~ubuntu-branches/ubuntu/intrepid/awstats/intrepid-security : changes

~ubuntu-branches/ubuntu/intrepid/awstats/intrepid-security » Changes from revision 18

From Revision 18

Rev	Summary	Authors	Tags	Date
18	* SECURITY UPDATE: XSS via quotes in the "config" parameter ... * SECURITY UPDATE: XSS via quotes in the "config" parameter (CVE-2008-3714). - 1006_quote_xss.patch: upstream fixes, thanks to Florian Weimer.	Kees Cook	6.7.dfsg-5ubuntu0.1	15 years ago
17	Add debian/patches/0001_awstats69beta_xss.patch, Add debian/patches/0001_awstats69beta_xss.patch, upstream security fix from 6.9 beta to fix XSS. (Closes: #495432, upstream bug 2001151)	Andreas Henriksson	6.7.dfsg-5	15 years ago
16	* Update local cdbs snippets: * Update local cdbs snippets: + Relax copyright-check to only warn about its discoveries. + Update dependency cleanup to strip cdbs 0.4.27 (not 0.4.27-1).	Jonas Smedegaard	6.7.dfsg-4	15 years ago
15	[ Andreas Henriksson ] [ Andreas Henriksson ] * Add debian/patches/1005_at-amp-t.patch (Closes: #478968) * Add myself to Uploaders. * Fix lintian warnings: + doc-base: Apps/Net -> Network/Monitoring * Bump to debian-policy 3.7.3 [ Charles Fry ] * Disable warnings for Perl < 5.6 (Closes: #432096, #440035) [ Jonas Smedegaard ] * Move Homepage to own field (from pseudo-field in long description). * Use Vcs-* fields (and not XS-Vcs-* ones). * Update cdbs tweaks: + update-tarball needs cdbs 0.4.39 or newer (only relevant for backports). + Support zip in upstream-tarball.mk (unneeded here). + Use ~ as repackaging delimiter by default in upstream-tarball.mk to make room for point releases and cleaned up rerelease. + Rename top srcdir in repackaged tarball to $pkg-$ver.orig to comply with Developers Reference 6.7.8.2. + Support mangling upstream version string in upstream-tarball.mk. + Major rewrite of copyright-check.mk. Update copyright_hints. + Drop wget options broken with recent versions of wget in update-tarball.mk. + Drop buildcore.mk override (set DEB_AUTO_UPDATE_DEBIAN_CONTROL manually when needed instead) + Misc. updates to README.cdbs-tweaks. * Rewrite config tweak in debian/rules in perl (instead of sed). * Fix dollar signs in perl-in-shell-in-make code in debian/rules. * Update build-dependency cosmetics in debian/rules, and semi-auto- update debian/control: DEB_AUTO_UPDATE_DEBIAN_CONTROL=yes fakeroot debian/rules	Andreas Henriksson	6.7.dfsg-2	15 years ago
14	* Non-maintainer upload during * Non-maintainer upload during credativ BSP 2008 * Fix release goal: FTBFS if build twice in a row (Closes: #442500)	Martin Zobel-Helas	6.7.dfsg-1.1	16 years ago
13	* New upstream release. Closes: bug#436572, thanks to Daniel... * New upstream release. Closes: bug#436572, thanks to Daniel Baumann. * Add XS-Vcs-Svn and XS-Vcs-Browser fields to debian/control. * Fix standards-version in debian/control.in. * Update CDBS tweaks: + Replace auto-update.mk with overloading buildcore.mk. + Check copyright strings in pre-build target (not clean target) to fix race condition. + Add upstream-tarball.mk to implement get-orig-source target. + Fix applying buildinfo only once. + Add debian/README.cdbs-tweaks and advertise it in debian/rules. * Declare (and merge duplicate) build-dependencies in debian/rules. Declare all as Build-Depends (not Build-depends-Indep). * Semi-auto-update debian/control: DEB_BUILD_OPTIONS=cdbs-autoupdate fakeroot debian/rules pre-build * Update debian/copyright: + Include both copyright and licensing info verbatim. + Update to include the year 2007. + Refer explicitly to GPLv2.	Jonas Smedegaard	6.7.dfsg-1	16 years ago
12	New upstream release (Closes: #350987, #335865) New upstream release (Closes: #350987, #335865)	Charles Fry	6.6+dfsg-1	17 years ago
11	Add 'debian/patches/1005_logresolve-dates.patch': correct lo... Add 'debian/patches/1005_logresolve-dates.patch': correct log parsing, fixed in upstream 6.6 (Closes LP#51902).	Kees Cook	6.5+dfsg-1ubuntu3	17 years ago
10	debian/rules: fix CRLF encodings in examples tools (Closes L... debian/rules: fix CRLF encodings in examples tools (Closes LP#52085), fixed in upstream awstats 6.6 already.	Kees Cook	6.5+dfsg-1ubuntu2	17 years ago
9	* Merge from debian unstable. Remaining changes: * Merge from debian unstable. Remaining changes: - fix for CVE-2006-3682	Michael Vogt	6.5+dfsg-1ubuntu1	17 years ago
8	* SECURITY UPDATE: Fix path exposure on error. * SECURITY UPDATE: Fix path exposure on error. * Add 'debian/patches/1004_backport_6.6_xss-fixes.patch' to correct URL decoding and adjust error message reports. Backported from upstream. * References CVE-2006-3682 http://awstats.cvs.sourceforge.net/awstats/awstats/wwwroot/cgi-bin/awstats.pl?r1=1.867&r2=1.871	Kees Cook	6.5-2ubuntu1	17 years ago
7	[ Charles Fry ] [ Charles Fry ] * Require AWSTATS_ENABLE_CONFIG_DIR environmental variable in order to enable configdir. Closes: #365910 (thanks to Hendrik Weimer <hendrik@enyo.de>) * Integrated security patches from upstream: + Decode QueryString. Closes: #364443 (thanks to Micah Anderson <micah@debian.org>) + Sanitize migrate parameter. Closes: #365909 (thanks to Hendrik Weimer <hendrik@enyo.de>) * Indent Homepage in long description, per debian reference guideline [ Jonas Smedegaard ] * Update local cdbs snippet copyright-check.mk: + Broaden scan to also look for "(c)" by default. + Make egrep options configurable. * Semi-auto-update debian/control: + Bump up versioned build-dependency on debhelper. * Semi-auto-update debian/copyright_hints (nothing remarkable). * Set urgency=high as this upload fixes security-related bugs (bug#365909: CVE-2006-2237). * Fix including a couple of example shell scripts ignored by mistake.	Jonas Smedegaard	6.5-2	18 years ago
6	* SECURITY UPDATE: Cross-site scripting. * SECURITY UPDATE: Cross-site scripting. * debian/patches/1001_sanitize_more.patch: - Use the Sanitize function to filter out arbitrary HTML from 'diricons' parameter (analoguous to CVE-2006-1945, which is already fixed in this version). - Sanitize MigrateStats parameter (XSS if statistics updates are enabled). [CVE-2006-2237] - Patch from upstream CVS, taken from Debian's 6.5-2 version.	Martin Pitt	6.5-1ubuntu1	18 years ago
5	[ Jonas Smedegaard ] [ Jonas Smedegaard ] * New upstream release. + Recognizes GNUTLS from lynx User-Agent header. Closes: #306130 (thanks to Dmitry Baryshkov <mitya@school.ioffe.ru>). + Geoip shows countries for resolved hostnames. Closes: #317310 (thanks to Administrator <azhrarn@underhanded.org>). * Simplify watch file to better work with parser used at qa.d.o. * Improve cdbs rules: + Use quilt (rather than cdbs-internal patch system). + Add and enable new local snippets copyright-check and auto-update. + Update local snippet buildinfo (fixing its namespace). * Auto-update debian/control: + Tightened build-dependency on cdbs. + Added build-dependencies on patchutils and quilt. * Package is now team-maintained: + New maintainer: Debian AWStats Team <pkg-awstats-devel@lists.alioth.debian.org>. + Add myself as uploader. [ Charles Fry ] * Use qa.debian.org SF redirector in watch file. * Use Homepage instead of Website in debian/control, per DDR 6.2.4. * Removed patches integrated upstream	Jonas Smedegaard	6.5-1	18 years ago
4	[ Charles Fry ] [ Charles Fry ] * New co-maintainer. * Suggest libgeo-ipfree-perl. Closes: #316126 (thanks to Gunnar Wolf <gwolf@gwolf.org>). * Fixed README.Debian path to configure.pl. Closes: #313093 (thanks to Michael De Nil <michael@flex-it.be>). [ Jonas Smedegaard ] * Acknowledge NMU. Closes: bug#322591. * Bump up watch version, and adjust the default command (we have moved to SubVerSion). * Add proto to URL in long description. * User newer chown syntax in postinst (thanks to lintian).	Jonas Smedegaard	6.4-2	18 years ago
3	* New upstream release. Closes: bug#293702, #293668 (thanks ... * New upstream release. Closes: bug#293702, #293668 (thanks to Nelson A. de Oliveira <naoliv@biolinux.df.ibilce.unesp.br>). + Includes upstream fix for security bug fixed in 6.2-1.1. + Includes upstream fix for most of security bug fixed in 6.2-1.1. * Acknowledge NMUs. Closes: bug#291064, #294488 (thanks to Martin Schulze <joey@infodrom.org>, Martin Pitt <mpitt@debian.org>, Ubuntu, Joey Hess <joeyh@debian.org>, Frank Lichtenheld <djpig@debian.org> and Steve Langasek <vorlon@debian.org>). * Include patch for last parts of security bug fixed in 6.2-1.1: 01_sanitize_more.patch. * Patch (02) to include snapshot of recent development: + Fix security hole that allowed a user to read log file content even when plugin rawlog was not enabled. + Fix a possible use of AWStats for a DoS attack. + configdir option was broken on windows servers. + DebugMessages is by default set to 0 for security reasons. + Minor fixes. * References: CAN-2005-0435 - read server logs via loadplugin and pluginmode CAN-2005-0436 - code injection via PluginMode CAN-2005-0437 - directory traversal via loadplugin CAN-2005-0438 - information leak via debug	Jonas Smedegaard	6.3-1	19 years ago
2	Really fix bug#247265. Really closes: Bug#247265 (thanks to ... Really fix bug#247265. Really closes: Bug#247265 (thanks to Edward J. Shornock <ed@crazeecanuck.homelinux.net>).	Jonas Smedegaard	6.0-4	20 years ago
1	Import upstream version 6.0 Import upstream version 6.0	Jonas Smedegaard	upstream-6.0	20 years ago