~ubuntu-core-dev/ubuntu/vivid/apport/ubuntu : changes

~ubuntu-core-dev/ubuntu/vivid/apport/ubuntu » Changes from revision 2436

From Revision 2436 to 2417

Rev	Summary	Authors	Tags	Date
2436	releasing package apport version 2.17.2-0ubuntu1.7 releasing package apport version 2.17.2-0ubuntu1.7	Martin Pitt	2.17.2-0ubuntu1.7	8 years ago
2435	SECURITY FIX: When determining the path of a Python module f... SECURITY FIX: When determining the path of a Python module for a program like "python -m module_name", avoid actually importing and running the module; this could lead to local root privilege escalation. Thanks to Gabriel Campana for discovering this and the fix! (CVE-2015-1341, LP: #1507480)	Martin Pitt		8 years ago
2434	test_backend_apt_dpkg.py: Reset internal apt caches between ... test_backend_apt_dpkg.py: Reset internal apt caches between tests. Avoids random test failures due to leaking paths from previous test cases.	Martin Pitt		8 years ago
2433	releasing package apport version 2.17.2-0ubuntu1.6 releasing package apport version 2.17.2-0ubuntu1.6	Martin Pitt	2.17.2-0ubuntu1.6	8 years ago
2432	Consistently intercept "report file already exists" errors i... Consistently intercept "report file already exists" errors in all writers of report files (package_hook, kernel_crashdump, and similar) to avoid unhandled exceptions on those. (LP: #1500450)	Martin Pitt		8 years ago
2431	releasing package apport version 2.17.2-0ubuntu1.5 releasing package apport version 2.17.2-0ubuntu1.5	Martin Pitt	2.17.2-0ubuntu1.5	8 years ago
2430	SECURITY FIX: Fix all writers of report files to open the re... SECURITY FIX: Fix all writers of report files to open the report file exclusively. Fix package_hook, kernel_crashdump, and similar hooks to fail if the report already exists. This prevents privilege escalation through symlink attacks. Note that this will also prevent overwriting previous reports with the same same. Thanks to halfdog for discovering this! (CVE-2015-1338, LP: #1492570)	Martin Pitt		8 years ago
2429	SECURITY FIX: kernel_crashdump: Enforce that the log/dmesg f... SECURITY FIX: kernel_crashdump: Enforce that the log/dmesg files are not a symlink. This prevents normal users from pre-creating a symlink to the predictable .crash file, and thus triggering a "fill up disk" DoS attack when the .crash report tries to include itself. Also clean up the code to make this easier to read: Drop the "vmcore_root" alias, move the vmcore and vmcore.log cleanup into the "no kdump" section, and replace the buggy os.walk() loop with a glob to only catch direct timestamp subdirectories of /var/crash/. Thanks to halfdog for discovering this! (CVE-2015-1338, part of LP #1492570)	Martin Pitt		8 years ago
2428	Fix the pocket for 2.17.2-0ubuntu1.4 Fix the pocket for 2.17.2-0ubuntu1.4	Brian Murray		8 years ago
2427	resolve test failures resolve test failures	Brian Murray		8 years ago
2426	releasing package apport version 2.17.2-0ubuntu1.4 releasing package apport version 2.17.2-0ubuntu1.4	Brian Murray	2.17.2-0ubuntu1.4	8 years ago
2425	data/package_hook: when creating the problem report include ... data/package_hook: when creating the problem report include the version of the package. (LP: #1485787)	Brian Murray		8 years ago
2424	Keep "[origin: ...]" information in Package: and Dependencie... Keep "[origin: ...]" information in Package: and Dependencies: fields for native-origins.d/ origins, so that it's possible to retrace them and so that bugs are reported about the right project. (LP: #1470572)	Brian Murray		8 years ago
2423	fix changelog bug reference fix changelog bug reference	Brian Murray		8 years ago
2422	releasing package apport version 2.17.2-0ubuntu1.2 releasing package apport version 2.17.2-0ubuntu1.2	Brian Murray	2.17.2-0ubuntu1.2	8 years ago
2421	* apport-noui.upstart: Utilize watershed to only launch one ... * apport-noui.upstart: Utilize watershed to only launch one instance of whoopsie-upload-all at a time. (LP: #1473652) * apport-noui: Depend on watershed.	Brian Murray		8 years ago
2420	releasing package apport version 2.17.2-0ubuntu1.1 releasing package apport version 2.17.2-0ubuntu1.1	Martin Pitt	2.17.2-0ubuntu1.1	8 years ago
2419	SECURITY UPDATE: When writing a core dump file for a crashed... SECURITY UPDATE: When writing a core dump file for a crashed packaged program, don't close and reopen the .crash report file but just rewind and re-read it. This prevents the user from modifying the .crash report file while "apport" is running to inject data and creating crafted core dump files. In conjunction with the above vulnerability of writing core dump files to arbitrary directories this could be exploited to gain root privileges. Thanks to Philip Pettersson for discovering this issue! (CVE-2015-1325, LP: #1453900)	Martin Pitt		8 years ago
2418	SECURITY UPDATE: When /proc/sys/fs/suid_dumpable is enabled,... SECURITY UPDATE: When /proc/sys/fs/suid_dumpable is enabled, crashing a program that is suid root or not readable for the user would create root-owned core files in the current directory of that program. Creating specially crafted core files in /etc/logrotate.d or similar could then lead to arbitrary code execution with root privileges. Now core files do not get written for these kinds of programs, in accordance with the intention of core(5). Thanks to Sander Bos for discovering this issue! (CVE-2015-1324, LP: #1452239)	Martin Pitt		8 years ago
2417	signal_crashes test: Fix test_crash_setuid_* to look at whet... signal_crashes test: Fix test_crash_setuid_* to look at whether suid_dumpable was enabled.	Martin Pitt		8 years ago

Older »