lp:ubuntu/hardy-security/gnupg

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

22. By Marc Deslauriers on 2013-01-08

* SECURITY UPDATE: keyring corruption via malformed key import
  - debian/patches/CVE-2012-6085.dpatch: validate PKTTYPE in g10/import.c.
  - CVE-2012-6085

21. By Marc Deslauriers on 2012-08-14

debian/patches/long-keyids.dpatch: Use the longest key ID available
when requesting a key from a key server.

20. By Steve Langasek on 2008-01-23

No-change rebuild against libldap-2.4-2.

19. By Michael Bienia on 2007-10-01

debian/patches/70_trust_error.dpatch: Removed as it broke setting the
trust level to 1 (LP: #147343).

18. By Michael Bienia on 2007-07-06

[ Scott Kitterman ]
* Add 'debian/patches/60_install_options_skel.dpatch': Patch to
  install options file from upstream (LP: #76983)
* Add 'debian/patches/61_use_agent_default.dpatch': Patch to set gpg
  (or gpg2) and gpgsm to use a passphrase agent by default (LP: #15485)
* Add 'debian/patches/70_trust_error.dpatch': Patch to disallow illegal
  zero response for trust level changes (LP: #39459)

[ Michael Bienia ]
* Add libcurl4-gnutls-dev to Build-Depends to fix gpg running into a timeout
  updating the keyring (LP: #62864)

17. By Kees Cook on 2007-05-15

Add 'debian/patches/50_show_primary_only.dpatch': add
'show-primary-uid-only' to verify options, to suppress 'aka' output
in key verifications, backported from 1.4.7 upstream.

16. By Kees Cook on 2007-05-08

* Merge from debian unstable, remaining changes:
  - config.h.in: Disable mlock() test since it fails with ulimit 0 (on
    buildds).
  - debian/rules:
    + Do not install gpg as suid root, since that is not necessary with
      kernels 2.6.8+.
    + Make the build fail if the test suite fails.
  - debian/control: Maintainer field update.

15. By Kees Cook on 2007-03-07

* SECURITY UPDATE: without --status-fd, forged inline sigs can appear valid.
* debian/patches/50_stop_multiple_messages.dpatch: upstream patch.
* References
  ftp://ftp.gnupg.org/gcrypt/gnupg/patches/gnupg-1.4.6-multiple-message.patch
  CVE-2007-1263

14. By Kees Cook on 2006-12-12

* Merge from debian unstable, remaining changes:
  - config.h.in: Disable mlock() test since it fails with ulimit 0 (on
    buildds).
  - debian/rules:
    + Do not install gpg as suid root, since that is not necessary with
      kernels 2.6.8+.
    + Make the build fail if the test suite fails.

13. By Kees Cook on 2006-12-06

* SECURITY UPDATE: unwound stack data use, leading to arbitrary code
  execution.
* Add debian/patches/29_dxf_context_stack.dpatch: upstream patch, use heap
  for allocation instead.
* References
  CVE-2006-6235