ubuntu/+source/libxslt:ubuntu/trusty-updates

Last commit made on 2019-04-15
Get this branch:
git clone -b ubuntu/trusty-updates https://git.launchpad.net/ubuntu/+source/libxslt
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/trusty-updates
Repository:
lp:ubuntu/+source/libxslt

Recent commits

fbafd18... by Leonidas S. Barbosa on 2019-04-12

Import patches-unapplied version 1.1.28-2ubuntu0.2 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: a88da1aa75a3bef09e16521cf00561803344dc63

New changelog entries:
  * SECURITY UPDATE: Bypass of protection mechanism
    - debian/patches/CVE-2019-11068.patch: Fix security
      framework bypass checking for returns equal or less
      -1 in libxslt/documents.c, libxslt/imports.c,
      libxslt/transform.c,libxslt/xslt.c.
    - CVE-2019-11068

a88da1a... by Steve Beattie on 2017-04-26

Import patches-unapplied version 1.1.28-2ubuntu0.1 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: c554e1933c1e681dcca762ba8e9bbce9509e4b9e

New changelog entries:
  * SECURITY UPDATE: type-confusion leading to denial of service
    - debian/patches/0009-CVE-2015-7955.patch: check that the parent
      node is an element before dereferencing its namespace
    - CVE-2015-7955
  * SECURITY UPDATE: out-of-bounds heap memory access
    - debian/patches/0010-CVE-2016-1683.patch: special case namespace
      nodes in xsltNumberFormatGetMultipleLevel
    - CVE-2016-1683
  * SECURITY UPDATE: integer overflow
    - debian/patches/0011-CVE-2016-1684-1.patch,
      debian/patches/0012-CVE-2016-1684-2.patch: add lower and upper
      bounds for 'i' and 'a' format tokens
    - CVE-2016-1684
  * SECURITY UPDATE: use-after-free in xsltDocumentFunctionLoadDocument
    - debian/patches/0013-CVE-2016-1841.patch: adjust xmlFree() call
    - CVE-2016-1841
  * SECURITY UPDATE: heap information leak
    - debian/patches/0014-CVE-2016-4738.patch: check for empty
      decimal separator.
    - CVE-2016-4738
  * SECURITY UPDATE: integer overflow in libxslt.
    - debian/patches/0015-CVE-2017-5029.patch: limit buffer size in
      xsltAddTextString to INT_MAX.
    - CVE-2017-5029
  * SECURITY UPDATE: double free in hash functions
    - 0016-Fix-double-free-in-libexslt-hash-functions-d8862309f0.patch:
      remove duplicate free calls
  * SECURITY UPDATE: NULL pointer dereference in Saxon
    - 0017-Fix-error-handling-in-Saxon-extension-functions-ef7429bb4.patch:
      fix error handling in Saxon extension functions
  * SECURITY UPDATE: out-of-bounds heap memory access
    - 0018-Fix-dyn-map-with-namespace-nodes-93bb3147.patch: use
      correct type for namespace nodes in exsltDynMapFunction
  * SECURITY UPDATE: out-of-bounds heap read memory access
    - 0019-Fix-saxon-line-number-with-namespace-nodes-8b90c9a6.patch:
      do not pass namespace "nodes" to xmlGetLineNo
  * SECURITY UPDATE: stack-based buffer overflow in exsltDateFormat
    - 0020-Fix-buffer-overflow-in-exsltDateFormat-5d0c6565b.patch:
      make stack buffer larger
  * SECURITY UPDATE: out-of-bounds head read in xsltExtModuleRegisterDynamic
    - 0021-Fix-OOB-heap-read-in-xsltExtModuleRegisterDynamic-87c3d9ea.patch:
      correct stripping of unwanted characters

c554e19... by Matthias Klose on 2014-02-23

Import patches-unapplied version 1.1.28-2build1 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: 9631bcf9cb0f26ccbd17aa4e8188b83f612c1d9b

New changelog entries:
  * Rebuild to drop files installed into /usr/share/pyshared.

9631bcf... by Aron Xu on 2013-08-01

Import patches-unapplied version 1.1.28-2 to debian/sid

Imported using git-ubuntu import.

Changelog parent: f2b3580e68d86406cb48a1c43f8647b1fc051e8b

New changelog entries:
  * debian/patches/000[4-8].patch:
    Upstream post release patches.

f2b3580... by Aron Xu on 2013-04-30

Import patches-unapplied version 1.1.28-1 to debian/experimental

Imported using git-ubuntu import.

Changelog parent: 4375a3618f4e20c8ffde1749a693616b08e14e46

New changelog entries:
  [ YunQiang Su ]
  * Imported Upstream version 1.1.28
  * Workaround xsltMaxVars version number (Closes: #698955)
  * Refresh patches
  * Correct email address of YunQiang Su
  * Mark libxslt1-dev as Multi-Arch: same (Closes: #689091)
  [ Aron Xu ]
  * Use canonical VCS-* fields.
  * Remove unused override: python-libxslt1-dbg: hardening-no-relro

4375a36... by Aron Xu on 2012-10-02

Import patches-unapplied version 1.1.27-1 to debian/experimental

Imported using git-ubuntu import.

Changelog parent: ce9369cac0517eb20232072097997f10fe218dda

New changelog entries:
  * New upstream release (Closes: #448205, #683353)
  * debian/rules:
    + Add hardening flags for dbg package in LDFLAGS (Closes: #681163)
  * debian/control:
    - std-ver: 3.9.3 -> 3.9.4, no change required.

ce9369c... by Aron Xu on 2012-07-05

Import patches-unapplied version 1.1.26-13 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 133802551d254a9eb2daf9e9bfc8e477dd1c4ad8

New changelog entries:
  * Patch to fix CVE-2012-2825 (Closes: #679283).

1338025... by Aron Xu on 2012-05-28

Import patches-unapplied version 1.1.26-12 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 76d14df121e663947150f3e9d2d30b1c8a8c4f9a

New changelog entries:
  [ Aron Xu ]
  * New maintainer (Closes: #654177)
  * debian/rules: small improvements, stop shipping .la files.
  * debian/control: mark libxslt1-dev as not M-A (Closes: #671902).

  [ YunQiang Su ]
  * Convert to 3.0 source format.
  * Byte-compile Python modules again (Closes: #671901).

76d14df... by Michael Gilbert <email address hidden> on 2012-05-07

Import patches-unapplied version 1.1.26-11 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 280168bfa1c08d4e84ce870ecf15ea9e5788922d

New changelog entries:
  * QA upload.
  * Bump standards version to 3.9.3.
  * Apply Steve Langasek's patch to enable multiarch (closes: 643034).
  * Fix cve-2011-3970: out-of-bounds array access issue (closes: #660650).
  * Bump debian/compat to 9 and enable hardened build flags (closes: #655601).
  * Eliminate system config.sub and config.guess from the debian diff
    (closes: #670799).

280168b... by Thorsten Glaser on 2012-05-06

Import patches-unapplied version 1.1.26-10 to debian/sid

Imported using git-ubuntu import.

Changelog parent: 858c7ce8555f22a90c7862b70965c9353631f11c

New changelog entries:
  * QA upload.
  * Fix building for real: (Closes: #666333)
    - make(1) targets accumulate, they do not replace
    - You absolutely must not have a build-% (wildcard) target!
    - Never have a directory (or file) with the same name as a
      (phony) target, as it *will* prevent the target from being
      run while that file/directory exists, with varying messages
    => rename ./build/ to builddir and build-% to dobuild-%
    Discovered while trying to hand-fix an m68k build.
  * Throw in some lintian fixes (manpage, spelling) for good measure.