[ubuntu/vivid-security] apport 2.17.2-0ubuntu1.5 (Accepted)

[Marc Deslauriers]

apport (2.17.2-0ubuntu1.5) vivid-security; urgency=medium

  * SECURITY FIX: kernel_crashdump: Enforce that the log/dmesg files are not a
    symlink.
    This prevents normal users from pre-creating a symlink to the predictable
    .crash file, and thus triggering a "fill up disk" DoS attack when the
    .crash report tries to include itself. Also clean up the code to make this
    easier to read: Drop the "vmcore_root" alias, move the vmcore and
    vmcore.log cleanup into the "no kdump" section, and replace the buggy
    os.walk() loop with a glob to only catch direct timestamp subdirectories
    of /var/crash/.
    Thanks to halfdog for discovering this!
    (CVE-2015-1338, part of LP #1492570)
  * SECURITY FIX: Fix all writers of report files to open the report file
    exclusively.
    Fix package_hook, kernel_crashdump, and similar hooks to fail if the
    report already exists. This prevents privilege escalation through symlink
    attacks. Note that this will also prevent overwriting previous reports
    with the same same. Thanks to halfdog for discovering this!
    (CVE-2015-1338, LP: #1492570)

apport (2.17.2-0ubuntu1.4) vivid-proposed; urgency=medium

  * data/package_hook: when creating the problem report include the version of
    the package. (LP: #1485787)

apport (2.17.2-0ubuntu1.3) vivid-proposed; urgency=medium

  * Keep "[origin: ...]" information in Package: and Dependencies: fields
    for native-origins.d/ origins, so that it's possible to retrace them and
    so that bugs are reported about the right project. (LP: #1470572)

apport (2.17.2-0ubuntu1.2) vivid-proposed; urgency=medium

  * apport-noui.upstart: Utilize watershed to only launch one instance of
    whoopsie-upload-all at a time. (LP: #1473562)
  * apport-noui: Depend on watershed.

Date: 2015-09-22 12:02:17.855091+00:00
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Signed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/apport/2.17.2-0ubuntu1.5
-------------- next part --------------
Sorry, changesfile not available.