~ubuntu-branches/ubuntu/hardy/pidgin/hardy-security : changes

~ubuntu-branches/ubuntu/hardy/pidgin/hardy-security » Changes from revision 28

From Revision 28 to 9

Rev	Summary	Authors	Tags	Date
28	* SECURITY UPDATE: denial of service via custom emoticon * SECURITY UPDATE: denial of service via custom emoticon - debian/patches/94_security_CVE-2010-1624.patch: make sure body is valid in libpurple/protocols/{msn,msnp9}/slp.c. - CVE-2010-1624 * SECURITY UPDATE: denial of service via base64 decoding (LP: #666998) - debian/patches/94_security_CVE-2010-3711.patch: correctly handle purple_base64_decode return codes in libpurple/ntlm.c, libpurple/protocols/{jabber/auth.c,msn/slp.c,msnp9/slp.c, myspace/message.c,yahoo/yahoo.c}. - CVE-2010-3711	Marc Deslauriers	1:2.4.1-1ubuntu2.10	13 years ago
27	* SECURITY UPDATE: denial of service via malformed SLP messa... * SECURITY UPDATE: denial of service via malformed SLP message - debian/patches/94_security_CVE-2010-0277.patch: validate input in libpurple/protocols/msn/{slp.c,slpcall.c,slplink.c,slpmsg.h}. - CVE-2010-0277 * SECURITY UPDATE: denial of service via certain nicknames in Finch - debian/patches/94_security_CVE-2010-0420.patch: properly unescape text in finch/libgnt/gnttree.c, libpurple/protocols/bonjour/parser.c, libpurple/protocols/jabber/parser.c, libpurple/xmlnode.c. - CVE-2010-0420 * SECURITY UPDATE: denial of service via large number of smileys - debian/patches/94_security_CVE-2010-0423.patch: limit the number of smileys in pidgin/gtkimhtml.c. - CVE-2010-0423	Marc Deslauriers	1:2.4.1-1ubuntu2.9	14 years ago
26	* SECURITY UPDATE: denial of service via TOPIC message * SECURITY UPDATE: denial of service via TOPIC message - debian/patches/87_security_CVE-2009-2703.patch: validate args in libpurple/protocols/irc/msgs.c. - CVE-2009-2703 * SECURITY UPDATE: information disclosure via incorrect jabber TLS handling - debian/patches/88_security_CVE-2009-3026.patch: bail out if encryption is not available in libpurple/protocols/jabber/auth.c. - CVE-2009-3026 * SECURITY UPDATE: denial of service via malformed SLP invite message - debian/patches/89_security_CVE-2009-3083.patch: validate branch, content_type and content in libpurple/protocols/msn/slp.c and libpurple/protocols/msnp9/slp.c. - CVE-2009-3083 * SECURITY UPDATE: denial of service via crafted contact list data - debian/patches/90_security_CVE-2009-3615.patch: validate contact list structure in libpurple/protocols/oscar/oscar.c. - CVE-2009-3615 * SECURITY UPDATE: denial of service via specially formulated long filename (LP: #245769) - previous 72_SECURITY_CVE-2008-2955.patch patch was incomplete - debian/patches/91_security_CVE-2008-2955-2.patch: change src/protocols/msnp9/[slplink.c,slpcall.] to make sure xfer structure still exists before putting dest_fp in it. - CVE-2008-2955 SECURITY UPDATE: arbitrary code execution via crafted MSN message - previous 83_security_CVE-2009-1376.patch patch was incomplete - debian/patches/92_security_CVE-2009-1376-2.patch: switch offset variable to guint64 in libpurple/protocols/msnp9/slplink.c. - CVE-2009-1376 * Fix connection issue with MSN (LP: #494002) - debian/patches/93_msn_protocol8.patch: use protocol v8 in libpurple/protocols/msnp9/session.c, as it seems v9 isn't supported by msn anymore.	Marc Deslauriers	1:2.4.1-1ubuntu2.8	14 years ago
25	* SECURITY UPDATE: arbitrary code execution via crafted MSNS... * SECURITY UPDATE: arbitrary code execution via crafted MSNSLP packet (LP: #415863) - debian/patches/85_security_CVE-2009-2694.patch: properly destroy slpmsg in libpurple/protocols/{msn,msnp9}/slplink.c. - CVE-2009-2694	Marc Deslauriers	1:2.4.1-1ubuntu2.6	14 years ago
24	* SECURITY UPDATE: denial of service via ICQWebMessage messa... * SECURITY UPDATE: denial of service via ICQWebMessage message type in OSCAR protocol. (LP: #393736) - debian/patches/84_security_CVE-2009-1889.patch: make the check better in libpurple/protocols/oscar/oscar.c, only allocate memory if len is valid in libpurple/protocols/oscar/bstream.c. - CVE-2009-1889	Marc Deslauriers	1:2.4.1-1ubuntu2.5	14 years ago
23	* SECURITY UPDATE: denial of service or possible code execut... * SECURITY UPDATE: denial of service or possible code execution in XMPP file transfer - debian/patches/81_security_CVE-2009-1373.patch: calculate lengths correctly in libpurple/protocols/jabber/si.c. - CVE-2009-1373 * SECURITY UPDATE: denial of service in PurpleCircBuffer object expansion - debian/patches/82_security_CVE-2009-1375.patch: add an additional check in libpurple/circbuffer.c. - CVE-2009-1375 * SECURITY UPDATE: arbitrary code execution via crafted MSN message - debian/patches/83_security_CVE-2009-1376.patch: switch offset variable to guint64 in libpurple/protocols/msn/slplink.c. - CVE-2009-1376	Marc Deslauriers	1:2.4.1-1ubuntu2.4	15 years ago
22	* SECURITY UPDATE: code execution via integer overflow in th... * SECURITY UPDATE: code execution via integer overflow in the MSN protocol handler (LP: #245770) - debian/patches/71_SECURITY_CVE-2008-2927.patch: fix msn_slplink_process_msg() in src/protocols/msn/slplink.c and src/ protocols/msnp9/slplink.c by checking against maximum size G_MAXSIZE. - CVE-2008-2927 * SECURITY UPDATE: denial of service via specially formulated long filename (LP: #245769) - debian/patches/72_SECURITY_CVE-2008-2955.patch: change src/protocols/msn/[slplink.c,slpcall.] to make sure xfer structure still exists before putting dest_fp in it. - CVE-2008-2955 SECURITY UPDATE: denial of service via resource exhaustion from arbitrary URL in UPnP functionality (LP: #245769) - debian/patches/73_SECURITY_CVE-2008-2957.patch: modified libpurple/[upnp.c,util.] to add purple_util_fetch_url_request_len() in order to limit http downloads to 128k. - CVE-2008-2957 SECURITY UPDATE: man in the middle attack from lack of certificate validation in nss plugin (LP: #251304) - debian/patches/74_SECURITY_CVE-2008-3532.patch: modified libpurple/plugins/ssl/ssl-nss.c to add certificate validation code. - CVE-2008-3532	Marc Deslauriers	1:2.4.1-1ubuntu2.2	15 years ago
21	rebuild due to liblaunchpad-integration soname change rebuild due to liblaunchpad-integration soname change	Sebastien Bacher	1:2.4.1-1ubuntu2	16 years ago
20	* Sync with Debian, remaining Ubuntu changes; (LP: #211769) * Sync with Debian, remaining Ubuntu changes; (LP: #211769) - debian/control: + Set Maintainer to Ubuntu Core Developers. + Add build-deps on liblaunchpad-integration-dev, intltool, libnm-glib-dev (for --enable-nm) + Drop build-deps on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1) as this library is in universe. + Drop the libpurple0 recommends on libpurple-bin. + Add a gaim transitionnal package for upgrades. + Moved finch's libx11-6 dependency to Suggests - Ship compatibility symlinks via debian/gaim.links - debian/rules: + Pass --enable-nm to configure to enable NetworkManager support + Pass --disable-silc to configure to disable silc support even if it's installed in the build environment. + Add X-Ubuntu-Gettext-Domain to the desktop file and update the translation templates in common-install-impl::. + Added necessary arguments to dh_shlibdeps for finch - Update debian/prefs.xml to set the notify plugin prefs /plugins/gtk/X11/notify/* and set /pidgin/plugins/loaded to load the notify plugin - debian/patches: + 02_lpi for LP integration + 04_let_crasher_for_apport to stop catching the SIGSEGV signal and let apport handle it + 05_default_to_irc_ubuntu_com to set the default IRC server to irc.ubuntu.com. + 70_autoconf patch	Pedro Fragoso	1:2.4.1-1ubuntu1	16 years ago
19	* Moved finch's libx11-6 dependency to Suggests: (LP: #19571... * Moved finch's libx11-6 dependency to Suggests: (LP: #195718) - debian/rules: added necessary arguments to dh_shlibdeps - debian/control: added Suggests: ${shlibs:Suggests}	Adrien Cunin	1:2.4.0-1ubuntu2	16 years ago
18	* Sync with Debian, remaining Ubuntu changes; (LP: #201055) * Sync with Debian, remaining Ubuntu changes; (LP: #201055) - Set Maintainer to Ubuntu Core Developers. - Add build-deps on liblaunchpad-integration-dev, intltool, libnm-glib-dev (for --enable-nm) (Ubuntu #112720). - Drop build-deps on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1) as this library is in universe. - Drop the libpurple0 recommends on libpurple-bin. - Add a gaim transitionnal package for upgrades. - Ship compatibility symlinks via debian/gaim.links. - Pass --enable-nm to configure to enable NetworkManager support. - Pass --disable-silc to configure to disable silc support even if it's installed in the build environment. - Add X-Ubuntu-Gettext-Domain to the desktop file and update the translation templates in common-install-impl::. - Update debian/prefs.xml to set the notify plugin prefs - Update debian/prefs.xml to set the notify plugin prefs /plugins/gtk/X11/notify/* and set /pidgin/plugins/loaded to load the notify plugin - Add LPI integration patch, 02_lpi. - Add patch 04_let_crasher_for_apport to stop catching the SIGSEGV signal and let apport handle it. - Add patch 05_default_to_irc_ubuntu_com to set the default IRC server to irc.ubuntu.com. - Add autoconf patch, 70_autoconf.	Pedro Fragoso	1:2.4.0-1ubuntu1	16 years ago
17	* Sync with Debian, remaining Ubuntu changes; (LP: #177811) * Sync with Debian, remaining Ubuntu changes; (LP: #177811) - Set Maintainer to Ubuntu Core Developers. - Add build-deps on liblaunchpad-integration-dev, intltool, libnm-glib-dev (for --enable-nm) (Ubuntu #112720). - Drop build-deps on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1) as this library is in universe. - Drop the libpurple0 recommends on libpurple-bin. - Add a gaim transitionnal package for upgrades. - Ship compatibility symlinks via debian/gaim.links. - Pass --enable-nm to configure to enable NetworkManager support. - Pass --disable-silc to configure to disable silc support even if it's installed in the build environment. - Add X-Ubuntu-Gettext-Domain to the desktop file and update the translation templates in common-install-impl::. - Update debian/prefs.xml to set the notify plugin prefs /plugins/gtk/X11/notify/* and set /pidgin/plugins/loaded to load the notify plugin; Ubuntu: #13389. - Add LPI integration patch, 02_lpi. - Add patch 04_let_crasher_for_apport to stop catching the SIGSEGV signal and let apport handle it. - Add patch 05_default_to_irc_ubuntu_com to set the default IRC server to irc.ubuntu.com. - Add autoconf patch, 70_autoconf.	Pedro Fragoso	1:2.3.1-2ubuntu1	16 years ago
16	* Sync with Debian; remaining Ubuntu changes: * Sync with Debian; remaining Ubuntu changes: - Set Maintainer to Ubuntu Core Developers. - Add build-deps on liblaunchpad-integration-dev, intltool, libnm-glib-dev (for --enable-nm), libsqlite3-dev (Ubuntu #112720). - Drop build-deps on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1) as this library is in universe. - Change transition version from 2.1.1-2 to 1:2.1.1-2 in pidgin-dev.preinst, pidgin.preinst, and pidgin-dbg.preinst. - Change pidgin's conflicts and replaces against pidgin-data from 2.1.1-2 to 1:2.1.1-2. - Let pidgin-data replace gaim-data (<< 1:2.0.0+beta6-3). - Change finch, libpurple-bin, and libpurple0 conflicts and replaces against pidgin from 2.1.1-2 to 1:2.1.1-2. - Change libpurple-dev and finch-dev conflicts and replaces against pidgin-dev from 2.1.1-2 to 1:2.1.1-2. - Drop the libpurple0 recommends on libpurple-bin. - Add a gaim transitionnal package for upgrades. - Ship compatibility symlinks via debian/gaim.links. - Pass --enable-nm to configure to enable NetworkManager support. - Pass --disable-silc to configure to disable silc support even if it's installed in the build environment. - Don't remove the debian/copyright file on clean and generate one by manually running the sed snippet from common-install-impl::. - Add X-Ubuntu-Gettext-Domain to the desktop file and update the translation templates in common-install-impl::. - Drop debian/patches/14_xulrunner_nss.patch as libnss / libnspr are properly detected by the upstream configure already. - Update debian/prefs.xml to set the notify plugin prefs /plugins/gtk/X11/notify/* and set /pidgin/plugins/loaded to load the notify plugin; Ubuntu: #13389. - Add LPI integration patch, 02_lpi. - Add patch 04_let_crasher_for_apport to stop catching the SIGSEGV signal and let apport handle it. - Add patch 05_default_to_irc_ubuntu_com to set the default IRC server to irc.ubuntu.com. - Add autoconf patch, 70_autoconf.	Loic Minier	1:2.2.2-1ubuntu1	16 years ago
15	* debian/patches/80_from_upstream_fix_irc_formatting_issue.p... * debian/patches/80_from_upstream_fix_irc_formatting_issue.patch: - patch from upstream, fix an IRC formatting issue (LP: #141201)	Sebastien Bacher	1:2.2.1-1ubuntu4	16 years ago
14	* debian/control: * debian/control: - Build-Depends on libsqlite3-dev (LP: #112720)	Sebastien Bacher	1:2.2.1-1ubuntu3	16 years ago
13	* debian/prefs.xml: * debian/prefs.xml: - changes from "Whoopie", don't load docklet.so and use "pathlist" rather than "stringlist", fix plugins selections (LP: #144122)	Sebastien Bacher	1:2.2.1-1ubuntu2	16 years ago
12	Sync with Debian Sync with Debian	Sebastien Bacher	1:2.2.1-1ubuntu1	16 years ago
11	* Sync with Debian (LP: #139686) * Sync with Debian (LP: #139686) * debian/control: - Build-Depends on liblaunchpad-integration-dev, intltool, libnm-glib-dev - don't Build-Depends on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1), the library is in universe - changed the transition version to use the ubuntu epoch number - list gaim transitionnal package for updates - pidgin-data Replaces gaim-data - updated the maintainer for Ubuntu * debian/copyright: - build in the source, that's a soyuz requirement to accept the upload * debian/gaim.links: - gaim compatibility symlinks * debian/patches/01_lpi.patch: - launchpad integration patch. * debian/patches/02_autoconf.patch: - configure update * debian/patches/04_let_crasher_for_apport.patch: - don't catch crashes, apport does that. - fixes apport having broken backtraces for gaim * debian/patches/14_xulrunner_nss.patch: - removed for Ubuntu, firefox nss is used * debian/patches/99_default_to_irc_ubuntu_com.patch: - set default irc server to irc.ubuntu.com * debian/pidgin-dbg.preinst, debian/pidgin-dev.preinst, debian/pidgin.preinst: - use the correct transition version * debian/prefs.xml: - set the notify by default (Ubuntu: #13389) * debian/rules: - add translation domain and update template - build with network-manager and without libsilc - don't remove the copyright on clean	Sebastien Bacher	1:2.2.0-1ubuntu1	16 years ago
10	* debian/pidgin-dbg.preinst, debian/pidgin-dev.preinst, debi... * debian/pidgin-dbg.preinst, debian/pidgin-dev.preinst, debian/pidgin.preinst: - patch from Laurent Bigonville, use the correct transition version (LP: #135722)	Sebastien Bacher	1:2.1.1-2ubuntu2	16 years ago
9	* Sync with Debian * Sync with Debian * debian/control: - Build-Depends on liblaunchpad-integration-dev, intltool, libnm-glib-dev - don't Build-Depends on libsilc-1.1-2-dev \| libsilc-dev (>= 1.1.1), the library is in universe - changed the transition version to use the ubuntu epoch number - list gaim transitionnal package for updates - pidgin-data Replaces gaim-data - updated the maintainer for Ubuntu * debian/copyright: - build in the source, that's a soyuz requirement to accept the upload * debian/gaim.links: - transitionnal update package * debian/patches/01_lpi.patch: - launchpad integration patch. * debian/patches/02_autoconf.patch: - configure update * debian/patches/04_let_crasher_for_apport.patch: - don't catch crashes, apport does that. - fixes apport having broken backtraces for gaim * debian/patches/14_xulrunner_nss.patch: - removed for Ubuntu, firefox nss is used * debian/patches/99_default_to_irc_ubuntu_com.patch: - set default irc server to irc.ubuntu.com * debian/prefs.xml: - set the notify by default (Ubuntu: #13389) * debian/rules: - add translation domain and update template - build with network-manager and without libsilc - don't remove the copyright on clean	Sebastien Bacher	1:2.1.1-2ubuntu1	16 years ago

Older »