New changelog entries:
* SECURITY UPDATE: fix DoS with too deeply nested messages
- debian/patches/99-CVE-2010-4352.patch: Limit nesting to 64 for dynamic
message variants. Backported from upstream.
- CVE-2010-4352
- LP: #688992
New changelog entries:
* Add debian/dbus.links: provide a symlink for dbus-daemon-launch-helper's
old location in /usr, to provide a more stable upgrade from Hardy. This
can be dropped in Lucid+1. (LP: #551672)
New changelog entries:
* debian/dbus-Xsession: Use new "has_option" function from x11-common
instead of grepping the option file, to avoid calling an external program.
New changelog entries:
* Merge with Debian testing; Remaining Ubuntu changes:
- Install into / rather than /usr.
- debian/control: Depend on ConsoleKit for "at_console" policy stanza.
- debian/dbus.postinst: Do not restart dbus on upgrades, since it breaks
too many applications. Instead, trigger a "reboot required" notification.
- debian/dbus.postinst: Create /var/run/dbus in postinst to handle system
being rebooted before package is configured. LP: #275229.
- Add debian/dbus.upstart and bump debhelper b-dep to ensure that it is
properly installed.
- 11_timeout_handling.patch: Fix timeout accounting. The
elapsed_milliseconds contains the time from the start, so subtracting it
on every iteration means that the timeout is much less than what is
requested. Instead compare the absolute values, but pass the difference
to calls which want a timeout so that the correct remaining time is
used. (LP #376145)
- 20_system_conf_limit.patch: Increase max_match_rules_per_connection for
the system bus to 5000 (LP #454093)
- 81-session.conf-timeout.patch: Raise the service startup timeout from 25
to 60 seconds. It may be too short on the live CD with slow machines.
New changelog entries:
* Add debian/patches/11_timeout_handling.patch:
- Fix timeout accounting. The elapsed_milliseconds contains the time
from the start, so subtracting it on every iteration means that the
timeout is much less than what is requested. Instead compare the
absolute values, but pass the difference to calls which want a timeout
so that the correct remaining time is used. (LP: #376145)
Thanks to Chris Coulson for his help in tracking this down.
