~ubuntu-branches/ubuntu/maverick/tomcat6/maverick-proposed : changes

~ubuntu-branches/ubuntu/maverick/tomcat6/maverick-proposed » Changes from revision 28

From Revision 28 to 9

Rev	Summary	Authors	Tags	Date
28	* SECURITY UPDATE: denial of service via hash collision and ... * SECURITY UPDATE: denial of service via hash collision and incorrect handling of large numbers of parameters and parameter values (LP: #909828) - debian/patches/0019-CVE-2012-0022.patch: refactor parameter handling code in conf/web.xml, java/org/apache/catalina/connector/Connector.java, java/org/apache/catalina/connector/mbeans-descriptors.xml, java/org/apache/catalina/connector/Request.java, java/org/apache/catalina/filters/FailedRequestFilter.java, java/org/apache/catalina/Globals.java, java/org/apache/coyote/Request.java, java/org/apache/tomcat/util/buf/B2CConverter.java, java/org/apache/tomcat/util/buf/ByteChunk.java, java/org/apache/tomcat/util/buf/MessageBytes.java, java/org/apache/tomcat/util/buf/StringCache.java, java/org/apache/tomcat/util/http/LocalStrings.properties, java/org/apache/tomcat/util/http/Parameters.java, webapps/docs/config/ajp.xml, webapps/docs/config/http.xml. - CVE-2011-4858 - CVE-2012-0022	Marc Deslauriers	6.0.28-2ubuntu1.6	12 years ago
27	* Fix update failures when JAVA_OPTS contains / (LP: #654549... * Fix update failures when JAVA_OPTS contains / (LP: #654549) - debian/tomcat6.postinst: amended sed calls to use % instead of / when generating /etc/default/tomcat6.	James Page	6.0.28-2ubuntu1.3	13 years ago
26	* SECURITY UPDATE: directory traversal via incorrect ServetC... * SECURITY UPDATE: directory traversal via incorrect ServetContext attribute (LP: #717396) - debian/patches/0012-CVE-2010-3718.patch: mark as read only in java/org/apache/catalina/core/StandardContext.java. - CVE-2010-3718 * SECURITY UPDATE: cross-site scripting in HTML Manager interface - debian/patches/0013-CVE-2011-0013.patch: properly filter values in java/org/apache/catalina/manager/{HTMLManagerServlet.java, StatusTransformer.java}. - CVE-2011-0013 * SECURITY UPDATE: denial of service via NIOS HTTP connector (LP: #714239, LP: #717396) - debian/patches/0014-CVE-2011-0534.patch: enforce proper size in java/org/apache/coyote/http11/InternalNioInputBuffer.java. - CVE-2011-0534	Marc Deslauriers	6.0.28-2ubuntu1.2	13 years ago
25	* SECURITY UPDATE: cross-site scripting in Manager applicati... * SECURITY UPDATE: cross-site scripting in Manager application - debian/patches/0011-CVE-2010-4172.patch: add proper escaping to java/org/apache/catalina/manager/JspHelper.java, webapps/manager/WEB-INF/jsp/{sessionDetail,sessionsList}.jsp. - patch from Debian 6.0.28-9 package - CVE-2010-4172	Marc Deslauriers	6.0.28-2ubuntu1.1	13 years ago
24	Check for group existence to avoid postinst failure (LP: #61... Check for group existence to avoid postinst failure (LP: #611721)	Thierry Carrez (ttx)	6.0.28-2ubuntu1	13 years ago
23	* Add debconf questions for user, group and Java options. * Add debconf questions for user, group and Java options. * Use ucf to install /etc/default/tomcat6 from a template * Drop CATALINA_BASE and CATALINA_HOME from /etc/default/tomcat6 since we shouldn't encourage users to change those anyway	Thierry Carrez	6.0.28-2	13 years ago
22	* Convert patches to dep3 format. * Convert patches to dep3 format. * Backport security fix from trunk to fix CVE-2010-1157. (Closes: #587447) * Set urgency to medium due to the security fix.	Torsten Werner	6.0.26-5	13 years ago
21	[ Marcus Better ] [ Marcus Better ] * Apply upstream fix for deadlock in WebappClassLoader. (Closes: #583896) [ Thierry Carrez ] * debian/tomcat6.{install,postinst}: Do not store the default root webapp in /usr/share/tomcat6/webapps as it increases confusion on what this directory contains (and its relation with /var/lib/tomcat6/webapps). Store it inside /usr/share/tomcat6-root instead (LP: #575303).	Marcus Better	6.0.26-3	13 years ago
20	* debian/tomcat6.{postinst,prerm}: Respect TOMCAT6_USER and ... * debian/tomcat6.{postinst,prerm}: Respect TOMCAT6_USER and TOMCAT6_GROUP as defined in /etc/default/tomcat6 when setting directory permissions and authbind configuration (Closes: #581018, LP: #557300) * debian/tomcat6.postinst: Use group "tomcat6" instead of "adm" for permissions in /var/lib/tomcat6, so that group "adm" doesn't get write permissions over /var/lib/tomcat6/webapps (LP: #569118)	Thierry Carrez	6.0.26-2	13 years ago
19	[ Thierry Carrez ] [ Thierry Carrez ] * Uploading what 6.0.24-5 should be (upload is blocked in Debian due to current infrastructure issues), in order to meet Beta2Freeze. [ Niels Thykier ] * Added optimised garbage collection options to tomcat6's default options. Thanks to Aaron J. Zirbes and Thierry Carrez for research and the patch. (Closes: LP: #541520) * Updated the changelog to mention closed CVE's in the 6.0.24-1 release. * Applied patch from Arto Jantunen fixing an issue with cleaning up the pid-file. (Closes: #574084) [ Ludovic Claude ] * debian/tomcat6.postrm: fix removal of Tomcat (Closes: #567548) * Set UTF-8 as default character encoding - Patch by Thomas Koch (Closes: #573539) * Set the major, minor and build versions when calling Ant (Closes: LP: #495505) * Rebuild with a more recent version of maven-repo-helper which puts the javax jars at the correct location in the Maven repository. Fixes several FTBFS in other packages.	Thierry Carrez	6.0.24-2ubuntu1	14 years ago
18	* Fix missing symlinks to tomcat-coyote.jar and * Fix missing symlinks to tomcat-coyote.jar and catalina-tribes.jar causing NoClassDefFoundException at startup (last minute packaging change, sorry) (Closes: #570220) * tomcat6-admin, tomcat6-examples and tomcat6-docs now depend on tomcat6-common instead of tomcat6, this allow users to install those packages without requiring tomcat6 and its automatic startup scripts being present. tomcat-users can be installed instead and allow full control over when Tomcat is started or stopped.	Ludovic Claude	6.0.24-2	14 years ago
17	[ Ludovic Claude ] [ Ludovic Claude ] * New upstream version * Update the POM files for the new version of Tomcat * Bump up Standards-Version to 3.8.4 * Refresh patches deploy-webapps-build-xml.patch and var_loaders.patch * Remove patch fix_context_name.patch as it has been applied upstream * Fix the installation of servlet-api-2.5.jar: the jar goes to /usr/share/java as in older versions (6.0.20-2) and links to the jar are added to /usr/share/maven-repo * Moved NEWS.Debian into README.Debian * Add a link from /usr/share/doc/tomcat6-common/README.Debian to /usr/share/doc/tomcat6/README.Debian to include a minimum of documentation in the tomcat6 package and add some useful notes. (Closes: #563937, #563939) * Remove poms from the Debian packaging, use upstream pom files [ Jason Brittain ] * Fixed a bug in the init script: When a start fails, the PID file was being left in place. Now the init script makes sure it is deleted. * Fixed a packaging bug that results in the ROOT webapp not being properly installed after an uninstall, then a reinstall. * control: Corrected a couple of comments (no functional change).	Ludovic Claude	6.0.24-1	14 years ago
16	* Fix debian/orig-tar.sh to exclude binary only standard.jar... * Fix debian/orig-tar.sh to exclude binary only standard.jar and jstl.jar. (Closes: #528119) * Upload a cleaned tarball. * Add ${misc:Depends} in debian/control.	Torsten Werner	6.0.20-dfsg1-1	14 years ago
15	* Fix spelling issues. * Fix spelling issues. * Always set JSVC_CLASSPATH to a default value in init.	Niels Thykier	6.0.20-9	14 years ago
14	* Merge from Debian unstable. Remaining changes: * Merge from Debian unstable. Remaining changes: - debian/control, debian/rules: Do not use 3.0 (quilt) source format yet * debian/tomcat6.default: Fix typos in "JSVC" and "remote", missing newline * debian/tomcat6.default, debian/tomcat6.init: Handle JSVC_CLASSPATH default value the same way as other defaults	Thierry Carrez	6.0.20-8ubuntu1	14 years ago
13	* Add maven POM's for libservlet2.5-java. LP: #454822. * Add maven POM's for libservlet2.5-java. LP: #454822. * debian/policy/02debian.policy: grant access to /usr/share/maven-repo/ as it is a valid source of Debian JARs.	Matthias Klose	6.0.20-2ubuntu2	14 years ago
12	* Merge from debian unstable (LP: #391018); remaining change... * Merge from debian unstable (LP: #391018); remaining changes: - debian/control, debian/rules: Use default-jdk to build - debian/control: Run using default-jre-headless by default	Iulian Udrea	6.0.20-2ubuntu1	14 years ago
11	[ Iulian Udrea ] [ Iulian Udrea ] * Merge from debian unstable (LP: #385262), remaining changes: - debian/control, debian/rules: Use default-jdk to build - debian/control: Run using default-jre-headless by default	Mathias Gug	6.0.20-1ubuntu1	14 years ago
10	* Merge from debian unstable (LP: #371728), remaining change... * Merge from debian unstable (LP: #371728), remaining changes: - debian/control, debian/rules: Use default-jdk to build - debian/control: Run using default-jre-headless by default - debian/patches/tcnative-ipv6-fix-43327.patch to fix incompatibility between libtcnative-1 and ipv6	Thierry Carrez	6.0.18-3ubuntu1	14 years ago
9	* Added debian/patches/tcnative-ipv6-fix-43327.patch to fix ... * Added debian/patches/tcnative-ipv6-fix-43327.patch to fix incompatibility between libtcnative-1 and ipv6 (fixes LP: #287645) * No longer create confusing /var/lib/tomcat6/lib or lib subdirectory in private instances, since they are ignored (LP: #324212)	Thierry Carrez	6.0.18-0ubuntu6	15 years ago

Older »