New changelog entries:
* SECURITY UPDATE: top configuration file read from current directory
- debian/patches/CVE-2018-1122.patch: do not default to the cwd in
top/top.c.
- CVE-2018-1122
* SECURITY UPDATE: ps output buffer overflow
- debian/patches/CVE-2018-1123.patch: check sizes in ps/output.c.
- CVE-2018-1123
* SECURITY UPDATE: integer overflow in file2strvec()
- debian/patches/CVE-2018-1124.patch: prevent overflow in
proc/readproc.c.
- CVE-2018-1124
* SECURITY UPDATE: stack overflow in pgrep
- debian/patches/CVE-2018-1125.patch: check length in pgrep.c.
- CVE-2018-1125
* SECURITY UPDATE: truncated sizes and possible integer overflow
- debian/patches/CVE-2018-1126.patch: use size_t, not unsigned int in
proc/alloc.*.
- CVE-2018-1126
New changelog entries:
* Merge from Debian unstable. Remaining changes:
- debian/sysctl.d (Ubuntu-specific):
+ 10-console-messages.conf: stop low-level kernel messages on console.
+ 10-kernel-hardening.conf: add the kptr_restrict setting
+ 10-keyboard.conf.powerpc: mouse button emulation on PowerPC.
+ 10-ipv6-privacy.conf: add a file to sysctl.d to apply the defaults
for IPv6 privacy extensions for interfaces. (LP: #176125, #841353)
+ 10-link-restrictions.conf: even though the Ubuntu
kernel is built with these defaults in place, we want to make sure
that people running stock kernels don't miss out.
+ 10-magic-sysrq.conf: Disable most magic sysrq by default, allowing
critical sync, remount, reboot functions. (LP: #194676, LP: #1025467)
+ 10-network-security.conf: enable rp_filter and SYN-flood protection.
+ 10-ptrace.conf: describe new PTRACE setting.
+ 10-zeropage.conf: safe mmap_min_addr value for graceful fall-back.
for armhf, and arm64.
+ README: describe how this directory is supposed to work.
- debian/upstart (Ubuntu-specific): upstart configuration to replace old
style sysv init script
- Fix cross build
- ignore_eaccess.patch: If we get eaccess when opening a sysctl file for
writing, don't error out. Otherwise package upgrades can fail,
especially in containers.
- ignore_erofs.patch: Same as ignore_eaccess but for the case where
part of /proc is read/only.
Merged
into
ubuntu/+source/procps:ubuntu/xenial-devel
at
revision 35096d3375c1fcd5912d9f605e05e8ca4ec23879
