[ubuntu/xenial-updates] chromium-browser 84.0.4147.105-0ubuntu0.16.04.1 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
chromium-browser (84.0.4147.105-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 84.0.4147.105
- CVE-2020-6537: Type Confusion in V8.
- CVE-2020-6538: Inappropriate implementation in WebView.
- CVE-2020-6532: Use after free in SCTP.
- CVE-2020-6539: Use after free in CSS.
- CVE-2020-6540: Heap buffer overflow in Skia.
- CVE-2020-6541: Use after free in WebUSB.

chromium-browser (84.0.4147.89-0ubuntu0.16.04.3) xenial; urgency=medium

  * Apply an upstream patch to fix a crash with video playback (LP: #1881751)
- debian/patches/upstream-fix-crash-in-MediaSerializer-base-Location.patch

chromium-browser (84.0.4147.89-0ubuntu0.16.04.2) xenial; urgency=medium

  * debian/tests/data/chromium-version.html: update test expectations after
the custom UA string was removed (LP: #1868117)

chromium-browser (84.0.4147.89-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 84.0.4147.89
- CVE-2020-6510: Heap buffer overflow in background fetch.
- CVE-2020-6511: Side-channel information leakage in content security 
policy.
- CVE-2020-6512: Type Confusion in V8.
- CVE-2020-6513: Heap buffer overflow in PDFium.
- CVE-2020-6514: Inappropriate implementation in WebRTC.
- CVE-2020-6515: Use after free in tab strip.
- CVE-2020-6516: Policy bypass in CORS.
- CVE-2020-6517: Heap buffer overflow in history.
- CVE-2020-6518: Use after free in developer tools.
- CVE-2020-6519: Policy bypass in CSP.
- CVE-2020-6520: Heap buffer overflow in Skia.
- CVE-2020-6521: Side-channel information leakage in autofill.
- CVE-2020-6522: Inappropriate implementation in external protocol handlers.
- CVE-2020-6523: Out of bounds write in Skia.
- CVE-2020-6524: Heap buffer overflow in WebAudio.
- CVE-2020-6525: Heap buffer overflow in Skia.
- CVE-2020-6526: Inappropriate implementation in iframe sandbox.
- CVE-2020-6527: Insufficient policy enforcement in CSP.
- CVE-2020-6528: Incorrect security UI in basic auth.
- CVE-2020-6529: Inappropriate implementation in WebRTC.
- CVE-2020-6530: Out of bounds memory access in developer tools.
- CVE-2020-6531: Side-channel information leakage in scroll to text.
- CVE-2020-6533: Type Confusion in V8.
- CVE-2020-6534: Heap buffer overflow in WebRTC.
- CVE-2020-6535: Insufficient data validation in WebUI.
- CVE-2020-6536: Incorrect security UI in PWAs.
  * debian/control: add build dependencies on python-xcbgen and xcb-proto
(needed since https://chromium.googlesource.com/chromium/src.git/+/e43aa4b)
  * debian/patches/cc-old-clang-compatibility.patch: added
  * debian/patches/chromium_useragent.patch: removed (LP: #1868117)
  * debian/patches/default-allocator: refreshed
  * debian/patches/define-libdrm-missing-identifiers.patch: added
  * debian/patches/fix-build-with-older-xcb-proto.patch: added
  * debian/patches/search-credit.patch: refreshed
  * debian/patches/set-rpath-on-chromium-executables.patch: refreshed
  * debian/patches/suppress-newer-clang-warning-flags.patch: refreshed
  * debian/patches/title-bar-default-system.patch-v35: refreshed
  * debian/patches/touch-v35: refreshed
  * debian/patches/use-old-mesa.patch: added
  * debian/patches/widevine-enable-version-string.patch: refreshed

chromium-browser (83.0.4103.116-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.116
- CVE-2020-6509: Use after free in extensions.

chromium-browser (83.0.4103.106-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.106
- CVE-2020-6505: Use after free in speech.
- CVE-2020-6506: Insufficient policy enforcement in WebView.
- CVE-2020-6507: Out of bounds write in V8.

chromium-browser (83.0.4103.97-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.97
- CVE-2020-6493: Use after free in WebAuthentication.
- CVE-2020-6494: Incorrect security UI in payments.
- CVE-2020-6495: Insufficient policy enforcement in developer tools.
- CVE-2020-6496: Use after free in payments.
  * debian/patches/suppress-newer-clang-warning-flags.patch: refreshed

chromium-browser (83.0.4103.61-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.61
- CVE-2020-6465: Use after free in reader mode.
- CVE-2020-6466: Use after free in media.
- CVE-2020-6467: Use after free in WebRTC.
- CVE-2020-6468: Type Confusion in V8.
- CVE-2020-6469: Insufficient policy enforcement in developer tools.
- CVE-2020-6470: Insufficient validation of untrusted input in clipboard.
- CVE-2020-6471: Insufficient policy enforcement in developer tools.
- CVE-2020-6472: Insufficient policy enforcement in developer tools.
- CVE-2020-6473: Insufficient policy enforcement in Blink.
- CVE-2020-6474: Use after free in Blink.
- CVE-2020-6475: Incorrect security UI in full screen.
- CVE-2020-6476: Insufficient policy enforcement in tab strip.
- 

[ubuntu/xenial-security] chromium-browser 84.0.4147.105-0ubuntu0.16.04.1 (Accepted)

2020-08-04 Thread Chris Coulson
chromium-browser (84.0.4147.105-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 84.0.4147.105
- CVE-2020-6537: Type Confusion in V8.
- CVE-2020-6538: Inappropriate implementation in WebView.
- CVE-2020-6532: Use after free in SCTP.
- CVE-2020-6539: Use after free in CSS.
- CVE-2020-6540: Heap buffer overflow in Skia.
- CVE-2020-6541: Use after free in WebUSB.

chromium-browser (84.0.4147.89-0ubuntu0.16.04.3) xenial; urgency=medium

  * Apply an upstream patch to fix a crash with video playback (LP: #1881751)
- debian/patches/upstream-fix-crash-in-MediaSerializer-base-Location.patch

chromium-browser (84.0.4147.89-0ubuntu0.16.04.2) xenial; urgency=medium

  * debian/tests/data/chromium-version.html: update test expectations after
the custom UA string was removed (LP: #1868117)

chromium-browser (84.0.4147.89-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 84.0.4147.89
- CVE-2020-6510: Heap buffer overflow in background fetch.
- CVE-2020-6511: Side-channel information leakage in content security 
policy.
- CVE-2020-6512: Type Confusion in V8.
- CVE-2020-6513: Heap buffer overflow in PDFium.
- CVE-2020-6514: Inappropriate implementation in WebRTC.
- CVE-2020-6515: Use after free in tab strip.
- CVE-2020-6516: Policy bypass in CORS.
- CVE-2020-6517: Heap buffer overflow in history.
- CVE-2020-6518: Use after free in developer tools.
- CVE-2020-6519: Policy bypass in CSP.
- CVE-2020-6520: Heap buffer overflow in Skia.
- CVE-2020-6521: Side-channel information leakage in autofill.
- CVE-2020-6522: Inappropriate implementation in external protocol handlers.
- CVE-2020-6523: Out of bounds write in Skia.
- CVE-2020-6524: Heap buffer overflow in WebAudio.
- CVE-2020-6525: Heap buffer overflow in Skia.
- CVE-2020-6526: Inappropriate implementation in iframe sandbox.
- CVE-2020-6527: Insufficient policy enforcement in CSP.
- CVE-2020-6528: Incorrect security UI in basic auth.
- CVE-2020-6529: Inappropriate implementation in WebRTC.
- CVE-2020-6530: Out of bounds memory access in developer tools.
- CVE-2020-6531: Side-channel information leakage in scroll to text.
- CVE-2020-6533: Type Confusion in V8.
- CVE-2020-6534: Heap buffer overflow in WebRTC.
- CVE-2020-6535: Insufficient data validation in WebUI.
- CVE-2020-6536: Incorrect security UI in PWAs.
  * debian/control: add build dependencies on python-xcbgen and xcb-proto
(needed since https://chromium.googlesource.com/chromium/src.git/+/e43aa4b)
  * debian/patches/cc-old-clang-compatibility.patch: added
  * debian/patches/chromium_useragent.patch: removed (LP: #1868117)
  * debian/patches/default-allocator: refreshed
  * debian/patches/define-libdrm-missing-identifiers.patch: added
  * debian/patches/fix-build-with-older-xcb-proto.patch: added
  * debian/patches/search-credit.patch: refreshed
  * debian/patches/set-rpath-on-chromium-executables.patch: refreshed
  * debian/patches/suppress-newer-clang-warning-flags.patch: refreshed
  * debian/patches/title-bar-default-system.patch-v35: refreshed
  * debian/patches/touch-v35: refreshed
  * debian/patches/use-old-mesa.patch: added
  * debian/patches/widevine-enable-version-string.patch: refreshed

chromium-browser (83.0.4103.116-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.116
- CVE-2020-6509: Use after free in extensions.

chromium-browser (83.0.4103.106-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.106
- CVE-2020-6505: Use after free in speech.
- CVE-2020-6506: Insufficient policy enforcement in WebView.
- CVE-2020-6507: Out of bounds write in V8.

chromium-browser (83.0.4103.97-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.97
- CVE-2020-6493: Use after free in WebAuthentication.
- CVE-2020-6494: Incorrect security UI in payments.
- CVE-2020-6495: Insufficient policy enforcement in developer tools.
- CVE-2020-6496: Use after free in payments.
  * debian/patches/suppress-newer-clang-warning-flags.patch: refreshed

chromium-browser (83.0.4103.61-0ubuntu0.16.04.1) xenial; urgency=medium

  * Upstream release: 83.0.4103.61
- CVE-2020-6465: Use after free in reader mode.
- CVE-2020-6466: Use after free in media.
- CVE-2020-6467: Use after free in WebRTC.
- CVE-2020-6468: Type Confusion in V8.
- CVE-2020-6469: Insufficient policy enforcement in developer tools.
- CVE-2020-6470: Insufficient validation of untrusted input in clipboard.
- CVE-2020-6471: Insufficient policy enforcement in developer tools.
- CVE-2020-6472: Insufficient policy enforcement in developer tools.
- CVE-2020-6473: Insufficient policy enforcement in Blink.
- CVE-2020-6474: Use after free in Blink.
- CVE-2020-6475: Incorrect security UI in full screen.
- CVE-2020-6476: Insufficient policy enforcement in tab strip.
- 

[ubuntu/xenial-updates] tomcat8 8.0.32-1ubuntu1.13 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
tomcat8 (8.0.32-1ubuntu1.13) xenial-security; urgency=medium

  * SECURITY UPDATE: infinite loop via invalid payload length
- debian/patches/CVE-2020-13935.patch: add additional payload length
  validation in java/org/apache/tomcat/websocket/WsFrameBase.java,
  java/org/apache/tomcat/websocket/LocalStrings.properties.
- CVE-2020-13935
  * SECURITY UPDATE: HTTP Request Smuggling via invalid request smuggling
- debian/patches/CVE-2020-1935.patch: use stricter header value
  parsing in java/org/apache/coyote/http11/AbstractNioInputBuffer.java,
  java/org/apache/coyote/http11/InternalAprInputBuffer.java,
  java/org/apache/coyote/http11/InternalInputBuffer.java,
  java/org/apache/tomcat/util/http/MimeHeaders.java,
  java/org/apache/tomcat/util/http/parser/HttpParser.java,
  test/org/apache/coyote/http11/TestInternalInputBuffer.java.
- CVE-2020-1935
  * SECURITY UPDATE: remote code execution via deserialization of a file
under the attacker's control
- debian/patches/CVE-2020-9484.patch: improve validation of storage
  location when using FileStore in
  java/org/apache/catalina/session/FileStore.java,
  java/org/apache/catalina/session/LocalStrings.properties.
- CVE-2020-9484

Date: 2020-08-03 12:05:24.815255+00:00
Changed-By: Marc Deslauriers 
Signed-By: Ubuntu Archive Robot 

https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-updates] ppp 2.4.7-1+2ubuntu1.16.04.3 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
ppp (2.4.7-1+2ubuntu1.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: arbitrary file disclosure vulnerability
- debian/patches/load_ppp_generic_if_needed: removed, ppp has been
  built into Ubuntu kernels since at least 2012.
- CVE-2020-15704
  * debian/patches/0016-pppoe-include-netinet-in.h-before-linux-in.h.patch:
fix build on newer kernels.

Date: 2020-07-23 14:54:15.406101+00:00
Changed-By: Marc Deslauriers 
Signed-By: Ubuntu Archive Robot 

https://launchpad.net/ubuntu/+source/ppp/2.4.7-1+2ubuntu1.16.04.3
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-updates] apport 2.20.1-0ubuntu2.24 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
apport (2.20.1-0ubuntu2.24) xenial-security; urgency=medium

  * SECURITY UPDATE: information disclosure issue (LP: #1885633)
- data/apport: also drop gid when checking if user session is closing.
- CVE-2020-11936
  * SECURITY UPDATE: crash via malformed ignore file (LP: #1877023)
- apport/report.py: don't crash on malformed mtime values.
- CVE-2020-15701
  * SECURITY UPDATE: TOCTOU in core file location
- data/apport: make sure the process hasn't been replaced after Apport
  has started.
- CVE-2020-15702
  * apport/ui.py, test/test_ui.py: make sure a PID is specified when using
--hanging (LP: #1876659)

Date: 2020-07-28 15:51:13.497433+00:00
Changed-By: Marc Deslauriers 
Maintainer: Martin Pitt 
Signed-By: Ubuntu Archive Robot 

https://launchpad.net/ubuntu/+source/apport/2.20.1-0ubuntu2.24
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-updates] whoopsie 0.2.52.5ubuntu0.5 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
whoopsie (0.2.52.5ubuntu0.5) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in bson parsing (LP: #1872560)
- lib/bson/*: updated to latest upstream release.
- CVE-2020-12135
  * SECURITY UPDATE: resource exhaustion via memory leak (LP: #1881982)
- src/whoopsie.c, src/tests/test_parse_report.c: properly handle
  GHashTable.
- CVE-2020-11937
  * SECURITY UPDATE: DoS via large data length (LP: #1882180)
- src/whoopsie.c, src/whoopsie.h, src/tests/test_parse_report.c: limit
  the size of a report file.
- CVE-2020-15570

Date: 2020-07-28 15:48:31.561277+00:00
Changed-By: Marc Deslauriers 
Maintainer: Evan 
Signed-By: Ubuntu Archive Robot 

https://launchpad.net/ubuntu/+source/whoopsie/0.2.52.5ubuntu0.5
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] grub2-signed 1.66.27 (Accepted)

2020-08-04 Thread Steve Beattie
grub2-signed (1.66.27) xenial; urgency=medium

  * Rebuild against grub2 2.02~beta2-36ubuntu3.27.

Date: 2020-07-31 04:42:08.754238+00:00
Changed-By: Steve Langasek 
Maintainer: Colin Watson 
Signed-By: Steve Beattie 
https://launchpad.net/ubuntu/+source/grub2-signed/1.66.27
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] grub2 2.02~beta2-36ubuntu3.27 (Accepted)

2020-08-04 Thread Steve Beattie
grub2 (2.02~beta2-36ubuntu3.27) xenial; urgency=medium

  * debian/postinst.in: Avoid calling grub-install on upgrade of the grub-pc
package, since we cannot be certain that it will install to the correct
disk and a grub-install failure will render the system unbootable.
LP: #1889556.

Date: 2020-07-31 04:53:09.225477+00:00
Changed-By: Steve Langasek 
Signed-By: Steve Beattie 
https://launchpad.net/ubuntu/+source/grub2/2.02~beta2-36ubuntu3.27
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] ppp 2.4.7-1+2ubuntu1.16.04.3 (Accepted)

2020-08-04 Thread Marc Deslauriers
ppp (2.4.7-1+2ubuntu1.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: arbitrary file disclosure vulnerability
- debian/patches/load_ppp_generic_if_needed: removed, ppp has been
  built into Ubuntu kernels since at least 2012.
- CVE-2020-15704
  * debian/patches/0016-pppoe-include-netinet-in.h-before-linux-in.h.patch:
fix build on newer kernels.

Date: 2020-07-23 14:54:15.406101+00:00
Changed-By: Marc Deslauriers 
https://launchpad.net/ubuntu/+source/ppp/2.4.7-1+2ubuntu1.16.04.3
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] whoopsie 0.2.52.5ubuntu0.5 (Accepted)

2020-08-04 Thread Marc Deslauriers
whoopsie (0.2.52.5ubuntu0.5) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in bson parsing (LP: #1872560)
- lib/bson/*: updated to latest upstream release.
- CVE-2020-12135
  * SECURITY UPDATE: resource exhaustion via memory leak (LP: #1881982)
- src/whoopsie.c, src/tests/test_parse_report.c: properly handle
  GHashTable.
- CVE-2020-11937
  * SECURITY UPDATE: DoS via large data length (LP: #1882180)
- src/whoopsie.c, src/whoopsie.h, src/tests/test_parse_report.c: limit
  the size of a report file.
- CVE-2020-15570

Date: 2020-07-28 15:48:31.561277+00:00
Changed-By: Marc Deslauriers 
Maintainer: Evan 
https://launchpad.net/ubuntu/+source/whoopsie/0.2.52.5ubuntu0.5
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] apport 2.20.1-0ubuntu2.24 (Accepted)

2020-08-04 Thread Marc Deslauriers
apport (2.20.1-0ubuntu2.24) xenial-security; urgency=medium

  * SECURITY UPDATE: information disclosure issue (LP: #1885633)
- data/apport: also drop gid when checking if user session is closing.
- CVE-2020-11936
  * SECURITY UPDATE: crash via malformed ignore file (LP: #1877023)
- apport/report.py: don't crash on malformed mtime values.
- CVE-2020-15701
  * SECURITY UPDATE: TOCTOU in core file location
- data/apport: make sure the process hasn't been replaced after Apport
  has started.
- CVE-2020-15702
  * apport/ui.py, test/test_ui.py: make sure a PID is specified when using
--hanging (LP: #1876659)

Date: 2020-07-28 15:51:13.497433+00:00
Changed-By: Marc Deslauriers 
Maintainer: Martin Pitt 
https://launchpad.net/ubuntu/+source/apport/2.20.1-0ubuntu2.24
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] tomcat8 8.0.32-1ubuntu1.13 (Accepted)

2020-08-04 Thread Marc Deslauriers
tomcat8 (8.0.32-1ubuntu1.13) xenial-security; urgency=medium

  * SECURITY UPDATE: infinite loop via invalid payload length
- debian/patches/CVE-2020-13935.patch: add additional payload length
  validation in java/org/apache/tomcat/websocket/WsFrameBase.java,
  java/org/apache/tomcat/websocket/LocalStrings.properties.
- CVE-2020-13935
  * SECURITY UPDATE: HTTP Request Smuggling via invalid request smuggling
- debian/patches/CVE-2020-1935.patch: use stricter header value
  parsing in java/org/apache/coyote/http11/AbstractNioInputBuffer.java,
  java/org/apache/coyote/http11/InternalAprInputBuffer.java,
  java/org/apache/coyote/http11/InternalInputBuffer.java,
  java/org/apache/tomcat/util/http/MimeHeaders.java,
  java/org/apache/tomcat/util/http/parser/HttpParser.java,
  test/org/apache/coyote/http11/TestInternalInputBuffer.java.
- CVE-2020-1935
  * SECURITY UPDATE: remote code execution via deserialization of a file
under the attacker's control
- debian/patches/CVE-2020-9484.patch: improve validation of storage
  location when using FileStore in
  java/org/apache/catalina/session/FileStore.java,
  java/org/apache/catalina/session/LocalStrings.properties.
- CVE-2020-9484

Date: 2020-08-03 12:05:24.815255+00:00
Changed-By: Marc Deslauriers 
https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.13
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-updates] libssh 0.6.3-4.3ubuntu0.6 (Accepted)

2020-08-04 Thread Ubuntu Archive Robot
libssh (0.6.3-4.3ubuntu0.6) xenial-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2020-16135-*.patch: fix a NULL dereference
  checking the return of ssh_buffer_new() and added others checks
  in src/sftpservcer.c, src/buffer.c.
- CVE-2020-16135

Date: 2020-08-03 16:19:15.518883+00:00
Changed-By: leo.barb...@canonical.com (Leonidas S. Barbosa)
Signed-By: Ubuntu Archive Robot 

https://launchpad.net/ubuntu/+source/libssh/0.6.3-4.3ubuntu0.6
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-security] libssh 0.6.3-4.3ubuntu0.6 (Accepted)

2020-08-04 Thread Leonidas S. Barbosa
libssh (0.6.3-4.3ubuntu0.6) xenial-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2020-16135-*.patch: fix a NULL dereference
  checking the return of ssh_buffer_new() and added others checks
  in src/sftpservcer.c, src/buffer.c.
- CVE-2020-16135

Date: 2020-08-03 16:19:15.518883+00:00
Changed-By: leo.barb...@canonical.com (Leonidas S. Barbosa)
https://launchpad.net/ubuntu/+source/libssh/0.6.3-4.3ubuntu0.6
Sorry, changesfile not available.-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes


[ubuntu/xenial-proposed] wireguard 1.0.20200513-1~16.04.2 (Accepted)

2020-08-04 Thread Andy Whitcroft
wireguard (1.0.20200513-1~16.04.2) xenial; urgency=medium

  * Switch alternative dependency order for the wireguard-modules,
wireguard-dkms alternative.  Whichever is first is deemed the
preferred installation candidate when neither is present.  When this is
wireguard-modules this is satisfied by installation of a random kernel
which claims support for wireguard regardless of its applicability.
Repeat after me, do not ever depend on a kernel.  (LP: #1890201)

Date: Tue, 04 Aug 2020 09:33:42 +0100
Changed-By: Andy Whitcroft 
Maintainer: Ubuntu Developers 
https://launchpad.net/ubuntu/+source/wireguard/1.0.20200513-1~16.04.2
Format: 1.8
Date: Tue, 04 Aug 2020 09:33:42 +0100
Source: wireguard
Architecture: source
Version: 1.0.20200513-1~16.04.2
Distribution: xenial
Urgency: medium
Maintainer: Ubuntu Developers 
Changed-By: Andy Whitcroft 
Launchpad-Bugs-Fixed: 1890201
Changes:
 wireguard (1.0.20200513-1~16.04.2) xenial; urgency=medium
 .
   * Switch alternative dependency order for the wireguard-modules,
 wireguard-dkms alternative.  Whichever is first is deemed the
 preferred installation candidate when neither is present.  When this is
 wireguard-modules this is satisfied by installation of a random kernel
 which claims support for wireguard regardless of its applicability.
 Repeat after me, do not ever depend on a kernel.  (LP: #1890201)
Checksums-Sha1:
 7f821ebb2088c2bf9b79606bea39071bd0377c4d 2176 
wireguard_1.0.20200513-1~16.04.2.dsc
 f053033e6d82ba456f9305e3246e892e73c43ec0 11524 
wireguard_1.0.20200513-1~16.04.2.debian.tar.xz
 2709e4643b0902a9cd1b710389b6c77e49e326a8 7353 
wireguard_1.0.20200513-1~16.04.2_source.buildinfo
Checksums-Sha256:
 3d7508427e5a32dc2e43124ae72ca7db3a47c4ac90fc61d6571b0b6214b24ec4 2176 
wireguard_1.0.20200513-1~16.04.2.dsc
 26db5898173508df40f37f06cd03585b4f1344001ff8231d863a35abb9db9ec7 11524 
wireguard_1.0.20200513-1~16.04.2.debian.tar.xz
 bf0415f02a8d4c659ac15bb560f04842834fc1c811c6ef0ec827d0d51c66920c 7353 
wireguard_1.0.20200513-1~16.04.2_source.buildinfo
Files:
 d713982509594479feef706dab7d6e00 2176 net optional 
wireguard_1.0.20200513-1~16.04.2.dsc
 16de33eab0c116599049a99fe915720d 11524 net optional 
wireguard_1.0.20200513-1~16.04.2.debian.tar.xz
 98c0d10c678853596276e11e8f73507f 7353 net optional 
wireguard_1.0.20200513-1~16.04.2_source.buildinfo
Original-Maintainer: Daniel Kahn Gillmor 
-- 
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/xenial-changes