-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sun, 09 Jun 2019 22:42:06 +0100 Source: dbus Binary: dbus dbus-1-dbg dbus-1-doc dbus-tests dbus-udeb dbus-user-session dbus-x11 libdbus-1-3 libdbus-1-3-udeb libdbus-1-dev Architecture: source Version: 1.10.28-0+deb9u1 Distribution: stretch-security Urgency: medium Maintainer: Utopia Maintenance Team Changed-By: Simon McVittie Description: dbus - simple interprocess messaging system (daemon and utilities) dbus-1-dbg - simple interprocess messaging system (debug symbols) dbus-1-doc - simple interprocess messaging system (documentation) dbus-tests - simple interprocess messaging system (test infrastructure) dbus-udeb - simple interprocess messaging system (minimal runtime) (udeb) dbus-user-session - simple interprocess messaging system (systemd --user integration) dbus-x11 - simple interprocess messaging system (X11 deps) libdbus-1-3 - simple interprocess messaging system (library) libdbus-1-3-udeb - simple interprocess messaging system (minimal library) (udeb) libdbus-1-dev - simple interprocess messaging system (development headers) Changes: dbus (1.10.28-0+deb9u1) stretch-security; urgency=medium . * New upstream stable release - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1 authentication for identities that differ from the user running the DBusServer. Previously, a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration were immune to this attack because they did not allow DBUS_COOKIE_SHA1, but third-party users of DBusServer such as Upstart could be vulnerable. - Prevent reading up to 3 bytes beyond the end of a truncated message. This could in principle be an information leak or denial of service on the system bus, but is not believed to be exploitable to crash the system bus or leak interesting information in practice. - Stop the dbus-daemon leaking memory (an error message) if delivering the message that triggered auto-activation is forbidden. This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log, and its scope is typically limited by the finite number of activatable services available. - Remove __attribute__((__malloc__)) attribute on dbus_realloc(), which does not meet the criteria for that attribute in gcc 4.7+, potentially leading to miscompilation. - Fix build with gcc 8 -Werror=cast-function-type - Fix warning from gcc 8 about suspicious use of strncpy() when populating struct sockaddr_un - Fix installation of Ducktype documentation with newer yelp-build versions * d/control: Update Vcs-Git, Vcs-Browser Checksums-Sha1: 90601f09ea799f8f73742263a29223a50234d0fc 3345 dbus_1.10.28-0+deb9u1.dsc 3177c3f8e65629dd6be7b60002da80d6bf5366f4 1998830 dbus_1.10.28.orig.tar.gz 5a7d04e09c0c220b1d035d6a03dab96655cfdbee 833 dbus_1.10.28.orig.tar.gz.asc 88373bc62a77b94a24893399e62d5e44dea135c1 57500 dbus_1.10.28-0+deb9u1.debian.tar.xz f90bb1acac6c403a7ae9c472e49d653dd2309479 8031 dbus_1.10.28-0+deb9u1_source.buildinfo Checksums-Sha256: a4758356f5a71e87804f3b55e1f83f41c10b19ddb84595e322eeb2cd44cdb367 3345 dbus_1.10.28-0+deb9u1.dsc 63f5b1d57360be5c147ef561e67f8efdd9034e1f12b7aba41feb42b376324552 1998830 dbus_1.10.28.orig.tar.gz 5da985dafdf223b7f5e0c6e51c608fd7d87e681e0c1eccfa2970be2978c0bed9 833 dbus_1.10.28.orig.tar.gz.asc 83c883431ee58fbfd7dcae4c763baa904e14b835023edff0dd495270d56d59b3 57500 dbus_1.10.28-0+deb9u1.debian.tar.xz f6cf9cfa2d44a4759ab174a38c97808729c09e9c6c292cd1ee30484d8080c34f 8031 dbus_1.10.28-0+deb9u1_source.buildinfo Files: 38180eef98e7ca9f6c33e6b5742f087c 3345 admin optional dbus_1.10.28-0+deb9u1.dsc 9c853418bdc44df243e51aacfa6257c3 1998830 admin optional dbus_1.10.28.orig.tar.gz b51f95419107e9b0f52485498df5589e 833 admin optional dbus_1.10.28.orig.tar.gz.asc 5477e85465b0697f4ca759e8774280e0 57500 admin optional dbus_1.10.28-0+deb9u1.debian.tar.xz 620d351fbf97d418e600493f8981e0f1 8031 admin optional dbus_1.10.28-0+deb9u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENuxaZEik9e95vv6Y4FrhR4+BTE8FAl0BQNkACgkQ4FrhR4+B TE/7/w//WmqVkiGJslULEoy9b45IF4d3OMCkO6ztAphi/S7d52W8+iRh/J/VRsJs 8ZJnpXC+xgBKei35+oj2XGUjyxtV8IR6qKh4lxgjIzQLDTUqrVxWboNDgXELrY59 KoSWV/E9lBlpsYBSFqFui/C1s7uPgID8RndQMhgHNEHmJLD1jhEzQKAEOZLemuWX A0kblQnCTb+OEhfn6FeaGGPB5BSbLoNgMkx0Lj1e0Gne5CFxgU4w5cDuCuFXZIQC PBR3PvwzhsW22HZW3i5qpjKLj++dzRpg4h5ACq55Pf/zyof7ZDtS2R4Ew+A3xADm ADQMNCw++LBvhI/Ij3LeZ57ltyHDioRjOz5sX6UEZ3/jtaNd5wSwgP1snJzFb2pI WVCP+B0n3t85F9um4daU0PEpIOyIcCDCFFXypxwXfF+mz9Fzyz+Y4KHk0M+uknk7 oxsM+hwrdIToOBJRIQBToGd1BNiJrrTRIZE+kC+PC2xBlswnzdcdHZW+CDDlDrC8 s/WIkVQY2XTf9/KgnB0/iJIjFAgIQCiSUhqu2KUd14L5o42YBA8IJMrzfw/7/b4o rF9QB664Y3lm85MJ5z23Wfog+aEI89dm5NTbZXFG9RxIBDKi4QmYr12Hd1kIo55m 2WUl5hIDmr6hFgrndcdqbOoGmK/8C8aK4c9yj8msEDYJHBmrEww= =XtYc -----END PGP SIGNATURE-----