~ubuntu-branches/ubuntu/hardy/glibc/hardy-security : changes

~ubuntu-branches/ubuntu/hardy/glibc/hardy-security » Changes from revision 95

From Revision 95 to 76

Rev	Summary	Authors	Tags	Date
95	debian/patches/any/strtod_overflow_bug7066.patch: Fix array debian/patches/any/strtod_overflow_bug7066.patch: Fix array overflow in floating point parser triggered by applying patch for CVE-2012-3480 (LP: #1090740)	Marc Deslauriers	2.7-10ubuntu8.3	11 years ago
94	* SECURITY UPDATE: buffer overflow in vfprintf handling * SECURITY UPDATE: buffer overflow in vfprintf handling - debian/patches/any/CVE-2012-3404.patch: Fix allocation when handling positional parameters in printf. - CVE-2012-3404 * SECURITY UPDATE: buffer overflow in vfprintf handling - debian/patches/any/CVE-2012-3405.patch: fix extension of array - CVE-2012-3405 * SECURITY UPDATE: stack buffer overflow in vfprintf handling (LP: #1031301) - debian/patches/any/CVE-2012-3406.patch: switch to malloc when array grows too large to handle via alloca extension - CVE-2012-3406 * SECURITY UPDATE: stdlib strtod integer/buffer overflows - debian/patches/any/CVE-2012-3480.patch: rearrange calculations and modify types to void integer overflows - CVE-2012-3480 * debian/expected_test_summary: update expected results to prevent FTBFS	Steve Beattie	2.7-10ubuntu8.2	11 years ago
93	* SECURITY UPDATE: timezone header parsing integer overflow ... * SECURITY UPDATE: timezone header parsing integer overflow (LP: #906961) - debian/patches/any/glibc-CVE-2009-5029.patch: Check values from TZ file header - CVE-2009-5029 * SECURITY UPDATE: - debian/patches/any/submitted-nis-shadow.diff remove encrypted passwords from passwd entries, and add them in shadow entries and fix incorrect password overwriting - CVE-2010-0015 * SECURITY UPDATE: memory consumption denial of service in fnmatch - debian/patches/any/glibc-CVE-2011-1071.patch: avoid too much stack use in fnmatch. - CVE-2011-1071 * SECURITY UPDATE: /etc/mtab corruption denial of service - debian/patches/any/glibc-CVE-2011-1089.patch: Report write error in addmnt even for cached streams - CVE-2011-1089 * SECURITY UPDATE: insufficient locale environment sanitization - debian/patches/any/glibc-CVE-2011-1095.patch: escape contents of LANG environment variable. - CVE-2011-1095 * SECURITY UPDATE: ld.so insecure handling of privileged programs' RPATHs with $ORIGIN - debian/patches/any/glibc-CVE-2011-1658.patch: improve handling of RPATH and ORIGIN - CVE-2011-1658 * SECURITY UPDATE: fnmatch integer overflow - debian/patches/any/glibc-CVE-2011-1659.patch: check size of pattern in wide character representation - CVE-2011-1659 * SECURITY UPDATE: signedness bug in memcpy_ssse3 - debian/patches/any/glibc-CVE-2011-2702.patch: use unsigned comparison instructions - CVE-2011-2702 * SECURITY UPDATE: DoS in RPC implementation (LP: #901716) - debian/patches/any/glibc-CVE-2011-4609.patch: nanosleep when too many open fds is detected - CVE-2011-4609 * SECURITY UPDATE: vfprintf nargs overflow leading to FORTIFY check bypass - debian/patches/any/glibc-CVE-2012-0864.patch: check for integer overflow - CVE-2012-0864	Steve Beattie	2.7-10ubuntu8.1	12 years ago
92	* SECURITY UPDATE: setuid iconv users could load arbitrary l... * SECURITY UPDATE: setuid iconv users could load arbitrary libraries. - debian/patches/any/dst-expansion-fix.diff: refresh with new proposed solution, avoiding iconv issues. - any/cvs-check-setuid-on-audit.diff: upstream fix for CVE-2010-3856, which was already had a work-around in 2.7-10ubuntu7.	Kees Cook	2.7-10ubuntu8	13 years ago
91	* SECURITY UPDATE: root escalation via LD_AUDIT DST expansio... * SECURITY UPDATE: root escalation via LD_AUDIT DST expansion. - debian/patches/any/dst-expansion-fix.diff: upstream fixes. - CVE-2010-3847 - debian/patches/any/disable-ld_audit.diff: turn off LD_AUDIT for setuid binaries.	Kees Cook	2.7-10ubuntu7	13 years ago
90	* SECURITY UPDATE: integer overflow in strfmon() might lead ... * SECURITY UPDATE: integer overflow in strfmon() might lead to arbitrary code execution. - debian/patches/any/git-strfmon-overflow.diff: backport from upstream. - CVE-2008-1391 * SECURITY UPDATE: newlines not escaped in /etc/mtab. - debian/patches/any/git-mntent-newline-escape.diff: upstream fixes. - CVE-2010-0296 * SECURITY UPDATE: arbitrary code execution from ELF headers (LP: #542197). - debian/patches/any/git-fix-dtag-cast.diff: upstream fixes. - CVE-2010-0830 * debian/patches/any/git-readdir-padding.diff: fix readdir padding when processing getdents64() in a 32-bit execution environment (LP: #392501).	Kees Cook	2.7-10ubuntu6	13 years ago
89	* Probably built on the good buildds last time; pessimize ex... * Probably built on the good buildds last time; pessimize expected test results on ia64, i386. * debian/expected_test_summary: Fix typos in expected sparc results.	Matthias Klose	2.7-10ubuntu3	16 years ago
88	* Adjust debian/expected_test_summary: * Adjust debian/expected_test_summary: - Fix typo for i386 xen. - crypt/sha512c fails on i386 (log-test-i486-linux-gnu-libc), but not on the PPA build. - Add current results for ia64, powerpc, sparc.	Matthias Klose	2.7-10ubuntu2	16 years ago
87	* Merge remaining changes from 2.7-10 (r2869:2892). * Merge remaining changes from 2.7-10 (r2869:2892). * If RELEASE_UPGRADE_MODE is set to `desktop', make the glibc/restart-services, glibc/restart-failed and glibc/upgrade questions of medium priority (and restarting the services automatically). LP: #174002. Works as well around the upgrade errors mentioned in LP #205079 in a KDE environment, when the upgrade is done using the update-manager. * debian/rules: Always use the package settings for FLAGS, not the settings from the environment. Fail the build if regressions are found running the testsuite compared to expected results from debian/expected_test_summary. Take initial values from a PPA build predating this upload. * Merge from Debian trunk: - local/manpages/ld.so.8: fix libraries search order. Closes: #473458. - Update Finish debconf translation, by Esko Arajärvi. Closes: #473802. - Add any/cvs-strerror_r.diff to make strerror_r actually thread safe. Closes: #456531. * debian/rules.d/build.mk: Call `sync' before building the tarball of supported locales. Our buildds trigger http://lkml.org/lkml/2007/8/1/337 on every build.	Matthias Klose	2.7-10ubuntu1	16 years ago
86	Clear out LDFLAGS when building; glibc isn't happy building ... Clear out LDFLAGS when building; glibc isn't happy building with -Wl,-Bsymbolic-functions. LP: #201673	Steve Langasek	2.7-9ubuntu2	16 years ago
85	* Merge with Debian (r2869); remaining changes: * Merge with Debian (r2869); remaining changes: - Packaging: + External tzdata + Use external locale information + Addition of Niagara and Niagara2 optimised libraries + GFDL Documentation added back in, build glibc-doc from this source. + Transition from /usr/include/ppc64-linux-gnu to powerpc64-linux-gnu + Use dpkg triggers for ldconfig + Do not die if extra libc libraries or symlinks found + Do not do a test run of nscd when starting + Only apply patches we actually use in Ubuntu + Use /lib and /usr/lib for amd64 + amd64 biarch is i686, not i486. + Non-optimised i386 glibc is Xen-friendly. + Support sparcv9v, v9v2, 64b, 64v, 64v2 + Add support for lpia. - Patches: + sparc/submitted-v9v2 + hppa/hppalll + Applied any/local-ipv6-lookup. + Not applied any/local-sysctl. * debian/sysdeps/.mk: Still build main flavours with -O3 (using gcc-4.2). Use <triplet>.conf for files in /etc/ld.so.conf.d. LP: #70315 * patches/any/local-ipv6-lookup.diff: Update (Tollef van Heen). [changes from Debian svn after -9] * Update Chinese debconf translation, by LI Daobing. * Update Dutch debconf translation, by Bart Cornelis. Closes: #468300. * Update Polish debcon translation, by Emilian Nowak. * Update Vietnamese debconf translation, by Clytie Siddall. Closes: #468453. * Update Basque debconf translation, by Piarres Beobide. Closes: #468463. * Update Romanian debconf translation, by Stan Ioan-Eugen. Closes: #468671. * Update Czech debconf translation, by Miroslav Kure. Closes: #468910. * Update Russian debconf translation, by Sergey Alyoshin. Closes: #469037. * Update Korean debconf translation, by Sunjae Park. Closes: #469097. * Update French debconf translation, by Christian Perrier. Closes: #469249. * patches/localedata/locale-es_CR.diff: chane AM/PM format to "a.m./p.m." from "A.M/P.M.". * Remove uk_UA from patches/localedata/first_weekday.diff: merged upstream in a different way. Closes: bug#469439. * patches/any/cvs-rfc3484.diff: update from CVS to allow the definition of IPv4 scopes in /etc/gai.conf. * patches/all/cvs-gai_conf.diff: update gai.conf from CVS to also mention Teredo tunnels and scopev4 defaults. * sysdeps/mips.mk, sysdeps/mipsel.mk: define TIMEOUTFACTOR. * patches/any/cvs-strtod.diff: new patch from CVS to fix strtod(). Closes: #465769. * Update Italian debconf translation, by Lica Monducci. Closes: #469985. * control.in/main, sysdeps/.mk, rules: build with gcc-4.3 by default, except on alpha, arm, armel, hppa, s390 and hurd-i386. rules, rules.d/build.mk: fix parallel build. * control.in/main: build-depends on gcc-4.3 (>= 4.3.0-2) to make sure a cld instruction is emitted in the prologue of functions using stringops. Closes: #469568. * debian/rules.d/build.mk: disable testsuite on ARM machines running a 2.6.21 to 2.6.24 kernel.	Matthias Klose	2.7-9ubuntu1	16 years ago
84	Really stop setting MAKEINFO to :, so that the info document... Really stop setting MAKEINFO to :, so that the info documentation is built.	Colin Watson	2.7-5ubuntu2	16 years ago
83	* Resynchronise with Debian. Remaining changes: * Resynchronise with Debian. Remaining changes: - Packaging: + External tzdata + Use external locale information + Addition of Niagara and Niagara2 optimised libraries + GFDL Documentation added back in. + Transition from /usr/include/ppc64-linux-gnu to powerpc64-linux-gnu + Use dpkg triggers for ldconfig + Do not die if extra libc libraries or symlinks found + Do not do a test run of nscd when starting + Only apply patches we actually use in Ubuntu + Use /lib and /usr/lib for amd64 + amd64 biarch is i686, not i486. + Non-optimised i386 glibc is Xen-friendly. + Support sparcv9v, v9v2, 64b, 64v, 64v2 + Add support for lpia. - Patches: + any/local-ipv6-sanity + i386/local-clone + amd64/local-clone + sparc/submitted-v9v2 + hppa/hppalll * Debian any/cvs-vfscanf patch fixes LP: #178045. Actually add it to debian/patches/series (forgotten in Debian). * Stop setting MAKEINFO to :, which prevented the info documentation being built. See also 2.5-0ubuntu3. * any/submitted-rfc3484-sortv4: Return to disabling RFC3484 s6 rule 9 by default. As requested by Ubuntu sysadmins, we want this regardless of the Debian technical committee's decision.	Colin Watson	2.7-5ubuntu1	16 years ago
82	Merge with Debian; remaining changes (see 2.7-1ubuntu1) Merge with Debian; remaining changes (see 2.7-1ubuntu1)	Matthias Klose	2.7-4ubuntu1	16 years ago
81	[ Matthias Klose ] [ Matthias Klose ] * Merge with Debian; remaining changes (see 2.7-1ubuntu1) * debian/rules.d/control.mk: Re-add support for lpia. * debian/sysdeps/amd64.mk: Restore i386_includedir. [ Jeff Bailey ] * debian/patches/hppa/hppalll.diff: Fix build failure on hppa.	Matthias Klose	2.7-3ubuntu1	16 years ago
80	Reapply any/local-ipv6-sanity.diff, lost when merging 2.6. L... Reapply any/local-ipv6-sanity.diff, lost when merging 2.6. LP: #156720.	Matthias Klose	2.6.1-6ubuntu2	16 years ago
79	[Fabio M. Di Nitto] [Fabio M. Di Nitto] * debian/patches/sparc/submitted-v9v2.diff: Add Niagara 2 optimized memcpy support. Code, patch and test done by David S. Miller. * debian/patches/series: update. * debian/sysdeps/sparc.mk: Add v9v2 32 and 64 bit targets. * debian/control.in/opt: Add sparc64v2 and sparcv9v2 packages. * debian/control: update. * debian/script.in/nohwcap.sh: - fix list of sparc optimized libc6. - add v9v2 optimized packages. [Matthias Klose] * Merge with Debian; remaining changes: - Upstream tarball including GFDL'd documentation. - Don't apply patches for architectures not found in Ubuntu. - Build optimized sparc packages. - Support lpia. - No support for linuxthreads.	Matthias Klose	2.6.1-6ubuntu1	16 years ago
78	Rebuild using g++-4.2 (>= 4.2.1-5ubuntu4). Rebuild using g++-4.2 (>= 4.2.1-5ubuntu4).	Matthias Klose	2.6.1-1ubuntu9	16 years ago
77	hppa/local-private-futex-lamont.diff: fix hppa FTBFS. hppa/local-private-futex-lamont.diff: fix hppa FTBFS.	LaMont Jones	2.6.1-1ubuntu8	16 years ago
76	* any/submitted-rfc3484-sortv4.diff: new patch to allow bypa... * any/submitted-rfc3484-sortv4.diff: new patch to allow bypassing RFC3484 rule 9 for IPv4 adresses. Closes: bug#438179. [ by Aurelien Jarno; imported from glibc 2.6.1-2 into Ubuntu by iwj ] * any/submitted-rfc3484-sortv4.diff: disable RFC3484 s6 rule 9 by default as requested by Ubuntu sysadmins and in anticipation of that change in Debian (which looks likely).	Ian Jackson	2.6.1-1ubuntu7	16 years ago

Older »