Author: Seth Arnold
Revision Date: 2015-05-21 16:34:24 UTC

fake sync from Debian

Author: Seth Arnold
Revision Date: 2015-05-21 16:34:24 UTC

fake sync from Debian

Author: Francesco Paolo Lovergine
Revision Date: 2015-04-23 14:11:19 UTC

* proftpd-dev: Depend on libtool-bin: merged NMU, thanks Doko.
  (closes: #761795)
* Add CVE-2015-3306 patch.
  Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy.
  (closes: #782781)

Author: Francesco Paolo Lovergine
Revision Date: 2015-04-23 14:11:19 UTC

* proftpd-dev: Depend on libtool-bin: merged NMU, thanks Doko.
  (closes: #761795)
* Add CVE-2015-3306 patch.
  Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy.
  (closes: #782781)

Author: Matthias Klose
Revision Date: 2014-10-08 10:25:36 UTC

* Non maintainer upload.
* proftpd-dev: Depend on libtool-bin. Closes: #761795.

Author: Matthias Klose
Revision Date: 2014-10-08 10:25:36 UTC

* Non maintainer upload.
* proftpd-dev: Depend on libtool-bin. Closes: #761795.

Author: Artur Rona
Revision Date: 2014-06-14 23:46:16 UTC

* Merge from Debian unstable. Remaining changes:
  - debian/patches/powerpc64le.diff:
    + Patch lib/libltdl/m4/libtool.m4 and configure for ppc64el.

Author: Artur Rona
Revision Date: 2014-06-14 23:46:16 UTC

* Merge from Debian unstable. Remaining changes:
  - debian/patches/powerpc64le.diff:
    + Patch lib/libltdl/m4/libtool.m4 and configure for ppc64el.

Author: Matthias Klose
Revision Date: 2013-12-20 18:42:50 UTC

Don't build using dh-autoreconf, patch the libtool snippets
directly.

Author: Matthias Klose
Revision Date: 2013-12-20 18:42:50 UTC

Don't build using dh-autoreconf, patch the libtool snippets
directly.

Author: Francesco Paolo Lovergine
Revision Date: 2013-07-03 14:09:32 UTC

* Added version for dependency on memcached, for completeness.
  (closes: #699514)
* The old proftpd-mod-geoip addon module is now onbsoleted by core proftpd,
  so required Breaks/Replaces are provided to avoid piuparts breakages.
  (closes: #699647)
* Modified modules.conf template to suggest the geoip module.

Author: Francesco Paolo Lovergine
Revision Date: 2013-07-03 14:09:32 UTC

* Added version for dependency on memcached, for completeness.
  (closes: #699514)
* The old proftpd-mod-geoip addon module is now onbsoleted by core proftpd,
  so required Breaks/Replaces are provided to avoid piuparts breakages.
  (closes: #699647)
* Modified modules.conf template to suggest the geoip module.

Author: Michael Gilbert
Revision Date: 2013-04-16 02:58:07 UTC

* Non-maintainer upload.
* Recommend proftpd-mod-vroot (closes: #704484).

Author: Michael Gilbert
Revision Date: 2013-04-16 02:58:07 UTC

* Non-maintainer upload.
* Recommend proftpd-mod-vroot (closes: #704484).

Author: Francesco Paolo Lovergine
Revision Date: 2012-03-28 15:24:13 UTC

[ Mahyuddin Susanto ]
* Team upload.
* Fix typo in proftpd.conf templates line 133, thanks John Smith.
  (Closes: #655630)
* Updated Danish translations, thanks Joe Dalton. (Closes: #659326)
* debian/copyright:
  - Resync with latest dep5 format.
  - Use stand-alone license paragraph for repeatable license.
  - Use whitespace instead of comma separated for Files fields.
  - wrap-and-sort.
* debian/control:
  - Bump Standards-Version to 3.9.3.
* debian/rules: Enabled hardened flags, patch from Moritz Muehlenhoff.
  (Closes: #657213)
* debian/changelog: Wrap latest changelog line 3 to 80 line, thanks lintian.
* debian/proftpd-basic.install: Add missing sftp-sql modules.
  (Closes: 665191)

[ Francesco Paolo Lovergine ]
* Added a note about the need of removing rfc/ folder in upstream sources.

Author: Francesco Paolo Lovergine
Revision Date: 2011-11-21 13:29:13 UTC

* New upstream release.
* Merged patch removed: 3711.
* Now enabled PCRE instead of glibc POSIX regex and added required libpcre3-dev
  build-dep.
* Added libpcre3-dev dependency to libproftpd-dev due to header files
  inclusion.

Author: Francesco Paolo Lovergine
Revision Date: 2011-09-02 11:32:31 UTC

* Now debian/rules manages correctly debug. noopt and nostrip options
  in DEB_BUILD_OPTIONS against proftpd building script.
  (closes: #624267)
* Added NoSessionReuseRequired as suggested TLSOptions: it does allow some
  clients to work correctly with data connection.
* Added a suitable entry in NEWS file to warn about mod_ldap directives
  upstream changes.
  (closes: #628944)
* Changed ldap.conf template to reflect new basic directives.
* Changed reference URL for the Timing Attack in proftpd.conf template.
  (closes: #630427)
* Now proftpd-basic.postrm removes also the logrotate script on purge.
  (closes: #626742)
* Added another override for lintian about embedding the libtool ltdl.

Author: Francesco Paolo Lovergine
Revision Date: 2011-03-23 10:49:44 UTC

debian/patches/3624 updated for a better management of possible NULL
value.

Author: Neil Wilson
Revision Date: 2010-11-13 11:51:28 UTC

* SECURITY UPDATE: Telnet IAC processing stack overflow.
   This vulnerability allows remote attackers to execute arbitrary code on
   vulnerable installations of ProFTPD. Authentication is not required to
   exploit this vulnerability.
   (LP: #674646)
   - debian/patches/3521.patch: adjust src/netio.c to check buflen properly.
   - http://bugs.proftpd.org/attachment.cgi?id=3521
   - CVE-2010-4221
 * SECURITY UPDATE: Inappropriate directory traversal allowed by
   mod_site_misc. This vulnerability can be used to:
    - create a directory located outside the writable directory
    - delete a directory located outside the writable directory
    - create a symlink located outside the writable directory
    - change the time of a file located outside the writable directory.
  (LP: #674798)
   - debian/patches/CVE_2010_3867.dpatch: based on debian 3519.dpatch
     backported to v1.3.2
   - http://bugs.proftpd.org/attachment.cgi?id=3519
   - CVE-2010-3867

Author: Steve Beattie
Revision Date: 2010-11-17 16:02:50 UTC

* SECURITY UPDATE: Telnet IAC processing stack overflow.
   This vulnerability allows remote attackers to execute arbitrary code on
   vulnerable installations of ProFTPD. Authentication is not required to
   exploit this vulnerability.
   (LP: #674646)
   - debian/patches/3521.patch: adjust src/netio.c to check buflen properly.
   - http://bugs.proftpd.org/attachment.cgi?id=3521
   - CVE-2010-4221
 * SECURITY UPDATE: Inappropriate directory traversal allowed by
   mod_site_misc. This vulnerability can be used to:
    - create a directory located outside the writable directory
    - delete a directory located outside the writable directory
    - create a symlink located outside the writable directory
    - change the time of a file located outside the writable directory.
  (LP: #674798)
   - debian/patches/CVE_2010_3867.dpatch: based on debian 3519.dpatch
     backported to v1.3.2
   - http://bugs.proftpd.org/attachment.cgi?id=3519
   - CVE-2010-3867
 * Thanks to Neil Wilson <neil@aldur.co.uk> for backporting patches

Author: Steve Beattie
Revision Date: 2010-11-17 16:02:50 UTC

* SECURITY UPDATE: Telnet IAC processing stack overflow.
   This vulnerability allows remote attackers to execute arbitrary code on
   vulnerable installations of ProFTPD. Authentication is not required to
   exploit this vulnerability.
   (LP: #674646)
   - debian/patches/3521.patch: adjust src/netio.c to check buflen properly.
   - http://bugs.proftpd.org/attachment.cgi?id=3521
   - CVE-2010-4221
 * SECURITY UPDATE: Inappropriate directory traversal allowed by
   mod_site_misc. This vulnerability can be used to:
    - create a directory located outside the writable directory
    - delete a directory located outside the writable directory
    - create a symlink located outside the writable directory
    - change the time of a file located outside the writable directory.
  (LP: #674798)
   - debian/patches/CVE_2010_3867.dpatch: based on debian 3519.dpatch
     backported to v1.3.2
   - http://bugs.proftpd.org/attachment.cgi?id=3519
   - CVE-2010-3867
 * Thanks to Neil Wilson <neil@aldur.co.uk> for backporting patches

Author: Neil Wilson
Revision Date: 2010-11-13 11:51:28 UTC

* SECURITY UPDATE: Telnet IAC processing stack overflow.
   This vulnerability allows remote attackers to execute arbitrary code on
   vulnerable installations of ProFTPD. Authentication is not required to
   exploit this vulnerability.
   (LP: #674646)
   - debian/patches/3521.patch: adjust src/netio.c to check buflen properly.
   - http://bugs.proftpd.org/attachment.cgi?id=3521
   - CVE-2010-4221
 * SECURITY UPDATE: Inappropriate directory traversal allowed by
   mod_site_misc. This vulnerability can be used to:
    - create a directory located outside the writable directory
    - delete a directory located outside the writable directory
    - create a symlink located outside the writable directory
    - change the time of a file located outside the writable directory.
  (LP: #674798)
   - debian/patches/CVE_2010_3867.dpatch: based on debian 3519.dpatch
     backported to v1.3.2
   - http://bugs.proftpd.org/attachment.cgi?id=3519
   - CVE-2010-3867

Author: Francesco Paolo Lovergine
Revision Date: 2010-03-18 11:16:29 UTC

Fixed inetd_check() in init file. Thanks Mats Erik Andersson.
(closes: #554029)

Author: Jan Hagemeyer
Revision Date: 2010-01-19 19:14:30 UTC

* Security: added 3124.dpatch patch to manage another SQL injection due to %
  variable substitution in user/group names. This is fixed in 1.3.2. This is
  CVE-2009-0542. (LP: #508738)

* Security: added 3173fix.dpatch to use PQescapeStringConn() instead of the
  deprecated PQescapeString(), which does not honour the encoding.
  This is referred to the previous fix of #3173 aka CVE-2009-0543.

* Security: added 3275.dpatch as taken from 1.3.2b branch to fix
  CVE-2009-3639.

Author: Jan Hagemeyer
Revision Date: 2010-01-19 19:14:30 UTC

* Security: added 3124.dpatch patch to manage another SQL injection due to %
  variable substitution in user/group names. This is fixed in 1.3.2. This is
  CVE-2009-0542. (LP: #508738)

* Security: added 3173fix.dpatch to use PQescapeStringConn() instead of the
  deprecated PQescapeString(), which does not honour the encoding.
  This is referred to the previous fix of #3173 aka CVE-2009-0543.

* Security: added 3275.dpatch as taken from 1.3.2b branch to fix
  CVE-2009-3639.

Author: Francesco Paolo Lovergine
Revision Date: 2009-12-11 09:42:48 UTC

* New upstream release, with fix of CVE-2009-3736 due to update of the
  embedded liblt with a backported fix.
  (closes: #553406, #555862, #559842)
  Merged patches: 3324, 3328.
* Added a note about AllowClientRenegotiations option for TLS protocols in NEWS
  and a commented directive in tls.conf subfile.
  (closes: #558597)

Author: Francesco Paolo Lovergine
Revision Date: 2009-03-10 10:28:12 UTC

* Added proftpd-mod-sqlite and proftpd-mod-odbc to Suggests in debian/control.
* Removed LIBS prefixed at configuration time in debian/rules and still around
  after odbc.patch. My oversight...
  (closes: #519029)
* [PATCH] Added 3204.dpatch to provide a better prxs to third-parties module.
  It properly manage DESTDIR and module $Libraries$. And also provides --help :)
* Removed 3188.dpatch because obsoleted by 3204.dpatch.

Author: Nick Ellery
Revision Date: 2009-02-13 10:55:20 UTC

* Merge from debian unstable, remaining changes (LP: #329167):
  - mod_rewrite.c.dpatch: Added S_IRUSR|S_IWUSR to build with the new
    Compiler Flags

Author: Nicolas Valcarcel
Revision Date: 2008-08-16 00:47:30 UTC

* Merge from debian unstable, remaining changes:
  - mod_rewrite.c.dpatch: Added S_IRUSR|S_IWUSR to build with the new
    Compiler Flags

Author: Stefan Ebner
Revision Date: 2008-02-19 22:13:20 UTC

 * Merge from debian unstable. (LP: #193429) remaining changes:
  - Re-add transitional packages, to allow an upgrade from Dapper.
  - Update maintainer field as per spec.

Author: Luke Yelavich
Revision Date: 2007-06-15 21:25:15 UTC

* Merge from debian unstable, remaining changes:
  - Use RequireValidShell in /etc/proftpd/proftpd.conf
  - Re-add transitional packages, to allow an upgrade from Dapper.
  - Update maintainer field in debian/control

Author: Lionel Porcheron
Revision Date: 2007-03-06 10:11:02 UTC

* Merge from debian unstable, remaining changes:
  - debian/control: Add update-inetd to proftpd's dependencies.
* debian/control: Change Maintainer/XSBC-Original-Maintainer field