-
Committer:
Package Import Robot
-
Author(s):
Marc Deslauriers
-
Date:
2015-06-22 10:51:39 UTC
-
Revision ID:
package-import@ubuntu.com-20150622105139-7f4rcrzciv1g50ed
Tags: 2.7.6-8ubuntu0.2
* SECURITY UPDATE: denial of service in multiple servers
- debian/patches/CVE-2013-1752-httplib-2.patch: limit amount of headers
in Lib/httplib.py, added test to Lib/test/test_httplib.py.
- debian/patches/CVE-2013-1752-poplib.patch: limit maximum line length
in Lib/poplib.py, added test to Lib/test/test_poplib.py.
- debian/patches/CVE-2013-1752-smtplib.patch: limit amount read from
the network in Lib/smtplib.py, added test to
Lib/test/test_smtplib.py.
- CVE-2013-1752
* SECURITY UPDATE: denial of service via xmlrpc gzip-compressed
HTTP bodies
- debian/patches/CVE-2013-1753.patch: add default limit in
Lib/xmlrpclib.py, added test to Lib/test/test_xmlrpc.py.
- CVE-2013-1753
* SECURITY UPDATE: arbitrary memory read via idx argument
- debian/patches/CVE-2014-4616.patch: reject negative idx values in
Modules/_json.c, added test to Lib/json/tests/test_decode.py.
- CVE-2014-4616
* SECURITY UPDATE: code execution or file disclosure via CGIHTTPServer
- debian/patches/CVE-2014-4650.patch: url unquote path in
Lib/CGIHTTPServer.py, added test to Lib/test/test_httpservers.py.
- CVE-2014-4650
* SECURITY UPDATE: information disclosure via buffer function
- debian/patches/CVE-2014-7185.patch: avoid overflow in
Objects/bufferobject.c, added test to Lib/test/test_buffer.py.
- CVE-2014-7185