRESSION UPDATE: a offset error passed in the last update that cause a regresion in dnsmasq this update fix this issue. dnsmasq (2.59-4ubuntu0.3) precise-security; urgency=medium * SECURITY UPDATE: add fixes to correct multiple security issues - CVE-2017-14491 DNS heap buffer overflow. - CVE-2017-14492, DHCPv6 RA heap overflow. - CVE-2017-14493, DHCPv6 - Stack buffer overflow. - CVE-2017-14494, Infoleak handling DHCPv6 forwarded requests. - CVE-2017-14495, OOM in DNS response creation. - CVE-2017-14496, Integer underflow in DNS response creation. Date: 2018-01-03 21:29:12.677131+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/dnsmasq/2.59-4ubuntu0.4 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:04 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:04 -0000 Subject: [ubuntu/precise-security] dpkg 1.16.1.2ubuntu7.9 (Accepted) Message-ID: <162004602480.6008.2219682655433617869.launchpad@ackee.canonical.com> dpkg (1.16.1.2ubuntu7.9) precise-security; urgency=medium * Fix physical file offset comparison in dpkg. Closes: #808912 Thanks to Yuri Gribov . - adbdfb0dd9cec401609fd3eef232b7ff2153db7f * Do not segfault on GNU/Linux when dpkg cannot retrieve the block size for the filesystem containing the info database. LP: #872734 - 916bdba9095bd361cb2bccd6f566ecffdb206193 dpkg (1.16.1.2ubuntu7.8) precise; urgency=medium * Backport from Debian (LP: #1587667): - Allow detached upstream signatures for upstream orig.tar files in the .dsc file. Suggested by Daniel Kahn Gillmor . Closes: #759478 - Allow detached upstream orig tarball signatures when extracting version 1.0 non-native source packages. Date: 2020-02-07 16:21:14.825837+00:00 Changed-By: Jamie Strandboge Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/dpkg/1.16.1.2ubuntu7.9 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:06 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:06 -0000 Subject: [ubuntu/precise-security] e2fsprogs 1.42-1ubuntu2.5 (Accepted) Message-ID: <162004602670.6007.5800936107499197083.launchpad@ackee.canonical.com> e2fsprogs (1.42-1ubuntu2.5) precise-security; urgency=medium * SECURITY UPDATE: Out-of-bounds write - debian/patches/CVE-2019-5188-*.patch: abort if there is a corrupted directory block when rehashing and don't try to rehash a deleted directory in e2fsck/rehash.c, e2fsck/pass1b.c. - CVE-2019-5188 e2fsprogs (1.42-1ubuntu2.4) precise-security; urgency=medium * SECURITY UPDATE: Out-of-bounds write on the heap - debian/patches/CVE-2019-5094.patch: add checks to prevent buffer overrun in quota code in lib/quota/quotaio_tree.c, lib/quota/quotaio_v2.c. - CVE-2019-5094 e2fsprogs (1.42-1ubuntu2.3) precise; urgency=low * fix rule-violating lblk->pblk mappings on bigalloc filesystems (LP: #1321418) Date: 2020-01-22 13:07:17.480873+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/e2fsprogs/1.42-1ubuntu2.5 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:11 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:11 -0000 Subject: [ubuntu/precise-security] expat 2.0.1-7.2ubuntu1.7 (Accepted) Message-ID: <162004603164.6007.3340266534544447444.launchpad@ackee.canonical.com> expat (2.0.1-7.2ubuntu1.7) precise-security; urgency=medium * SECURITY UPDATE: heap-based buffer over-read - debian/patches/CVE-2019-15903.dpatch: Deny internal entities closing the doctype in lib/xmlparse.c. - CVE-2019-15903 expat (2.0.1-7.2ubuntu1.6) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-20843.dpatch: adds a break in setElementTypePrefix avoiding consume a high amount of RAM and CPU in lib/xmlparser.c - CVE-2018-20843 expat (2.0.1-7.2ubuntu1.5) precise-security; urgency=medium * SECURITY UPDATE: external entity infinite loop - debian/patches/CVE-2017-9233.dpatch: add check to lib/xmlparse.c. - CVE-2017-9233 Date: 2019-09-12 13:59:13.835185+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/expat/2.0.1-7.2ubuntu1.7 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:12 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:12 -0000 Subject: [ubuntu/precise-security] eglibc 2.15-0ubuntu10.23 (Accepted) Message-ID: <162004603206.6008.10859423370102922326.launchpad@ackee.canonical.com> eglibc (2.15-0ubuntu10.23) precise-security; urgency=medium * Removing locale/locales-all from debian/control since in Precise it uses langpack-locales and no binary is created in eglibc for locales eglibc (2.15-0ubuntu10.22) precise-security; urgency=medium * SECURITY UPDATE: Integer overflow - debian/patch/CVE-2018-6485.patch: fix integer overflows in internal memallign and malloc functions in malloc/malloc.c. - CVE-2018-6485 eglibc (2.15-0ubuntu10.21) precise-security; urgency=medium * SECURITY UPDATE: Buffer underflow in realpath() - debian/patches/any/cvs-make-getcwd-fail-if-path-is-no-absolute.diff: Make getcwd(3) fail if it cannot obtain an absolute path - CVE-2018-1000001 eglibc (2.15-0ubuntu10.20) precise-security; urgency=medium * SECURITY UPDATE: LD_LIBRARY_PATH stack corruption - debian/patches/any/CVE-2017-1000366.patch: Completely ignore LD_LIBRARY_PATH for AT_SECURE=1 programs - CVE-2017-1000366 * SECURITY UPDATE: LD_PRELOAD stack corruption - debian/patches/any/upstream-harden-rtld-Reject-overly-long-LD_PRELOAD.patch: Reject overly long names or names containing directories in LD_PRELOAD for AT_SECURE=1 programs. * debian/patches/any/cvs-harden-glibc-malloc-metadata.patch: add additional consistency check for 1-byte overflows * debian/patches/any/cvs-harden-ignore-LD_HWCAP_MASK.patch: ignore LD_HWCAP_MASK for AT_SECURE=1 programs Date: 2020-03-06 13:51:34.505624+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/eglibc/2.15-0ubuntu10.23 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:15 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:15 -0000 Subject: [ubuntu/precise-security] file 5.09-2ubuntu0.8 (Accepted) Message-ID: <162004603572.6007.18404281788524997401.launchpad@ackee.canonical.com> file (5.09-2ubuntu0.8) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: buffer overflow via CDF_VECTOR elements - debian/patches/CVE-2019-18218.patch: limit the number of elements in a vector in src/cdf.*. - CVE-2019-18218 file (5.09-2ubuntu0.7) precise-security; urgency=medium * SECURITY UPDATE: memory corruption in file_check_mem. - debian/patches/CVE-2015-8865.patch: properly calculate length in src/funcs.c. - CVE-2015-8865 * SECURITY UPDATE: out-of-bounds read via crafted ELF file - debian/patches/CVE-2018-10360.patch: add bounds check to src/readelf.c. - CVE-2018-10360 Date: 2019-10-31 15:03:15.592961+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/file/5.09-2ubuntu0.8 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:17 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:17 -0000 Subject: [ubuntu/precise-security] freetype 2.4.8-1ubuntu2.7 (Accepted) Message-ID: <162004603762.6008.15120179363822356243.launchpad@ackee.canonical.com> freetype (2.4.8-1ubuntu2.7) precise-security; urgency=medium * SECURITY UPDATE: heap-based buffer over-read - debian/patches-freetype/CVE-2015-9381.patch: check if 'eexec' doesn't exceed 'limit' in src/type1/t1parse.c - CVE-2015-9381 * SECURITY UPDATE: buffer over-read - debian/patches-freetype/CVE-2015-9382.patch: ensure that the cursor position doesn't get larger than the current limit in src/psaux/psobjs.c. - CVE-2015-9382 * SECURITY UPDATE: heap-based buffer over-read - debian/patches-freetype/CVE-2015-9383.patch: check limit before accessing 'numRanges' and numMappings in src/sfnt/ttcmap.c. - CVE-2015-9383 Date: 2019-09-06 15:05:32.743768+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/freetype/2.4.8-1ubuntu2.7 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:18 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:18 -0000 Subject: [ubuntu/precise-security] gettext 0.18.1.1-5ubuntu3.1 (Accepted) Message-ID: <162004603809.26058.4293907880636751140.launchpad@ackee.canonical.com> gettext (0.18.1.1-5ubuntu3.1) precise-security; urgency=medium * SECURITY UPDATE: Invalid free - debian/patches/CVE-2018-18751.patch: fix in gettext-tools/src/read-catalog.c, gettext-tools/tests/Makefile.am, gettext-tools/tests/xgettext-po-2. - CVE-2018-18751 Date: 2018-11-09 13:22:14.291560+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/gettext/0.18.1.1-5ubuntu3.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:47:21 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:47:21 -0000 Subject: [ubuntu/precise-security] glib2.0 2.32.4-0ubuntu1.4 (Accepted) Message-ID: <162004604126.6007.9523514864156488438.launchpad@ackee.canonical.com> glib2.0 (2.32.4-0ubuntu1.4) precise-security; urgency=medium * SECURITY REGRESSION: regression in last security update (LP: #1838890) - debian/patches/CVE-2019-13012-regression.patch: fix a memory leak introduced by the last security update while not properly handled the g_file_get_patch function in gio/gkeyfilesettingsbackend.c. Date: 2019-08-05 17:06:18.586317+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/glib2.0/2.32.4-0ubuntu1.4 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:48:59 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:48:59 -0000 Subject: [ubuntu/precise-security] libmspack 0.4-1~12.04.1 (Accepted) Message-ID: <162004613994.5996.9457470336169839162.launchpad@ackee.canonical.com> libmspack (0.4-1~12.04.1) precise-security; urgency=medium * Rebuilding for precise/esm Date: 2019-10-02 18:18:13.321717+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libmspack/0.4-1~12.04.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:07 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:07 -0000 Subject: [ubuntu/precise-security] libnl3 3.2.3-2ubuntu2.1 (Accepted) Message-ID: <162004614772.6007.4771138004397876889.launchpad@ackee.canonical.com> libnl3 (3.2.3-2ubuntu2.1) precise-security; urgency=medium * SECURITY UPDATE: integer-overflow in nlmsg_reserve() - debian/patches/CVE-2017-0553.patch: check len in lib/msg.c. - CVE-2017-0553 Date: 2017-06-16 17:23:14.221062+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libnl3/3.2.3-2ubuntu2.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:09 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:09 -0000 Subject: [ubuntu/precise-security] libpam-krb5 4.5-3ubuntu0.1 (Accepted) Message-ID: <162004614908.6008.8035122475960952354.launchpad@ackee.canonical.com> libpam-krb5 (4.5-3ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: One-byte buffer overflow - debian/patches/CVE-2020-10595.patch: checks prompts[i].reply->length boundaries in prompting.c. - CVE-2020-10595 Date: 2020-03-24 13:45:16.394954+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libpam-krb5/4.5-3ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:11 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:11 -0000 Subject: [ubuntu/precise-security] libpam-radius-auth 1.3.17-0ubuntu3.1 (Accepted) Message-ID: <162004615169.5996.1558280096527099390.launchpad@ackee.canonical.com> libpam-radius-auth (1.3.17-0ubuntu3.1) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: DoS via stack overflow in password field - debian/patches/CVE-2015-9542-1.patch: use length, which has been limited in size in pam_radius_auth.c. - debian/patches/CVE-2015-9542-2.patch: clear out trailing part of the buffer in pam_radius_auth.c. - debian/patches/CVE-2015-9542-3.patch: copy password to buffer before rounding length in pam_radius_auth.c. - debian/rules: added new patches. - CVE-2015-9542 Date: 2020-02-20 16:23:14.919779+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libpam-radius-auth/1.3.17-0ubuntu3.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:14 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:14 -0000 Subject: [ubuntu/precise-security] libpcap 1.1.1-10ubuntu0.1 (Accepted) Message-ID: <162004615443.6008.5561975822614901476.launchpad@ackee.canonical.com> libpcap (1.1.1-10ubuntu0.1) precise-security; urgency=medium [ Steve Beattie ] * SECURITY UPDATE: pcapng reading buffer over-read. - debian/patches/CVE-2019-15165-1.patch: do sanity checks on PHB header length before allocating memory. - debian/patches/CVE-2019-15165-2.patch: fix introduced format warning - CVE-2019-15165 Date: 2020-01-15 15:03:14.268667+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libpcap/1.1.1-10ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:17 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:17 -0000 Subject: [ubuntu/precise-security] libpng 1.2.46-3ubuntu4.3 (Accepted) Message-ID: <162004615748.5996.3939238494168058654.launchpad@ackee.canonical.com> libpng (1.2.46-3ubuntu4.3) precise-security; urgency=medium * SECURITY UPDATE: Null pointer dereference - debian/patches/CVE-2016-10087.patch: fix in png.c. - CVE-2016-10087 Date: 2018-07-10 20:18:25.575377+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libpng/1.2.46-3ubuntu4.3 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:21 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:21 -0000 Subject: [ubuntu/precise-security] libsdl1.2 1.2.14-6.4ubuntu3.2 (Accepted) Message-ID: <162004616166.6007.5281971275305986444.launchpad@ackee.canonical.com> libsdl1.2 (1.2.14-6.4ubuntu3.2) precise-security; urgency=medium * SECURITY UPDATE: Heap-based buffer over-read - debian/patches/CVE-2019-13616.patch: validate image size when loading BMP files in src/video/SDL_bmp.c. - CVE-2019-13616 * SECURITY UPDATE: Buffer over-read - debian/patches/CVE-2019-7572*.patch: moving clamping the index value at beginning of IMA_ADPCM_nibble in src/audio/SDL_wave.c. - CVE-2019-7572 * SECURITY UPDATE: Heap-based buffer over-read - debian/patches/CVE-2019-7573-76.patch: check if MS ADPCK chunk was too short in src/audio/SDL_wave.c. - CVE-2019-7573 - CVE-2019-7576 * SECURITY UPDATE: Heap-based buffer over-read - debian/patches/CVE-2019-7574.patch: check if data chunk was shorter than expected based on WAF format in src/audio/SDL_wave.c. - CVE-2019-7574 * SECURITY UPDATE: Heap-based buffer overflow and buffer over-read - debian/patches/CVE-2019-7575-77-2.patch: check if a WAV format defines shorter audio stream in src/audio/SDL_wave.c. - debian/patches/CVE-2019-7577.patch: checks overread in src/audio/SDL_wave.c. - CVE-2019-7575 - CVE-2019-7577 * SECURITY UPDATE: heap-based buffer over-read - debian/patches/CVE-2019-7578.patch: fix in src/audio/SDL_wave.c. - CVE-2019-7578 * SECURITY UPDATE: heap-based buffer over-read - debian/patches/CVE-2019-7635.patch: fix in src/video/SDL_bmp.c. - CVE-2019-7635 * SECURITY UPDATE: heap-baed buffer over-read - debian/patches/CVE-2019-7636.patch: fix in src/video/SDL_bmp.c. - CVE-2019-7636 * SECURITY UPDATE: heap-based buffer overflow - debian/patches/CVE-2019-7637*.patch: fix in src/video/SDL_pixels.c, src/video/gapi/SDL_gapivideo.c. - CVE-2019-7637 * fixing a patch error - debian/patches/fix_error_patching*.patch: in src/audio/SDL_wave.c, src/video/SDL_pixels.c. Date: 2019-10-16 13:19:13.939551+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libsdl1.2/1.2.14-6.4ubuntu3.2 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:23 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:23 -0000 Subject: [ubuntu/precise-security] libtasn1-3 2.10-1ubuntu1.6 (Accepted) Message-ID: <162004616342.6008.579637383026780587.launchpad@ackee.canonical.com> libtasn1-3 (2.10-1ubuntu1.6) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: buffer overflow via specially crafted assignments file - debian/patches/CVE-2017-6891.patch: add checks lib/parser_aux.c. - CVE-2017-6891 Date: 2017-07-11 18:57:16.377525+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libtasn1-3/2.10-1ubuntu1.6 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:27 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:27 -0000 Subject: [ubuntu/precise-security] libtirpc 0.2.2-5ubuntu0.1 (Accepted) Message-ID: <162004616721.6008.6775335093866862565.launchpad@ackee.canonical.com> libtirpc (0.2.2-5ubuntu0.1) precise-security; urgency=medium * SECURITY UPDATE: Denial of service - debian/patches/CVE-2016-4429.diff: fix in src/clnt_dg.c. - CVE-2016-4429 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2017-8779.patch: fix in src/rpc_generic.c, src/rpcb_prot.c, src/rpcb_st_xdr.c, src/xdr.c. - CVE-2017-8779 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14622.patch: fix in src/svc_c.c. - CVE-2018-14622 Date: 2018-09-04 16:40:17.373457+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libtirpc/0.2.2-5ubuntu0.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:29 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:29 -0000 Subject: [ubuntu/precise-security] libx11 2:1.4.99.1-0ubuntu2.5 (Accepted) Message-ID: <162004616991.6008.12915567339942601147.launchpad@ackee.canonical.com> libx11 (2:1.4.99.1-0ubuntu2.5) precise-security; urgency=medium [ Marc Deslauriers ] * SECURITY UPDATE: integer overflow and heap overflow in XIM client - debian/patches/CVE-2020-14344-1.patch: fix signed length values in modules/im/ximcp/imRmAttr.c. - debian/patches/CVE-2020-14344-2.patch: fix integer overflows in modules/im/ximcp/imRmAttr.c. - debian/patches/CVE-2020-14344-3.patch: fix more unchecked lengths in modules/im/ximcp/imRmAttr.c. - debian/patches/CVE-2020-14344-4.patch: zero out buffers in functions in modules/im/ximcp/imDefIc.c, modules/im/ximcp/imDefIm.c. - debian/patches/CVE-2020-14344-5.patch: change the data_len parameter to CARD16 in modules/im/ximcp/imRmAttr.c. - debian/patches/CVE-2020-14344-6.patch: fix size calculation in modules/im/ximcp/imRmAttr.c. - debian/patches/CVE-2020-14344-7.patch: fix input clients connecting to server in modules/im/ximcp/imRmAttr.c. - CVE-2020-14344 * SECURITY UPDATE: integer overflow and double free in locale handling - debian/patches/CVE-2020-14363.patch: fix an integer overflow in modules/om/generic/omGeneric.c. - CVE-2020-14363 libx11 (2:1.4.99.1-0ubuntu2.4) precise-security; urgency=medium * SECURITY UPDATE: Out-of-bounds read - debian/patches/CVE-2016-7942.patch: fix in src/GetImage.c. - CVE-2016-7942 * SECURITY UPDATE: Out-of-bounds read - debian/patches/CVE-2016-7943.patch: fix in src/FontNames.c, src/ListExt.c, src/ModMap.c. - CVE-2016-7943 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14598.patch: fix in src/GetFPath.c, src/ListExt.c. - CVE-2018-14598 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14599.patch: fix in src/FontNames.c, src/GetFPath.c, src/ListExt.c. - CVE-2018-14599 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14600.patch: fix in src/GetFPath. - CVE-2018-14600 Date: 2020-09-02 17:55:14.309433+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libx11/2:1.4.99.1-0ubuntu2.5 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:35 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:35 -0000 Subject: [ubuntu/precise-security] libxml2 2.7.8.dfsg-5.1ubuntu4.22 (Accepted) Message-ID: <162004617541.5996.7479201226250069463.launchpad@ackee.canonical.com> libxml2 (2.7.8.dfsg-5.1ubuntu4.22) precise-security; urgency=medium * SECURITY UPDATE: Memory leak - fix memory leak in xmlParseBalancedChunkMemoryRecover checking if doc is NULL in parser.c. - CVE-2019-19956 * SECURITY UPDATE: Denial of service though an infinite loop - fix infinite loop in xmlStringLenDecodeEntities adding checks to ctxt->instate if it is == XML_PARSER_EOF in parser.c. - CVE-2020-7595 libxml2 (2.7.8.dfsg-5.1ubuntu4.21) precise-security; urgency=medium * SECURITY UPDATE: XXE attacks - debian/patches/CVE-2016-9318.patch: fix in parser.c. - CVE-2016-9318 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2018-14404.patch: fix in xpath.c. - CVE-2018-14404 libxml2 (2.7.8.dfsg-5.1ubuntu4.20) precise-security; urgency=medium * SECURITY UPDATE: use after-free in xmlXPathCompOpEvalPositionPredicate - CVE-2017-15412 libxml2 (2.7.8.dfsg-5.1ubuntu4.19) precise-security; urgency=medium * SECURITY UPDATE: infinite recursion in parameter entities - CVE-2017-16932 libxml2 (2.7.8.dfsg-5.1ubuntu4.18) precise-security; urgency=medium * SECURITY UPDATE: type confusion leading to out-of-bounds write - CVE-2017-0663 * SECURITY UPDATE: XML external entity (XXE) vulnerability entity references - CVE-2017-7375 * SECURITY UPDATE: buffer overflow in URL handling ports in HTTP redirect support - CVE-2017-7376 * SECURITY UPDATE: buffer overflows in xmlSnprintfElementContent() remains in buffer for copied data - CVE-2017-9047, CVE-2017-9048 * SECURITY UPDATE: heap based buffer overreads in xmlDictComputeFastKey() expansions, add additional sanity check - CVE-2017-9049, CVE-2017-9050 Date: 2020-02-05 17:23:22.089564+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.22 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:36 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:36 -0000 Subject: [ubuntu/precise-security] libxslt 1.1.26-8ubuntu1.6 (Accepted) Message-ID: <162004617639.6007.362338183206561711.launchpad@ackee.canonical.com> libxslt (1.1.26-8ubuntu1.6) precise-security; urgency=medium * SECURITY UPDATE: Uninitialized read Fix uninitialized read of xsl:number token in libxslt/numbers.c. - CVE-2019-13117 * SECURITY UPDATE: Uninitialized read Fix uninitialized read with UTF-8 grouping chars in libxslt/numbers.c, tests/docs/bug-222.xml, tests/general/bug-222.out, tests/general/bug-222.xsl. - CVE-2019-13118 * SECURITY UPDATE: Buffer over-read Fix dangling pointer in xsltCopyText in libxslt/transform.c. - CVE-2019-18197 libxslt (1.1.26-8ubuntu1.5) precise-security; urgency=medium * SECURITY UPDATE: Bypass of protection mechanism - debian/patches/CVE-2019-11068.patch: Fix security framework bypass checking for returns equal or less -1 in libxslt/documents.c, libxslt/imports.c, libxslt/transform.c,libxslt/xslt.c. - CVE-2019-11068 Date: 2019-10-22 14:44:15.610919+00:00 Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa) Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/libxslt/1.1.26-8ubuntu1.6 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:52 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:52 -0000 Subject: [ubuntu/precise-security] linux-backports-modules-3.2.0 3.2.0-150.141 (Accepted) Message-ID: <162004619203.6007.12045774010616468051.launchpad@ackee.canonical.com> linux-backports-modules-3.2.0 (3.2.0-150.141) precise; urgency=medium * Bump ABI 3.2.0-150 linux-backports-modules-3.2.0 (3.2.0-149.140) precise; urgency=medium * Bump ABI 3.2.0-149 linux-backports-modules-3.2.0 (3.2.0-148.139) precise; urgency=medium * Bump ABI 3.2.0-148 linux-backports-modules-3.2.0 (3.2.0-147.138) precise; urgency=medium * Bump ABI 3.2.0-147 linux-backports-modules-3.2.0 (3.2.0-145.137) precise; urgency=medium * Bump ABI 3.2.0-145 * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log linux-backports-modules-3.2.0 (3.2.0-144.136) precise; urgency=medium * Bump ABI 3.2.0-144 linux-backports-modules-3.2.0 (3.2.0-143.135) precise; urgency=medium * Bump ABI 3.2.0-143 linux-backports-modules-3.2.0 (3.2.0-142.134) precise; urgency=medium * Bump ABI 3.2.0-142 linux-backports-modules-3.2.0 (3.2.0-141.133) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-140.132) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-139.131) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-138.130) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-137.129) precise; urgency=low * UBUNTU: cw: fix compilation error after L1TF fixes linux-backports-modules-3.2.0 (3.2.0-137.128) precise; urgency=low * Bump ABI linux-backports-modules-3.2.0 (3.2.0-136.127) precise; urgency=low * Bump ABI linux-backports-modules-3.2.0 (3.2.0-135.126) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-134.125) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-133.124) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-132.123) precise; urgency=medium * Bmp ABI linux-backports-modules-3.2.0 (3.2.0-131.122) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-130.121) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-129.120) precise; urgency=medium * Bump ABI linux-backports-modules-3.2.0 (3.2.0-128.119) precise; urgency=medium * Bump ABI Date: 2021-04-05 22:26:09.038659+00:00 Changed-By: Thadeu Lima de Souza Cascardo Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/linux-backports-modules-3.2.0/3.2.0-150.141 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:49:57 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:49:57 -0000 Subject: [ubuntu/precise-security] linux-base 4.5ubuntu1~12.04.1 (Accepted) Message-ID: <162004619757.6007.10582773806091319711.launchpad@ackee.canonical.com> linux-base (4.5ubuntu1~12.04.1) precise; urgency=low * Update precise to the latest linux-base. (LP: #1766728) Date: 2019-02-15 16:29:13.381213+00:00 Changed-By: Andy Whitcroft Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/linux-base/4.5ubuntu1~12.04.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:50:29 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:50:29 -0000 Subject: [ubuntu/precise-security] linux-meta 3.2.0.150.164 (Accepted) Message-ID: <162004622984.5996.905500676459733582.launchpad@ackee.canonical.com> linux-meta (3.2.0.150.164) precise; urgency=medium * Bump ABI 3.2.0-150 linux-meta (3.2.0.149.163) precise; urgency=medium * Bump ABI 3.2.0-149 linux-meta (3.2.0.148.162) precise; urgency=medium * Bump ABI 3.2.0-148 linux-meta (3.2.0.147.161) precise; urgency=medium * Bump ABI 3.2.0-147 linux-meta (3.2.0.145.160) precise; urgency=medium * Bump ABI 3.2.0-145 * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log linux-meta (3.2.0.144.159) precise; urgency=medium * Bump ABI 3.2.0-144 linux-meta (3.2.0.143.158) precise; urgency=medium * Bump ABI 3.2.0-143 linux-meta (3.2.0.142.157) precise; urgency=medium * Bump ABI 3.2.0-142 linux-meta (3.2.0.141.156) precise; urgency=medium * Bump ABI 3.2.0-141 linux-meta (3.2.0.140.155) precise; urgency=medium * Bump ABI 3.2.0-140 linux-meta (3.2.0.139.154) precise; urgency=medium * Bump ABI 3.2.0-139 linux-meta (3.2.0.138.153) precise; urgency=medium * Bump ABI 3.2.0-138 linux-meta (3.2.0.137.152) precise; urgency=medium * Bump ABI 3.2.0-137 linux-meta (3.2.0.136.151) precise; urgency=medium * Bump ABI 3.2.0-136 linux-meta (3.2.0.135.150) precise; urgency=medium * Bump ABI 3.2.0-135 linux-meta (3.2.0.134.149) precise; urgency=medium * Bump ABI 3.2.0-134 linux-meta (3.2.0.133.148) precise; urgency=medium * Bump ABI 3.2.0-133 * Miscellaneous upstream changes - Revert "UBUNTU: Make kernel image packages depend on cpu microcode updates" linux-meta (3.2.0.132.147) precise; urgency=medium * Make the kernel image packages depend on the cpu microcode updates, to ensure they are pulled into all host installs of Ubuntu on upgrade. LP: #1738259. [intel-microcode only] linux-meta (3.2.0.132.146) precise; urgency=medium * Bump ABI 3.2.0-132 linux-meta (3.2.0.131.145) precise; urgency=medium * Bump ABI 3.2.0-131 linux-meta (3.2.0.130.144) precise; urgency=medium * Bump ABI 3.2.0-130 linux-meta (3.2.0.129.143) precise; urgency=medium * Bump ABI 3.2.0-129 linux-meta (3.2.0.128.142) precise; urgency=medium * Bump ABI 3.2.0-128 Date: 2021-04-05 22:24:12.774640+00:00 Changed-By: Thadeu Lima de Souza Cascardo Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/linux-meta/3.2.0.150.164 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:50:34 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:50:34 -0000 Subject: [ubuntu/precise-security] linux-meta-lts-trusty 3.13.0.185.170 (Accepted) Message-ID: <162004623466.26760.12444920696478679366.launchpad@ackee.canonical.com> linux-meta-lts-trusty (3.13.0.185.170) precise; urgency=medium * Bump ABI 3.13.0-185 linux-meta-lts-trusty (3.13.0.183.169) precise; urgency=medium * Bump ABI 3.13.0-183 linux-meta-lts-trusty (3.13.0.182.168) precise; urgency=medium * Bump ABI 3.13.0-182 linux-meta-lts-trusty (3.13.0.181.167) precise; urgency=medium * Bump ABI 3.13.0-181 linux-meta-lts-trusty (3.13.0.180.166) precise; urgency=medium * Bump ABI 3.13.0-180 linux-meta-lts-trusty (3.13.0.177.165) precise; urgency=medium * Bump ABI 3.13.0-177 * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log linux-meta-lts-trusty (3.13.0.176.164) precise; urgency=medium * Bump ABI 3.13.0-176 linux-meta-lts-trusty (3.13.0.175.163) precise; urgency=medium * Bump ABI 3.13.0-175 linux-meta-lts-trusty (3.13.0.174.162) precise; urgency=medium * Bump ABI 3.13.0-174 linux-meta-lts-trusty (3.13.0.173.161) precise; urgency=medium * Bump ABI 3.13.0-173 linux-meta-lts-trusty (3.13.0.172.160) precise; urgency=medium * Bump ABI 3.13.0-172 linux-meta-lts-trusty (3.13.0.171.159) precise; urgency=medium * Bump ABI 3.13.0-171 linux-meta-lts-trusty (3.13.0.170.158) precise; urgency=medium * Bump ABI 3.13.0-170 linux-meta-lts-trusty (3.13.0.168.157) precise; urgency=medium * Bump ABI 3.13.0-168 linux-meta-lts-trusty (3.13.0.166.156) precise; urgency=medium * Bump ABI 3.13.0-166 * signing: only install a signed kernel (LP: #1764794) - switch to signed-only binary packages - convert linux-signed* into transitional packages linux-meta-lts-trusty (3.13.0.165.155) precise; urgency=medium * Bump ABI 3.13.0-165 linux-meta-lts-trusty (3.13.0.164.154) precise; urgency=medium * Bump ABI 3.13.0-164 linux-meta-lts-trusty (3.13.0.163.153) precise; urgency=medium * Bump ABI 3.13.0-163 linux-meta-lts-trusty (3.13.0.162.152) precise; urgency=medium * Bump ABI 3.13.0-162 linux-meta-lts-trusty (3.13.0.161.151) precise; urgency=medium * Bump ABI 3.13.0-161 linux-meta-lts-trusty (3.13.0.160.150) precise; urgency=medium * Bump ABI 3.13.0-160 linux-meta-lts-trusty (3.13.0.159.149) precise; urgency=medium * Bump ABI 3.13.0-159 linux-meta-lts-trusty (3.13.0.158.148) precise; urgency=medium * Bump ABI 3.13.0-158 linux-meta-lts-trusty (3.13.0.157.147) precise; urgency=medium * Bump ABI 3.13.0-157 linux-meta-lts-trusty (3.13.0.156.146) precise; urgency=medium * Bump ABI 3.13.0-156 linux-meta-lts-trusty (3.13.0.155.145) precise; urgency=medium * Bump ABI 3.13.0-155 linux-meta-lts-trusty (3.13.0.154.144) precise; urgency=medium * Bump ABI 3.13.0-154 linux-meta-lts-trusty (3.13.0.153.143) precise; urgency=medium * Bump ABI 3.13.0-153 linux-meta-lts-trusty (3.13.0.151.142) precise; urgency=medium * Bump ABI 3.13.0-151 linux-meta-lts-trusty (3.13.0.150.141) precise; urgency=medium * Bump ABI 3.13.0-150 linux-meta-lts-trusty (3.13.0.149.140) precise; urgency=medium * Bump ABI 3.13.0-149 linux-meta-lts-trusty (3.13.0.148.139) precise; urgency=medium * Bump ABI 3.13.0-148 linux-meta-lts-trusty (3.13.0.147.138) precise; urgency=medium * Bump ABI 3.13.0-147 linux-meta-lts-trusty (3.13.0.146.137) precise; urgency=medium * Bump ABI 3.13.0-146 linux-meta-lts-trusty (3.13.0.145.136) precise; urgency=medium * Bump ABI 3.13.0-145 linux-meta-lts-trusty (3.13.0.144.135) precise; urgency=medium * Bump ABI 3.13.0-144 linux-meta-lts-trusty (3.13.0.143.134) precise; urgency=medium * Bump ABI 3.13.0-143 linux-meta-lts-trusty (3.13.0.142.133) precise; urgency=medium * Bump ABI 3.13.0-142 linux-meta-lts-trusty (3.13.0.141.132) precise; urgency=medium * Bump ABI 3.13.0-141 linux-meta-lts-trusty (3.13.0.140.131) precise; urgency=medium * Bump ABI 3.13.0-140 * Miscellaneous upstream changes - Revert "UBUNTU: Make kernel image packages depend on cpu microcode updates" linux-meta-lts-trusty (3.13.0.139.130) precise; urgency=medium * Make the kernel image packages depend on the cpu microcode updates, to ensure they are pulled into all host installs of Ubuntu on upgrade. LP: #1738259. [intel-microcode only] linux-meta-lts-trusty (3.13.0.139.129) precise; urgency=medium * Bump ABI 3.13.0-139 linux-meta-lts-trusty (3.13.0.138.128) precise; urgency=medium * Bump ABI 3.13.0-138 linux-meta-lts-trusty (3.13.0.137.127) precise; urgency=medium * Bump ABI 3.13.0-137 linux-meta-lts-trusty (3.13.0.136.126) precise; urgency=medium * Bump ABI 3.13.0-136 linux-meta-lts-trusty (3.13.0.135.125) precise; urgency=medium * Bump ABI 3.13.0-135 linux-meta-lts-trusty (3.13.0.134.124) precise; urgency=medium * Bump ABI 3.13.0-134 linux-meta-lts-trusty (3.13.0.133.123) precise; urgency=medium * Bump ABI 3.13.0-133 linux-meta-lts-trusty (3.13.0.132.122) precise; urgency=medium * Bump ABI 3.13.0-132 linux-meta-lts-trusty (3.13.0.131.121) precise; urgency=medium * Bump ABI 3.13.0-131 linux-meta-lts-trusty (3.13.0.130.120) precise; urgency=medium * Bump ABI 3.13.0-130 linux-meta-lts-trusty (3.13.0.129.119) precise; urgency=medium * Bump ABI 3.13.0-129 linux-meta-lts-trusty (3.13.0.128.118) precise; urgency=medium * Bump ABI 3.13.0-128 linux-meta-lts-trusty (3.13.0.126.117) precise; urgency=medium * Bump ABI 3.13.0-126 linux-meta-lts-trusty (3.13.0.125.116) precise; urgency=medium * Bump ABI 3.13.0-125 linux-meta-lts-trusty (3.13.0.124.115) precise; urgency=medium * Bump ABI 3.13.0-124 linux-meta-lts-trusty (3.13.0.123.114) precise; urgency=medium * Bump ABI 3.13.0-123 linux-meta-lts-trusty (3.13.0.122.113) precise; urgency=medium * Bump ABI 3.13.0-122 linux-meta-lts-trusty (3.13.0.121.112) precise; urgency=medium * Bump ABI 3.13.0-121 linux-meta-lts-trusty (3.13.0.120.111) precise; urgency=medium * Bump ABI 3.13.0-120 linux-meta-lts-trusty (3.13.0.119.110) precise; urgency=medium * Bump ABI 3.13.0-119 linux-meta-lts-trusty (3.13.0.118.109) precise; urgency=medium * Bump ABI 3.13.0-118 Date: 2021-03-18 15:43:31.050229+00:00 Changed-By: Stefan Bader Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/linux-meta-lts-trusty/3.13.0.185.170 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:50:37 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:50:37 -0000 Subject: [ubuntu/precise-security] linux-signed-lts-trusty 3.13.0-185.236~12.04.1 (Accepted) Message-ID: <162004623711.5996.9233464745020622424.launchpad@ackee.canonical.com> linux-signed-lts-trusty (3.13.0-185.236~12.04.1) precise; urgency=medium * Master version: 3.13.0-185.236~12.04.1 linux-signed-lts-trusty (3.13.0-183.234~12.04.1) precise; urgency=medium * Master version: 3.13.0-183.234~12.04.1 linux-signed-lts-trusty (3.13.0-182.233~12.04.1) precise; urgency=medium * Master version: 3.13.0-182.233~12.04.1 linux-signed-lts-trusty (3.13.0-181.232~12.04.1) precise; urgency=medium * Master version: 3.13.0-181.232~12.04.1 linux-signed-lts-trusty (3.13.0-180.231~12.04.1) precise; urgency=medium * Master version: 3.13.0-180.231~12.04.1 linux-signed-lts-trusty (3.13.0-177.228~12.04.1) precise; urgency=medium * Master version: 3.13.0-177.228~12.04.1 * Packaging resync (LP: #1786013) - [Packaging] resync git-ubuntu-log linux-signed-lts-trusty (3.13.0-176.227~12.04.1) precise; urgency=medium * Master version: 3.13.0-176.227~12.04.1 linux-signed-lts-trusty (3.13.0-175.226~12.04.1) precise; urgency=medium * Master version: 3.13.0-175.226~12.04.1 linux-signed-lts-trusty (3.13.0-174.225~12.04.1) precise; urgency=medium * Master version: 3.13.0-174.225~12.04.1 linux-signed-lts-trusty (3.13.0-173.224~12.04.1) precise; urgency=medium * Master version: 3.13.0-173.224~12.04.1 linux-signed-lts-trusty (3.13.0-172.223~12.04.1) precise; urgency=medium * Master version: 3.13.0-172.223~12.04.1 linux-signed-lts-trusty (3.13.0-171.222~12.04.1) precise; urgency=medium * Master version: 3.13.0-171.222~12.04.1 linux-signed-lts-trusty (3.13.0-170.220~12.04.2+signed1) precise; urgency=medium * Rebuild after fixing and incorrectly based upload. linux-signed-lts-trusty (3.13.0-170.220~12.04.2) precise; urgency=medium * Master version: 3.13.0-170.220~12.04.2 linux-signed-lts-trusty (3.13.0-168.218~precise1) precise; urgency=medium * Master version: 3.13.0-168.218~precise1 linux-signed-lts-trusty (3.13.0-166.216~precise1) precise; urgency=medium * Master version: 3.13.0-166.216~precise1 * signing: only install a signed kernel (LP: #1764794) - [Packaging] switch to signed-only forms - [Packaging] use arch headers package when building download path for signed binaries - [Packaging] match +signedN more accuratly - [Packaging] download-signed -- fix downloader component and handle versions correctly linux-signed-lts-trusty (3.13.0-165.215~precise1) precise; urgency=medium * Master Version 3.13.0-165.215~precise1 linux-signed-lts-trusty (3.13.0-164.214~precise1) precise; urgency=medium * Master Version 3.13.0-164.214~precise1 linux-signed-lts-trusty (3.13.0-163.213~precise1) precise; urgency=medium * Master Version 3.13.0-163.213~precise1 linux-signed-lts-trusty (3.13.0-162.212~precise1) precise; urgency=medium * Master Version 3.13.0-162.212~precise1 linux-signed-lts-trusty (3.13.0-161.211~precise1) precise; urgency=medium * Master Version 3.13.0-161.211~precise1 linux-signed-lts-trusty (3.13.0-160.210~precise1) precise; urgency=medium * Master Version 3.13.0-160.210~precise1 linux-signed-lts-trusty (3.13.0-159.209~precise1) precise; urgency=medium * Master Version 3.13.0-159.209~precise1 linux-signed-lts-trusty (3.13.0-158.208~precise2) precise; urgency=medium * Master Version 3.13.0-158.208~precise2 linux-signed-lts-trusty (3.13.0-158.208~precise1) precise; urgency=medium * Master Version 3.13.0-158.208~precise1 linux-signed-lts-trusty (3.13.0-157.207~precise1) precise; urgency=medium * Master Version 3.13.0-157.207~precise1 linux-signed-lts-trusty (3.13.0-156.206~precise1) precise; urgency=medium * Master Version 3.13.0-156.206~precise1 linux-signed-lts-trusty (3.13.0-155.206~precise1) precise; urgency=medium * Master Version 3.13.0-155.206~precise1 linux-signed-lts-trusty (3.13.0-154.204~precise1) precise; urgency=medium * Master Version 3.13.0-154.204~precise1 linux-signed-lts-trusty (3.13.0-153.203~precise1) precise; urgency=medium * Master Version 3.13.0-153.203~precise1 linux-signed-lts-trusty (3.13.0-151.201~precise1) precise; urgency=medium * Master Version 3.13.0-151.201~precise1 linux-signed-lts-trusty (3.13.0-150.200~precise1) precise; urgency=medium * Master Version 3.13.0-150.200~precise1 linux-signed-lts-trusty (3.13.0-149.199~precise1) precise; urgency=medium * Master Version 3.13.0-149.199~precise1 linux-signed-lts-trusty (3.13.0-148.197~precise1) precise; urgency=medium * Master Version 3.13.0-148.197~precise1 linux-signed-lts-trusty (3.13.0-147.196~precise1) precise; urgency=medium * Master Version 3.13.0-147.196~precise1 linux-signed-lts-trusty (3.13.0-146.195~precise1) precise; urgency=medium * Master Version 3.13.0-146.195~precise1 linux-signed-lts-trusty (3.13.0-145.194~precise2) precise; urgency=medium * Master Version 3.13.0-145.194~precise2 linux-signed-lts-trusty (3.13.0-145.194~precise1) precise; urgency=medium * Master Version 3.13.0-145.194~precise1 linux-signed-lts-trusty (3.13.0-144.193~precise1) precise; urgency=medium * Master Version 3.13.0-144.193~precise1 linux-signed-lts-trusty (3.13.0-143.192~precise1) precise; urgency=medium * Master Version 3.13.0-143.192~precise1 linux-signed-lts-trusty (3.13.0-142.191~precise1) precise; urgency=medium * Master Version 3.13.0-142.191~precise1 linux-signed-lts-trusty (3.13.0-141.190~precise1) precise; urgency=medium * Master Version 3.13.0-141.190~precise1 linux-signed-lts-trusty (3.13.0-140.189~precise1) precise; urgency=medium * Master Version 3.13.0-140.189~precise1 linux-signed-lts-trusty (3.13.0-139.188~precise1) precise; urgency=medium * Master Version 3.13.0-139.188~precise1 linux-signed-lts-trusty (3.13.0-138.187~precise1) precise; urgency=medium * Master Version 3.13.0-138.187~precise1 linux-signed-lts-trusty (3.13.0-137.186~precise1) precise; urgency=medium * Master Version 3.13.0-137.186~precise1 linux-signed-lts-trusty (3.13.0-136.185~precise1) precise; urgency=medium * Master Version 3.13.0-136.185~precise1 linux-signed-lts-trusty (3.13.0-135.184~precise1) precise; urgency=medium * Master Version 3.13.0-135.184~precise1 linux-signed-lts-trusty (3.13.0-134.183~precise1) precise; urgency=medium * Master Version 3.13.0-134.183~precise1 linux-signed-lts-trusty (3.13.0-133.182~precise1) precise; urgency=medium * Master Version 3.13.0-133.182~precise1 linux-signed-lts-trusty (3.13.0-132.181~precise1) precise; urgency=medium * Master Version 3.13.0-132.181~precise1 linux-signed-lts-trusty (3.13.0-131.180~precise1) precise; urgency=medium * Master Version 3.13.0-131.180~precise1 linux-signed-lts-trusty (3.13.0-130.179~precise1) precise; urgency=medium * Master Version 3.13.0-130.179~precise1 linux-signed-lts-trusty (3.13.0-129.178~precise1) precise; urgency=medium * Master Version 3.13.0-129.178~precise1 linux-signed-lts-trusty (3.13.0-128.177~precise1) precise; urgency=medium * Master Version 3.13.0-128.177~precise1 linux-signed-lts-trusty (3.13.0-126.175~precise1) precise; urgency=medium * Master Version 3.13.0-126.175~precise1 linux-signed-lts-trusty (3.13.0-125.174~precise1) precise; urgency=medium * Master Version 3.13.0-125.174~precise1 linux-signed-lts-trusty (3.13.0-124.173~precise1) precise; urgency=medium * Master Version 3.13.0-124.173~precise1 linux-signed-lts-trusty (3.13.0-123.172~precise1) precise; urgency=medium * Master Version 3.13.0-123.172~precise1 linux-signed-lts-trusty (3.13.0-122.171~precise1) precise; urgency=medium * Master Version 3.13.0-122.171~precise1 linux-signed-lts-trusty (3.13.0-121.170~precise1) precise; urgency=medium * Master Version 3.13.0-121.170~precise1 linux-signed-lts-trusty (3.13.0-120.167~precise1) precise; urgency=medium * Master Version 3.13.0-120.167~precise1 linux-signed-lts-trusty (3.13.0-119.166~precise1) precise; urgency=medium * Master Version 3.13.0-119.166~precise1 linux-signed-lts-trusty (3.13.0-118.165~precise1) precise; urgency=medium * Master Version 3.13.0-118.165~precise1 Date: 2021-03-18 15:43:32.438879+00:00 Changed-By: Stefan Bader Signed-By: Steve Langasek https://launchpad.net/ubuntu/+source/linux-signed-lts-trusty/3.13.0-185.236~12.04.1 -------------- next part -------------- Sorry, changesfile not available. From steve.langasek at canonical.com Mon May 3 12:50:37 2021 From: steve.langasek at canonical.com (Steve Langasek) Date: Mon, 03 May 2021 12:50:37 -0000 Subject: [ubuntu/precise-security] lxml 2.3.2-1ubuntu0.5 (Accepted) Message-ID: <162004623796.26760.18387819483700624391.launchpad@ackee.canonical.com> lxml (2.3.2-1ubuntu0.5) precise-security; urgency=medium * SECURITY UPDATE: XSS vulnerability - This adds the missing part reported from upstream Prevent combinations of