The following commit has been merged in the lenny branch:
commit 765b4e7d32c43218c05fce75e9566a30ce4868f4
Author: Raphaël Hertzog <[email protected]>
Date: Fri Mar 5 21:18:48 2010 +0100
Release 1.14.29
diff --git a/ChangeLog b/ChangeLog
index 15e6c8d..fbad303 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2010-03-05 Raphael Hertzog <[email protected]>
+
+ * configure.ac: Release 1.14.29.
+
+2010-03-05 Raphael Hertzog <[email protected]>
+
+ * scripts/Dpkg/Source/Patch.pm (analyze): sanity check
+ the paths inside the diff and error out if some path contain
+ "/../". Also forbid patches modifying files through a symlink.
+ * scripts/Dpkg/Source/Package/V3/quilt.pm: error out if the series
+ files contains insecure paths with "/../".
+
2010-01-03 Raphael Hertzog <[email protected]>
* configure.ac: Release 1.14.28.
diff --git a/configure.ac b/configure.ac
index 9c85050..6a19dcb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,7 +1,7 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ(2.59)
-AC_INIT([dpkg], [1.14.29~], [[email protected]])
+AC_INIT([dpkg], [1.14.29], [[email protected]])
AC_CONFIG_SRCDIR([lib/dpkg.h])
AC_CONFIG_MACRO_DIR([m4])
AC_CONFIG_AUX_DIR([config])
diff --git a/debian/changelog b/debian/changelog
index 3512f0b..c7e6e8b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-dpkg (1.14.29) UNRELEASED; urgency=low
+dpkg (1.14.29) stable-security; urgency=high
* Modify dpkg-source to error out when it would apply patches containing
insecure paths (with "/../") and also error out when it would apply a
@@ -10,7 +10,7 @@ dpkg (1.14.29) UNRELEASED; urgency=low
can cause patch to create files outside of the source package due
to the -B .pc/$path option that it gets.
- -- Raphael Hertzog <[email protected]> Fri, 05 Mar 2010 20:41:39 +0100
+ -- Raphael Hertzog <[email protected]> Fri, 05 Mar 2010 22:25:05 +0100
dpkg (1.14.28) stable; urgency=low
--
dpkg's main repository
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
