[Telepathy] ANNOUNCE: Empathy 3.7.91

2013-03-04 Thread Guillaume Desmottes 
Empathy 3.7.91 is now available for download from:
http://download.gnome.org/sources/empathy/3.7/

2e459bbc06034df1dfd1b5f9564a411a  empathy-3.7.91.tar.xz


What is it?
===
Empathy is a messaging program which supports text, voice, and video
chat and file transfers over many different protocols.  Empathy is the
default chat client in GNOME, and is based on the Telepathy framework,
making it easier for other GNOME applications to integrate collaboration
functionality.

You can visit the project web site:
http://live.gnome.org/Empathy

What's New?
===
Translations:
 - Updated cs Translation (Adam Matoušek)
 - Updated el Translation (Dimitris Spingos)
 - Updated lv Translation (Rūdolfs Mazurs)
 - Updated pa Translation (A S Alam)
 - Updated ug Translation (Gheyret Kenji)

Documentation translations:
 - Updated de Documentation translation (Tobias Endrigkeit)

04 March 2013
Empathy team


___
telepathy mailing list
telepathy@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/telepathy

Re: [Telepathy] Announce: telepathy-gabble 0.16.5

2013-03-04 Thread Will Thompson 

On 04/03/13 12:26, Will Thompson wrote:

tarball: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.16.5.tar.gz
signature: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.16.5.tar.gz.asc


I or the release script messed up, and these weren't uploaded before. 
Fixed now. Thanks to Rishi for pointing it out,

--
Will
___
telepathy mailing list
telepathy@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/telepathy

[Telepathy] CVE-2013-1769: remotely-triggered NULL pointer dereference in telepathy-gabble

2013-03-04 Thread Will Thompson 

Hi,

I've just released two new versions of telepathy-gabble which fix a 
family of remotely-triggered NULL pointer dereference bugs in 
telepathy-gabble: specifically, in its implementation of the hashing 
algorithm specified in . These 
bugs existed in essentially all previous versions of telepathy-gabble. A 
malicious user can trigger the bug for any of their contacts who use 
Gabble by publishing caps which trigger the bug, or for anyone whose JID 
they know.


In the current stable release series, the bug is fixed in 
telepathy-gabble 0.16.5 (release announcement: 
).


In the current unstable release series, the bug is fixed in 
telepathy-gabble 0.17.3 (release announcement: 
).


Simon McVittie has prepared some patches which apply to the 0.12 series 
of telepathy-gabble. Interested parties can find them, and more 
information, on the bug report: 
. That said, I 
recommend that distributors of 0.12 upgrade to the 0.16 stable series if 
possible.


Thanks to Kurt Seifried of the Red Hat Security Response Team for 
allocating a CVE ID for this issue.


--
Will
___
telepathy mailing list
telepathy@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/telepathy

[Telepathy] Announce: telepathy-gabble 0.17.3

2013-03-04 Thread Will Thompson 
The “less resplendent backup ruffs” release. This includes the fixes
from telepathy-gabble 0.16.5, including fixing a remotely-triggered
denial-of-service bug. You should upgrade to this version if you are
already running the 0.17 development branch; you should upgrade to
0.16.5 if you want a stable release.

tarball: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.17.3.tar.gz
signature: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.17.3.tar.gz.asc
git: http://cgit.freedesktop.org/telepathy/telepathy-gabble

Fixes:

• fd.o#57521: don't crash when the server sends back malformed or error
  replies to privacy list queries. (wjt)

• fd.o#61433: don't crash on weirdly-shaped data forms in caps query
  replies. This issue is tracked as CVE-2013-1769. Unfortunately, this
  bug can be triggered by any XMPP user who knows your bare JID, not
  just by people you've authorized to see your presence. Fortunately, it
  is just a NULL pointer dereference, rather than allowing the attacker
  to do anything more nefarious like execute code. (wjt)

• fd.o#43166: handle rate-limiting by MUCs better, including disabling
  typing notifications if we get rate-limited, and including the error
  message from the server in the D-Bus signal so that the user interface
  could, in principle, show it to the user. (wjt)

Enhancements:

• fd.o#58198: the Jingle protocol code now lives in Wocky. This should make no
  functional difference to Gabble. (wjt)

Cheers,
-- 
Will
___
telepathy mailing list
telepathy@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/telepathy

[Telepathy] Announce: telepathy-gabble 0.16.5

2013-03-04 Thread Will Thompson 
The “In Actuality You Are A Gigantic, Bloodthirsty Grizzly Bear”
release. This fixes a remotely-triggered denial-of-service bug. You
should upgrade.

tarball: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.16.5.tar.gz
signature: 
http://telepathy.freedesktop.org/releases/telepathy-gabble/telepathy-gabble-0.16.5.tar.gz.asc
git: http://cgit.freedesktop.org/telepathy/telepathy-gabble

Fixes:

• fd.o#57521: don't crash when the server sends back malformed or error
  replies to privacy list queries. (wjt)

• fd.o#61433: don't crash on weirdly-shaped data forms in caps query
  replies. This issue is tracked as CVE-2013-1769. Unfortunately, this
  bug can be triggered by any XMPP user who knows your bare JID, not
  just by people you've authorized to see your presence. Fortunately, it
  is just a NULL pointer dereference, rather than allowing the attacker
  to do anything more nefarious like execute code. (wjt)

Regards,
-- 
Will
___
telepathy mailing list
telepathy@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/telepathy