ubuntu/+source/dbus:ubuntu/lucid-security

Last commit made on 2014-09-22
Get this branch:
git clone -b ubuntu/lucid-security https://git.launchpad.net/ubuntu/+source/dbus
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/lucid-security
Repository:
lp:ubuntu/+source/dbus

Recent commits

0bfcffa... by Marc Deslauriers on 2014-09-17

Import patches-unapplied version 1.2.16-2ubuntu4.8 to ubuntu/lucid-security

Imported using git-ubuntu import.

Changelog parent: e713f7ae84909ee918e8384e357fdabc0d1e4c13

New changelog entries:
  * SECURITY UPDATE: denial of service via large number of pending replies
    - debian/patches/CVE-2014-3638.patch: reduce max_replies_per_connection
      to 128 in bus/config-parser.c.
    - CVE-2014-3638
  * SECURITY UPDATE: denial of service via incomplete connections
    - debian/patches/CVE-2014-3639.patch: reduce auth_timeout in
      bus/config-parser.c, stop listening on DBusServer sockets when
      reaching max_incomplete_connections in bus/bus.*, bus/connection.*,
      dbus/dbus-server-protected.h, dbus/dbus-server.c, dbus/dbus-watch.*.
    - CVE-2014-3639

e713f7a... by Marc Deslauriers on 2012-10-03

Import patches-unapplied version 1.2.16-2ubuntu4.7 to ubuntu/lucid-security

Imported using git-ubuntu import.

Changelog parent: e7ecda7a5215d72ee08a46d66f81910003d31bc6

New changelog entries:
  * REGRESSION FIX: some applications launched with the activation helper
    may need DBUS_STARTER_ADDRESS. (LP: #1058343)
    - debian/patches/CVE-2012-3524-regression-fix.patch: hardcode the
      starter address to the default system bus address.
  * REGRESSION FIX: unclean shutdown after dbus upgrade (LP: #740390)
    - debian/libdbus-1-3.postinst: trigger an upstart re-exec before
      shutdown or reboot so that it can safely unmount the root
      filesystem.

e7ecda7... by Marc Deslauriers on 2012-09-19

Import patches-unapplied version 1.2.16-2ubuntu4.5 to ubuntu/lucid-security

Imported using git-ubuntu import.

Changelog parent: b08987574a6c0b6cd9f34c601ed1ea77cbd224bc

New changelog entries:
  * SECURITY UPDATE: privilege escalation via unsanitized environment
    - debian/patches/CVE-2012-3524-dbus.patch: Don't access environment
      variables or run dbus-launch when setuid in configure.in,
      dbus/dbus-keyring.c, dbus/dbus-sysdeps*
    - CVE-2012-3524

b089875... by Jamie Strandboge on 2011-07-22

Import patches-unapplied version 1.2.16-2ubuntu4.3 to ubuntu/lucid-security

Imported using git-ubuntu import.

Changelog parent: b16c51314f844b28b3ea02227f70ec0f135bfe19

New changelog entries:
  * SECURITY UPDATE: denial of service via messages with non-native byte order
    - debian/patches/99-CVE-2011-2200.patch: update dbus-marshal-header.c
      to verify header->data byte order and header->byte_order match in
      _dbus_header_byteswap()
    - CVE-2011-2200

b16c513... by Alkis Georgopoulos on 2011-01-21

Import patches-unapplied version 1.2.16-2ubuntu4.2 to ubuntu/lucid-proposed

Imported using git-ubuntu import.

Changelog parent: adc4c84ba6eac2448be5bbabaf4650a189cebbc3

New changelog entries:
  * Prevent dbus.postinst from failing in chroots (LP: #552404)

adc4c84... by Jamie Strandboge on 2011-01-04

Import patches-unapplied version 1.2.16-2ubuntu4.1 to ubuntu/lucid-security

Imported using git-ubuntu import.

Changelog parent: 6953b61610fe78f5a04c5597980eca5df1ca053c

New changelog entries:
  * SECURITY UPDATE: fix DoS with too deeply nested messages
    - debian/patches/99-CVE-2010-4352.patch: Limit nesting to 64 for dynamic
      message variants. Backported from upstream.
    - CVE-2010-4352
    - LP: #688992

6953b61... by Martin Pitt on 2010-03-30

Import patches-unapplied version 1.2.16-2ubuntu4 to ubuntu/lucid

Imported using git-ubuntu import.

Changelog parent: 1fbe35404441b3b30a798e2eeaa73a886ff7a2a5

New changelog entries:
  * Add debian/dbus.links: provide a symlink for dbus-daemon-launch-helper's
    old location in /usr, to provide a more stable upgrade from Hardy. This
    can be dropped in Lucid+1. (LP: #551672)

1fbe354... by Martin Pitt on 2010-02-19

Import patches-unapplied version 1.2.16-2ubuntu3 to ubuntu/lucid

Imported using git-ubuntu import.

Changelog parent: 1a4655ba7b11aadfa5eb0920317488e0c208947f

New changelog entries:
  * debian/dbus-Xsession: Use new "has_option" function from x11-common
    instead of grepping the option file, to avoid calling an external program.

1a4655b... by Martin Pitt on 2009-12-08

Import patches-unapplied version 1.2.16-2ubuntu2 to ubuntu/lucid

Imported using git-ubuntu import.

Changelog parent: c2673206107b3df310385abcfb86b7a45d99bd25

New changelog entries:
  * Fix installation of dbus-arch-deps.h.

c267320... by Martin Pitt on 2009-12-07

Import patches-unapplied version 1.2.16-2ubuntu1 to ubuntu/lucid

Imported using git-ubuntu import.

Changelog parent: 88fd2dc0e2dccdced1f7c202a296ad24393993d2

New changelog entries:
  * Merge with Debian testing; Remaining Ubuntu changes:
    - Install into / rather than /usr.
    - debian/control: Depend on ConsoleKit for "at_console" policy stanza.
    - debian/dbus.postinst: Do not restart dbus on upgrades, since it breaks
      too many applications. Instead, trigger a "reboot required" notification.
    - debian/dbus.postinst: Create /var/run/dbus in postinst to handle system
      being rebooted before package is configured. LP: #275229.
    - Add debian/dbus.upstart and bump debhelper b-dep to ensure that it is
      properly installed.
    - 11_timeout_handling.patch: Fix timeout accounting. The
      elapsed_milliseconds contains the time from the start, so subtracting it
      on every iteration means that the timeout is much less than what is
      requested. Instead compare the absolute values, but pass the difference
      to calls which want a timeout so that the correct remaining time is
      used. (LP #376145)
    - 20_system_conf_limit.patch: Increase max_match_rules_per_connection for
      the system bus to 5000 (LP #454093)
    - 81-session.conf-timeout.patch: Raise the service startup timeout from 25
      to 60 seconds. It may be too short on the live CD with slow machines.