2017-05-23 17:12:57 by Jonathan Perkin | Files touched by this commit (3) |
Log message:
Fix build on SunOS with GCC 7.1
|
2017-04-19 14:22:09 by Thomas Klausner | Files touched by this commit (2) |
Log message:
Updated dbus to 1.10.18.
D-Bus 1.10.18 (2017-04-05)
==
The âcan't handle a self-referential paradoxâ release.
Fixes:
⢠Re-order dbus-daemon startup so that on SELinux systems, the thread
that reads AVC notifications retains the ability to write to the
audit log (fd.o #92832, Debian #857660; Laurent Bigonville)
⢠Fix a harmless read overflow and some memory leaks in a unit test
(fd.o #100568, Philip Withnall)
|
2017-03-14 16:34:56 by Thomas Klausner | Files touched by this commit (1) |
Log message:
Add missing '+'.
Noted by Dennis Lindroos in 52071.
Only affected builds with 'x11' option turned off (non-default).
|
2017-03-08 17:09:15 by Jonathan Perkin | Files touched by this commit (1) |
Log message:
Use local Docbook DTDs. Fixes issue where xmllint --nonet doesn't actually
work.
|
2017-02-16 17:07:05 by Thomas Klausner | Files touched by this commit (2) |
Log message:
Updated dbus to 1.10.16.
D-Bus 1.10.16 (2017-02-16)
==
The âsuper digging powersâ release.
The fixes in this release are arguably security fixes, but if they
affect you, please take this opportunity to rethink how you are
configuring dbus.
Enhancements:
⢠Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
stable and Debian testing in addition to the older Ubuntu that is
the default (fd.o #98889, Simon McVittie)
Fixes:
⢠Prevent symlink attacks in the nonce-tcp transport on Unix that could
allow an attacker to overwrite a file named "nonce", in a directory
that the user running dbus-daemon can write, with a random value
known only to the user running dbus-daemon. This is unlikely to be
exploitable in practice, particularly since the nonce-tcp transport
is really only useful on Windows.
On Unix systems we strongly recommend using only the unix: and systemd:
transports, together with EXTERNAL authentication. These are the only
transports and authentication mechanisms enabled by default,
(fd.o #99828, Simon McVittie)
⢠Avoid symlink attacks in the "embedded tests", which are not enabled
by default and should never be enabled in production builds of dbus.
(fd.o #99828, Simon McVittie)
|
2016-12-12 14:57:44 by Thomas Klausner | Files touched by this commit (2) |
Log message:
Updated dbus to 1.10.14.
D-Bus 1.10.14 (2016-11-28)
==
The âWell, other bands know more than three chordsâ release.
Fixes:
⢠Work around an undesired effect of the fix for CVE-2014-3637
(fd.o #80559), in which processes that frequently send fds, such as
logind during a flood of new PAM sessions, can get disconnected for
continuously having at least one fd "in flight" for too long;
dbus-daemon interprets that as a potential denial of service attack.
The workaround is to disable that check for uid 0 process such as
logind, with a message in the system log. The bug remains open while
we look for a more general solution.
(fd.o #95263, LP#1591411; Simon McVittie)
⢠Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
was disabled at compile time. That test is not expected to work
in that configuration. (fd.o #98665, Simon McVittie)
|
2016-11-02 20:57:04 by Jonathan Perkin | Files touched by this commit (2) |
Log message:
Remove broken and incorrect DEINSTALL script, these directories are
correctly handled by OWN_DIRS. Bump PKGREVISION.
|
2016-10-10 15:16:44 by Thomas Klausner | Files touched by this commit (2) |
Log message:
Updated dbus to 1.10.12.
D-Bus 1.10.12 (2016-10-10)
==
The ânot excessively inhospitableâ release.
Security fixes:
⢠Do not treat ActivationFailure message received from root-owned systemd
name as a format string. In principle this is a security vulnerability,
but we do not believe it is exploitable in practice, because only
privileged processes can own the org.freedesktop.systemd1 bus name, and
systemd does not appear to send activation failures that contain "%".
Please note that this probably *was* exploitable in dbus versions
older than 1.6.30, 1.8.16 and 1.9.10 due to a missing check which at
the time was only thought to be a denial of service vulnerability
(CVE-2015-0245). If you are still running one of those versions,
patch or upgrade immediately.
(fd.o #98157, Simon McVittie)
Other fixes:
⢠Harden dbus-daemon against malicious or incorrect ActivationFailure
messages by rejecting them if they do not come from a privileged
process, or if systemd activation is not enabled
(fd.o #98157, Simon McVittie)
⢠Avoid undefined behaviour when setting reply serial number without going
via union DBusBasicValue (fd.o #98035, Marc Mutz)
⢠autogen.sh: fail cleanly if autoconf fails (Simon McVittie)
|
2016-08-22 15:35:36 by Thomas Klausner | Files touched by this commit (2) | |
Log message:
Updated dbus to 1.10.10.
D-Bus 1.10.10 (2016-08-15)
==
The âtungsten doorâ release.
Fixes:
⢠On Linux, when dbus-daemon is run with reduced susceptibility to the
OOM killer (typically via systemd), do not let child processes inherit
that setting (fd.o #32851; Kimmo Hämäläinen, WaLyong Cho)
⢠Output valid shell syntax in ~/.dbus/session-bus/ if the bus address
contains a semicolon (fd.o #94746, Thiago Macieira)
⢠Fix memory leaks and thread safety in subprocess starting on Windows
(fd.o #95191, Ralf Habacker)
⢠Do not require systemd to have a service file if using it for activation
(fd.o #93194; Simon McVittie; backport from 1.11.0)
⢠Stop test-dbus-daemon incorrectly failing on platforms that cannot
discover the process ID of clients (fd.o #96653, Ð ÑÑлан \
ÐжбÑлаÑов)
⢠In tests that exercise correct handling of crashing D-Bus services,
suppress Windows crash handler (fd.o #95155; Yiyang Fei, Ralf Habacker)
⢠Explicitly check for stdint.h (Ioan-Adrian Ratiu)
⢠update-activation-environment: produce better diagnostics on error
(fd.o #96653, Simon McVittie)
⢠Don't fail the build with an unused const variable warning under gcc 6
(fd.o #97282; Thomas Zimmermann, Simon McVittie)
⢠Merge dbus-1.10-ci branch, containing backports from 1.11.0 in build/test
code to support continuous integration (fd.o #93194, Simon McVittie)
· Avoid -Wunused-label when compiling with libselinux but no libaudit
· In development builds, allow OOM tests to be disabled as documented
· Accept and ignore the --tap argument in all "embedded tests", \
and run
all automated tests with that argument for better diagnostics
· Fix the systemd activation test under CMake by installing the required
files
· In Automake, fix shell syntax for installcheck-local with no DESTDIR
· In Automake, don't try to run manual tests in installcheck
· In CMake, don't run manual-tcp test as an automated test
· Add travis-ci.org build machinery
|
2016-06-08 12:16:57 by Jonathan Perkin | Files touched by this commit (89) |
Log message:
Remove the stability entity, it has no meaning outside of an official context.
|