mosquitto (0.15-2+deb7u3ubuntu0.1) trusty-security; urgency=medium
* Merge from Debian. Remaining changes:
- Install apparmor profile.
- Replace init script with upstart script.
mosquitto (0.15-2+deb7u3) wheezy-security; urgency=high
* Non-maintainer upload by the Wheezy LTS Team.
* CVE-2017-7651
fix to avoid extraordinary memory consumption by crafted
CONNECT packet from unauthenticated client
* CVE-2017-7652
in case all sockets/file descriptors are exhausted, this is a
fix to avoid default config values after reloading configuration
by SIGHUP signal
mosquitto (0.15-2+deb7u2) wheezy-security; urgency=high
* SECURITY UPDATE: Persistence file is world readable, which may expose
sensitive data.
- debian/patches/mosquitto-0.15_cve-2017-9868.patch: Set umask to
restrict persistence file read access to owner.
- CVE-2017-9868
mosquitto (0.15-2+deb7u1) wheezy-security; urgency=high
* SECURITY UPDATE: Pattern ACL can be bypassed by using a username/client id
set to '+' or '#'.
- debian/patches/mosquitto-1.3.4_cve-2017-7650.patch: Reject send/receive
of messages to/from clients with a '+', '#' or '/' in their
username/client id.
- CVE-2017-7650
Date: 2018-09-05 15:11:24.589193+00:00
Changed-By: Eduardo dos Santos Barretto <[email protected]>
https://launchpad.net/ubuntu/+source/mosquitto/0.15-2+deb7u3ubuntu0.1
Sorry, changesfile not available.
--
Trusty-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/trusty-changes
