~ubuntu-branches/ubuntu/maverick/ruby1.8/maverick-security : changes

~ubuntu-branches/ubuntu/maverick/ruby1.8/maverick-security » Changes from revision 39

From Revision 39 to 20

Rev	Summary	Authors	Tags	Date
39	* SECURITY UPDATE: Cross-site scripting via HTTP error respo... * SECURITY UPDATE: Cross-site scripting via HTTP error responses - debian/patches/CVE-2010-0541.patch: Use the ISO-8859-1 character set for HTTP error responses. Based on upstream patch. - CVE-2010-0541 * SECURITY UPDATE: Arbitrary code execution and denial of service - debian/patches/CVE-2011-0188.patch: Remove cast to prevent memory corruption during allocation. Based on upstream patch. - CVE-2011-0188 * SECURITY UPDATE: Arbitrary file deletion due to symlink race - debian/patches/CVE-2011-1004.patch: Unlink the symlink rather than recursively removing everything underneath the symlink destination. Based on upstream patch. - CVE-2011-1004 * SECURITY UPDATE: Safe level bypass - debian/patches/CVE-2011-1005.patch: Remove incorrect string taint in exception handling methods. Based on upstream patch. - CVE-2011-1005 * SECURITY UPDATE: Predictable random number generation - debian/patches/CVE-2011-2686.patch: Reseed the random number generator each time a child process is created. Based on upstream patch. - CVE-2011-2686 * SECURITY UPDATE: Predicatable random number generation - debian/patches/CVE-2011-2705.patch: Reseed the random number generator with the pid number and the current time to prevent predictable random numbers in the case of pid number rollover. Based on upstream patch. - CVE-2011-2705 * SECURITY UPDATE: Denial of service via crafted hash table keys - debian/patches/CVE-2011-4815.patch: Add randomness to the key hashing algorithm to prevent predictable results when inserting objects into a hash table. Based on upstream patch. - CVE-2011-4815	Tyler Hicks	1.8.7.299-2ubuntu0.1	12 years ago
38	* Convert from dpatch to quilt using dpatch2quilt.sh * Convert from dpatch to quilt using dpatch2quilt.sh * Add patch 100730_disable_getsetcontext_on_nptl: disable getsetcontext on NPTL. LP: #307462, Closes: #579229 * Added 100730_verbose-tests.patch: run tests in verbose mode. * Run make test-all, but do not consider failures fatal for now. * Upgrade to Standards-Version: 3.9.1. No changes needed. * Deal with Ubuntu changing the GCC target to i686-linux-gnu: search for libs in i486-linux too. LP: #611322.	Lucas Nussbaum	1.8.7.299-2	13 years ago
37	* New upstream release * New upstream release * Removed patches that the upstrem has applied: - debian/patches/100312_timeout-fix.dpatch - debian/patches/100620_fix_pathname_warning.dpatch - debian/patches/100620_fix_super_called_outside_of_method.dpatch	Daigo Moriwaki	1.8.7.299-1	13 years ago
36	[ Lucas Nussbaum ] [ Lucas Nussbaum ] * Make ruby1.8 depend on exactly the same version of libruby1.8 after private discussion with Alex Legler. This avoids confusing situations for users. * Update debian/patches/100312_timeout-fix.dpatch after discussion with Petr Salinger. Treat FreeBSD the same as Linux. Closes: #580464 [ Daigo Moriwaki ] * Removed debian/patches/091125_gc_check.dpatch, which the upstream has applied. (Closes: #586374) * Added debian/patches/100620_fix_pathname_warning.dpatch, which was backported from the upstream r23485. (Closes: #566611) * Added debian/patches/100620_fix_super_called_outside_of_method.dpatch, which was backported from the upstream r26534:26536. (Closes: #568597)	Daigo Moriwaki	1.8.7.249-4	13 years ago
35	* Fix sections. Agree with ftpmasters. * Fix sections. Agree with ftpmasters. * Update debian/copyright. Clarify that Ruby is GPLv2, not just "GPL". * Merge lib{dbm,gdbm,readline,openssl}-ruby1.8 into libruby1.8. * Merge irb1.8 and rdoc1.8 into ruby1.8. * Update lintian override. * Update debian/copyright. * Upgrade to Standards-Version: 3.8.4. No changes needed. * Add README.source. * Fix not-binnmuable-all-depends-any lintian warning. * Add lintian override for package-name-doesnt-match-sonames. * Remove duplicate section/priority stanzas. * Fix a few minor problems in manpages.	Lucas Nussbaum	1.8.7.249-3	14 years ago
34	Add 100312_timeout-fix.dpatch: Backport upstream change to f... Add 100312_timeout-fix.dpatch: Backport upstream change to fix problem with threads and timeouts. Closes: #539987	Lucas Nussbaum	1.8.7.249-2	14 years ago
33	Move libreadline5-dev build dependency to libreadline-dev, t... Move libreadline5-dev build dependency to libreadline-dev, to build against libreadline6. (Debian #553843)	Martin Pitt	1.8.7.249-1ubuntu1	14 years ago
32	* New upstream release. * New upstream release. * The upstream has fixed a vulnerability in WEBrick, a part of Ruby's standard library. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator.	Daigo Moriwaki	1.8.7.249-1	14 years ago
31	Added debian/patches/091125_gc_check.dpatch: applied Bryan's... Added debian/patches/091125_gc_check.dpatch: applied Bryan's patch to fix garbage collector seg faults under race conditions. (upstream issue #2326) Thans to Bryan McLellan. (Closes: #557924)	Daigo Moriwaki	1.8.7.174-3	14 years ago
30	[ akira yamada ] [ akira yamada ] * Added debian/patches/090811_thread_and_select.dpatch: threads may hangup when IO.select called from two or more threads. * Added debian/patches/090812_finalizer_at_exit.dpatch: finalizers should be run at exit (Closes: #534241) * Added debian/patches/090812_class_clone_segv.dpatch: avoid segv when an object cloned. (Closes: #533329) * Added debian/patches/090812_eval_long_exp_segv.dpatch: fix segv when eval a long expression. (Closes: #510561) * Added debian/patches/090812_openssl_x509_warning.dpatch: suppress warning from OpenSSL::X509::ExtensionFactory. (Closes: #489443) [ Lucas Nussbaum ] * Removed Fumitoshi UKAI <ukai@debian.or.jp> from Uploaders. Thanks a lot for the past help! Closes: #541037 [ Daigo Moriwaki ] * debian/fixshebang.sh: skip non-text files, which works around hanging of sed on scanning gif images. * Bumped up Standards-Version to 3.8.2.	Daigo Moriwaki		14 years ago
29	New upstream release. New upstream release.	Daigo Moriwaki		14 years ago
28	[ akira yamada ] [ akira yamada ] * Added debian/patches/090811_thread_and_select.dpatch: threads may hangup when IO.select called from two or more threads. * Added debian/patches/090812_finalizer_at_exit.dpatch: finalizers should be run at exit (Closes: #534241) * Added debian/patches/090812_class_clone_segv.dpatch: avoid segv when an object cloned. (Closes: #533329) * Added debian/patches/090812_eval_long_exp_segv.dpatch: fix segv when eval a long expression. (Closes: #510561) * Added debian/patches/090812_openssl_x509_warning.dpatch: suppress warning from OpenSSL::X509::ExtensionFactory. (Closes: #489443) [ Lucas Nussbaum ] * Removed Fumitoshi UKAI <ukai@debian.or.jp> from Uploaders. Thanks a lot for the past help! Closes: #541037 [ Daigo Moriwaki ] * debian/fixshebang.sh: skip non-text files, which works around hanging of sed on scanning gif images. * Bumped up Standards-Version to 3.8.2.	Daigo Moriwaki	1.8.7.174-2	14 years ago
27	New upstream release. New upstream release.	Daigo Moriwaki	1.8.7.174-1	14 years ago
26	* New upstream release. * New upstream release. * removed unnecessary patchs under debian/patches: - 168_rexml_dos.dpatch - 801_update_sample_README - 807_sync_try_lock_always_fail.dpatch - 905_class_dup_should_copy_constants.dpatch - 090301_r22646_OCSP_basic_verify.dpatch * Added a patch: debian/patches/090613_exclude_rdoc.dpatch * Added debian/libopenssl-ruby1.8.lintian-overrides * The upstream has fixed the DoS vulnerability in BigDecimal Ruby Library (CVE-2009-1904; Closes: #532689) * debian/control: - Bumped up Standards-Version to 3.8.1. - Corrected sections.	Daigo Moriwaki	1.8.7.173-1	14 years ago
25	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Add upstream patch to properly check return values of the OCSP_basic_verify function (CVE-2009-0642; Closes: #522939,#517639)	Nico Golde	1.8.7.72-3.1	15 years ago
24	* applied debian/patches/905_class_dup_should_copy_constants... * applied debian/patches/905_class_dup_should_copy_constants.dpatch: - Class#dup should copy constants into the duplicated class. (closes: #506344)	akira yamada	1.8.7.72-3	15 years ago
23	debian/patches/905_short_named_constants.dpatch: Fix for sho... debian/patches/905_short_named_constants.dpatch: Fix for short-named constants regression (LP: #282302)	Jamie Strandboge	1.8.7.72-1ubuntu1	15 years ago
22	* New upstream release. * New upstream release. - many patches in 1.8.7.22-4 were simply backported from upstream SVN, and are integrated into that release. We drop those: + 103_array_c_r17472_to_r17756.dpatch + 810_ruby187p22_fixes.dpatch + 811_multiple_vuln_200808.dpatch - Fixes the following security issues: (Closes: #494401) * Several vulnerabilities in safe level * DoS vulnerability in WEBrick * Lack of taintness check in dl * DNS spoofing vulnerability in resolv.rb (CVE-2008-1447) * Applied debian/patches/168_rexml_dos.dpatch: Fix CVE-2008-3790 (REXML expansion DOS). Closes: #496808.	Lucas Nussbaum	1.8.7.72-1	15 years ago
21	* New upstream release. * New upstream release. * Fixed vulnerability: arbitrary code execution vulnerability and so on (Closes: #487238)	Daigo Moriwaki	1.8.7.22-1	15 years ago
20	* New upstream release. * New upstream release. * removed patches that the upstream has included: - debian/patches/201_erb_187_release.dpatch - debian/patches/202_delegate_187_release.dpatch - debian/patches/203_openssl_ctx_r187_release.dpatch * debian/watch: it will report 1.8.\d-p\d* versions.	Daigo Moriwaki	1.8.7.17-1	15 years ago

Older »