Path to this page:
Subject: CVS commit: [pkgsrc-2014Q2] pkgsrc/sysutils/dbus
From: Matthias Scheler
Date: 2014-07-07 11:23:34
Message id: 20140707092334.A26FD96@cvs.netbsd.org
Log Message:
Pullup ticket #4442 - requested by wiz
sysutils/dbus: security update
Revisions pulled up:
- sysutils/dbus/Makefile 1.72
- sysutils/dbus/distinfo 1.57
---
Module Name: pkgsrc
Committed By: wiz
Date: Sun Jul 6 14:54:32 UTC 2014
Modified Files:
pkgsrc/sysutils/dbus: Makefile distinfo
Log Message:
Update to 1.8.6:
D-Bus 1.8.6 (2014-06-02)
==
Security fixes:
⢠On Linux ⥠2.6.37-rc4, if sendmsg() fails with ETOOMANYREFS, \
silently drop
the message. This prevents an attack in which a malicious client can
make dbus-daemon disconnect a system service, which is a local
denial of service.
(fd.o #80163, CVE-2014-3532; Alban Crequy)
⢠Track remaining Unix file descriptors correctly when more than one
message in quick succession contains fds. This prevents another attack
in which a malicious client can make dbus-daemon disconnect a system
service.
(fd.o #79694, fd.o #80469, CVE-2014-3533; Alejandro MartÃnez Suárez,
Simon McVittie, Alban Crequy)
Other fixes:
⢠When dbus-launch --exit-with-session starts a dbus-daemon but then cannot
attach to a session, kill the dbus-daemon as intended
(fd.o #74698, Роман ÐонÑенко)
Files: