Author: Gerrit Pape
Revision Date: 2010-04-01 20:42:19 UTC

* debian/git-daemon-run.postrm: purge: don't warn if the git-daemon
  service is already removed; use -f option to userdel, on fast-purge
  the log service daemon might still run for a short time (closes:
  #575434).
* new upstream point release.

Author: Steve Beattie
Revision Date: 2010-12-17 13:18:54 UTC

* SECURITY UPDATE: gitweb cross-site scripting vulnerability
  - debian/diff/0034-gitweb-Introduce-esc_attr...diff:
    from upstream: gitweb: do not parrot filenames or other arguments
    given in a request without proper quoting
  - CVE-2010-3906

Author: Baptiste Mille-Mathias
Revision Date: 2010-09-13 13:19:46 UTC

debian/rules: install missing gitweb.js for the gitweb Web configuration
(LP: #636999)

Author: Steve Beattie
Revision Date: 2010-12-17 13:18:54 UTC

* SECURITY UPDATE: gitweb cross-site scripting vulnerability
  - debian/diff/0034-gitweb-Introduce-esc_attr...diff:
    from upstream: gitweb: do not parrot filenames or other arguments
    given in a request without proper quoting
  - CVE-2010-3906

Author: Gerrit Pape
Revision Date: 2010-04-01 20:42:19 UTC

* debian/git-daemon-run.postrm: purge: don't warn if the git-daemon
  service is already removed; use -f option to userdel, on fast-purge
  the log service daemon might still run for a short time (closes:
  #575434).
* new upstream point release.

Author: Gerrit Pape
Revision Date: 2009-06-29 00:06:59 UTC

[ Anders Kaseorg ]
* Fix manpage formatting: set ASCIIDOC_NO_ROFF instead of
  DOCBOOK_XSL_173 (based on the instructions in Documentation/Makefile)
  and don’t override the internal Makefile variable ASCIIDOC_EXTRA
  (closes: #530693, #521954, #533320).

[ Gerrit Pape ]
* debian/control: Standards-Version: 3.8.2.0.

Author: Steve Beattie
Revision Date: 2010-12-17 14:43:15 UTC

* SECURITY UPDATE: gitweb cross-site scripting vulnerability
  - debian/diff/0034-gitweb-Introduce-esc_attr...diff:
    from upstream: gitweb: do not parrot filenames or other arguments
    given in a request without proper quoting
  - CVE-2010-3906

Author: Steve Beattie
Revision Date: 2010-12-17 14:43:15 UTC

* SECURITY UPDATE: gitweb cross-site scripting vulnerability
  - debian/diff/0034-gitweb-Introduce-esc_attr...diff:
    from upstream: gitweb: do not parrot filenames or other arguments
    given in a request without proper quoting
  - CVE-2010-3906

Author: Marc Deslauriers
Revision Date: 2009-02-13 08:45:10 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - Previous CVE-2008-3546 patch was incomplete
  - debian/diff/0006-CVE-2008-3546-missing-part.diff: safely build the full
    path in attr.c and builtin-grep.c.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via diff.external configuration
  variable.
  - debian/diff/0007-CVE-2008-5916.diff: remove unused legacy-style URI code
    in gitweb/gitweb.perl.
  - CVE-2008-5916

Author: Marc Deslauriers
Revision Date: 2009-02-20 13:55:31 UTC

* SECURITY UPDATE: arbitrary command execution via diff.external configuration
  variable.
  - debian/diff/0005-CVE-2008-5916.diff: remove unused legacy-style URI code
    in gitweb/gitweb.perl.
  - CVE-2008-5916

Author: Alessio Treglia
Revision Date: 2008-09-24 10:36:22 UTC

* debian/control:
 + Added libauthen-sasl-perl on Recommends for git-email (LP: #258142).
 + Added libnet-smtp-ssl-perl on Depends for git-email (LP: #272939).

Author: Marc Deslauriers
Revision Date: 2009-02-13 08:45:10 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - Previous CVE-2008-3546 patch was incomplete
  - debian/diff/0006-CVE-2008-3546-missing-part.diff: safely build the full
    path in attr.c and builtin-grep.c.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via diff.external configuration
  variable.
  - debian/diff/0007-CVE-2008-5916.diff: remove unused legacy-style URI code
    in gitweb/gitweb.perl.
  - CVE-2008-5916

Author: Marc Deslauriers
Revision Date: 2009-02-12 15:49:08 UTC

[ David Leadbeater ]
* SECURITY UPDATE: Fix remote code execution in gitweb (LP: #317052)
  - CVE-2008-5516: http://repo.or.cz/w/git.git?a=commitdiff;h=c582abae
  - CVE-2008-5517: http://repo.or.cz/w/git.git?a=commitdiff;h=516381d5

[ Marc Deslauriers ]
* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0007-SECURITY-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via diff.external configuration
  variable.
  - debian/diff/0008-SECURITY-CVE-2008-5916.diff: remove unused legacy-style
    URI code in gitweb/gitweb.perl.
  - CVE-2008-5916

Author: Marc Deslauriers
Revision Date: 2009-02-12 15:49:08 UTC

[ David Leadbeater ]
* SECURITY UPDATE: Fix remote code execution in gitweb (LP: #317052)
  - CVE-2008-5516: http://repo.or.cz/w/git.git?a=commitdiff;h=c582abae
  - CVE-2008-5517: http://repo.or.cz/w/git.git?a=commitdiff;h=516381d5

[ Marc Deslauriers ]
* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0007-SECURITY-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via diff.external configuration
  variable.
  - debian/diff/0008-SECURITY-CVE-2008-5916.diff: remove unused legacy-style
    URI code in gitweb/gitweb.perl.
  - CVE-2008-5916

Author: Marc Deslauriers
Revision Date: 2009-02-13 09:32:33 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0007-SECURITY-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via shell metacharacters
  related to git_search in gitweb (LP: #317052)
  - debian/diff/0006-CVE-2008-5516.diff: use git-log instead of git-rev-list |
    git-diff-tree for pickaxe search in gitweb/gitweb.perl.
  - CVE-2008-5516
* SECURITY UPDATE: arbitrary command execution via shell metacharacters
  related to git_snapshot and git_object in gitweb (LP: #317052)
  - debian/diff/0007-CVE-2008-5517.diff: quote the given arguments before
    passing them to the shell in gitweb/gitweb.perl.
  - CVE-2008-5517

Author: Bryan Donlan
Revision Date: 2008-04-06 18:53:53 UTC

debian/rules: Use wish8.4 for the tcl interpreter, to match our dependency
in debian/control. (LP: #196846)

Author: Marc Deslauriers
Revision Date: 2009-02-13 09:32:33 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0007-SECURITY-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546
* SECURITY UPDATE: arbitrary command execution via shell metacharacters
  related to git_search in gitweb (LP: #317052)
  - debian/diff/0006-CVE-2008-5516.diff: use git-log instead of git-rev-list |
    git-diff-tree for pickaxe search in gitweb/gitweb.perl.
  - CVE-2008-5516
* SECURITY UPDATE: arbitrary command execution via shell metacharacters
  related to git_snapshot and git_object in gitweb (LP: #317052)
  - debian/diff/0007-CVE-2008-5517.diff: quote the given arguments before
    passing them to the shell in gitweb/gitweb.perl.
  - CVE-2008-5517

Author: LaMont Jones
Revision Date: 2007-09-07 10:39:45 UTC

No changes from Debian.

Author: LaMont Jones
Revision Date: 2007-11-29 07:28:44 UTC

* backport to dapper et al.
  - debian/rules changes to support source:Upstream-Version for old dpkg.
  - allow asciidoc (>7.0.2-3)

Author: Matthias Klose
Revision Date: 2007-03-05 01:16:45 UTC

Rebuild for changes in the amd64 toolchain.

Author: LaMont Jones
Revision Date: 2007-11-29 07:28:44 UTC

* backport to dapper et al.
  - debian/rules changes to support source:Upstream-Version for old dpkg.
  - allow asciidoc (>7.0.2-3)

Author: Gerrit Pape
Revision Date: 2006-07-11 21:38:33 UTC

* new upstream release.
* debian/changelog.upstream: upstream changes taken from mailing list
  announcement.
* debian/rules: user same build flags and prefix to $(MAKE) in build
  and install target to prevent rebuild in install target.

Author: Marc Deslauriers
Revision Date: 2009-02-13 13:34:03 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0001-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546

Author: LaMont Jones
Revision Date: 2008-04-06 13:54:27 UTC

* backport to dapper
* source:Upstream-Version expanded inline

Author: Marc Deslauriers
Revision Date: 2009-02-13 13:34:03 UTC

* SECURITY UPDATE: arbitrary code execution via long PATH in diff_addremove
  and diff_change (LP: #248750)
  - debian/diff/0001-CVE-2008-3546.diff: safely build the full path.
  - CVE-2008-3546

Author: Fabio Massimo Di Nitto
Revision Date: 2006-04-02 08:23:27 UTC

Add fix for CVE-2006-0477 stolen from head.
(1ecc18e4fc0c91e9cab1aafbedb0eebdebaa8dd3)