~ubuntu-branches/ubuntu/maverick/proftpd-dfsg/maverick-security : changes

~ubuntu-branches/ubuntu/maverick/proftpd-dfsg/maverick-security » Changes from revision 34

From Revision 34 to 15

Rev	Summary	Authors	Tags	Date
34	* SECURITY UPDATE: Telnet IAC processing stack overflow. * SECURITY UPDATE: Telnet IAC processing stack overflow. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability. (LP: #674646) - debian/patches/3521.patch: adjust src/netio.c to check buflen properly. - http://bugs.proftpd.org/attachment.cgi?id=3521 - CVE-2010-4221 * SECURITY UPDATE: Inappropriate directory traversal allowed by mod_site_misc. This vulnerability can be used to: - create a directory located outside the writable directory - delete a directory located outside the writable directory - create a symlink located outside the writable directory - change the time of a file located outside the writable directory. (LP: #674798) - debian/patches/CVE_2010_3867.dpatch: based on debian 3519.dpatch backported to v1.3.2 - http://bugs.proftpd.org/attachment.cgi?id=3519 - CVE-2010-3867 * Thanks to Neil Wilson <neil@aldur.co.uk> for backporting patches	Steve Beattie	1.3.2e-4ubuntu0.1	13 years ago
33	Fixed inetd_check() in init file. Thanks Mats Erik Andersson... Fixed inetd_check() in init file. Thanks Mats Erik Andersson. (closes: #554029)	Francesco Paolo Love...	1.3.2e-4	14 years ago
32	* New upstream release, with fix of CVE-2009-3736 due to upd... * New upstream release, with fix of CVE-2009-3736 due to update of the embedded liblt with a backported fix. (closes: #553406, #555862, #559842) Merged patches: 3324, 3328. * Added a note about AllowClientRenegotiations option for TLS protocols in NEWS and a commented directive in tls.conf subfile. (closes: #558597)	Francesco Paolo Love...	1.3.2c-1	14 years ago
31	* Now copy original config.* stuff and restore at cleaning t... * Now copy original config.* stuff and restore at cleaning time. This makes lintian happy. * Added security patch 3324.dpatch to manage SSL/TLS renegotiation. This is related to recently discovered protocol defection which could render it attackable. See also CVE-2009-3555. * Added 3328.dpatch patch to manage a possible end-less loop in mod_quotatab_sql.	Francesco Paolo Love...	1.3.2b-2	14 years ago
30	New upstream release. New upstream release. Merged patches: 3282, 3284 and 3275. Note that 3275 solved CVE-2009-3639.	Francesco Paolo Love...	1.3.2b-1	14 years ago
29	* Added TLSOptions EnableDiags in tls.conf templates, as a u... * Added TLSOptions EnableDiags in tls.conf templates, as a useful option to be much more verbose. * Added a proftpd-substvars snippet in proftpd-dev package. It should be used for providing build-time substvars for third-parties packages. The snippet should be added to local substvars and provides ${proftpd:Depends} substvar. * Moved to libmysqlclient-dev build-dep for MySQL 5.1 transition and recent ack aba NMU. (closes: #542905) * Policy bumped to 3.8.3. * Removed /var/run/proftpd among proftpd-basic.dirs/install, it is anyway created in the init script since long time. This fixes the dir-or-file-in-var-run in lintian. * Long due fix to POTFILES.in due to proftpd -> proftpd-basic change in binary package name. Fixed lintian warn. * Fixed debian-rules-calls-debhelper-in-odd-order lintian warn. * Fixed debhelper-but-no-misc-depends lintian warn. * Added a long due README.source file, which also fixes patch-system-but-no-source-readme lintian warning. * Set -e in prerm script. Fixes maintainer-script-ignores-errors lintian warn. * Added Old Changelog: token to avoid historical warns by lintian on old entries of debian/changelog. * Fixed exit codes for status action in init script. (closes: #527879) * The -dev package no more install libtool .la files. * [PATCH] Added 3275.dpatch to fix NULs management in TLS cert validation. If reverse DNS resolution is off, OR if client certs are not being verified, OR if the DNS name in the client cert is not required, then the bug does not occur. * [PATCH] Added 3282.dpatch to uncache first user in mod_sql when SQLNegativeCache is on. * [PATCH] Added 3284.dpatch to fix TCP_NODELAY misuse in inet.c core file. It negatively impacts >= 1.3.1 versions.	Francesco Paolo Love...	1.3.2a-2	14 years ago
28	* Added proftpd-mod-sqlite and proftpd-mod-odbc to Suggests ... * Added proftpd-mod-sqlite and proftpd-mod-odbc to Suggests in debian/control. * Removed LIBS prefixed at configuration time in debian/rules and still around after odbc.patch. My oversight... (closes: #519029) * [PATCH] Added 3204.dpatch to provide a better prxs to third-parties module. It properly manage DESTDIR and module $Libraries$. And also provides --help :) * Removed 3188.dpatch because obsoleted by 3204.dpatch.	Francesco Paolo Love...	1.3.2-3	15 years ago
27	* Merge from debian unstable, remaining changes (LP: #329167... * Merge from debian unstable, remaining changes (LP: #329167): - mod_rewrite.c.dpatch: Added S_IRUSR\|S_IWUSR to build with the new Compiler Flags	Nick Ellery	1.3.1-17ubuntu1	15 years ago
26	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - mod_rewrite.c.dpatch: Added S_IRUSR\|S_IWUSR to build with the new Compiler Flags	Nicolas Valcárcel	1.3.1-16ubuntu1	15 years ago
25	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - mod_rewrite.c.dpatch: Added S_IRUSR\|S_IWUSR to build with the new Compiler Flags	Nicolas Valcárcel	1.3.1-15ubuntu1	15 years ago
24	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - mod_rewrite.c.dpatch: Added S_IRUSR\|S_IWUSR to build with the new Compiler Flags	Nicolas Valcárcel	1.3.1-12ubuntu1	15 years ago
23	* mod_rewrite.c.dpatch: (LP: #248034) * mod_rewrite.c.dpatch: (LP: #248034) - Added S_IRUSR\|S_IWUSR to build with the new Compiler Flags (https://wiki.ubuntu.com/CompilerFlags) * Modify Maintainer value to match the DebianMaintainerField specification.	Nicolas Valcárcel	1.3.1-11ubuntu1	15 years ago
22	* [PATCH] mod_dynmasq.dpatch * [PATCH] mod_dynmasq.dpatch Added contributed module mod_dynmasq and modified a bit templates for supporting it. (closes: #354059) * Removing currently superfluous static and libtool files in usr/lib/proftpd. * Fixed typo in dh_shlibdeps call in debian/rules.	Francesco Paolo Love...	1.3.1-11	15 years ago
21	* Commented better tls.conf templates in order to simplify S... * Commented better tls.conf templates in order to simplify SSL/TTL certs generation for users. Changed /etc/ssl/{private/certs} paths used for coherence. * Added a /usr/sbin/proftpd-gencert utility to generate or re-create a self-signed SSL/TLS certificate. This is inspired to the exim4 sample script and useful for lazy people. * Added openssl as suggested package. It is required in order to run proftpd-gencert. * Now set IdentLookups off in default proftpd.conf.	Francesco Paolo Love...	1.3.1-10	16 years ago
20	* Removed bashisms in debian/rules and revised file names re... * Removed bashisms in debian/rules and revised file names removed. (closes: #478617) * [PATCH] mod_cap.dpatch. Removed obsolete embedded sys/capability.h header inclusion in mod_cap.c modules. Also it avoids building of the obsolete embedded libpcap. (closes: #479893)	Francesco Paolo Love...	1.3.1-9	16 years ago
19	* Merge from debian unstable. (LP: #193429) remaining change... * Merge from debian unstable. (LP: #193429) remaining changes: - Re-add transitional packages, to allow an upgrade from Dapper. - Update maintainer field as per spec.	Stefan Ebner	1.3.1-6ubuntu1	16 years ago
18	Rebuild for the libldap-2.3-0 -> libldap-2.4-2 transistion. Rebuild for the libldap-2.3-0 -> libldap-2.4-2 transistion.	Steve Kowalik	1.3.1-2ubuntu2	16 years ago
17	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Re-add transitional packages, to allow an upgrade from Dapper. - Update maintainer field as per spec. * Update FSF address. * Fix some lintian warnings. * Moved compat setting to debian/compat. * Compile mod_lang statically,. IT does not work as a dynamically loadable module.	Luke Yelavich	1.3.1-2ubuntu1	16 years ago
16	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Use RequireValidShell in /etc/proftpd/proftpd.conf - Re-add transitional packages, to allow an upgrade from Dapper. - Update maintainer field in debian/control	Luke Yelavich	1.3.0-24ubuntu1	16 years ago
15	Re-add transitional packages, to allow an upgrade from Dappe... Re-add transitional packages, to allow an upgrade from Dapper.	Luke Yelavich	1.3.0-23ubuntu2	17 years ago

Older »