lp:~jtaylor/ubuntu/natty/gajim/multiple-CVE

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp:ubuntu/natty/gajim

Ubuntu branches: Pending requested 2012-05-01

Diff: 366 lines (+344/-0)

4 files modified

debian/changelog (+19/-0)
debian/patches/CVE-2012-2085.patch (+54/-0)
debian/patches/CVE-2012-2086.patch (+157/-0)
debian/patches/CVE-2012-2093.patch (+114/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #992613: gajim: CVE-2012-2093 insecure temporary file creation in LaTeX support	Low	Fix Released
Bug #992618: gajim code execution and sql injection	Medium	Fix Released

Link a bug report

Related blueprints

57. By Julian Taylor on 2012-05-10

fix missing wait on process end

56. By Julian Taylor on 2012-05-10

fix missing jid tuple in patch

55. By Julian Taylor on 2012-05-01

nicen changelog

54. By Julian Taylor on 2012-05-01

fix error in patch, obj.command is only used in >= 0.14

53. By Julian Taylor on 2012-05-01

* SECURITY UPDATE: assisted code execution (LP: #992618)
  - debian/patches/CVE-2012-2085.dpatch: fix subprocess call to prevent
    shell escape
    https://trac.gajim.org/changeset/bc296e96ac10
  - CVE-2012-2085
* SECURITY UPDATE: sql injection (LP: #992618)
  - debian/patches/CVE-2012-2086.dpatch: use a prepated statement
    https://trac.gajim.org/changeset/bfd5f94489d8
  - CVE-2012-2086
* SECURITY UPDATE: insecure tmpfile creation(LP: #992613)
  - debian/patches/CVE-2012-2093.dpatch: use safe tmpfile functions
    Thanks to Nico Golde
  - CVE-2012-2093

52. By Matthias Klose on 2010-12-08

Rebuild with python 2.7 as the python default.

51. By Angel Abad on 2010-11-08

* Merge from debian unstable (LP: #672484). Remaining changes:
  - Updated debian/watch
  - Kept Ubuntu patches
    + config-write-sync.patch
    + ubuntu-keyring.patch

50. By Angel Abad on 2010-09-14

* Merge from debian unstable (LP: #662154). Remaining changes:
  - Updated debian/watch
  - Kept Ubuntu patches
    + config-write-sync.patch
    + ubuntu-keyring.patch
* Dropped change: (superceeded in debian)
  - Changed python build version from 2.5 to 2.6 in debian/rules

49. By Jonathan Michalon on 2010-05-25

* Merge from debian testing (LP: #506049), remaining changes:
  - Updated debian/watch
  - Kept Ubuntu patches
    + config-write-sync.patch
    + ubuntu-keyring.patch
  - Changed python build version from 2.5 to 2.6 in debian/rules

48. By Chris Coulson on 2009-12-15

* debian/control:
  - Change python-gnome2-extras recommends to python-eggtrayicon.
    The former package has gone away in Lucid.