~ubuntu-branches/ubuntu/oneiric/apt/oneiric-security : changes

~ubuntu-branches/ubuntu/oneiric/apt/oneiric-security » Changes from revision 174

From Revision 174 to 155

Rev	Summary	Authors	Tags	Date
174	* SECURITY UPDATE: InRelease verification bypass * SECURITY UPDATE: InRelease verification bypass - CVE-2013-1051 [ David Kalnischk ] [ Michael Vogt ] * apt-pkg/deb/debmetaindex.cc, test/integration/test-bug-595691-empty-and-broken-archive-files, test/integration/test-releasefile-verification: - disable InRelease downloading until the verification issue is fixed, thanks to Ansgar Burchardt for finding the flaw	Marc Deslauriers	0.8.16~exp5ubuntu13.7	11 years ago
173	* SECURITY UPDATE: change permissions of * SECURITY UPDATE: change permissions of /var/log/apt/term.log to 0640 (LP: #975199) - CVE-2012-0961	Michael Vogt	0.8.16~exp5ubuntu13.6	11 years ago
172	* SECURITY UPDATE: Disable apt-key net-update for now, as va... * SECURITY UPDATE: Disable apt-key net-update for now, as validation code is still insecure - cmdline/apt-key: exit 1 immediately in net_update() - CVE-2012-0954 - LP: #1013639	Jamie Strandboge	0.8.16~exp5ubuntu13.5	11 years ago
171	adjust apt-key to ensure no collisions on subkeys too. Patch... adjust apt-key to ensure no collisions on subkeys too. Patch thanks to Marc Deslauriers. (LP: #1013128)	Jamie Strandboge	0.8.16~exp5ubuntu13.4	11 years ago
170	* SECURITY UPDATE: trust bypass via stale InRelease file (LP... * SECURITY UPDATE: trust bypass via stale InRelease file (LP: #947108) - CVE-2012-0214 * This packages does _not_ contain the changes from 0.8.16~exp5ubuntu13.1 in oneiric-proposed. [ David Kalnischkies ] * apt-pkg/acquire-item.cc: - remove 'old' InRelease file if we can't get a new one before proceeding with Release.gpg to avoid the false impression of a still trusted repository by a (still present) old InRelease file. Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214)	Marc Deslauriers	0.8.16~exp5ubuntu13.2	12 years ago
169	[ Adam Conrad ] [ Adam Conrad ] * On armel, call update-apt-xapian-index with '-u' to keep the CPU and I/O usage low. We would do this on all arches, but there's a regression risk here, but that's better than killing slow systems. [ Michael Vogt ] * cmdline/apt-key: - fix apt-key net-update, thanks to Marc Deslauriers and Adam Conrad for the code review (LP: #857472)	Michael Vogt	0.8.16~exp5ubuntu13	12 years ago
168	[ David Kalnischkies ] [ David Kalnischkies ] * apt-pkg/deb/deblistparser.cc: - fix crash when the dynamic mmap needs to be remapped during LoadReleaseInfo (LP: #854090)	Michael Vogt	0.8.16~exp5ubuntu12	12 years ago
167	[ Colin Watson ] [ Colin Watson ] * ftparchive/cachedb.cc: - fix buffersize in bytes2hex [ Marc Deslauriers ] * SECURITY UPDATE: Disable apt-key net-update for now, as validation code is insecure. - cmdline/apt-key: exit immediately out of net_update(). - CVE number pending	Michael Vogt	0.8.16~exp5ubuntu11	12 years ago
166	* methods/https.cc: * methods/https.cc: - cleanup broken downloads properly (just like http)	Michael Vogt	0.8.16~exp5ubuntu10	12 years ago
165	[ Michael Vogt ] [ Michael Vogt ] * apt-pkg/acquire-item.h, apt-pkg/deb/debmetaindex.cc: - fix fetching translated package descriptions (including the newly stripped out english ones) by adding OptionalSubIndexTarget [ David Kalnischkies ] * apt-pkg/acquire-item.cc: - if no Release.gpg file is found try to verify with hashes, but do not fail if a hash can't be found * apt-pkg/indexrecords.cc: - fix Acquire::Max-ValidTime option by interpreting it really as seconds as specified in the manpage and not as days - add an Acquire::Min-ValidTime option (Closes: #640122) * doc/apt.conf.5.xml: - reword Acquire::Max-ValidTime documentation to make clear that it doesn't provide the new Min-ValidTime functionality	Michael Vogt	0.8.16~exp5ubuntu9	12 years ago
164	* cherry pick r1825 from lp:~mvo/apt/mvo: * cherry pick r1825 from lp:~mvo/apt/mvo: * apt-pkg/contrib/configuration.cc: - fix double delete (LP: #848907) - ignore only the invalid regexp instead of all options * cherry pick r2165 from lp:~donkult/apt/sid: [ David Kalnischkies ] * cmdline/apt-get.cc: - output list of virtual package providers to c1out in -q=1 instead of /dev/null to unbreak sbuild (LP: #816155)	Michael Vogt	0.8.16~exp5ubuntu8	12 years ago
163	[ Michael Vogt ] [ Michael Vogt ] * cherry pick revision 2173 from lp:~donkult/apt/sid [ David Kalnischkies ] - M-A:same lockstep unpack should operate on installed packages first (LP: #835625)	Michael Vogt	0.8.16~exp5ubuntu7	12 years ago
162	[ Michael Vogt [ Michael Vogt * merged lp:~jr/ubuntu/oneiric/apt/bzr-get-rename, thanks to Jonathan Riddell [ David Kalnischkies ] * lots of cppcheck fixes * apt-pkg/packagemanager.cc, apt-pkg/pkgcache.cc: - ignore "self"-conflicts for all architectures of a package instead of just for the architecture of the package locked at in the ordering of installations too (Closes: #802901)	Michael Vogt	0.8.16~exp5ubuntu6	12 years ago
161	* debian/control: * debian/control: - fix VCS location * methods/mirror.cc: - include the architecture(s) in the query string as well so that the server can make better decisions	Michael Vogt	0.8.16~exp5ubuntu5	12 years ago
160	Merge change from Robert Collins to upgrade ubuntu-keyring r... Merge change from Robert Collins to upgrade ubuntu-keyring recommends to a hard dependency to match Debian behaviour and fix LP: #816606	Adam Conrad	0.8.16~exp5ubuntu4	12 years ago
159	* apt-pkg/acquire.cc: * apt-pkg/acquire.cc: - fix potential divide-by-zero (LP: #823277)	Michael Vogt	0.8.16~exp5ubuntu3	12 years ago
158	* test/integration/test-hashsum-verification: * test/integration/test-hashsum-verification: - add regression test for hashsum verification * apt-pkg/acquire-item.cc: - if no Release.gpg file is found, still load the hashes for verification (closes: #636314) and add test * apt-pkg/pkgcachegen.cc: - fix incorrect comparision when checking sources.list freshness	Michael Vogt	0.8.16~exp5ubuntu2	12 years ago
157	merged new version from debian/experimental, this includes merged new version from debian/experimental, this includes a ABI break and two new library packages	Michael Vogt	0.8.16~exp5ubuntu1	12 years ago
156	Merge change from Robert Collins to upgrade ubuntu-keyring r... Merge change from Robert Collins to upgrade ubuntu-keyring recommends to a hard dependency to match Debian behaviour and fix LP: #816606	Adam Conrad	0.8.15.5ubuntu2	12 years ago
155	* apt-pkg/pkgcachegen.{cc,h}: * apt-pkg/pkgcachegen.{cc,h}: - fix crash when P.Arch() was used but the cache got remapped (LP: #812862)	Michael Vogt	0.8.15.5ubuntu1	12 years ago

Older »