File mingw32-dbus-1.changes of Package mingw32-dbus-1

Overview Repositories Revisions Requests Users Attributes Meta

File mingw32-dbus-1.changes of Package mingw32-dbus-1 (Revision 8be4fc5c3d4b466d24d420c3667ca358)

Currently displaying revision 8be4fc5c3d4b466d24d420c3667ca358 , Show latest

-------------------------------------------------------------------
Sat Jul 18 08:46:02 UTC 2020 - Ralf Habacker <ralf.habacker@freenet.de>

- Update to dbus 1.12.20
  * On Unix, avoid a use-after-free if two usernames have the same
    numeric uid. In older versions this could lead to a crash (denial of
    service) or other undefined behaviour, possibly including incorrect
    authorization decisions if <policy group=...> is used.
    Like Unix filesystems, D-Bus' model of identity cannot distinguish
    between users of different names with the same numeric uid, so this
    configuration is not advisable on systems where D-Bus will be used.
    Thanks to Daniel Onaca.
    (dbus#305, dbus!166; Simon McVittie)
  * On Solaris and its derivatives, if a cmsg header is truncated, ensure
    that we do not overrun the buffer used for fd-passing, even if the
    kernel tells us to.
    (dbus#304, dbus!165; Andy Fiddaman)
- From 1.12.18
  * CVE-2020-12049: If a message contains more file descriptors than can
    be sent, close those that did get through before reporting error.
    Previously, a local attacker could cause the system dbus-daemon (or
    another system service with its own DBusServer) to run out of file
    descriptors, by repeatedly connecting to the server and sending fds that
    would get leaked.
    Thanks to Kevin Backhouse of GitHub Security Lab.
    (dbus#294, GHSL-2020-057; Simon McVittie)
  * Fix a crash when the dbus-daemon is terminated while one or more
    monitors are active (dbus#291, dbus!140; Simon McVittie)
  * The dbus-send(1) man page now documents --bus and --peer instead of
    the old --address synonym for --peer, which has been deprecated since
    the introduction of --bus and --peer in 1.7.6
    (fd.o #48816, dbus!115; Chris Morin)
  * Fix a wrong environment variable name in dbus-daemon(1)
    (dbus#275, dbus!122; Mubin, Philip Withnall)
  * Fix formatting of dbus_message_append_args example
    (dbus!126, Felipe Franciosi)
  * Avoid a test failure on Linux when built in a container as uid 0, but
    without the necessary privileges to increase resource limits
    (dbus!58, Debian #908092; Simon McVittie)
  * When building with CMake, cope with libX11 in a non-standard location
    (dbus!129, Tuomo Rinne)
- From 1.12.16
  * CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1
    authentication for identities that differ from the user running the
    DBusServer. Previously, a local attacker could manipulate symbolic
    links in their own home directory to bypass authentication and connect
    to a DBusServer with elevated privileges. The standard system and
    session dbus-daemons in their default configuration were immune to this
    attack because they did not allow DBUS_COOKIE_SHA1, but third-party
    users of DBusServer such as Upstart could be vulnerable.
    Thanks to Joe Vennix of Apple Information Security.
    (dbus#269, Simon McVittie)

-------------------------------------------------------------------
Tue Jun  9 20:29:29 UTC 2020 - Ralf Habacker <ralf.habacker@freenet.de>

- Use python3 instead of python2 to fix building on Tumbleweed

-------------------------------------------------------------------
Wed Nov 20 13:40:31 UTC 2019 - Ludwig Nussel <lnussel@suse.de>

- inital package for Factory submission

Places

File mingw32-dbus-1.changes of Package mingw32-dbus-1 (Revision 8be4fc5c3d4b466d24d420c3667ca358)

Places