[Touch-packages] [Bug 1348241] Re: StateSaver serializes potentially sensitive data under /tmp, doesn’t use O_EXCL

2014-09-05 Thread Marc Deslauriers
This was fixed in ubuntu-ui-toolkit (1.1.1188+14.10.20140813.4-0ubuntu1) by http://bazaar.launchpad.net/~ubuntu-sdk-team/ubuntu-ui-toolkit/staging/revision/1182 ** Information type changed from Private Security to Public Security ** Changed in: ubuntu-ui-toolkit (Ubuntu Utopic) Status:

[Touch-packages] [Bug 1358251] Re: unity-panel-service crashed with SIGSEGV in panel_indicator_entry_accessible_get_n_children()

2014-09-05 Thread Marc Deslauriers
** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to unity in Ubuntu. https://bugs.launchpad.net/bugs/1358251 Title: unity-panel-service crashed with SIGSEGV in

[Touch-packages] [Bug 1185665] Re: unity-panel-service crashed with signal 7

2014-09-05 Thread Marc Deslauriers
** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to unity in Ubuntu. https://bugs.launchpad.net/bugs/1185665 Title: unity-panel-service crashed with signal 7 Status

[Touch-packages] [Bug 1365020] Re: option subject-match not working

2014-09-05 Thread Marc Deslauriers
Mathieu, Do you have any idea what this could be? ** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to network-manager in Ubuntu.

[Touch-packages] [Bug 1366314] Re: security issue? auto suggest seems to copy credentials into clipboard

2014-09-06 Thread Marc Deslauriers
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyboard in Ubuntu. https://bugs.launchpad.net/bugs/1366314 Title: security issue? auto suggest seems to

[Touch-packages] [Bug 1365336] Re: Lightdm update=No desktop

2014-09-08 Thread Marc Deslauriers
This also affects the xserver-xorg-video-vmware driver when running utopic in a VM. ** Also affects: xserver-xorg-video-vmware (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 1366790] Re: Fix for CVE-2014-1949 (GTK 3.10.x)

2014-09-08 Thread Marc Deslauriers
CVE-2014-1949 was assigned to cinnamon-screensaver. The fix for this issue actually lies in gtk+3.0, in the following commit: https://git.gnome.org/browse/gtk+/commit/?id=1691bb741d50c90ee938f0b73fe81b0ca9bfd6d4 gtk+3.0 is already fixed in utopic, and we only have connamon- screensaver in

[Touch-packages] [Bug 1365336] Re: Lightdm update=No desktop

2014-09-09 Thread Marc Deslauriers
** Attachment added: logs https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1365336/+attachment/4199604/+files/mdeslaur-logs.tar.gz -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to lightdm in Ubuntu.

[Touch-packages] [Bug 1365336] Re: Lightdm update=No desktop

2014-09-09 Thread Marc Deslauriers
Id=seat0 ActiveSession=c1 CanMultiSession=yes CanTTY=yes CanGraphical=no Sessions=c1 IdleHint=no IdleSinceHint=1410263200256000 IdleSinceHintMonotonic=394137924 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to lightdm in

[Touch-packages] [Bug 1365336] Re: Lightdm update=No desktop

2014-09-09 Thread Marc Deslauriers
Here are my logs with utopic installed in kvm with the vmvga driver: seat0 Sessions: *c1 Devices: ├─/sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0 │ input:input0 Power Button

[Touch-packages] [Bug 1370175] [NEW] Libav security fixes Sept 2014

2014-09-16 Thread Marc Deslauriers
: Undecided Status: Confirmed ** Affects: libav (Ubuntu Precise) Importance: Undecided Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: libav (Ubuntu Trusty) Importance: Undecided Status: Confirmed ** Affects: libav (Ubuntu Utopic

[Touch-packages] [Bug 1371058] Re: Regression: Latest apt security update returns Hash Sum mismatch for file: URI:s

2014-09-18 Thread Marc Deslauriers
** Changed in: apt (Ubuntu Lucid) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: apt (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: apt (Ubuntu Trusty) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) -- You received

[Touch-packages] [Bug 1371058] Re: Regression: Latest apt security update returns Hash Sum mismatch for file: URI:s

2014-09-19 Thread Marc Deslauriers
Thanks for testing these updates, I will be releasing them on tuesday after they have been through our QA process. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apt in Ubuntu. https://bugs.launchpad.net/bugs/1371058 Title:

[Touch-packages] [Bug 1371766] Re: Latest CVE-2014-5270 patch breaks ElGamal keys of 16k

2014-09-19 Thread Marc Deslauriers
This is an upstream decision. In fact, they've now limited the size of ElGamal keys to 4096 with the following commit: http://git.gnupg.org/cgi- bin/gitweb.cgi?p=gnupg.git;a=commit;h=aae7ec516b79e20938c56fd48fc0bc9d2116426c Another relevant Debian bug: https://bugs.debian.org/cgi-

[Touch-packages] [Bug 1372410] [NEW] NSS version in stable releases contain outdated CA certs

2014-09-22 Thread Marc Deslauriers
*** This bug is a security vulnerability *** Public security bug reported: NSS in stable releases is at 3.15.4, which contains outdated CA certificates. ** Affects: nss (Ubuntu) Importance: Undecided Status: Fix Released ** Affects: nss (Ubuntu Lucid) Importance: Undecided

[Touch-packages] [Bug 1372410] Re: NSS version in stable releases contain outdated CA certs

2014-09-22 Thread Marc Deslauriers
Updated have now been released: http://www.ubuntu.com/usn/usn-2350-1/ ** Changed in: nss (Ubuntu Lucid) Status: New = Fix Released ** Changed in: nss (Ubuntu Precise) Status: New = Fix Released ** Changed in: nss (Ubuntu Trusty) Status: New = Fix Released -- You received

[Touch-packages] [Bug 1358727] Re: LibNss Bug 962760 affects usability of Chrome

2014-09-22 Thread Marc Deslauriers
NSS has now been updated to 3.17 in all supported releases: http://www.ubuntu.com/usn/usn-2350-1/ As such, I am closing this bug. Feel free to reopen it if the update didn't solve the issue. ** Changed in: nss (Ubuntu) Status: New = Fix Released -- You received this bug notification

[Touch-packages] [Bug 1371766] Re: Latest CVE-2014-5270 patch breaks ElGamal keys of 16k

2014-09-22 Thread Marc Deslauriers
Please report this issue to the gnupg project at the following link, and link the bug here: https://bugs.g10code.com/ -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to gnupg in Ubuntu. https://bugs.launchpad.net/bugs/1371766

[Touch-packages] [Bug 1371058] Re: Regression: Latest apt security update returns Hash Sum mismatch for file: URI:s

2014-09-23 Thread Marc Deslauriers
** Changed in: apt (Ubuntu Trusty) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apt in Ubuntu. https://bugs.launchpad.net/bugs/1371058 Title: Regression: Latest apt security

[Touch-packages] [Bug 1354110] Re: Merge openssl 1.0.1i-2 (main) from Debian unstable (main)

2014-09-23 Thread Marc Deslauriers
It's much too late in the 14.10 cycle to merge this. I will look at it again once 15.04 opens. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/1354110 Title: Merge openssl

[Touch-packages] [Bug 347611] Re: evolution crashed with SIGSEGV in NSSRWLock_LockRead_Util()

2014-09-23 Thread Marc Deslauriers
Ubuntu 9.04 has been end-of-life for a long time now. I'm closing this bug, please feel free to open a new one if you can reproduce this issue with a current version of Ubuntu. ** Changed in: nss (Ubuntu) Status: New = Won't Fix -- You received this bug notification because you are a

[Touch-packages] [Bug 523113] Re: missing manpages for nss tools

2014-09-23 Thread Marc Deslauriers
** Bug watch added: Debian Bug tracker #505382 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505382 ** Also affects: nss (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505382 Importance: Unknown Status: Unknown -- You received this bug notification because you

[Touch-packages] [Bug 1167255] Re: No standard documentation for certutil

2014-09-23 Thread Marc Deslauriers
*** This bug is a duplicate of bug 523113 *** https://bugs.launchpad.net/bugs/523113 ** Bug watch added: Debian Bug tracker #505382 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505382 ** Also affects: nss (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505382

[Touch-packages] [Bug 557180] Re: taxbird crashed with SIGSEGV in CERT_NewTempCertificate()

2014-09-23 Thread Marc Deslauriers
Are you able to reproduce this with Ubuntu 14.04 LTS? ** Changed in: nss (Ubuntu) Status: New = Incomplete ** Changed in: taxbird (Ubuntu) Status: New = Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 348372] Re: nspluginviewer crashed with SIGSEGV in PL_HashTableLookupConst()

2014-09-23 Thread Marc Deslauriers
This was reported using a version of Ubuntu that has been out of support for a long time. As such, I am closing this bug. Please feel free to open a new bug if you can reproduce the issue with Ubuntu 14.04 LTS. ** Changed in: nspr (Ubuntu) Status: Confirmed = Won't Fix -- You received

[Touch-packages] [Bug 512847] Re: NSS_VersionCheck fails to work as intended

2014-09-23 Thread Marc Deslauriers
This bug was reported against an ancient version of nss, and it was reported fixed against nspr 4.7.5. We currently have 4.10.7 in all supported Ubuntu release. As such, I am closing this bug. If you can reproduce with a current version, please file a new bug. Thanks! ** Changed in: nspr

[Touch-packages] [Bug 1161374] Re: package libnspr4 4.9.5-0ubuntu0.12.04.1 failed to install/upgrade: ошибка записи в «стандартный вывод»: Победа

2014-09-23 Thread Marc Deslauriers
nspr has been updated to 4.10.7 in all supported versions of Ubuntu. Are you still able to reproduce this issue? ** Changed in: nspr (Ubuntu) Status: New = Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 1155295] Re: nspr needs to be updated for nss 3.14.3

2014-09-23 Thread Marc Deslauriers
We now have nspr 4.10.7 in all supported versions of Ubuntu. ** Changed in: nspr (Ubuntu) Status: New = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to nspr in Ubuntu.

[Touch-packages] [Bug 1169481] Re: package libnss3 3.14.3-0ubuntu0.12.04.1 failed to install/upgrade: error writing to 'standard output': Success

2014-09-23 Thread Marc Deslauriers
nss has been updated to 3.17 in all supported versions of Ubuntu. Are you able to reproduce this issue with 3.17? ** Changed in: nss (Ubuntu) Status: Confirmed = Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

[Touch-packages] [Bug 1349465] Re: Please sync libxml2 (main) 2.9.1+dfsg1-4 from Debian testing (main)

2014-07-29 Thread Marc Deslauriers
This bug was fixed in the package libxml2 - 2.9.1+dfsg1-4 Sponsored for Aron Xu (happyaron) --- libxml2 (2.9.1+dfsg1-4) unstable; urgency=low [ Christian Svensson ] * Do not build-depend on readline (Closes: #742350) [ Daniel Schepler ] * Patch to bootstrap without python

[Touch-packages] [Bug 1310690] Re: Lock screen password field does not capture key press - password is disclosed in background application

2014-08-01 Thread Marc Deslauriers
You need to install your security updates to get unity 7.2.2+14.04.20140714-0ubuntu1.1 See: http://www.ubuntu.com/usn/usn-2303-1/ -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to unity in Ubuntu.

[Touch-packages] [Bug 1351616] Re: Ubuntu 14.04: multi-touch screen can cause desktop to unlock

2014-08-04 Thread Marc Deslauriers
** Package changed: unity (Ubuntu) = xorg (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to xorg in Ubuntu. https://bugs.launchpad.net/bugs/1351616 Title: Ubuntu 14.04: multi-touch screen can cause desktop to unlock

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
** Changed in: eglibc (Ubuntu) Assignee: TJ (tj) = Marc Deslauriers (mdeslaur) ** Also affects: eglibc (Ubuntu Trusty) Importance: Undecided Status: New ** Also affects: eglibc (Ubuntu Utopic) Importance: Critical Assignee: Marc Deslauriers (mdeslaur) Status

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
in: eglibc (Ubuntu Utopic) Importance: Critical = Undecided ** Changed in: eglibc (Ubuntu Utopic) Assignee: Marc Deslauriers (mdeslaur) = (unassigned) ** Changed in: eglibc (Ubuntu Lucid) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) -- You received this bug notification

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to eglibc in Ubuntu. https://bugs.launchpad.net/bugs/1352504 Title: Regression in 2.11.1-0ubuntu7.14; segfault in

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
I am currently preparing an updated package, and will put it in the following PPA: https://launchpad.net/~ubuntu-security- proposed/+archive/ubuntu/ppa/+packages Once it is built, as soon as someone can test it and make sure it solves the issue, I will publish it. Does anyone have steps to

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
Is everyone that is hitting this issue running nscd with ldap? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to eglibc in Ubuntu. https://bugs.launchpad.net/bugs/1352504 Title: Regression in 2.11.1-0ubuntu7.14; segfault in

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
The amd64 packages have finished building in the following PPA: https://launchpad.net/~ubuntu-security- proposed/+archive/ubuntu/ppa/+packages Could someone who can reproduce please test them and see if they solve the issue? -- You received this bug notification because you are a member of

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
Thanks for testing everyone! As soon as all the build are finished, I'll release it as a security regression fix. Sorry for the inconvenience. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to eglibc in Ubuntu.

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
The regression will be announced on the ubuntu-security-announce mailing list. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to eglibc in Ubuntu. https://bugs.launchpad.net/bugs/1352504 Title: Regression in

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
You need to wait until the packages are available in the archive...probably in ~20 minutes, then the regular update and dist- upgrade should work after you're stopped nscd. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 1352504] Re: Regression in 2.11.1-0ubuntu7.14; segfault in getservbyname

2014-08-05 Thread Marc Deslauriers
you need to run apt-get update to refresh the list of packages from the mirror, and then apt-get dist-upgrade to install all available updates. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to eglibc in Ubuntu.

[Touch-packages] [Bug 1349128] Re: Ubuntu 14.04 lock screen doesn't accept keyboard input and sends it back to the underlying window (until using indicators)

2014-08-06 Thread Marc Deslauriers
This bug is now fixed in both trusty and utopic. Please install your updates. If you see an issue after making sure all updates are applied and restarting your computer, please file a new bug. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which

[Touch-packages] [Bug 1354714] Re: buffer overrun in kadmind with ldap backend

2014-08-09 Thread Marc Deslauriers
This bug was fixed in the package krb5 - 1.12.1+dfsg-7 Sponsored for Sam Hartman (hartmans) --- krb5 (1.12.1+dfsg-7) unstable; urgency=high * Apply upstream's patch for CVE-2014-4345 (MITKRB5-SA-2014-001), buffer overrun in kadmind with LDAP backend, Closes: #757416 --

[Touch-packages] [Bug 1354755] Re: Libav security fixes Aug 2014

2014-08-12 Thread Marc Deslauriers
Ah, yes, I seem to have forgotten to update libav-extra once again. I'll push out an update in a few minutes. ** Changed in: libav-extra (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: libav (Ubuntu Trusty) Status: In Progress = Fix Released

[Touch-packages] [Bug 1354755] Re: Libav security fixes Aug 2014

2014-08-12 Thread Marc Deslauriers
OK, updated libav-extra has been published. ** Changed in: libav-extra (Ubuntu Precise) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to libav in Ubuntu.

[Touch-packages] [Bug 1356843] Re: ccs received early

2014-08-14 Thread Marc Deslauriers
So from the irc discussion: two servers, one Ubuntu 10.04, and one Ubuntu 12.04. Both are using postfix. The 12.04 server is running postfix 2.9.6-1~12.04.1. 10.04 is running openssl 0.9.8k-7ubuntu8.20 and 12.04 is running openssl 1.0.1-4ubuntu5.17. The 10.04 is sending mail to the 12.04

[Touch-packages] [Bug 1320422] Re: Please merge dbus 1.8.2-1 (main) from Debian testing (main)

2014-08-14 Thread Marc Deslauriers
@laney: The patches have already been submitted and reviewed upstream here: https://bugs.freedesktop.org/show_bug.cgi?id=75113 ** Bug watch added: freedesktop.org Bugzilla #75113 https://bugs.freedesktop.org/show_bug.cgi?id=75113 -- You received this bug notification because you are a

[Touch-packages] [Bug 1356843] Re: ccs received early

2014-08-14 Thread Marc Deslauriers
The 10.04 server is running postfix 2.7.0-1ubuntu0.2 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/1356843 Title: ccs received early Status in “openssl” package in

[Touch-packages] [Bug 1356843] Re: ccs received early

2014-08-15 Thread Marc Deslauriers
I have reproduced this issue. It looks like something may be wrong with openssl in Ubuntu 12.04. Attached is a packet capture that shows 12.04 sending a CCS before a Server Key Exchange for some reason. ** Attachment added: problem.pcap

[Touch-packages] [Bug 1356843] Re: ccs received early

2014-08-15 Thread Marc Deslauriers
Actually, I believe I'm reading that wrong, disregard my last comment. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/1356843 Title: ccs received early Status in

[Touch-packages] [Bug 1382133] Re: Issue with servers with SSLv3 disabled due to Poodle

2014-10-17 Thread Marc Deslauriers
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to evolution-data-server in Ubuntu. https://bugs.launchpad.net/bugs/1382133 Title: Issue with servers with SSLv3

[Touch-packages] [Bug 1376249] Re: Ubuntu Mate 14.10 Beta2 Upowerd package error message during boot

2014-10-17 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Touch-packages] [Bug 1378071] Re: bash crashed with SIGSEGV in strlen()

2014-10-17 Thread Marc Deslauriers
This should be fixed now by: http://www.ubuntu.com/usn/usn-2380-1/ ** Changed in: bash (Ubuntu) Status: New = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to bash in Ubuntu.

[Touch-packages] [Bug 244250] Re: Spurious reboot notifications caused by libssl upgrades.

2014-10-20 Thread Marc Deslauriers
@khaled-blah: please file a new bug, you are not supposed to see reboot notifications when openssl gets upgraded on a desktop system. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu.

[Touch-packages] [Bug 1371170] Re: information disclosure: clipboard contents can be obtained without user knowledge

2014-10-22 Thread Marc Deslauriers
** Description changed: Currently, the clipboard is implemented such that all apps can access the contents at any time. The clipboard contents should only be given to apps based on user driven input (eg, a paste operation). Attack scenario: 1. user launches malicious app 'baz' that

[Touch-packages] [Bug 1039420] Re: NTP security vulnerability because not using authentication by default

2014-10-22 Thread Marc Deslauriers
Unfortunately, ntp autokey is broken and insecure, it can't be used to provide any additional security. http://zero-entropy.de/autokey_analysis.pdf The only solution for the moment is for system administrators to set up their own symmetric keys with their own ntp server. -- You received this

[Touch-packages] [Bug 1382559] Re: adbd does not check the screen state before allowing a connection

2014-10-23 Thread Marc Deslauriers
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to android-tools in Ubuntu. https://bugs.launchpad.net/bugs/1382559 Title: adbd does not check the screen state before

[Touch-packages] [Bug 1358827] Re: /etc/bash.bashrc checks for admin instead of sudo group

2014-10-29 Thread Marc Deslauriers
** Changed in: bash (Ubuntu) Status: New = Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to bash in Ubuntu. https://bugs.launchpad.net/bugs/1358827 Title: /etc/bash.bashrc checks for admin instead of

[Touch-packages] [Bug 983810] Re: libxml2 security update fails to address problem and breaks thread-safety

2014-10-29 Thread Marc Deslauriers
Introduced by: https://git.gnome.org/browse/libxml2/commit/?id=8973d58b7498fa5100a876815476b81fd1a2412a Fixed by: https://git.gnome.org/browse/libxml2/commit/dict.c?id=379ebc1d774865fa92f2a8d80cc4da65cbe19998

[Touch-packages] [Bug 1387347] [NEW] sudo doesn't check for sudo group

2014-10-29 Thread Marc Deslauriers
about using sudo in the terminal, but since the flag file isn't being created, the blurb always gets printed. ** Affects: sudo (Ubuntu) Importance: Undecided Assignee: Marc Deslauriers (mdeslaur) Status: New ** Changed in: sudo (Ubuntu) Assignee: (unassigned) = Marc

[Touch-packages] [Bug 1373270] Re: Ubuntu 14.04 fails to pass login screen after dbus:amd64-1.6.18-0ubuntu4.2 update

2014-09-24 Thread Marc Deslauriers
What desktop environment is this with? Could you attach your dpkg.log file? ** Changed in: dbus (Ubuntu) Status: New = Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to dbus in Ubuntu.

[Touch-packages] [Bug 1373270] Re: Ubuntu 14.04 fails to pass login screen after dbus:amd64-1.6.18-0ubuntu4.2 update

2014-09-24 Thread Marc Deslauriers
Did you also get the libdbus packages? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to dbus in Ubuntu. https://bugs.launchpad.net/bugs/1373270 Title: Ubuntu 14.04 fails to pass login screen after

[Touch-packages] [Bug 1373781] Re: bash CVE-2014-6271 fix does NOT work

2014-09-25 Thread Marc Deslauriers
Proposed patch for CVE-2014-7169 here: http://www.openwall.com/lists/oss-security/2014/09/25/10 I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official: https://launchpad.net/~ubuntu-security-

[Touch-packages] [Bug 1374207] Re: CVE-2014-7169 fix not effective on trusty

2014-09-25 Thread Marc Deslauriers
There was a build issue with the Ubuntu 14.04 package, and I am in the process of fixing it now. An update will be released within the hour. The other releases should be ok. ** Changed in: bash (Ubuntu) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Also affects: bash (Ubuntu

[Touch-packages] [Bug 1373781] Re: bash incomplete fix for CVE-2014-6271

2014-09-25 Thread Marc Deslauriers
Fumihito YOSHIDA (hito), We are awaiting comments from the upstream bash developer about the OOB memory fixes, and the variable isolation hardening. We will address those in a later bash update. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages,

[Touch-packages] [Bug 1373781] Re: bash incomplete fix for CVE-2014-6271

2014-09-26 Thread Marc Deslauriers
@dino99: both your test cases look good to me. What results were you expecting? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to bash in Ubuntu. https://bugs.launchpad.net/bugs/1373781 Title: bash incomplete fix for

[Touch-packages] [Bug 1373781] Re: bash incomplete fix for CVE-2014-6271

2014-09-26 Thread Marc Deslauriers
do you perhaps have a left-over file called 'echo' in that directory? If so, you need to delete it before running the test. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to bash in Ubuntu.

[Touch-packages] [Bug 1374375] Re: CVE-2014-7186: bash crashed with SIGSEGV in list_reverse()

2014-09-27 Thread Marc Deslauriers
This is now fixed: http://www.ubuntu.com/usn/usn-2364-1/ ** Changed in: bash (Ubuntu Precise) Status: Confirmed = Fix Released ** Changed in: bash (Ubuntu Trusty) Status: Confirmed = Fix Released ** Changed in: bash (Ubuntu Lucid) Status: Confirmed = Fix Released -- You

[Touch-packages] [Bug 1374375] Re: CVE-2014-7186: bash crashed with SIGSEGV in list_reverse()

2014-09-27 Thread Marc Deslauriers
** Changed in: bash (Ubuntu Utopic) Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to bash in Ubuntu. https://bugs.launchpad.net/bugs/1374375 Title: CVE-2014-7186: bash crashed

[Touch-packages] [Bug 1375271] Re: desktop or other past screen contents visible before lockscreen on resume

2014-09-29 Thread Marc Deslauriers
What desktop environment are you using? ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to unity in Ubuntu. https://bugs.launchpad.net/bugs/1375271 Title: desktop

[Touch-packages] [Bug 1376447] [NEW] When forcing TLSv1.2, the cipher list is truncated

2014-10-01 Thread Marc Deslauriers
Status: Invalid ** Affects: openssl (Ubuntu Precise) Importance: Undecided Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Also affects: openssl (Ubuntu Precise) Importance: Undecided Status: New ** Changed in: openssl (Ubuntu) Status: New = Invalid

[Touch-packages] [Bug 1376447] Re: When forcing TLSv1.2, the cipher list is truncated

2014-10-01 Thread Marc Deslauriers
This is brought to our attention here: https://twitter.com/andreasdotorg/status/517328756365873152 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/1376447 Title: When

[Touch-packages] [Bug 1256576] Re: Ubuntu 12.04 LTS: OpenSSL downlevel version is 1.0.0, and does not support TLS 1.2

2014-10-02 Thread Marc Deslauriers
That USN doesn't re-enable TLSv1.2 by default for clients in Ubuntu 12.04. It simply fixes an issue if someone _forced_ TLSv1.2 to be enabled. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu.

[Touch-packages] [Bug 1378680] Re: Insecure tempfile handling

2014-10-08 Thread Marc Deslauriers
Thanks for the debdiffs, I'll prepare security updates. ** Changed in: apt (Ubuntu Trusty) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: apt (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: apt (Ubuntu Precise) Status

[Touch-packages] [Bug 1378680] Re: Insecure tempfile handling

2014-10-08 Thread Marc Deslauriers
http://www.ubuntu.com/usn/usn-2370-1/ ** Changed in: apt (Ubuntu Precise) Status: Confirmed = Fix Released ** Changed in: apt (Ubuntu Trusty) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 244250] Re: Spurious reboot notifications caused by libssl upgrades.

2014-10-31 Thread Marc Deslauriers
@khaled-blah: yes, on a server, it should do the usual and add a reboot required blurb to the motd. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/244250 Title: Spurious

[Touch-packages] [Bug 1389283] [NEW] dh-python 1.20141026-1ubuntu1 incorrectly handles gi package names

2014-11-04 Thread Marc Deslauriers
Public bug reported: 1.20141026-1ubuntu1 introduced support for guessing dependencies from the egginfo file: * Add support for guessing dependencies from egg-info files (closes: 756378) But this is mishandling gi.introspection dependencies. The pasaffe package, which compiles fine on Utopic, is

[Touch-packages] [Bug 1387734] Re: Location service uses the cached authorization, even if the user denied location access to an app

2014-11-14 Thread Marc Deslauriers
This is CVE-2014-1422 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2014-1422 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to location-service in Ubuntu. https://bugs.launchpad.net/bugs/1387734 Title:

[Touch-packages] [Bug 1390592] Re: 'ptrace peer=@{profile_name}' does not work on 14.04 (at least) with docker

2014-11-14 Thread Marc Deslauriers
This is CVE-2014-1424 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2014-1424 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1390592 Title: 'ptrace

[Touch-packages] [Bug 1392380] Re: OA gives out all tokens to any app

2014-11-14 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to signon in Ubuntu. https://bugs.launchpad.net/bugs/1392380 Title: OA gives out all tokens to any app

[Touch-packages] [Bug 1390430] Re: package evolution-data-server 3.10.4-0ubuntu1.5 failed to install/upgrade: problemi con le dipendenze - lasciato non configurato

2014-11-17 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Touch-packages] [Bug 1393172] Re: [VGN-G2ABPS, Realtek ALC262, Black Headphone Out, Front] No sound at all

2014-11-17 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Touch-packages] [Bug 1390183] Re: EFI directory is insecure by default

2014-11-18 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mountall in Ubuntu. https://bugs.launchpad.net/bugs/1390183 Title: EFI directory is insecure by default

[Touch-packages] [Bug 1390183] Re: EFI directory is insecure by default

2014-11-18 Thread Marc Deslauriers
** Bug watch added: Debian Bug tracker #770033 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770033 ** Also affects: partman-efi (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770033 Importance: Unknown Status: Unknown -- You received this bug notification

[Touch-packages] [Bug 1390183] Re: EFI directory is insecure by default

2014-11-18 Thread Marc Deslauriers
Thanks for reporting it! :) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mountall in Ubuntu. https://bugs.launchpad.net/bugs/1390183 Title: EFI directory is insecure by default Status in “mountall” package in Ubuntu:

[Touch-packages] [Bug 1391296] Re: 14.10: NFS drives in fstab not mounted automatically

2014-11-18 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1384502 *** https://bugs.launchpad.net/bugs/1384502 ** This bug has been marked a duplicate of bug 1384502 fstab entry for nfs /home fails to mount on boot -- You received this bug notification because you are a member of Ubuntu Touch seeded packages,

[Touch-packages] [Bug 1389164] Re: Ubuntu 14.10 ppc64le not automatically mounting NFS mounts in /etc/fstab

2014-11-18 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1384502 *** https://bugs.launchpad.net/bugs/1384502 ** This bug has been marked a duplicate of bug 1384502 fstab entry for nfs /home fails to mount on boot -- You received this bug notification because you are a member of Ubuntu Touch seeded packages,

[Touch-packages] [Bug 1384502] Re: fstab entry for nfs /home fails to mount on boot

2014-11-18 Thread Marc Deslauriers
Ok, I've investigated this, and it turn out: statd-mounting.conf intercepts nfs mounts and waits for the statd daemon to be run statd.conf starts on (virtual-filesystems and started portmap ON_BOOT=y) rpcbind.conf is what emits the started portmap event: # For compatibility with older upstart

[Touch-packages] [Bug 1389164] Re: Ubuntu 14.10 ppc64le not automatically mounting NFS mounts in /etc/fstab

2014-11-18 Thread Marc Deslauriers
** This bug is no longer a duplicate of bug 1384502 fstab entry for nfs /home fails to mount on boot -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mountall in Ubuntu. https://bugs.launchpad.net/bugs/1389164 Title:

[Touch-packages] [Bug 1384502] Re: fstab entry for nfs /home fails to mount on boot

2014-11-18 Thread Marc Deslauriers
Please disregard the last comment, that was unfortunately for a different bug that affects 14.10 only. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to mountall in Ubuntu. https://bugs.launchpad.net/bugs/1384502 Title:

[Touch-packages] [Bug 1391296] Re: 14.10: NFS drives in fstab not mounted automatically

2014-11-18 Thread Marc Deslauriers
Upstart shouldn't require an INSTANCE variable for that to work, and nfs-utils shouldn't be waiting on the portmap job, as that is for legacy compatibility only. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to upstart in

[Touch-packages] [Bug 1391296] Re: 14.10: NFS drives in fstab not mounted automatically

2014-11-18 Thread Marc Deslauriers
Ok, I've investigated this, and it turns out: statd-mounting.conf intercepts nfs mounts and waits for the statd daemon to be run statd.conf starts on (virtual-filesystems and started portmap ON_BOOT=y) rpcbind.conf is what emits the started portmap event: # For compatibility with older upstart

[Touch-packages] [Bug 1391296] Re: 14.10: NFS drives in fstab not mounted automatically

2014-11-18 Thread Marc Deslauriers
(Ubuntu Utopic) Importance: Undecided Status: New ** Changed in: nfs-utils (Ubuntu Utopic) Status: New = Confirmed ** Changed in: upstart (Ubuntu Utopic) Status: New = Confirmed ** Changed in: nfs-utils (Ubuntu Utopic) Assignee: (unassigned) = Marc Deslauriers

[Touch-packages] [Bug 1391296] Re: 14.10: NFS drives in fstab not mounted automatically

2014-11-19 Thread Marc Deslauriers
** Description changed: + [SRU Request] + + Due to a change in Upstart behaviour, the statd daemon no longer starts + automatically at boot, resulting in nfs mounts not being mounted at + boot. + + This has been corrected by modifying the statd upstart job to wait for + the rpcbind job to

[Touch-packages] [Bug 1400473] Re: Apache 2.2 on Ubuntu 12.04 LTS only supports TLS1.0 which is vulnerable to BEAST attack

2014-12-08 Thread Marc Deslauriers
Apache 2.2 on 12.04 LTS does support TLSv1.1 and TLSv1.2 just fine. Could you describe why you think it's not supported? ** Changed in: openssl (Ubuntu) Status: New = Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 1256576] Re: Ubuntu 12.04 LTS: OpenSSL downlevel version is 1.0.0, and does not support TLS 1.2

2014-12-08 Thread Marc Deslauriers
Apache2 in 12.04 supports TLSv1.2 just fine, I've been running test scripts against it. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssl in Ubuntu. https://bugs.launchpad.net/bugs/1256576 Title: Ubuntu 12.04 LTS:

[Touch-packages] [Bug 1396151] Re: password not checked on screen unlock

2014-12-11 Thread Marc Deslauriers
** Package changed: light-locker (Ubuntu) = unity (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to unity in Ubuntu. https://bugs.launchpad.net/bugs/1396151 Title: password not checked on screen unlock Status in

[Touch-packages] [Bug 1396568] Re: saslauthd allow authentication after user deletion until it is restarted

2014-12-11 Thread Marc Deslauriers
By default, saslauthd caches credentials. The cache and timeout are set by the -c and -t command line options. You can disable caching by removing the -c from /etc/default/saslauthd, or adjust the timeout from the default 28800 seconds by adding -t to it. ** Information type changed from

[Touch-packages] [Bug 1401487] Re: apt reports wrong hashes

2014-12-11 Thread Marc Deslauriers
This happens from time to time when a mirror is out of sync. ** Information type changed from Private Security to Public ** Package changed: thunderbird (Ubuntu) = apt (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed

  1   2   3   4   5   6   7   8   9   10   >