simplestreams (0.1.0~bzr354-0ubuntu1.15.04.1) vivid-security; urgency=medium
* SECURITY UPDATE: insufficient verification of GPG signatures
allowing malicious injection into images
- debian/patches/lp1487004-use-checksumming-reader.patch: Ensure
that users of the BasicMirrorWriter get exceptions when importing
data that has invalid checksum or sizes. (LP: #1487004)
- CVE-2015-1337
- debian/patches/lp1487004-sru-safetynet.patch:
provide a backwards compatible behavior via setting
SS_MISSING_ITEM_CHECKSUM_BEHAVIOR=silent. See bug for more info.
Date: 2015-09-24 05:40:19.386172+00:00
Changed-By: Scott Moser <[email protected]>
Signed-By: Ubuntu Archive Robot
<[email protected]>
https://launchpad.net/ubuntu/+source/simplestreams/0.1.0~bzr354-0ubuntu1.15.04.1
Sorry, changesfile not available.
--
Vivid-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/vivid-changes
