lp:~ari-tczew/ubuntu/hardy/xchat/CVE-2009-0315

Branch merges

Propose for merging

No branches dependent on this one.

Ready for review for merging into lp:ubuntu/hardy/xchat

Marc Deslauriers: Approve on 2010-06-07

Diff: 75 lines (+43/-1)

4 files modified

debian/changelog (+11/-0)
debian/control (+1/-1)
debian/patches/00list (+1/-0)
debian/patches/64_CVE-2009-0315.dpatch (+30/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #322196: Untrusted search path vulnerability in Python and multiple other programs

Low

Fix Released

Link a bug report

Related blueprints

26. By Artur Rona on 2010-06-01

* SECURITY UPDATE (LP: #322196)
* debian/patches/64_CVE-2009-0315.dpatch:
  - Fix untrusted search path vulnerability in the Python module
    in xchat allows local users to execute arbitrary code via
    a Trojan horse Python file in the current working directory
  - CVE-2009-0315

25. By Luca Falavigna on 2008-04-09

Rebuild for liblaunchpad-integration1 transition.

24. By Andrea Colangelo on 2008-02-14

* debian/patches/01_serverlist.dpatch:
  - modify default port for irc.ubuntu.com and irc.freenode.com to 8001 to
    prevent dcc exploit (LP: #191691).
  - fix Oz.net servers list wrongly referring to OzNet (LP: #146434).

23. By Áron Sisak on 2007-09-29

* debian/patches/63_xc284-improvescrollback.dpatch:
  - Allow users to enable / disable XChat logging (LP: #144600)

22. By Áron Sisak on 2007-09-08

* debian/rules:
  - Sets XCHATSHAREDIR correctly _indeed_ (patch by Whoopie) (LP: #137712)

21. By Áron Sisak on 2007-09-06

* debian/rules:
  - Sets XCHATSHAREDIR correctly (patch by Whoopie) (LP: #137712)

20. By Áron Sisak on 2007-07-31

* debian/control
  - recommends libnotify-bin for notification alerts (LP: #129422)
* debian/patches/01_serverlist.dpatch
  - updated to remove IPV6 servers from default install (LP: #127616)

19. By Áron Sisak on 2007-07-26

* New upstream release:
  - Updated translations (cs, de, ko, mk, sv, vi).
  - System-Tray balloons now get the xchat icon instead of a generic one.
  - Fixed the notify-send zombies (released as xc282-fixtrayzombies.diff).
  - Fixed underscore ('_') in real names in the nick-name right-click menu being
    drawn as a underline.
  - ut2004:// URLs are now underlined too.
  - /set gui_tray_flags 4 will now enable a "Minimize to tray" feature. Clicking
    the window minimize button will minimize to tray instead of the task-bar.
  - Fixed bug: [1680762] Notify fails if network name contains spaces.
  - Extended tclConfig.sh search paths so it hopefully works on Ubuntu now.
  - Added a feature that reloads conversations from last time you used XChat
    (type /set text_replay 0 to disable it).
  - Fixed /LASTLOG printing everything twice if you had Indented Nicks off.
  - The CTRL-F keybinding (Find) is now disabled when using Emacs keys.
  - Added /SET gui_tweaks. See http://forum.xchat.org/viewtopic.php?p=13766
  - Fixed opening URLs on KDE that didn't begin with http:// or other protocol.
  - A better quit dialog which warns you if you're connected to IRC or have
    active file transfers.
  - Fixed: [1741525] Cycle selected channel (Luca Falavigna).
  - Fixed: [1737249] Doesn't recognize nicks with halfop mode on hovering.
  - The userlist and treeview can now be placed on the same side, with a resize
    handle in between them. They can also be dragged and dropped into place.
  - When you hide the userlist using the View menu, the resize handle now
    disappears too. It also disappears when you have a server tab in focus.
  - If you have a tree on one side and userlist on the other, they'll both now
    have a resize handle, previously the tree's size was fixed.
  - The userlist can be hidden and shown with CTRL+F7.
  - [1735116] Channel List's minimum users spin-button can now be set downward
    even on networks that sent a list of channels of only a larger size. In this
    case the Download button will flash to indicate you need to download a new
    list.
  - Changing the channel switcher type (Tree or Tabs) is also possible in the
    setup dialog.
  - The Ban List window now lists exceptions too (mode +e).
  - Script and Plugin related changes:
   * /SETTEXT with no argument now clears the input box.
   * Python: Added a xchat.strip method for stripping IRC attributes and mIRC
     color codes.
   * C-API and Perl: Returning 0 from a FD hook will now remove the hook and
     free all associated memory.
   * /MENU now supports a $CHAN root aswell (see plugin20.html).
   * Fixed GDK warning when using /MENU to add a key binding to a popup menu.
* debian/patches/04_patch361525.dpatch
  - dropped, upstream fixed xchat.desktop
* debian/patches/11_fix_dcc_close_message.dpatch
  - dropped
* debian/patches/52_fix_tray_zombies.dpatch
  - dropped, upstream fixed this
* debian/patches/60_hig_desktop.dpatch
  - dropped, upstream edited xchat.desktop according to HIG
* debian/patches/61_cycle_selected_channel.dpatch
  - dropped, upstream fixed this issue
* debian/patches/62_xc284-scrollbmkdir.dpatch
  - from http://www.xchat.org/files/source/2.8/patches/xc284-scrollbmkdir.diff

18. By Luca Falavigna on 2007-07-02

Cycle selected channel, not current one (LP: #120880)

17. By Chris Cheney on 2007-06-22

* Merge from debian unstable, remaining changes:
  - debian/control:
    Build-Depends
    . Added. liblaunchpad-integration-dev, python-dev
    . Updated. libgtk2.0-dev to >=2.10.0
    Maintainer
    . Updated. Ubuntu MOTU Developers <email address hidden>
    Package: xchat
    . Added. Conflicts: xchat-systray
    . Added. Recommends: esound-clients | alsa-utils | libarts1c2
    . Added. Replaces: xchat-systray
    . Removed. Conflicts: xchat-gnome (<< 1:0.11-1)
    . Removed. Replaces: xchat-gnome (<< 1:0.11-1)
  - debian/patches/01_serverlist.dpatch:
    Modified. "Ubuntu Servers" from irc.freenode.net to irc.ubuntu.com
  - debian/patches/09_browser.dpatch:
    Dropped. Upstream fixed the browser launching.
  - debian/patches/37_lpi.dpatch:
    Added. Launchpad integration.
  - debian/patches/38_autoconf.dpatch:
    Added. Launchpad integration autoconf changes.
  - debian/patches/45_ctcp_version_less_information.dpatch:
    Added. Make ctcp version show less information.
  - debian/patches/60_hig_desktop.dpatch60_hig_desktop.dpatch:
    Added. Change descriptions.
  - debian/rules:
    Modified. Make the build independent of the python version.