NEW changes in stable-new
Processing changes file: systemd_232-25+deb9u10_mipsel.changes ACCEPT Processing changes file: vips_8.4.5-1+deb9u1_mipsel.changes ACCEPT
NEW changes in stable-new
Processing changes file: vips_8.4.5-1+deb9u1_mips64el.changes ACCEPT
Processed: Re: unblock: notary/0.6.1~ds1-3
Processing control commands: > tags -1 - moreinfo Bug #926337 [release.debian.org] unblock: notary/0.6.1~ds1-3 Removed tag(s) moreinfo. -- 926337: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926337 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#926337: unblock: notary/0.6.1~ds1-3
Control: tags -1 - moreinfo Hi, It has been built on mips now. // send from my mobile device Ivo De Decker 于 2019年4月5日周五 03:27写道: > Control: tags -1 moreinfo > > Hi, > > On Thu, Apr 04, 2019 at 01:00:00AM +0800, Shengjing Zhu wrote: > > Please unblock package notary > > > > * Regenerate some test certs since they are expired (Closes: #924119) > > > > unblock notary/0.6.1~ds1-3 > > The build failed on mips. This will block migration, even if the package is > unblocked. > > https://buildd.debian.org/status/package.php?p=notary > > Ivo > >
Bug#926438: stretch-pu: package gocode/20150303-3+deb9u1
Package: release.debian.org Severity: normal Tags: stretch User: release.debian@packages.debian.org Usertags: pu Hi, the recent PU of auto-complete-el caused a regression in gocode-auto-complete-el, which fails to install due to some emacs lisp dependency ordering problem. The easiest workaround is to ensure auto-complete-el is configured first by promoting it to Pre-Depends. I also tried to backport the supposed fix from 20150303-5, but that didn't fix the install error. With the move to elpa (and new upstream releases of both packages) this bug is not relevant for testing/sid. The package is already uploaded. Andreas diff -Nru gocode-20150303/debian/changelog gocode-20150303/debian/changelog --- gocode-20150303/debian/changelog2015-07-28 09:18:12.0 +0200 +++ gocode-20150303/debian/changelog2019-04-05 10:36:56.0 +0200 @@ -1,3 +1,11 @@ +gocode (20150303-3+deb9u1) stretch; urgency=medium + + * Non-maintainer upload. + * gocode-auto-complete-el: Promote auto-complete-el to Pre-Depends. +(Closes: #911590) + + -- Andreas Beckmann Fri, 05 Apr 2019 10:36:56 +0200 + gocode (20150303-3) unstable; urgency=medium * Remove dh_auto_build override (Closes: #793829) diff -Nru gocode-20150303/debian/control gocode-20150303/debian/control --- gocode-20150303/debian/control 2015-07-28 09:18:26.0 +0200 +++ gocode-20150303/debian/control 2019-04-05 10:36:56.0 +0200 @@ -29,7 +29,8 @@ Package: gocode-auto-complete-el Section: editors Architecture: all -Depends: ${shlibs:Depends}, ${misc:Depends}, gocode, auto-complete-el, +Pre-Depends: auto-complete-el, +Depends: ${shlibs:Depends}, ${misc:Depends}, gocode, Enhances: gocode Description: gocode integration for Emacs This package provides gocode integration with Emacs, based on
Bug#926439: unblock: tryton-server/5.0.4-2
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package tryton-server This version fixes CVE-2019-10868. debdiff attached. unblock tryton-server/5.0.4-2 -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (800, 'testing'), (700, 'unstable'), (600, 'experimental'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de_DE.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) diff -Nru tryton-server-5.0.4/debian/changelog tryton-server-5.0.4/debian/changelog --- tryton-server-5.0.4/debian/changelog2019-01-23 16:06:18.0 +0100 +++ tryton-server-5.0.4/debian/changelog2019-04-03 17:29:15.0 +0200 @@ -1,3 +1,15 @@ +tryton-server (5.0.4-2) unstable; urgency=high + + * Add 03_sec_issue8189_check_read_access_on_search_order.patch +for CVE-2019-10868. +This patch fixes security issue http://bugs.tryton.org/issue8189: + Check read access on field in search_order. + An authenticated user can order records based on a field for which + he has no access right. This may allow the user to guess values. + See also https://discuss.tryton.org/t/security-release-for-issue8189/ + + -- Mathias Behrle Wed, 03 Apr 2019 17:29:15 +0200 + tryton-server (5.0.4-1) unstable; urgency=medium * Add more configuration parameters to trytond.conf. diff -Nru tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch --- tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch 1970-01-01 01:00:00.0 +0100 +++ tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch 2019-04-03 17:16:42.0 +0200 @@ -0,0 +1,53 @@ +Description: Check read access on field in search_order. + An authenticated user can order records based on a field for which + he has no access right. This may allow the user to guess values. + +Origin: upstream, http://hg.tryton.org/trytond/rev/b2fab24f9c60 +Bug: http://bugs.tryton.org/issue8189 +Forwarded: not-needed +Last-Update: 2019-04-03 + +--- tryton-server-5.0.4.orig/trytond/model/modelstorage.py tryton-server-5.0.4/trytond/model/modelstorage.py +@@ -395,7 +395,7 @@ class ModelStorage(Model): + + ModelAccess.check(cls.__name__, 'read') + +-def check(domain, cls, to_check): ++def check_domain(domain, cls, to_check): + if is_leaf(domain): + local, relate = (domain[0].split('.', 1) + [None])[:2] + to_check[cls.__name__].add(local) +@@ -405,16 +405,29 @@ class ModelStorage(Model): + else: + target = cls._fields[local].get_target() + target_domain = [(relate,) + tuple(domain[1:])] +-check(target_domain, target, to_check) ++check_domain(target_domain, target, to_check) + elif not domain: + return + else: + i = 1 if domain[0] in ['OR', 'AND'] else 0 + for d in domain[i:]: +-check(d, cls, to_check) ++check_domain(d, cls, to_check) ++ ++def check_order(order, cls, to_check): ++if not order: ++return ++for oexpr, otype in order: ++local, _, relate = oexpr.partition('.') ++to_check[cls.__name__].add(local) ++if relate: ++target = cls._fields[local].get_target() ++target_order = [(relate, otype)] ++check_order(target_order, target, to_check) ++ + if transaction.user and transaction.context.get('_check_access'): + to_check = defaultdict(set) +-check(domain, cls, to_check) ++check_domain(domain, cls, to_check) ++check_order(order, cls, to_check) + for name, fields_names in to_check.items(): + ModelAccess.check(name, 'read') + ModelFieldAccess.check(name, fields_names, 'read') diff -Nru tryton-server-5.0.4/debian/patches/series tryton-server-5.0.4/debian/patches/series --- tryton-server-5.0.4/debian/patches/series 2019-01-23 16:06:17.0 +0100 +++ tryton-server-5.0.4/debian/patches/series 2019-04-03 17:11:53.0 +0200 @@ -1,2 +1,3 @@ 01_migrate_obsolete_modules.patch 02_avoid_call_to_pypi.patch +03_sec_issue8189_check_read_access_on_search_order.patch
Bug#926440: unblock: oggvideotools/0.9.1-5
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package oggvideotools I decided to leave the following all non-invasive changes that were accumulated in Git: + [ Ondřej Nový ] + * d/control: Deprecating priority extra as per policy 4.0.1 + * d/changelog: Remove trailing whitespaces + * d/control: Remove trailing whitespaces + * d/control: Set Vcs-* to salsa.debian.org + * d/control: Remove XS-Testsuite field, not needed anymore + * d/watch: Use https protocol unblock oggvideotools/0.9.1-5 -- System Information: Debian Release: 9.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-6-amd64 (SMP w/1 CPU core) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) diff -Nru oggvideotools-0.9.1/debian/changelog oggvideotools-0.9.1/debian/changelog --- oggvideotools-0.9.1/debian/changelog2019-02-03 14:37:15.0 +0100 +++ oggvideotools-0.9.1/debian/changelog2019-04-05 09:46:07.0 +0200 @@ -1,3 +1,25 @@ +oggvideotools (0.9.1-5) unstable; urgency=medium + + * Team upload. + + [ Ondřej Nový ] + * d/control: Deprecating priority extra as per policy 4.0.1 + * d/changelog: Remove trailing whitespaces + * d/control: Remove trailing whitespaces + * d/control: Set Vcs-* to salsa.debian.org + * d/control: Remove XS-Testsuite field, not needed anymore + * d/watch: Use https protocol + + [ Peter Michael Green ] + * Update dependency and file path for python-mecavideo -> python3-mecavideo +package rename. +Closes: #924608 + + [ Andreas Tille ] + * Standards-Version: 4.3.0 + + -- Andreas Tille Fri, 05 Apr 2019 09:46:07 +0200 + oggvideotools (0.9.1-4.1) unstable; urgency=high * Non-maintainer upload. @@ -168,7 +190,7 @@ oggvideotools (0.7b-ubuntu1) jaunty; urgency=low - * rebuilt with libtheora beta1 + * rebuilt with libtheora beta1 -- jan gerber Tue, 11 Aug 2009 00:27:20 +0200 diff -Nru oggvideotools-0.9.1/debian/control oggvideotools-0.9.1/debian/control --- oggvideotools-0.9.1/debian/control 2019-02-03 14:37:15.0 +0100 +++ oggvideotools-0.9.1/debian/control 2019-04-05 09:46:07.0 +0200 @@ -17,11 +17,10 @@ libboost-dev, debconf, pysycache-i18n, - python-mecavideo, -Standards-Version: 4.0.0 -XS-Testsuite: autopkgtest -Vcs-Git: https://anonscm.debian.org/git/pkg-xiph/oggvideotools.git -Vcs-Browser: https://anonscm.debian.org/cgit/pkg-xiph/oggvideotools.git + python3-mecavideo, +Standards-Version: 4.3.0 +Vcs-Git: https://salsa.debian.org/multimedia-team/oggvideotools.git +Vcs-Browser: https://salsa.debian.org/multimedia-team/oggvideotools Homepage: http://www.streamnik.de/oggvideotools.html Package: oggvideotools @@ -34,7 +33,7 @@ * oggCat - concatenates two ogg video files * oggCut - extracts parts of an ogg file * oggDump - * oggJoin - multiplexes ogg streams + * oggJoin - multiplexes ogg streams * oggLength * oggTranscode - resizes ogg files in multiple ways * oggScroll @@ -45,7 +44,6 @@ Package: oggvideotools-dbg Section: debug -Priority: extra Architecture: any Multi-Arch: no Depends: oggvideotools (= ${binary:Version}), ${misc:Depends} @@ -55,7 +53,7 @@ * oggCat - concatenates two ogg video files * oggCut - extracts parts of an ogg file * oggDump - * oggJoin - multiplexes ogg streams + * oggJoin - multiplexes ogg streams * oggLength * oggTranscode - resizes ogg files in multiple ways * oggScroll diff -Nru oggvideotools-0.9.1/debian/tests/control oggvideotools-0.9.1/debian/tests/control --- oggvideotools-0.9.1/debian/tests/control2017-05-20 08:10:45.0 +0200 +++ oggvideotools-0.9.1/debian/tests/control2019-04-05 09:46:07.0 +0200 @@ -1,4 +1,4 @@ Tests: test-oggjoin test-oggcut -Depends: @, debconf, pysycache-i18n, python-mecavideo, valgrind +Depends: @, debconf, pysycache-i18n, python3-mecavideo, valgrind Restrictions: allow-stderr diff -Nru oggvideotools-0.9.1/debian/tests/test-oggcut oggvideotools-0.9.1/debian/tests/test-oggcut --- oggvideotools-0.9.1/debian/tests/test-oggcut2016-05-24 11:35:01.0 +0200 +++ oggvideotools-0.9.1/debian/tests/test-oggcut2019-04-05 09:46:07.0 +0200 @@ -1,6 +1,6 @@ #!/bin/sh # -# Need the package mktemp and python-mecavideo +# Need the package mktemp and python3-mecavideo # Based on https://bugs.launchpad.net/ubuntu/+source/oggvideotools/+bug/1462697 > # This test does not trigger the reported bug, but test oggCut that do # not crash. To crash, a different input file is needed, as only some @@ -24,7 +24,7 @@ echo "info: Running autopkgtest script $0" -input=/usr/share/python-mecavideo/video/Effet_force_magnetique.ogv +input=/usr/share/python3-mecavideo/video/Effet_f
Bug#926441: unblock: qemu/1:3.1+dfsg-7
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package qemu The version currently in -unstable fixes 2 security issues (CVE-2019-9824 and CVE-2018-20815), patches taken from upstream, and fixes a mistake in previous version of one of the binary packages (qemu-guest-agent) - we misplaced a new config file, putting it to a subdir (/etc/qemu/fsfreeze-hook/ instead of /etc/qemu/fsfreeze-hook), -- this last issue required some work fixing it and moving the file into proper place. All various corner cases of this, including when the user modified that file locally _and_ fixed its location too, where tested and all works ok. This is Ubuntu bug (LP: #1820291) which slipped to Debian too. Here's the debdiff against 1:3.1+dfsg-5 currently in testing: diff -Nru qemu-3.1+dfsg/debian/changelog qemu-3.1+dfsg/debian/changelog --- qemu-3.1+dfsg/debian/changelog 2019-03-11 14:30:44.0 +0300 +++ qemu-3.1+dfsg/debian/changelog 2019-03-27 14:24:06.0 +0300 @@ -1,3 +1,26 @@ +qemu (1:3.1+dfsg-7) unstable; urgency=high + + [ Michael Tokarev ] + * device_tree-don-t-use-load_image-CVE-2018-20815.patch +fix heap buffer overflow while loading device tree blob +(Closes: CVE-2018-20815) + + [ Christian Ehrhardt ] + * qemu-guest-agent: fix path of fsfreeze-hook (LP: #1820291) + - d/qemu-guest-agent.install: use correct path for fsfreeze-hook + - d/qemu-guest-agent.pre{rm|inst}/.postrm: special handling for + mv_conffile since the new path is a directory in the old package + version which can not be handled by mv_conffile. + + -- Michael Tokarev Wed, 27 Mar 2019 14:24:06 +0300 + +qemu (1:3.1+dfsg-6) unstable; urgency=high + + * slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch +fix information leakage in slirp code (Closes: CVE-2019-9824) + + -- Michael Tokarev Mon, 18 Mar 2019 14:41:51 +0300 + qemu (1:3.1+dfsg-5) unstable; urgency=high * i2c-ddc-fix-oob-read-CVE-2019-3812.patch fixes diff -Nru qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch --- qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch 1970-01-01 03:00:00.0 +0300 +++ qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch 2019-03-27 14:16:54.0 +0300 @@ -0,0 +1,35 @@ +From: Peter Maydell +Date: Fri, 14 Dec 2018 13:30:52 + +Subject: device_tree.c: Don't use load_image() (CVE-2018-20815) +Commit-Id: da885fe1ee8b4589047484bd7fa05a4905b52b17 + +The load_image() function is deprecated, as it does not let the +caller specify how large the buffer to read the file into is. +Instead use load_image_size(). + +Signed-off-by: Peter Maydell +Reviewed-by: Richard Henderson +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Eric Blake +Message-id: 20181130151712.2312-9-peter.mayd...@linaro.org +--- + device_tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/device_tree.c b/device_tree.c +index 6d9c9726f66..296278e12ae 100644 +--- a/device_tree.c b/device_tree.c +@@ -91,7 +91,7 @@ void *load_device_tree(const char *filename_path, int *sizep) + /* First allocate space in qemu for device tree */ + fdt = g_malloc0(dt_size); + +-dt_file_load_size = load_image(filename_path, fdt); ++dt_file_load_size = load_image_size(filename_path, fdt, dt_size); + if (dt_file_load_size < 0) { + error_report("Unable to open device tree file '%s'", + filename_path); +-- +2.11.0 + diff -Nru qemu-3.1+dfsg/debian/patches/series qemu-3.1+dfsg/debian/patches/series --- qemu-3.1+dfsg/debian/patches/series 2019-03-11 14:30:08.0 +0300 +++ qemu-3.1+dfsg/debian/patches/series 2019-03-27 14:16:54.0 +0300 @@ -7,3 +7,5 @@ scsi-generic-avoid-possible-oob-access-to-r-buf-CVE-2019-6501.patch slirp-check-data-length-while-emulating-ident-function-CVE-2019-6778.patch i2c-ddc-fix-oob-read-CVE-2019-3812.patch +slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch +device_tree-don-t-use-load_image-CVE-2018-20815.patch diff -Nru qemu-3.1+dfsg/debian/patches/slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch qemu-3.1+dfsg/debian/patches/slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch --- qemu-3.1+dfsg/debian/patches/slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch 1970-01-01 03:00:00.0 +0300 +++ qemu-3.1+dfsg/debian/patches/slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch 2019-03-18 14:41:28.0 +0300 @@ -0,0 +1,49 @@ +From: Samuel Thibault +Date: Thu, 7 Mar 2019 12:51:34 +0100 +Message-Id: <20190307115143.780-5-samuel.thiba...@ens-lyon.org> +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Subject: slirp: check sscanf res
NEW changes in stable-new
Processing changes file: dns-root-data_2019031302~deb9u1_all.changes ACCEPT Processing changes file: dnsruby_1.54-2+deb9u1_all.changes ACCEPT
NEW changes in stable-new
Processing changes file: edk2_0~20161202.7bbe0b3e-1+deb9u1_all.changes ACCEPT
Bug#926442: unblock: torsocks/2.3.0-2
Package: release.debian.org User: release.debian@packages.debian.org Usertags: unblock X-Debbugs-CC: Debian Privacy Tools Maintainers Dear Release Team, Please consider unblocking torsocks 2.3.0-2 for buster: torsocks (2.3.0-2) unstable; urgency=medium [ intrigeri & Sandro Knauß ] * Cherry-pick patch from upstream Git, to fix Totem crashing when run under torsocks, by adding support for the getdents and getdents64 syscalls. (Closes: Tails#16618, which would be severity: important in a Debian context.) [ Ulrike Uhlig ] * Update package description: don't make safety promises that upstream prefers not to. (Closes: #870763) This issue surfaced when testing under Tails; please see: https://redmine.tails.boum.org/code/issues/16618#change-102199 … for more information and the specific history of the issue. We would, of course, dearly love to drop our locally-patched copy of this package and be synced with Debian The full debdiff is attached. Apologies for the non-essential changes to the package description (#870763) but this was already pushed to Salsa and it should be pretty harmless from an unblock point of view. Best wishes, -- ,''`. : :' : Chris Lamb `. `'` la...@debian.org / chris-lamb.co.uk `- debdiff Description: Binary data
Bug#926427: marked as done (unblock: astroidmail/0.14-2.1)
Your message dated Fri, 05 Apr 2019 10:47:46 + with message-id and subject line unblock astroidmail has caused the Debian Bug report #926427, regarding unblock: astroidmail/0.14-2.1 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926427: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926427 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Dear Release Team, Please unblock astroidmail 0.14-2.1. This upload fixes the RC bug https://bugs.debian.org/924818 , which is caused by the compatibility issue between this software and the newer ronn 0.8.x introduced in the Buster cycle. The solution is to use the alternative tool (scdoc) as preferred by upstream to generate the man page. A patch onto CMakeLists.txt is also applied to fix the ronn compatibility issue itself. -- Thanks, Boyuan Yang Full source diff is also provided here: diff -Nru astroidmail-0.14/debian/changelog astroidmail- 0.14/debian/changelog --- astroidmail-0.14/debian/changelog 2018-11-30 15:54:19.0 -0500 +++ astroidmail-0.14/debian/changelog 2019-04-04 19:03:52.0 -0400 @@ -1,3 +1,13 @@ +astroidmail (0.14-2.1) unstable; urgency=high + + * Non-maintainer upload. + * debian/patches: Add a patch to fix compatibility with +newer ronn and solve the FTBFS. (Closes: #924818) + * debian/control: Add build-dependency on scdoc in order to +generate man pages with higher quality. + + -- Boyuan Yang Thu, 04 Apr 2019 19:03:52 -0400 + astroidmail (0.14-2) unstable; urgency=medium * Add patch cherry-picked upstream diff -Nru astroidmail-0.14/debian/control astroidmail- 0.14/debian/control --- astroidmail-0.14/debian/control 2018-10-01 04:27:05.0 -0400 +++ astroidmail-0.14/debian/control 2019-04-04 19:03:50.0 -0400 @@ -28,6 +28,7 @@ pkg-config, protobuf-compiler, python3-gi, + scdoc, ronn, xauth, xvfb, diff -Nru astroidmail-0.14/debian/patches/1002-CMakeLists.txt-Update- ronn-parameters-for-compat-wit.patch astroidmail- 0.14/debian/patches/1002-CMakeLists.txt-Update-ronn-parameters-for- compat-wit.patch --- astroidmail-0.14/debian/patches/1002-CMakeLists.txt-Update-ronn- parameters-for-compat-wit.patch 1969-12-31 19:00:00.0 -0500 +++ astroidmail-0.14/debian/patches/1002-CMakeLists.txt-Update-ronn- parameters-for-compat-wit.patch 2019-04-04 19:01:03.0 -0400 @@ -0,0 +1,25 @@ +From: Boyuan Yang +Date: Thu, 4 Apr 2019 18:44:22 -0400 +Subject: CMakeLists.txt: Update ronn parameters for compat with new ronn + +The newer versions of ronn no longer accepts the -p option. +Using the long option ("--pipe") instead. + +Forwarded: https://github.com/astroidmail/astroid/issues/627 +--- + CMakeLists.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 99b38e4..d1de553 100644 +--- a/CMakeLists.txt b/CMakeLists.txt +@@ -410,7 +410,7 @@ if (NOT DISABLE_DOCS) + message (WARNING "Falling back to 'ronn' for man page generation.") + add_custom_command ( + TARGET astroid +-COMMAND ${RONN} -rp ${CMAKE_SOURCE_DIR}/doc/astroid.1.scd | gzip > ${CMAKE_BINARY_DIR}/astroid.1.gz ++COMMAND ${RONN} -r --pipe ${CMAKE_SOURCE_DIR}/doc/astroid.1.scd | gzip > ${CMAKE_BINARY_DIR}/astroid.1.gz + COMMENT "Generating man page (ronn)") + else () + message (FATAL_ERROR "Neither 'scdoc' nor 'ronn' installed. One is required for man page generation.") diff -Nru astroidmail-0.14/debian/patches/series astroidmail- 0.14/debian/patches/series --- astroidmail-0.14/debian/patches/series 2018-11-30 15:50:50.0 -0500 +++ astroidmail-0.14/debian/patches/series 2019-04-04 18:50:50.0 -0400 @@ -1 +1,2 @@ 020181123~83c03f4.patch +1002-CMakeLists.txt-Update-ronn-parameters-for-compat-wit.patch signature.asc Description: This is a digitally signed message part --- End Message --- --- Begin Message --- Unblocked astroidmail.--- End Message ---
Bug#926435: marked as done (unblock: camitk/4.1.2-3)
Your message dated Fri, 05 Apr 2019 10:48:52 + with message-id and subject line unblock camitk has caused the Debian Bug report #926435, regarding unblock: camitk/4.1.2-3 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926435: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926435 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package camitk diff -Nru camitk-4.1.2/debian/changelog camitk-4.1.2/debian/changelog --- camitk-4.1.2/debian/changelog 2018-10-23 10:19:39.0 +0200 +++ camitk-4.1.2/debian/changelog 2019-04-05 07:36:59.0 +0200 @@ -1,3 +1,14 @@ +camitk (4.1.2-3) unstable; urgency=medium + + [ Andreas Beckmann ] + * libcamitk-dev: Add Breaks against several vtk6 packages to force switching +from libvtk6-dev to libvtk7-dev. (Closes: #926430) + + [ Andreas Tille ] + * Standards-Version: 4.3.0 + + -- Andreas Tille Fri, 05 Apr 2019 07:36:59 +0200 + camitk (4.1.2-2) unstable; urgency=medium * VTK7 compatibility. Closes: #909120 diff -Nru camitk-4.1.2/debian/control camitk-4.1.2/debian/control --- camitk-4.1.2/debian/control 2018-10-23 10:19:39.0 +0200 +++ camitk-4.1.2/debian/control 2019-04-05 07:36:29.0 +0200 @@ -21,7 +21,7 @@ xauth, doxygen, graphviz -Standards-Version: 4.2.1 +Standards-Version: 4.3.0 Vcs-Browser: https://salsa.debian.org/med-team/camitk Vcs-Git: https://salsa.debian.org/med-team/camitk.git Homepage: https://camitk.imag.fr/ @@ -81,7 +81,11 @@ ${shlibs:Depends} Recommends: camitk-imp Suggests: camitk-actionstatemachine -Breaks: libcamitk3-dev +Breaks: libcamitk3-dev, +libvtk6-dev, +libvtk6-java, +libvtk6-jni, +libvtk6-qt-dev, Replaces: libcamitk3-dev Description: Computer Assisted Medical Intervention Tool Kit - development Helps researchers and clinicians to easily and rapidly collaborate in unblock camitk/4.1.2-3 -- System Information: Debian Release: 9.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-6-amd64 (SMP w/1 CPU core) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) --- End Message --- --- Begin Message --- Unblocked camitk.--- End Message ---
Bug#926440: marked as done (unblock: oggvideotools/0.9.1-5)
Your message dated Fri, 05 Apr 2019 10:50:10 + with message-id and subject line unblock oggvideotools has caused the Debian Bug report #926440, regarding unblock: oggvideotools/0.9.1-5 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926440: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926440 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package oggvideotools I decided to leave the following all non-invasive changes that were accumulated in Git: + [ Ondřej Nový ] + * d/control: Deprecating priority extra as per policy 4.0.1 + * d/changelog: Remove trailing whitespaces + * d/control: Remove trailing whitespaces + * d/control: Set Vcs-* to salsa.debian.org + * d/control: Remove XS-Testsuite field, not needed anymore + * d/watch: Use https protocol unblock oggvideotools/0.9.1-5 -- System Information: Debian Release: 9.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-6-amd64 (SMP w/1 CPU core) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) diff -Nru oggvideotools-0.9.1/debian/changelog oggvideotools-0.9.1/debian/changelog --- oggvideotools-0.9.1/debian/changelog2019-02-03 14:37:15.0 +0100 +++ oggvideotools-0.9.1/debian/changelog2019-04-05 09:46:07.0 +0200 @@ -1,3 +1,25 @@ +oggvideotools (0.9.1-5) unstable; urgency=medium + + * Team upload. + + [ Ondřej Nový ] + * d/control: Deprecating priority extra as per policy 4.0.1 + * d/changelog: Remove trailing whitespaces + * d/control: Remove trailing whitespaces + * d/control: Set Vcs-* to salsa.debian.org + * d/control: Remove XS-Testsuite field, not needed anymore + * d/watch: Use https protocol + + [ Peter Michael Green ] + * Update dependency and file path for python-mecavideo -> python3-mecavideo +package rename. +Closes: #924608 + + [ Andreas Tille ] + * Standards-Version: 4.3.0 + + -- Andreas Tille Fri, 05 Apr 2019 09:46:07 +0200 + oggvideotools (0.9.1-4.1) unstable; urgency=high * Non-maintainer upload. @@ -168,7 +190,7 @@ oggvideotools (0.7b-ubuntu1) jaunty; urgency=low - * rebuilt with libtheora beta1 + * rebuilt with libtheora beta1 -- jan gerber Tue, 11 Aug 2009 00:27:20 +0200 diff -Nru oggvideotools-0.9.1/debian/control oggvideotools-0.9.1/debian/control --- oggvideotools-0.9.1/debian/control 2019-02-03 14:37:15.0 +0100 +++ oggvideotools-0.9.1/debian/control 2019-04-05 09:46:07.0 +0200 @@ -17,11 +17,10 @@ libboost-dev, debconf, pysycache-i18n, - python-mecavideo, -Standards-Version: 4.0.0 -XS-Testsuite: autopkgtest -Vcs-Git: https://anonscm.debian.org/git/pkg-xiph/oggvideotools.git -Vcs-Browser: https://anonscm.debian.org/cgit/pkg-xiph/oggvideotools.git + python3-mecavideo, +Standards-Version: 4.3.0 +Vcs-Git: https://salsa.debian.org/multimedia-team/oggvideotools.git +Vcs-Browser: https://salsa.debian.org/multimedia-team/oggvideotools Homepage: http://www.streamnik.de/oggvideotools.html Package: oggvideotools @@ -34,7 +33,7 @@ * oggCat - concatenates two ogg video files * oggCut - extracts parts of an ogg file * oggDump - * oggJoin - multiplexes ogg streams + * oggJoin - multiplexes ogg streams * oggLength * oggTranscode - resizes ogg files in multiple ways * oggScroll @@ -45,7 +44,6 @@ Package: oggvideotools-dbg Section: debug -Priority: extra Architecture: any Multi-Arch: no Depends: oggvideotools (= ${binary:Version}), ${misc:Depends} @@ -55,7 +53,7 @@ * oggCat - concatenates two ogg video files * oggCut - extracts parts of an ogg file * oggDump - * oggJoin - multiplexes ogg streams + * oggJoin - multiplexes ogg streams * oggLength * oggTranscode - resizes ogg files in multiple ways * oggScroll diff -Nru oggvideotools-0.9.1/debian/tests/control oggvideotools-0.9.1/debian/tests/control --- oggvideotools-0.9.1/debian/tests/control2017-05-20 08:10:45.0 +0200 +++ oggvideotools-0.9.1/debian/tests/control2019-04-05 09:46:07.0 +0200 @@ -1,4 +1,4 @@ Tests: test-oggjoin test-oggcut -Depends: @, debconf, pysycache-i18n, python-mecavideo, valgrind +Depends: @, debconf, pysycache-i18n, python3-mecavideo, valgrind Restrictions: allow-stderr diff -Nru oggvideotools-0.9.1/debian/tests/t
Bug#926422: marked as done (unblock: java-atk-wrapper/0.33.3-22)
Your message dated Fri, 05 Apr 2019 14:32:15 + with message-id and subject line unblock java-atk-wrapper has caused the Debian Bug report #926422, regarding unblock: java-atk-wrapper/0.33.3-22 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926422: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926422 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Hello, Please unblock package java-atk-wrapper. As shown in Bug#926420, it has a strong memory leak and performance issue, as raised upstream on https://bugzilla.gnome.org/show_bug.cgi?id=791970 and https://issues.apache.org/jira/browse/NETBEANS-861 It does not make applications really crash, but the latter report says it makes the netbeans UI really unresponsive. unblock java-atk-wrapper/0.33.3-22 -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'proposed-updates'), (500, 'oldoldstable'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental-debug'), (1, 'buildd-experimental'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.0.0 (SMP w/8 CPU cores) Kernel taint flags: TAINT_OOT_MODULE Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) diff -Nru java-atk-wrapper-0.33.3/debian/changelog java-atk-wrapper-0.33.3/debian/changelog --- java-atk-wrapper-0.33.3/debian/changelog2018-05-02 23:06:45.0 +0200 +++ java-atk-wrapper-0.33.3/debian/changelog2019-04-04 22:51:05.0 +0200 @@ -1,3 +1,9 @@ +java-atk-wrapper (0.33.3-22) unstable; urgency=medium + + * patches/remove_component_listener: Fix memory leak (Closes: Bug#926420) + + -- Samuel Thibault Thu, 04 Apr 2019 22:51:05 +0200 + java-atk-wrapper (0.33.3-21) unstable; urgency=medium * Bump Standards-Version to 4.1.4 (no changes). diff -Nru java-atk-wrapper-0.33.3/debian/patches/remove_component_listener java-atk-wrapper-0.33.3/debian/patches/remove_component_listener --- java-atk-wrapper-0.33.3/debian/patches/remove_component_listener 1970-01-01 01:00:00.0 +0100 +++ java-atk-wrapper-0.33.3/debian/patches/remove_component_listener 2019-04-04 22:50:49.0 +0200 @@ -0,0 +1,23 @@ +commit f9faf04a88685d6759c18572988876215332086a +Author: Samuel Thibault +Date: Tue Apr 2 19:55:13 2019 +0200 + +Fix removing component listener + +instead of adding it again. + +Fixes https://bugzilla.gnome.org/show_bug.cgi?id=791970 + +diff --git a/wrapper/org/GNOME/Accessibility/AtkWrapper.java.in b/wrapper/org/GNOME/Accessibility/AtkWrapper.java.in +index 0fbb196..3463a59 100644 +--- a/wrapper/org/GNOME/Accessibility/AtkWrapper.java.in b/wrapper/org/GNOME/Accessibility/AtkWrapper.java.in +@@ -306,7 +306,7 @@ public class AtkWrapper { + case ContainerEvent.COMPONENT_REMOVED: + { + java.awt.Component c = ((ContainerEvent)e).getChild(); +-c.addComponentListener(componentAdapter); ++c.removeComponentListener(componentAdapter); + break; + } + diff -Nru java-atk-wrapper-0.33.3/debian/patches/series java-atk-wrapper-0.33.3/debian/patches/series --- java-atk-wrapper-0.33.3/debian/patches/series 2018-05-02 22:58:28.0 +0200 +++ java-atk-wrapper-0.33.3/debian/patches/series 2019-04-04 22:51:05.0 +0200 @@ -19,4 +19,6 @@ GC parameters coords +remove_component_listener + nojavah --- End Message --- --- Begin Message --- Unblocked java-atk-wrapper.--- End Message ---
Bug#926426: marked as done (unblock: python-smoke-zephyr/1.4.1-1)
Your message dated Fri, 05 Apr 2019 14:34:12 + with message-id and subject line unblock python-smoke-zephyr has caused the Debian Bug report #926426, regarding unblock: python-smoke-zephyr/1.4.1-1 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926426: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926426 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Hello, I'm asking for the unblock of python-smoke-zephyr because a critical bug was solved upstream. This bug was detected in the past and me and upstream thought it was fixed already[0], then after it was reported again recently[1] we found out that the problem still persisted. This time I first tried to fix the problem by uploading 1.4.0-2, and while it was on Unstable I think somebody else filled an unblock request and it was granted, but before this version hit testing I uploaded the correct fix (1.4.1-1) to unstable, that's why you can see two changelog entries on the debdiff. Thanks [0]https://github.com/zeroSteiner/smoke-zephyr/issues/4 [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925208 -- Samuel Henrique python-smoke-zephyr.debdiff Description: Binary data --- End Message --- --- Begin Message --- Unblocked python-smoke-zephyr.--- End Message ---
Bug#926439: marked as done (unblock: tryton-server/5.0.4-2)
Your message dated Fri, 05 Apr 2019 14:36:19 + with message-id and subject line unblock tryton-server has caused the Debian Bug report #926439, regarding unblock: tryton-server/5.0.4-2 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926439: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926439 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package tryton-server This version fixes CVE-2019-10868. debdiff attached. unblock tryton-server/5.0.4-2 -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (800, 'testing'), (700, 'unstable'), (600, 'experimental'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de_DE.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) diff -Nru tryton-server-5.0.4/debian/changelog tryton-server-5.0.4/debian/changelog --- tryton-server-5.0.4/debian/changelog2019-01-23 16:06:18.0 +0100 +++ tryton-server-5.0.4/debian/changelog2019-04-03 17:29:15.0 +0200 @@ -1,3 +1,15 @@ +tryton-server (5.0.4-2) unstable; urgency=high + + * Add 03_sec_issue8189_check_read_access_on_search_order.patch +for CVE-2019-10868. +This patch fixes security issue http://bugs.tryton.org/issue8189: + Check read access on field in search_order. + An authenticated user can order records based on a field for which + he has no access right. This may allow the user to guess values. + See also https://discuss.tryton.org/t/security-release-for-issue8189/ + + -- Mathias Behrle Wed, 03 Apr 2019 17:29:15 +0200 + tryton-server (5.0.4-1) unstable; urgency=medium * Add more configuration parameters to trytond.conf. diff -Nru tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch --- tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch 1970-01-01 01:00:00.0 +0100 +++ tryton-server-5.0.4/debian/patches/03_sec_issue8189_check_read_access_on_search_order.patch 2019-04-03 17:16:42.0 +0200 @@ -0,0 +1,53 @@ +Description: Check read access on field in search_order. + An authenticated user can order records based on a field for which + he has no access right. This may allow the user to guess values. + +Origin: upstream, http://hg.tryton.org/trytond/rev/b2fab24f9c60 +Bug: http://bugs.tryton.org/issue8189 +Forwarded: not-needed +Last-Update: 2019-04-03 + +--- tryton-server-5.0.4.orig/trytond/model/modelstorage.py tryton-server-5.0.4/trytond/model/modelstorage.py +@@ -395,7 +395,7 @@ class ModelStorage(Model): + + ModelAccess.check(cls.__name__, 'read') + +-def check(domain, cls, to_check): ++def check_domain(domain, cls, to_check): + if is_leaf(domain): + local, relate = (domain[0].split('.', 1) + [None])[:2] + to_check[cls.__name__].add(local) +@@ -405,16 +405,29 @@ class ModelStorage(Model): + else: + target = cls._fields[local].get_target() + target_domain = [(relate,) + tuple(domain[1:])] +-check(target_domain, target, to_check) ++check_domain(target_domain, target, to_check) + elif not domain: + return + else: + i = 1 if domain[0] in ['OR', 'AND'] else 0 + for d in domain[i:]: +-check(d, cls, to_check) ++check_domain(d, cls, to_check) ++ ++def check_order(order, cls, to_check): ++if not order: ++return ++for oexpr, otype in order: ++local, _, relate = oexpr.partition('.') ++to_check[cls.__name__].add(local) ++if relate: ++target = cls._fields[local].get_target() ++target_order = [(relate, otype)] ++check_order(target_order, target, to_check) ++ + if transaction.user and transaction.context.get('_check_access'): + to_check = defaultdict(set) +-check(domain,
Bug#926441: marked as done (unblock: qemu/1:3.1+dfsg-7)
Your message dated Fri, 05 Apr 2019 14:37:41 + with message-id and subject line unblock qemu has caused the Debian Bug report #926441, regarding unblock: qemu/1:3.1+dfsg-7 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926441: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926441 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package qemu The version currently in -unstable fixes 2 security issues (CVE-2019-9824 and CVE-2018-20815), patches taken from upstream, and fixes a mistake in previous version of one of the binary packages (qemu-guest-agent) - we misplaced a new config file, putting it to a subdir (/etc/qemu/fsfreeze-hook/ instead of /etc/qemu/fsfreeze-hook), -- this last issue required some work fixing it and moving the file into proper place. All various corner cases of this, including when the user modified that file locally _and_ fixed its location too, where tested and all works ok. This is Ubuntu bug (LP: #1820291) which slipped to Debian too. Here's the debdiff against 1:3.1+dfsg-5 currently in testing: diff -Nru qemu-3.1+dfsg/debian/changelog qemu-3.1+dfsg/debian/changelog --- qemu-3.1+dfsg/debian/changelog 2019-03-11 14:30:44.0 +0300 +++ qemu-3.1+dfsg/debian/changelog 2019-03-27 14:24:06.0 +0300 @@ -1,3 +1,26 @@ +qemu (1:3.1+dfsg-7) unstable; urgency=high + + [ Michael Tokarev ] + * device_tree-don-t-use-load_image-CVE-2018-20815.patch +fix heap buffer overflow while loading device tree blob +(Closes: CVE-2018-20815) + + [ Christian Ehrhardt ] + * qemu-guest-agent: fix path of fsfreeze-hook (LP: #1820291) + - d/qemu-guest-agent.install: use correct path for fsfreeze-hook + - d/qemu-guest-agent.pre{rm|inst}/.postrm: special handling for + mv_conffile since the new path is a directory in the old package + version which can not be handled by mv_conffile. + + -- Michael Tokarev Wed, 27 Mar 2019 14:24:06 +0300 + +qemu (1:3.1+dfsg-6) unstable; urgency=high + + * slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch +fix information leakage in slirp code (Closes: CVE-2019-9824) + + -- Michael Tokarev Mon, 18 Mar 2019 14:41:51 +0300 + qemu (1:3.1+dfsg-5) unstable; urgency=high * i2c-ddc-fix-oob-read-CVE-2019-3812.patch fixes diff -Nru qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch --- qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch 1970-01-01 03:00:00.0 +0300 +++ qemu-3.1+dfsg/debian/patches/device_tree-don-t-use-load_image-CVE-2018-20815.patch 2019-03-27 14:16:54.0 +0300 @@ -0,0 +1,35 @@ +From: Peter Maydell +Date: Fri, 14 Dec 2018 13:30:52 + +Subject: device_tree.c: Don't use load_image() (CVE-2018-20815) +Commit-Id: da885fe1ee8b4589047484bd7fa05a4905b52b17 + +The load_image() function is deprecated, as it does not let the +caller specify how large the buffer to read the file into is. +Instead use load_image_size(). + +Signed-off-by: Peter Maydell +Reviewed-by: Richard Henderson +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Michael S. Tsirkin +Reviewed-by: Eric Blake +Message-id: 20181130151712.2312-9-peter.mayd...@linaro.org +--- + device_tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/device_tree.c b/device_tree.c +index 6d9c9726f66..296278e12ae 100644 +--- a/device_tree.c b/device_tree.c +@@ -91,7 +91,7 @@ void *load_device_tree(const char *filename_path, int *sizep) + /* First allocate space in qemu for device tree */ + fdt = g_malloc0(dt_size); + +-dt_file_load_size = load_image(filename_path, fdt); ++dt_file_load_size = load_image_size(filename_path, fdt, dt_size); + if (dt_file_load_size < 0) { + error_report("Unable to open device tree file '%s'", + filename_path); +-- +2.11.0 + diff -Nru qemu-3.1+dfsg/debian/patches/series qemu-3.1+dfsg/debian/patches/series --- qemu-3.1+dfsg/debian/patches/series 2019-03-11 14:30:08.0 +0300 +++ qemu-3.1+dfsg/debian/patches/series 2019-03-27 14:16:54.0 +0300 @@ -7,3 +7,5 @@ scsi-generic-avoid-possible-oob-access-to-r-buf-CVE-2019-6501.patch slirp-check-data-length-while-emulating-ident-function-CVE-2019-6778.patch i2c-ddc-fix-oob-read-CVE-2019-3812.patch +slirp-check-sscanf-result-when-emulating-ident-CVE-2019-9824.patch +device_tree-do
Bug#926442: marked as done (unblock: torsocks/2.3.0-2)
Your message dated Fri, 05 Apr 2019 14:38:49 + with message-id and subject line unblock torsocks has caused the Debian Bug report #926442, regarding unblock: torsocks/2.3.0-2 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926442: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926442 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org User: release.debian@packages.debian.org Usertags: unblock X-Debbugs-CC: Debian Privacy Tools Maintainers Dear Release Team, Please consider unblocking torsocks 2.3.0-2 for buster: torsocks (2.3.0-2) unstable; urgency=medium [ intrigeri & Sandro Knauß ] * Cherry-pick patch from upstream Git, to fix Totem crashing when run under torsocks, by adding support for the getdents and getdents64 syscalls. (Closes: Tails#16618, which would be severity: important in a Debian context.) [ Ulrike Uhlig ] * Update package description: don't make safety promises that upstream prefers not to. (Closes: #870763) This issue surfaced when testing under Tails; please see: https://redmine.tails.boum.org/code/issues/16618#change-102199 … for more information and the specific history of the issue. We would, of course, dearly love to drop our locally-patched copy of this package and be synced with Debian The full debdiff is attached. Apologies for the non-essential changes to the package description (#870763) but this was already pushed to Salsa and it should be pretty harmless from an unblock point of view. Best wishes, -- ,''`. : :' : Chris Lamb `. `'` la...@debian.org / chris-lamb.co.uk `- debdiff Description: Binary data --- End Message --- --- Begin Message --- Unblocked torsocks.--- End Message ---
Bug#926454: unblock: biabam/0.9.7-7.2
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock biabam 0.9.7-7.2. This upload fixes the RC bug https://bugs.debian.org/925227 , which is lintian error debian-rules-missing- required-target binary-arch. The full source diff is attached here. -- Regards, Boyuan diff -Nru biabam-0.9.7/debian/changelog biabam-0.9.7/debian/changelog --- biabam-0.9.7/debian/changelog 2010-04-03 10:55:20.0 -0400 +++ biabam-0.9.7/debian/changelog 2019-04-04 20:14:31.0 -0400 @@ -1,3 +1,34 @@ +biabam (0.9.7-7.2) unstable; urgency=medium + + * Non-maintainer upload. + * Revert changes not relevant to RC bugs for the release freeze +period. (debhelper compat level). + + -- Boyuan Yang Thu, 04 Apr 2019 20:14:31 -0400 + +biabam (0.9.7-7.1) unstable; urgency=high + + * Non-maintainer upload. + + [ Bhavani Shankar ] + * Apply downstream Ubuntu 0.9.7-7ubuntu1 patches. ++ debian/compat: Bump to 9. ++ debian/control: Build-depend on debhelper (>= 9). ++ debian/rules: + - Add required binary-arch target. (Closes: 925227). + - Add recommended build-arch and build-indep targets. +(Fix FTBFS with dpkg-buildpackage -B and -A). + + [ Boyuan Yang ] + * debian/control: ++ Replace obsolete package priority (extra) with + Priority: optional. ++ Update dependency on "exim4 | mail-transport-agent" to + "default-mta | mail-transport-agent | exim4" in order to + fix lintian warning. + + -- Boyuan Yang Thu, 04 Apr 2019 18:15:23 -0400 + biabam (0.9.7-7) unstable; urgency=low * Accepted period in mail body (Closes: #390669) diff -Nru biabam-0.9.7/debian/control biabam-0.9.7/debian/control --- biabam-0.9.7/debian/control 2010-03-29 15:59:10.0 -0400 +++ biabam-0.9.7/debian/control 2019-04-04 20:14:31.0 -0400 @@ -1,6 +1,6 @@ Source: biabam Section: mail -Priority: extra +Priority: optional Maintainer: Thierry Randrianiriana Build-Depends: debhelper (>= 5), quilt (>= 0.40) Standards-Version: 3.8.4 diff -Nru biabam-0.9.7/debian/rules biabam-0.9.7/debian/rules --- biabam-0.9.7/debian/rules 2010-04-03 11:22:43.0 -0400 +++ biabam-0.9.7/debian/rules 2019-04-04 20:12:48.0 -0400 @@ -10,6 +10,8 @@ include /usr/share/quilt/quilt.make build: build-stamp +build-arch: build-stamp +build-indep: build-stamp build-stamp: $(QUILT_STAMPFN) touch build-stamp @@ -39,5 +41,9 @@ dh_md5sums dh_builddeb -binary: binary-indep -.PHONY: build clean binary-indep binary install patch unpatch +# Build architecture-dependent files here. +binary-arch: build install +# We have nothing to do by default. + +binary: binary-indep binary-arch +.PHONY: build build-arch build-indep clean binary-indep binary-arch binary install patch unpatch signature.asc Description: This is a digitally signed message part
Bug#926455: mail_autoremovals: incorrect version number in email warning
Package: release.debian.org Severity: normal I received the following warning mail regarding an autoremoval: > Subject: duc is marked for autoremoval from testing > Date: Fri, 05 Apr 2019 04:39:19 + > > duc 1.4.3-6 is marked for autoremoval from testing on 2019-04-20 > > It is affected by these RC bugs: > 924473: duc: FTBFS (dh_installman: Cannot find "debian/build-nox/doc/duc.1") In fact, #924473 affected duc 1.4.3-5, and 1.4.3-6 contained the bug fix. (I got a separate, correct email for 1.4.3-5, earlier.) In terms of time frame, the wrong mail was received on 5th Apr, the fix was uploaded on 30 Mar and transitioned to testing on 5th Apr, it seems 6 seconds after this mail's Date header was generated: https://tracker.debian.org/news/1037367/duc-143-6-migrated-to-testing/ -- System Information: Debian Release: 9.7 APT prefers stable APT policy: (990, 'stable'), (500, 'stable-debug'), (500, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)
Bug#926456: unblock: debian-timeline/42
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock X-Debbugs-CC: debian-public...@lists.debian.org Please unblock debian-timeline 42. This is a native package handled by Debian Publicity Team that aims to build https://timeline.debian.net/ . -- Thanks, Boyuan Yang signature.asc Description: This is a digitally signed message part
Bug#926456: marked as done (unblock: debian-timeline/42)
Your message dated Fri, 05 Apr 2019 16:12:23 + with message-id and subject line unblock debian-timeline has caused the Debian Bug report #926456, regarding unblock: debian-timeline/42 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 926456: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926456 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock X-Debbugs-CC: debian-public...@lists.debian.org Please unblock debian-timeline 42. This is a native package handled by Debian Publicity Team that aims to build https://timeline.debian.net/ . -- Thanks, Boyuan Yang signature.asc Description: This is a digitally signed message part --- End Message --- --- Begin Message --- Unblocked debian-timeline.--- End Message ---
Bug#926480: unblock: tvtime/1.0.11-4
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package tvtime The patch fixes #924076, a insecure usage of /tmp. The important part of the debdiff is this: --- a/src/utils.c +++ b/src/utils.c @@ -202,17 +202,11 @@ } } -/* If we can't use our /tmp directory, put the fifo in $HOME. */ -if( !mkdir_and_force_owner( fifodir, uid, getgid() ) ) { -if( asprintf( &fifo, "%s/.tvtime/tvtimefifo-%s", - getenv( "HOME" ), hostname ) < 0 ) { -fifo = 0; -} -} else { -if( asprintf( &fifo, "%s/tvtimefifo-%s", fifodir, hostname ) < 0 ) { -fifo = 0; -} -} +/* put the fifo in $HOME */ + if( asprintf( &fifo, "%s/.tvtime/tvtimefifo-%s", + getenv( "HOME" ), hostname ) < 0 ) { + fifo = 0; + } free( hostname ); free( fifodir ); return fifo; (Sorry for the refreshing of the patches, I realized this just now that this would not have been necessary) Debdiff attached. Cheers, tobi unblock tvtime/1.0.11-4 -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-4-amd64 (SMP w/8 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled diff -Nru tvtime-1.0.11/debian/changelog tvtime-1.0.11/debian/changelog --- tvtime-1.0.11/debian/changelog 2018-12-10 23:50:07.0 +0100 +++ tvtime-1.0.11/debian/changelog 2019-04-05 20:27:01.0 +0200 @@ -1,3 +1,14 @@ +tvtime (1.0.11-5) unstable; urgency=medium + + * QA upload. + * Create repository on salsa. + * Refresh patches + * Fix "insecure use of /tmp" by only using the fall back to $HOME. +This is patch 0002-disable-insecure-temp-file.patch +(Closes: #924076) + + -- Tobias Frost Fri, 05 Apr 2019 20:27:01 +0200 + tvtime (1.0.11-4) unstable; urgency=medium * QA upload. diff -Nru tvtime-1.0.11/debian/control tvtime-1.0.11/debian/control --- tvtime-1.0.11/debian/control2018-12-10 23:50:07.0 +0100 +++ tvtime-1.0.11/debian/control2019-04-05 19:56:54.0 +0200 @@ -22,6 +22,8 @@ libasound2-dev Standards-Version: 3.9.3 Homepage: https://linuxtv.org/wiki/index.php/Tvtime +VCS-Browser: https://salsa.debian.org/debian/tvtime +VCS-Git: https://salsa.debian.org/debian/tvtime.git Package: tvtime Architecture: any diff -Nru tvtime-1.0.11/debian/patches/0001-Fix-warning-implicit-declaration-of-function-minor-m.patch tvtime-1.0.11/debian/patches/0001-Fix-warning-implicit-declaration-of-function-minor-m.patch --- tvtime-1.0.11/debian/patches/0001-Fix-warning-implicit-declaration-of-function-minor-m.patch 2018-12-10 21:35:44.0 +0100 +++ tvtime-1.0.11/debian/patches/0001-Fix-warning-implicit-declaration-of-function-minor-m.patch 2019-04-05 19:57:51.0 +0200 @@ -14,8 +14,6 @@ src/get_media_devices.c | 1 + 1 file changed, 1 insertion(+) -diff --git a/src/get_media_devices.c b/src/get_media_devices.c -index 619734ea..453b0677 100644 --- a/src/get_media_devices.c +++ b/src/get_media_devices.c @@ -23,6 +23,7 @@ @@ -26,6 +24,3 @@ #include #include #include --- -2.11.0 - diff -Nru tvtime-1.0.11/debian/patches/0002-disable-insecure-temp-file.patch tvtime-1.0.11/debian/patches/0002-disable-insecure-temp-file.patch --- tvtime-1.0.11/debian/patches/0002-disable-insecure-temp-file.patch 1970-01-01 01:00:00.0 +0100 +++ tvtime-1.0.11/debian/patches/0002-disable-insecure-temp-file.patch 2019-04-05 20:10:15.0 +0200 @@ -0,0 +1,25 @@ +--- a/src/utils.c b/src/utils.c +@@ -202,17 +202,11 @@ + } + } + +-/* If we can't use our /tmp directory, put the fifo in $HOME. */ +-if( !mkdir_and_force_owner( fifodir, uid, getgid() ) ) { +-if( asprintf( &fifo, "%s/.tvtime/tvtimefifo-%s", +- getenv( "HOME" ), hostname ) < 0 ) { +-fifo = 0; +-} +-} else { +-if( asprintf( &fifo, "%s/tvtimefifo-%s", fifodir, hostname ) < 0 ) { +-fifo = 0; +-} +-} ++/* put the fifo in $HOME */ ++if( asprintf( &fifo, "%s/.tvtime/tvtimefifo-%s", ++ getenv( "HOME" ), hostname ) < 0 ) { ++fifo = 0; ++} + free( hostname ); + free( fifodir ); + return fifo; diff -Nru tvtime-1.0.11/debian/patches/freetype.patch tvtime-1.0.11/debian/patches/freetype.patch --- tvtime-1.0.11/debian/patches/freetype.patch 2018-10-26 17:32:26.0 +0200 +++ tvtime-1.0.11/debian/patches/freetype.patch 2019-04-05 19:57:50.0 +0200 @@ -2,9 +2,9 @@ Author: Adrian Bunk Bug-D
Bug#926481: stretch-pu: package open-vm-tools/2:10.1.5-5055683-4+deb9u2
Package: release.debian.org Severity: normal Tags: stretch User: release.debian@packages.debian.org Usertags: pu Hi release team, as discuassed with the security team, I'd like to fix #925959 with the next stable pointrelease. The proposed debdiff is attached. Please let me know if its okay to upload. Thanks, Bernd -- Bernd ZeimetzDebian GNU/Linux Developer http://bzed.dehttp://www.debian.org GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F diff --git a/debian/changelog b/debian/changelog index 0be9f865..9b8f4cbb 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,20 @@ +open-vm-tools (2:10.1.5-5055683-4+deb9u2) stable; urgency=medium + + * [34db05f] /tmp/VMwareDnD permissions security fix. +Fix possible security issue with the permissions of the intermediate +staging directory and path +/tmp/VMwareDnD is a staging directory used for DnD and CnP. It should be +a regular directory, but malicious code or user may create the /tmp/VMwareDnD +as a symbolic link which points elsewhere on the system. This may provide +user access to user B's files. +Do not set the permission of the root directory if the root directory +already exists and has the wrong permission. The permission of the directory +must be 1777 if it is created by the VMToolsi. If not, then the directory +has been created or modified by malicious code or user, so just cancel the +host to guest DnD or CnP operation. (Closes: #925959) + + -- Bernd Zeimetz Fri, 05 Apr 2019 23:10:04 +0200 + open-vm-tools (2:10.1.5-5055683-4+deb9u1) stretch; urgency=medium * [dec8df6] Upstream fix for CVE-2015-5191 (Closes: #869633) diff --git a/debian/patches/e88f91b00a715b79255de6576506d80ecfdb064c_vmware_dnd_fix.patch b/debian/patches/e88f91b00a715b79255de6576506d80ecfdb064c_vmware_dnd_fix.patch new file mode 100644 index ..43daed8a --- /dev/null +++ b/debian/patches/e88f91b00a715b79255de6576506d80ecfdb064c_vmware_dnd_fix.patch @@ -0,0 +1,54 @@ +commit e88f91b00a715b79255de6576506d80ecfdb064c +Author: Oliver Kurth +Date: Tue Jan 29 14:03:19 2019 -0800 + +Fix possible security issue with the permissions of the intermediate +staging directory and path + +/tmp/VMwareDnD is a staging directory used for DnD and CnP. It should be +a regular directory, but malicious code or user may create the /tmp/VMwareDnD +as a symbolic link which points elsewhere on the system. This may provide +user access to user B's files. + +Do not set the permission of the root directory if the root directory +already exists and has the wrong permission. The permission of the directory +must be 1777 if it is created by the VMToolsi. If not, then the directory +has been created or modified by malicious code or user, so just cancel the +host to guest DnD or CnP operation. + +--- a/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c b/open-vm-tools/services/plugins/dndcp/dnd/dndCommon.c +@@ -276,12 +276,11 @@ DnDCreateRootStagingDirectory(void) +} + +if (File_Exists(root)) { +- if (!DnDRootDirUsable(root) && +- !DnDSetPermissionsOnRootDir(root)) { ++ if (!DnDRootDirUsable(root)) { + /* +- * The directory already exists and its permissions are wrong and +- * cannot be set, so there's not much we can do. ++ * The directory already exists and its permissions are wrong. + */ ++ Log("%s: The root dir is not usable.\n", __FUNCTION__); + return NULL; + } +} else { +--- a/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c b/open-vm-tools/services/plugins/dndcp/dnd/dndXdg.c +@@ -318,12 +318,11 @@ CreateApparentRootDirectory(void) +} + +if (File_Exists(root)) { +- if ( !DnDRootDirUsable(root) +- && !DnDSetPermissionsOnRootDir(root)) { ++ if (!DnDRootDirUsable(root)) { + /* +- * The directory already exists and its permissions are wrong and +- * cannot be set, so there's not much we can do. ++ * The directory already exists and its permissions are wrong. + */ ++ Log_Trivia("dnd: The root dir is not usable.\n"); + return NULL; + } +} else { diff --git a/debian/patches/series b/debian/patches/series index 2c8fbff7..58f5849b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -5,3 +5,4 @@ from_arch/0001-Fix-vmxnet-module-on-kernels-3.16.patch debian/enable_vmhgfs-fuse_by_default debian/vmxnet_fix_kernel_4.7.patch debian/cve-2015-5191.patch +e88f91b00a715b79255de6576506d80ecfdb064c_vmware_dnd_fix.patch
Bug#926484: unblock: gpsd/3.17-6
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Hi release-team, please unblock package gpsd. The applied diff was discussed with the release team and we've decided its the best way to fix the json related fixes. Diff between 3.17-5 und 3.17-6 is attached to this mail. * [0a8e4e18] Pull json fixes from upstream to fix a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs. CVE-2018-17937 / Closes: #925327 The update also fixes several other json parser bugs. - ECMA-404 says JSON \u must have 4 hex digits - Allow for \u escapes with fewer than 4 digits. - Fail on bad escape string. unblock gpsd/3.17-6 Thanks, Bernd -- Bernd ZeimetzDebian GNU/Linux Developer http://bzed.dehttp://www.debian.org GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F diff --git a/debian/changelog b/debian/changelog index ebd29108b..16bb69795 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,19 @@ +gpsd (3.17-6) unstable; urgency=medium + + * [0a8e4e18] Pull json fixes from upstream to fix a stack-based +buffer overflow, which may allow remote attackers to execute +arbitrary code on embedded platforms via traffic on Port +2947/TCP or crafted JSON inputs. +CVE-2018-17937 / Closes: #925327 +The update also fixes several other json parser bugs. +- ECMA-404 says JSON \u must have 4 hex digits +- Allow for \u escapes with fewer than 4 digits. +- Fail on bad escape string. + * [71020f4f] Update git-buildpackage config to build from the +buster branch. + + -- Bernd Zeimetz Fri, 05 Apr 2019 23:31:30 +0200 + gpsd (3.17-5) unstable; urgency=medium * [fd1e83f9] Add pkg-config as Build-Dependency. diff --git a/debian/gbp.conf b/debian/gbp.conf index 1529a93db..151b02d6b 100644 --- a/debian/gbp.conf +++ b/debian/gbp.conf @@ -4,7 +4,7 @@ # the default branch for upstream sources: #upstream-branch = upstream # the default branch for the debian patch: -#debian-branch = master +debian-branch = buster # the default tag formats used: #upstream-tag = upstream/%(version)s #debian-tag = debian/%(version)s diff --git a/debian/patches/json-cve-fix b/debian/patches/json-cve-fix new file mode 100644 index 0..e81237bee --- /dev/null +++ b/debian/patches/json-cve-fix @@ -0,0 +1,170 @@ +--- a/json.c b/json.c +@@ -30,7 +30,7 @@ will match the right spec against the ac + recognize the JSON "null" value. Secondly, arrays may not have + character values as elements (this limitation could be easily removed + if required). Third, all elements of an array must be of the same +-type. ++type. Fourth, it can not handle NaN's in doubles (Issue 53150). + +There are separate entry points for beginning a parse of either + JSON object or a JSON array. JSON "float" quantities are actually +@@ -59,7 +59,7 @@ reusable module; search for "microjson". + + PERMISSIONS +This file is Copyright (c) 2010 by the GPSD project +- BSD terms apply: see the file COPYING in the distribution root for details. ++ SPDX-License-Identifier: BSD-2-clause + + ***/ + #include +@@ -188,7 +188,7 @@ static int json_internal_read_object(con + char *lptr; + + if (end != NULL) +- *end = NULL;/* give it a well-defined value on parse failure */ ++ *end = NULL;/* give it a well-defined value on parse failure */ + + /* stuff fields with defaults in case they're omitted in the JSON input */ + for (cursor = attrs; cursor->attribute != NULL; cursor++) +@@ -294,7 +294,8 @@ static int json_internal_read_object(con + } + if (cursor->attribute == NULL) { + json_debug_trace((1, +-"Unknown attribute name '%s' (attributes begin with '%s').\n", ++"Unknown attribute name '%s'" ++ " (attributes begin with '%s').\n", + attrbuf, attrs->attribute)); + /* don't update end here, leave at attribute start */ + return JSON_ERR_BADATTR; +@@ -374,6 +375,12 @@ static int json_internal_read_object(con + if (pval == NULL) + /* don't update end here, leave at value start */ + return JSON_ERR_NULLPTR; ++ else if (pval > valbuf + JSON_VAL_MAX - 1 ++ || pval > valbuf + maxlen) { ++ json_debug_trace((1, "String value too long.\n")); ++ /* don't update end here, leave at value start */ ++ return JSON_ERR_STRLONG;/* */ ++ } + switch (*cp) { + case 'b': + *pval++ =
Bug#926495: unblock: gnome-gmail/2.6-1
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package gnome-gmail This version contains a minimal change that resolves the serious bug against Buster - #926487. A recent Gmail update is unable to properly process upload MIME-encoded messages that do not include a message body.The latest gnome-gmail resolves the issue by taking more effort for messages to be well formed - to always include a message body, and to drop the "To:" header if otherwise blank. Debdiff attached. unblock gnome-gmail/2.6-1 -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (700, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-4-amd64 (SMP w/6 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash diff -Nru gnome-gmail-2.5.6/debian/changelog gnome-gmail-2.6/debian/changelog --- gnome-gmail-2.5.6/debian/changelog 2018-10-09 13:38:04.0 -0400 +++ gnome-gmail-2.6/debian/changelog2019-04-05 21:18:19.0 -0400 @@ -1,3 +1,9 @@ +gnome-gmail (2.6-1) unstable; urgency=medium + + * Fix Gmail bug - bad message if no body (Closes: 926487). + + -- David Steele Fri, 05 Apr 2019 21:18:19 -0400 + gnome-gmail (2.5.6-1) unstable; urgency=medium * Fix bug in setup.py distutils. diff -Nru gnome-gmail-2.5.6/gnome-gmail.appdata.xml.in gnome-gmail-2.6/gnome-gmail.appdata.xml.in --- gnome-gmail-2.5.6/gnome-gmail.appdata.xml.in2018-10-09 11:22:57.0 -0400 +++ gnome-gmail-2.6/gnome-gmail.appdata.xml.in 2019-04-05 21:22:56.0 -0400 @@ -51,6 +51,7 @@ + diff -Nru gnome-gmail-2.5.6/gnomegmail.py gnome-gmail-2.6/gnomegmail.py --- gnome-gmail-2.5.6/gnomegmail.py 2018-10-09 11:22:57.0 -0400 +++ gnome-gmail-2.6/gnomegmail.py 2019-04-05 21:22:56.0 -0400 @@ -569,7 +569,8 @@ qsdict = urllib.parse.parse_qs(query_string) -qsdict['to'] = [address] +if address: +qsdict['to'] = [address] if 'attachment' in qsdict: qsdict['attach'] = qsdict['attachment'] @@ -587,6 +588,9 @@ if 'su' in qsdict: outdict["subject"] = outdict["su"] +if "body" not in qsdict: +outdict["body"] = " " + return(outdict) def simple_gmail_url(self): diff -Nru gnome-gmail-2.5.6/setup.py gnome-gmail-2.6/setup.py --- gnome-gmail-2.5.6/setup.py 2018-10-09 11:22:57.0 -0400 +++ gnome-gmail-2.6/setup.py2019-04-05 21:22:56.0 -0400 @@ -129,7 +129,7 @@ setup( name='gnome-gmail', -version='2.5.6', +version='2.6', description='support for Gmail as the preferred GNOME email application', author='David Steele', author_email='dste...@gmail.com', diff -Nru gnome-gmail-2.5.6/test/test_body.py gnome-gmail-2.6/test/test_body.py --- gnome-gmail-2.5.6/test/test_body.py 2018-10-09 11:22:57.0 -0400 +++ gnome-gmail-2.6/test/test_body.py 2019-04-05 21:22:56.0 -0400 @@ -107,8 +107,8 @@ @pytest.mark.parametrize("mailto, needs_api", ( -("mailto:joe";, False), -("mailto:joe?subject=hi";, False), +("mailto:joe";, True), +("mailto:joe?subject=hi";, True), ("mailto:joe?body=%20";, True), ("mailto:joe?attach=file";, True), ("mailto:joe?attachment=file";, True),
Bug#891010: marked as done (nmu: ruby-bcrypt-pbkdf_1.0.0-1)
Your message dated Sat, 6 Apr 2019 08:11:17 +0200 with message-id <20a30052-9ad4-a388-712a-8aaee93e4...@debian.org> and subject line Re: Subject: nmu: ruby-bcrypt-pbkdf_1.0.0-1 has caused the Debian Bug report #891010, regarding nmu: ruby-bcrypt-pbkdf_1.0.0-1 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 891010: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891010 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org User: release.debian@packages.debian.org Usertags: binnmu Severity: normal nmu ruby-bcrypt-pbkdf_1.0.0-1 . ANY . unstable . -m "Rebuild for ruby 2.5 support" -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.14.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=ml_IN.UTF-8, LC_CTYPE=ml_IN.UTF-8 (charmap=UTF-8), LANGUAGE=ml_IN.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) signature.asc Description: OpenPGP digital signature --- End Message --- --- Begin Message --- Hi, On Wed, 21 Feb 2018 19:30:54 +0530 Pirate Praveen wrote: > nmu ruby-bcrypt-pbkdf_1.0.0-1 . ANY . unstable . -m "Rebuild for ruby > 2.5 support" A new version of ruby-bcrypt-pbkdf got uploaded since, so this is moot now. Paul signature.asc Description: OpenPGP digital signature --- End Message ---
Bug#872293: nmu: loads of golang stuff
Control: tags -1 moreinfo Hi On Sat, 9 Dec 2017 12:24:40 -0500 Paul Tagliamonte wrote: > > What's outdated here, built-using? If so, we rebuild those before or during > > the > > freeze. Not sure we need to do it more often than that, as things will get > > out > > of date again before the freeze. > > Due to the way golang binaries get built, not rebuilding them outside > of freeze results in binaries that become buggy during freeze and > trigger more uploads and rebuilds. > > buildd time is cheep, and ensuring we can both get rid of old sources > and find bugs is important during development. > > The other way we can do this is I can do routine empty uploads -- we > need them rebuilt either way There was a second bug filed (916642) which has seen action. So is there anything missing from there with respect to this list? Also this bug is rather old to fix "out-of-date" issues, so I think it should be closed. Also quoting from that bug: * We (the release team) generally try to rebuild packages with outdated built-using before the release. Paul signature.asc Description: OpenPGP digital signature
Processed: Re: Bug#872293: nmu: loads of golang stuff
Processing control commands: > tags -1 moreinfo Bug #872293 [release.debian.org] nmu: loads of golang stuff Added tag(s) moreinfo. -- 872293: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872293 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#850447: marked as done (nmu: systemd_230-7~bpo8+2)
Your message dated Sat, 6 Apr 2019 08:03:12 +0200 with message-id <372a58c6-ca6d-0cf9-b5f3-c655586ac...@debian.org> and subject line Re: Bug#850447: systemd backport sections only 4K aligned, won't boot with arm64 64K kernel has caused the Debian Bug report #850447, regarding nmu: systemd_230-7~bpo8+2 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 850447: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850447 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: systemd Version: 230-7~bpo8+2 Severity: normal Hi, This version of systemd won't boot on arm64 when the kernel is configured for 64K pages: > Starting init: /etc/init exists but couldn't execute it (error -13) > Starting init: /bin/sh exists but couldn't execute it (error -14) > Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance. > CPU: 3 PID: 1 Comm: init Not tainted 4.10.0-rc2-00036-g5a4dd5f49931 #6712 > Hardware name: ARM Juno development board (r1) (DT) > Call trace: > [] dump_backtrace+0x0/0x25c > [] show_stack+0x20/0x28 > [] dump_stack+0x94/0xb4 > [] panic+0x134/0x2a4 > [] kernel_init+0xf4/0x104 > [] ret_from_fork+0x10/0x20 Booting with init=/bin/bash and interrogating the linker: > root@(none):/lib/systemd# /lib/ld-linux-aarch64.so.1 --list /sbin/init > /sbin/init: error while loading shared libraries: /sbin/init: ELF load command alignment not page-aligned Comparing sytemd's LOAD sections with bash's: > root@(none):/lib/systemd# readelf -a /sbin/init | grep -A 1 LOAD > LOAD 0x 0x 0x > 0x000bc56c 0x000bc56c R E1000 > LOAD 0x000bc7a8 0x000bd7a8 0x000bd7a8 > 0x00020a88 0x00020b7d RW 1000 > root@(none):/lib/systemd# readelf -a /bin/bash | grep -A 1 LOAD > LOAD 0x 0x0040 0x0040 > 0x000d49f4 0x000d49f4 R E1 > LOAD 0x000d4db0 0x004e4db0 0x004e4db0 > 0x8ae8 0xe728 RW 1 (The key to these tables is:) > Program Headers: > Type Offset VirtAddr PhysAddr > FileSizMemSiz Flags Align The Align value for each of systemd's LOAD sections is 4K aligned, not 64K, so the runtime linker can't load it when the kernel is built with a page-size other than 4K. This was reported by Basil Eljuse who was using a filesystem from Linaro. Sanity check whether this should be reported to debian by poking around in the original deb file: > readlink sbin/init > /lib/systemd/systemd > wget http://ftp.uk.debian.org/debian/pool/main/s/systemd/systemd_230-7~bpo8+2_arm64.deb > ar x systemd_230-7~bpo8+2_arm64.deb > tar xf data.tar.xz > readelf -a lib/systemd/systemd | grep -A 1 LOAD > LOAD 0x 0x 0x > 0x000bc56c 0x000bc56c R E1000 > LOAD 0x000bc7a8 0x000bd7a8 0x000bd7a8 > 0x00020a88 0x00020b7d RW 1000 This is potentially a wider issue affecting anything else built with the same linker that built this 'bpo' package. Thanks, James -- Package-specific info: -- System Information: Debian Release: 8.6 APT prefers vivid APT policy: (500, 'vivid'), (500, 'stable-updates'), (500, 'stable') Architecture: arm64 (aarch64) Kernel: Linux 4.10.0-rc2-00036-g5a4dd5f49931 (SMP w/6 CPU cores) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages systemd depends on: ii adduser 3.113+nmu3 ii libacl1 2.2.52-2 ii libapparmor12.10.95-4~bpo8+2 ii libaudit1 1:2.4-1+b1 ii libblkid1 2.27.1-1.linarojessie.1 ii libc6 2.19-18+deb8u6 ii libcap2 1:2.24-8 ii libcap2-bin 1:2.24-8 ii libcryptsetup4 2:1.6.6-5 ii libgcrypt20 1.6.3-2+deb8u2 ii libgpg-error0 1.17-3 ii libidn111.29-1+deb8u2 ii libkmod218-3 ii liblzma55.1.1alpha+20120614-2+b3 ii libmount1 2.27.1-1.linarojessie.1 ii libpam0g1.1.8-3.1+deb8u1+b1 ii libseccomp2 2.2.3-3~bpo8+1 ii libselinux1 2.3-2 ii libsystemd0 230-7~bpo8+2 ii mount 2.27.1-1.linarojessie.1 ii util-linux 2.27.1-1.linarojes