~ubuntu-branches/ubuntu/precise/eglibc/precise-security

• Changes
• Files

~ubuntu-branches/ubuntu/precise/eglibc/precise-security » Changes from revision 319

From Revision 319 to 300

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
319		* REGRESSION UPDATE: revert CVE-2014-9761 fix due to added s... * REGRESSION UPDATE: revert CVE-2014-9761 fix due to added symbol   dependency from libm to libc (LP: #1585614)   - debian/patches/any/CVE-2014-9761-2.diff: keep exporting     __strto*_nan symbols added to libc.	Steve Beattie	2.15-0ubuntu10.15	7 years ago
318		* SECURITY UPDATE: buffer overflow in gethostbyname_r and re... * SECURITY UPDATE: buffer overflow in gethostbyname_r and related   functions   - debian/patches/any/CVE-2015-1781.diff: take alignment padding     into account when computing if buffer is too small.   - CVE-2015-1781 * SECURITY UPDATE: glibc Name Service Switch (NSS) denial of sevice   - debian/patches/any/CVE-2014-8121-1.diff: do not close NSS files     database during iteration.   - debian/patches/any/CVE-2014-8121-2.diff: Separate internal state     between getXXent and getXXbyYY NSS calls.   - CVE-2014-8121 * SECURITY UPDATE: glibc unbounded stack usage in NaN strtod   conversion   - debian/patches/any/CVE-2014-9761-1.diff: Refactor strtod parsing     of NaN payloads.   - debian/patches/any/CVE-2014-9761-1.diff:  Fix nan functions     handling of payload strings   - CVE-2014-9761 * SECURITY UPDATE: out of range data to strftime() causes segfault   (denial of service)   - debian/patches/any/CVE-2015-8776.diff: add range checks to     strftime() processing   - CVE-2015-8776 * SECURITY UPDATE: glibc honors LD_POINTER_GUARD env for setuid   AT_SECURE programs (e.g. setuid), allowing disabling of pointer   mangling   - debian/patches/any/CVE-2015-8777.diff: Always enable pointer     guard   - CVE-2015-8777 * SECURITY UPDATE: integer overflow in hcreate and hcreate_r   - debian/patches/any/CVE-2015-8778.diff: check for large inputs   - CVE-2015-8778 * SECURITY UPDATE: unbounded stack allocation in catopen()   - debian/patches/any/CVE-2015-8779.diff: stop using unbounded     alloca()   - CVE-2015-8779 * SECURITY UPDATE: Stack overflow in _nss_dns_getnetbyname_r   - debian/patches/any/CVE-2016-3075.diff: do not make unneeded     memory copy on the stack.   - CVE-2016-3075 * SECURITY UPDATE: pt_chown privilege escalation   - debian/patches/any/CVE-2016-2856-pre.diff: add option to     enable/disable pt_chown.   - debian/patches/any/CVE-2016-2856.diff: grantpt: trust the kernel     about pty group and permission mode   - debian/debhelper.in/libc-bin.install: drop installation of     pt_chown   - CVE-2016-2856, CVE-2013-2207 * debian/debhelper.in/libc.postinst: add reboot notifications for   security updates (LP: #1546457)	Steve Beattie	2.15-0ubuntu10.14	8 years ago
317		* SECURITY UPDATE: glibc getaddrinfo stack-based buffer over... * SECURITY UPDATE: glibc getaddrinfo stack-based buffer overflow   - debian/patches/any/CVE-2015-7547-pre1.diff: fix memory leak in     resolv/nss_dns/dns-host.c.   - debian/patches/any/CVE-2015-7547-pre2.diff: fix memory leak in     include/resolv.h, resolv/gethnamaddr.c, resolv/nss_dns/dns-canon.c,     resolv/nss_dns/dns-host.c, resolv/nss_dns/dns-network.c,     resolv/res_query.c, resolv/res_send.c.   - debian/patches/any/CVE-2015-7547.diff: fix buffer handling in     resolv/nss_dns/dns-host.c, resolv/res_query.c, resolv/res_send.c.   - CVE-2015-7547	Marc Deslauriers	2.15-0ubuntu10.13	8 years ago
316		* SECURITY UPDATE: getaddrinfo writes to random file descrip... * SECURITY UPDATE: getaddrinfo writes to random file descriptors under   high load   - debian/patches/any/cvs-resolv-reuse-fd.diff: reload file descriptor     after calling reopen in resolv/res_send.c.   - CVE-2013-7423 * SECURITY UPDATE: denial of service via endless loop in getaddr_r   - debian/patches/any/cvs-getnetbyname.diff: iterate over alias names in     resolv/nss_dns/dns-network.c.   - CVE-2014-9402 * SECURITY UPDATE: buffer overflow in wscanf   - debian/patches/any/cvs-wscanf.diff: calculate correct size in     stdio-common/vfscanf.c, added test to stdio-common/tst-sscanf.c.   - CVE-2015-1472   - CVE-2015-1473	Marc Deslauriers	2.15-0ubuntu10.11	9 years ago
315		* SECURITY UPDATE: buffer overflow in __nss_hostname_digits_... * SECURITY UPDATE: buffer overflow in __nss_hostname_digits_dots   - debian/patches/any/CVE-2015-0235.diff: fix overflow in     nss/digits_dots.c   - CVE-2015-0235	Steve Beattie	2.15-0ubuntu10.10	9 years ago
314		* SECURITY UPDATE: denial of service in IBM gconv modules * SECURITY UPDATE: denial of service in IBM gconv modules   - debian/patches/any/CVE-2012-6656.diff: fix check in     iconvdata/ibm930.c.   - debian/patches/any/cvs-CVE-2014-6040.diff: fix checks in     iconvdata/ibm*.c.   - CVE-2012-6656   - CVE-2014-6040 * SECURITY UPDATE: arbitrary command execution via wordexp (LP: #1396471)   - debian/patches/any/CVE-2014-7817.diff: properly handle WRDE_NOCMD in     posix/wordexp.c, added tests to posix/wordexp-test.c.   - CVE-2014-7817	Marc Deslauriers	2.15-0ubuntu10.9	9 years ago
313		* SECURITY UPDATE: heap overflow in __gconv_translit_find() ... * SECURITY UPDATE: heap overflow in __gconv_translit_find() (LP: #1362409)   - debian/patches/any/cvs-CVE-2014-5119.diff: Backport upstream commit to     completely remove support for loadable gconv transliteration modules. * SECURITY REGRESSION: localplt regression introduced in 2.15-0ubuntu10.6   - debian/patches/any/submitted-CVE-2014-0475.diff: update with a backport     of upstream commit ca38dc17 to include memmem hidden alias declaration.	Adam Conrad	2.15-0ubuntu10.7	9 years ago
312		* SECURITY UPDATE: denial of service via buffer overflow in ... * SECURITY UPDATE: denial of service via buffer overflow in getaddrinfo   - debian/patches/any/CVE-2013-4458.patch: fix overflow in     sysdeps/posix/getaddrinfo.c.   - CVE-2013-4458 * SECURITY UPDATE: Directory traversal in locale environment handling   - debian/patches/any/CVE-2014-0475.diff: validate locale names in     locale/findlocale.c, locale/setlocale.c, added test to     localedata/tst-setlocale3.c, localedata/Makefile.   - CVE-2014-0475 * SECURITY UPDATE: use-after-free via posix_spawn_file_actions_addopen   failing to copy the path argument   - debian/patches/any/CVE-2014-4043.diff: properly copy path in     posix/spawn_faction_addopen.c, posix/spawn_faction_destroy.c,     posix/spawn_int.h, added test to posix/tst-spawn.c.   - CVE-2014-4043 * debian/patches/any/CVE-2013-4237-part2.diff: fix alignment issue   causing a readdir regression on sparc. * debian/patches/any/CVE-2013-4332-part2.diff: added a couple of extra   commits to fix another overflow and an infinite loop.	Marc Deslauriers	2.15-0ubuntu10.6	9 years ago
311		* SECURITY UPDATE: denial of service and possible code execu... * SECURITY UPDATE: denial of service and possible code execution via   strcoll overflows   - debian/patches/any/CVE-2012-44xx.diff: fix overflows in     string/strcoll_l.c, add test to string/tst-strcoll-overflow.c,     string/Makefile.   - CVE-2012-4412   - CVE-2012-4424 * SECURITY UPDATE: denial of service in regular expression matcher   - debian/patches/any/CVE-2013-0242.diff: fix buffer overrun in     posix/regexec.c, add test to posix/bug-regex34.c, posix/Makefile.   - CVE-2013-0242 * SECURITY UPDATE: denial of service in getaddrinfo   - debian/patches/any/CVE-2013-1914.diff: fix overflow in     sysdeps/posix/getaddrinfo.c.   - CVE-2013-1914 * SECURITY UPDATE: denial of service and possible code execution via   readdir_r   - debian/patches/any/CVE-2013-4237.diff: enforce NAME_MAX limit in     sysdeps/unix/readdir_r.c, add errcode to sysdeps/unix/dirstream.h,     sysdeps/unix/opendir.c, sysdeps/unix/rewinddir.c, remove     GETDENTS_64BIT_ALIGNED from     sysdeps/unix/sysv/linux/i386/readdir64_r.c,     sysdeps/unix/sysv/linux/wordsize-64/readdir_r.c.   - CVE-2013-4237 * SECURITY UPDATE: denial of service and possible code execution via   overflows in memory allocator   - debian/patches/any/CVE-2013-4332.diff: check for overflows in     malloc/malloc.c.   - CVE-2013-4332	Marc Deslauriers	2.15-0ubuntu10.5	10 years ago
310		* SECURITY UPDATE: stack buffer overflow in vfprintf handlin... * SECURITY UPDATE: stack buffer overflow in vfprintf handling   (LP: #1031301)   - debian/patches/any/CVE-2012-3406.patch: switch to malloc when     array grows too large to handle via alloca extension   - CVE-2012-3406 * SECURITY UPDATE: stdlib strtod integer/buffer overflows   - debian/patches/any/CVE-2012-3480.patch: rearrange calculations     and modify types to void integer overflows   - CVE-2012-3480	Steve Beattie	2.15-0ubuntu10.2	11 years ago
309		kdm is not meant to be restarted, only warned about; moving ... kdm is not meant to be restarted, only warned about; moving the restart code to the preinst is causing kdm restarts that will break the desktop in the middle of the upgrade.  Zero out our list of services between the two uses of the variable.  LP: #985735.	Steve Langasek	2.15-0ubuntu10	12 years ago
308		debian/debhelper.in/libc.preinst: Brown paper bag fix; when ... debian/debhelper.in/libc.preinst: Brown paper bag fix; when we upgrade from older versions, we don't have our linker in place before unpacking, however the preisnt wants one, so create a temporary linker symlink in the new location for one-time use	Adam Conrad	2.15-0ubuntu9	12 years ago
307		[ James Hunt ] [ James Hunt ] * debian/debhelper.in/libc.preinst: Moved logic from postinst to   prompt user for services to restart. We ask here to allow the   problematic cron to be stopped in the preinst, but defer the restart of   remaining services until postinst time (LP: #508083). [ Steve Langasek ] * debian/debhelper.in/libc.{pre,post}inst: drop special casing of upstart   jobs when restarting, since the check was completely wrong anyway,   depending on the no-longer-existent /lib/init/readlink. * Drop obsolete gdm upgrade handling code that only applies for upgrades   from hardy to lucid. * Remove the /etc/ld.so.conf.d/i486-linux-gnu.conf conffile on upgrade on   i386, since it's no longer shipped and we should give consistent results   on upgrade and install; and add a Breaks on the three library packages   in lucid that used this path. [ Adam Conrad ] * debian/patches/any/local-nscd-NO_MAPPING.diff: Apply patch from Jeff Law   to clean up thread handling in __nscd_get_nl_timestamp and resolve a few   random crashing issues with chromium-browser and ktorrent (LP: #929219) * debian/rules.d/debhelper.mk: Fix RTLD_SO replacement regex for sanity.	Adam Conrad	2.15-0ubuntu7	12 years ago
306		* SECURITY UPDATE: denial of service in RPC implementation ... * SECURITY UPDATE: denial of service  in RPC implementation (LP: #901716)   - debian/patches/any/local-CVE-2011-4609.patch: nanosleep when too     many open fds are detected   - CVE-2011-4609 * SECURITY UPDATE: vfprintf nargs overflow leading to FORTIFY   check bypass (LP: #953171)   - debian/patches/any/cvs-CVE-2012-0864.patch: check for integer     overflow   - CVE-2012-0864	Steve Beattie	2.15-0ubuntu6	12 years ago
305		Backport ARM makecontext() routines. LP: #696794 Backport ARM makecontext() routines. LP: #696794	Michael Hope	2.15-0ubuntu5	12 years ago
304		* Merge from Debian (r5173, 2.13-27). * Merge from Debian (r5173, 2.13-27). * Don't include the non-default multilib debug files in the libc6-dbg   package for any architecture.	Matthias Klose	2.15-0ubuntu4	12 years ago
303		[ Matthias Klose ] [ Matthias Klose ] * debian/debhelper.in/libc.postinst: Call notify-reboot-required for   updates to 2.15. * Expect same test failures on armhf as on armel. * Only restart gdm if it is running. LP: #931745. * Don't include the non-default multilib debug files in the libc6-dbg   package on ARM. Install the multiarch package instead. [ Steve Langasek ] * Synchronize the kernel version checks in   debian/debhelper.in/libc6.preinst with the values actually set in   debian/sysdeps/linux.mk.	Matthias Klose	2.15-0ubuntu3	12 years ago
302		* Revert commit c5a0802a. LP: #929713. * Revert commit c5a0802a. LP: #929713. * Fix nvidia libgl crashes. LP: #929384.	Matthias Klose	2.15-0ubuntu2	12 years ago
301		Build upstream tarball from r16526. Build upstream tarball from r16526.	Matthias Klose	2.15-0ubuntu1	12 years ago
300		Merge from Debian (r5151, 2.13-26). Merge from Debian (r5151, 2.13-26).	Matthias Klose	2.15~pre6-0ubuntu10	12 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1