[no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=pkgsrc-2014Q2 2014-07-07T09:23:34Z 2014-07-07T09:23:34Z tron tron@pkgsrc.org 2014-07-07T09:23:34Z urn:sha1:6e98a7d43bd3f07e7a1f8bb97a15ad5abe704ba7 sysutils/dbus: security update Revisions pulled up: - sysutils/dbus/Makefile 1.72 - sysutils/dbus/distinfo 1.57 --- Module Name: pkgsrc Committed By: wiz Date: Sun Jul 6 14:54:32 UTC 2014 Modified Files: pkgsrc/sysutils/dbus: Makefile distinfo Log Message: Update to 1.8.6: D-Bus 1.8.6 (2014-06-02) == Security fixes: • On Linux ≥ 2.6.37-rc4, if sendmsg() fails with ETOOMANYREFS, silently drop the message. This prevents an attack in which a malicious client can make dbus-daemon disconnect a system service, which is a local denial of service. (fd.o #80163, CVE-2014-3532; Alban Crequy) • Track remaining Unix file descriptors correctly when more than one message in quick succession contains fds. This prevents another attack in which a malicious client can make dbus-daemon disconnect a system service. (fd.o #79694, fd.o #80469, CVE-2014-3533; Alejandro Martínez Suárez, Simon McVittie, Alban Crequy) Other fixes: • When dbus-launch --exit-with-session starts a dbus-daemon but then cannot attach to a session, kill the dbus-daemon as intended (fd.o #74698, Роман Донченко) 2014-06-14T21:59:20Z wiz wiz@pkgsrc.org 2014-06-14T21:59:20Z urn:sha1:3291c550fd1acd0f585bd6930b323946f947ea23 2014-06-14T21:57:34Z wiz wiz@pkgsrc.org 2014-06-14T21:57:34Z urn:sha1:15a0998711c0a260adaf02399d26770f21a4eaa5 Accepted upstream as part of https://bugs.freedesktop.org/show_bug.cgi?id=69702 2014-06-14T21:52:56Z wiz wiz@pkgsrc.org 2014-06-14T21:52:56Z urn:sha1:3705175eebed4cbbe59e3fbf2fe90cf5d42a3619 2014-06-14T21:48:34Z wiz wiz@pkgsrc.org 2014-06-14T21:48:34Z urn:sha1:d71f4343c8f02ede57de69597b837b7e24c334ba 2014-06-14T21:11:34Z cheusov cheusov@pkgsrc.org 2014-06-14T21:11:34Z urn:sha1:7e4c53ebc1b30ad9aa4b435f9d4dccd241ac8665 2014-06-10T19:10:04Z wiz wiz@pkgsrc.org 2014-06-10T19:10:04Z urn:sha1:a16efd59233adcc5335119495cde4eb6b930deb1 D-Bus 1.8.4 (2014-06-10) == Security fix: • Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate. (CVE-2014-3477, fd.o #78979) 2014-05-04T16:44:08Z wiz wiz@pkgsrc.org 2014-05-04T16:44:08Z urn:sha1:f357a729552c28146d7ba2ffc074f4f1826b5659 D-Bus 1.8.2 (2014-04-30) == The “nobody wants red” release. Enhancements: • in the CMake build system, add some hints for Linux users cross-compiling Windows D-Bus binaries to be able to run tests under Wine (fd.o #41252, Ralf Habacker) • add Documentation key to dbus.service (fd.o #77447, Cameron Norman) Fixes: • in "dbus-uuidgen --ensure", try to copy systemd's /etc/machine-id to /var/lib/dbus/machine-id instead of generating an entirely new ID (fd.o #77941, Simon McVittie) • if dbus-launch receives an X error very quickly, do not kill unrelated processes (fd.o #74698, Роман Донченко) • on Windows, allow up to 8K connections to the dbus-daemon, instead of the previous 64 (fd.o #71297; Cristian Onet, Ralf Habacker) • cope with \r\n newlines in regression tests, since on Windows, dbus-daemon.exe uses text mode (fd.o #75863, Руслан Ижбулатов) 2014-04-29T10:18:54Z obache obache@pkgsrc.org 2014-04-29T10:18:54Z urn:sha1:80842cf9f926b30f1dce46dd6606e8818bb7ce6e 2014-04-24T09:40:08Z wiz wiz@pkgsrc.org 2014-04-24T09:40:08Z urn:sha1:2341be4dd9d61a18aee33715a55396129c154827 but on *BSD, only -1 means infinite.