lp:ubuntu/trusty-updates/libxfont

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

35. By Marc Deslauriers on 2015-03-18

* SECURITY UPDATE: arbitrary code exection via invalid property count
  - debian/patches/CVE-2015-1802.patch: check for integer overflow in
    src/bitmap/bdfread.c.
  - CVE-2015-1802
* SECURITY UPDATE: arbitrary code execution via bitmap data parse failure
  - debian/patches/CVE-2015-1803.patch: bail out if bitmap can't be read
    in src/bitmap/bdfread.c.
  - CVE-2015-1803
* SECURITY UPDATE: arbitrary code execution via invalid metrics
  - debian/patches/CVE-2015-1804.patch: ensure metrics fit in struct in
    src/bitmap/bdfread.c.
  - CVE-2015-1804
* Backport some commits from git to solve ftbfs with newer fontsproto:
  - debian/patches/ftbfs-new-fontsproto.patch
  - debian/patches/ftbfs-new-fontsproto-2.patch

34. By Marc Deslauriers on 2014-05-13

* SECURITY UPDATE: denial of service and possible code execution via
  font metadata file parsing
  - debian/patches/CVE-2014-0209.patch: check for overflows in
    src/fontfile/dirfile.c, src/fontfile/fontdir.c.
  - CVE-2014-0209
* SECURITY UPDATE: denial of service and possible code execution via
  xfs font server replies
  - debian/patches/CVE-2014-021x.patch: check lengths and sizes in
    src/fc/fsconvert.c, src/fc/fserve.c.
  - CVE-2014-0210
  - CVE-2014-0211

33. By Julien Cristau on 2014-01-07

* New upstream release
  + CVE-2013-6462: unlimited sscanf overflows stack buffer in
    bdfReadCharacters()
* Don't put dbg symbols from the udeb in the dbg package.
* dev package is no longer Multi-Arch: same (closes: #720026).
* Disable support for connecting to a font server. That code is horrible and
  full of holes.

32. By Marc Deslauriers on 2014-01-07

* SECURITY UPDATE: denial of service and possible code execution via
  stack overflow
  - debian/patches/CVE-2013-6462.patch: limit sscanf field in
    src/bitmap/bdfread.c.
  - CVE-2013-6462

31. By Julien Cristau on 2013-08-12

* New upstream release.
* Build for multiarch (closes: #654252). Patch by Riku Voipio, thanks!
* Disable silent build rules.

30. By Cyril Brulebois on 2012-05-03

Ease sync for Ubuntu: strip -Bsymbolic-functions from LDFLAGS
(LP: #992745).

29. By Cyril Brulebois on 2012-03-04

[ Cyril Brulebois ]
* New upstream release.
* Switch to dh:
  - Bump debhelper build-dep and compat.
  - Rewrite debian/rules, using autoreconf and quilt sequences.
  - Adjust build dependencies accordingly.
  - Use build-main and build-udeb as build directories.
  - Adjust .install accordingly.
* Remove xsfbs accordingly.
* Add support for hardened build flags through dpkg-buildflags, based
  on a patch by Moritz Muehlenhoff, thanks! (Closes: #654154).

[ Julien Cristau ]
* Remove David Nusinow from Uploaders.

28. By Cyril Brulebois on 2011-08-11

[ Julien Cristau ]
* Drop Pre-Depends on x11-common (only needed for upgrades from the
  monolith) and Replaces on xlibs-static-dev (hasn't existed in forever).

[ Cyril Brulebois ]
* New upstream release:
  - LZW decompress: fix for CVE-2011-2895. From the commit message:
    “Specially crafted LZW stream can crash an application using libXfont
     that is used to open untrusted font files. With X server, this may
     allow privilege escalation when exploited.”
* Set urgency to “high” accordingly.
* Update debian/copyright from upstream COPYING.
* Bump xorg-sgml-doctools build-dep.
* Drop xorg.css from .install, no longer shipped upstream.

27. By Cyril Brulebois on 2011-02-05

Upload to unstable.

26. By Cyril Brulebois on 2010-11-19

* New upstream release.
* Bump xutils-dev build-dep for new macros.
* Add xmlto, xorg-sgml-doctools, and w3m build-dep for the doc.
* Pass --with-xmlto and --without-fop for the regular build (we want
  html and txt only). Disable both for the udeb build.
* Tweak doc filenames, and handle that through dh_install.
* Add --fail-missing -XlibXfont.la for the second dh_install call (the
  udeb one), for additional safety.