Bug#753470: libspring-java: CVE-2014-0225
tony mancill
tmancill at debian.org
Sat Sep 6 15:50:24 UTC 2014
On Wed, 02 Jul 2014 10:36:55 +0200 Moritz Muehlenhoff <jmm at inutil.org>
wrote:
> Package: libspring-java
> Severity: grave
> Tags: security
> Justification: user security hole
>
> Hi,
> please see http://www.gopivotal.com/security/cve-2014-0225
Hello,
I have uploaded a a patched version (thanks Stephen!) to unstable and
prepared an upload 3.0.6.RELEASE-6+deb7u4 for wheezy-security, for which
the debdiff for the .dsc and .changes is attached. (It is essentially
identical to the debdiff for unstable.) I also placed the source and
binary packages for the wheezy update here:
https://people.debian.org/~tmancill/libspring-java_wheezy/
for Security Team review.
Thank you,
tony
-------------- next part --------------
============================================================================================
debdiff of .dsc
============================================================================================
diff -Nru libspring-java-3.0.6.RELEASE/debian/changelog libspring-java-3.0.6.RELEASE/debian/changelog
--- libspring-java-3.0.6.RELEASE/debian/changelog 2014-03-24 14:20:48.000000000 -0700
+++ libspring-java-3.0.6.RELEASE/debian/changelog 2014-09-05 22:52:45.000000000 -0700
@@ -1,3 +1,11 @@
+libspring-java (3.0.6.RELEASE-6+deb7u4) wheezy-security; urgency=high
+
+ * Team upload.
+ * Add patch for CVE-2014-0225. (Closes: #753470)
+ - Thanks to Stephen Nelson.
+
+ -- tony mancill <tmancill at debian.org> Fri, 05 Sep 2014 22:47:07 -0700
+
libspring-java (3.0.6.RELEASE-6+deb7u3) wheezy-security; urgency=high
* Team upload.
diff -Nru libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch
--- libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch 1969-12-31 16:00:00.000000000 -0800
+++ libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch 2014-09-05 22:47:22.000000000 -0700
@@ -0,0 +1,305 @@
+--- a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
++++ b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
+@@ -21,6 +21,7 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.io.StringReader;
+ import java.io.UnsupportedEncodingException;
+ import java.lang.reflect.GenericArrayType;
+ import java.lang.reflect.ParameterizedType;
+@@ -69,6 +70,7 @@
+
+ import org.apache.commons.logging.Log;
+ import org.apache.commons.logging.LogFactory;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -668,8 +670,11 @@
+ if (xmlReader == null) {
+ xmlReader = XMLReaderFactory.createXMLReader();
+ }
+- xmlReader.setFeature("http://xml.org/sax/features/external-general-entities",
+- this.processExternalEntities);
++ String name = "http://xml.org/sax/features/external-general-entities";
++ xmlReader.setFeature(name, isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++ xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+
+ return new SAXSource(xmlReader, inputSource);
+ }
+@@ -865,4 +870,11 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new EntityResolver() {
++ public InputSource resolveEntity(String publicId, String systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+--- a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/support/AbstractMarshaller.java
++++ b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/support/AbstractMarshaller.java
+@@ -20,6 +20,7 @@
+ import java.io.InputStream;
+ import java.io.OutputStream;
+ import java.io.Reader;
++import java.io.StringReader;
+ import java.io.Writer;
+ import javax.xml.parsers.DocumentBuilder;
+ import javax.xml.parsers.DocumentBuilderFactory;
+@@ -42,6 +43,7 @@
+ import org.apache.commons.logging.LogFactory;
+ import org.w3c.dom.Node;
+ import org.xml.sax.ContentHandler;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -203,6 +205,9 @@
+ protected XMLReader createXmlReader() throws SAXException {
+ XMLReader xmlReader = XMLReaderFactory.createXMLReader();
+ xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++ xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ return xmlReader;
+ }
+
+@@ -563,4 +568,11 @@
+ protected abstract Object unmarshalSaxReader(XMLReader xmlReader, InputSource inputSource)
+ throws XmlMappingException, IOException;
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new EntityResolver() {
++ public InputSource resolveEntity(String publicId, String systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+--- a/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java
++++ b/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java
+@@ -17,6 +17,7 @@
+ package org.springframework.http.converter.xml;
+
+ import java.io.IOException;
++import java.io.StringReader;
+ import javax.xml.bind.JAXBElement;
+ import javax.xml.bind.JAXBException;
+ import javax.xml.bind.MarshalException;
+@@ -28,6 +29,8 @@
+ import javax.xml.bind.annotation.XmlType;
+ import javax.xml.transform.Result;
+ import javax.xml.transform.Source;
++import javax.xml.transform.sax.SAXSource;
++import javax.xml.transform.stream.StreamSource;
+
+ import org.springframework.core.annotation.AnnotationUtils;
+ import org.springframework.http.HttpHeaders;
+@@ -36,6 +39,11 @@
+ import org.springframework.http.converter.HttpMessageNotReadableException;
+ import org.springframework.http.converter.HttpMessageNotWritableException;
+ import org.springframework.util.ClassUtils;
++import org.xml.sax.EntityResolver;
++import org.xml.sax.InputSource;
++import org.xml.sax.SAXException;
++import org.xml.sax.XMLReader;
++import org.xml.sax.helpers.XMLReaderFactory;
+
+ /**
+ * Implementation of {@link org.springframework.http.converter.HttpMessageConverter HttpMessageConverter} that can read
+@@ -49,6 +57,21 @@
+ */
+ public class Jaxb2RootElementHttpMessageConverter extends AbstractJaxb2HttpMessageConverter<Object> {
+
++ private boolean processExternalEntities = false;
++
++
++ /**
++ * Indicates whether external XML entities are processed when converting to a Source.
++ * <p>Default is {@code false}, meaning that external entities are not resolved.
++ */
++ public void setProcessExternalEntities(boolean processExternalEntities) {
++ this.processExternalEntities = processExternalEntities;
++ }
++
++ public boolean isProcessExternalEntities() {
++ return this.processExternalEntities;
++ }
++
+ @Override
+ public boolean canRead(Class<?> clazz, MediaType mediaType) {
+ return (clazz.isAnnotationPresent(XmlRootElement.class) || clazz.isAnnotationPresent(XmlType.class)) &&
+@@ -69,6 +92,7 @@
+ @Override
+ protected Object readFromSource(Class<?> clazz, HttpHeaders headers, Source source) throws IOException {
+ try {
++ source = processSource(source);
+ Unmarshaller unmarshaller = createUnmarshaller(clazz);
+ if (clazz.isAnnotationPresent(XmlRootElement.class)) {
+ return unmarshaller.unmarshal(source);
+@@ -87,6 +111,29 @@
+ }
+ }
+
++ protected Source processSource(Source source) {
++ if (source instanceof StreamSource) {
++ StreamSource streamSource = (StreamSource) source;
++ InputSource inputSource = new InputSource(streamSource.getInputStream());
++ try {
++ XMLReader xmlReader = XMLReaderFactory.createXMLReader();
++ String featureName = "http://xml.org/sax/features/external-general-entities";
++ xmlReader.setFeature(featureName, isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++ xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
++ return new SAXSource(xmlReader, inputSource);
++ }
++ catch (SAXException ex) {
++ logger.warn("Processing of external entities could not be disabled", ex);
++ return source;
++ }
++ }
++ else {
++ return source;
++ }
++ }
++
+ @Override
+ protected void writeToResult(Object o, HttpHeaders headers, Result result) throws IOException {
+ try {
+@@ -109,4 +156,11 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new EntityResolver() {
++ public InputSource resolveEntity(String publicId, String systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+--- a/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java
++++ b/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java
+@@ -21,9 +21,11 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.io.StringReader;
+ import javax.xml.parsers.DocumentBuilder;
+ import javax.xml.parsers.DocumentBuilderFactory;
+ import javax.xml.parsers.ParserConfigurationException;
++import javax.xml.stream.XMLResolver;
+ import javax.xml.stream.XMLInputFactory;
+ import javax.xml.stream.XMLStreamException;
+ import javax.xml.stream.XMLStreamReader;
+@@ -38,6 +40,7 @@
+ import javax.xml.transform.stream.StreamSource;
+
+ import org.w3c.dom.Document;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -125,8 +128,11 @@
+ try {
+ DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+ documentBuilderFactory.setNamespaceAware(true);
+- documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", processExternalEntities);
++ documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", isProcessExternalEntities());
+ DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
++ if (!isProcessExternalEntities()) {
++ documentBuilder.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ Document document = documentBuilder.parse(body);
+ return new DOMSource(document);
+ }
+@@ -141,8 +147,11 @@
+ private SAXSource readSAXSource(InputStream body) throws IOException {
+ try {
+ XMLReader reader = XMLReaderFactory.createXMLReader();
+- reader.setFeature("http://xml.org/sax/features/external-general-entities", processExternalEntities);
++ reader.setFeature("http://xml.org/sax/features/external-general-entities", isProcessExternalEntities());
+ byte[] bytes = StreamUtils.copyToByteArray(body);
++ if (!isProcessExternalEntities()) {
++ reader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ return new SAXSource(reader, new InputSource(new ByteArrayInputStream(bytes)));
+ }
+ catch (SAXException ex) {
+@@ -219,4 +228,17 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new EntityResolver() {
++ public InputSource resolveEntity(String publicId, String systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
++ private static final XMLResolver NO_OP_XML_RESOLVER = new XMLResolver() {
++ public Object resolveEntity(String publicID, String systemID, String base, String ns) {
++ return new ByteArrayInputStream(new byte[0]);
++ }
++ };
++
+ }
+--- a/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTest.java
++++ b/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTest.java
+@@ -98,6 +98,33 @@
+ assertEquals("Invalid result", "Hello World", result.s);
+ }
+
++ @Test
++ public void readXmlRootElementExternalEntityDisabled() throws Exception {
++ Resource external = new ClassPathResource("external.txt", getClass());
++ String content = "<!DOCTYPE root SYSTEM \"http://192.168.28.42/1.jsp\" [" +
++ " <!ELEMENT external ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
++ " <rootElement><external>&ext;</external></rootElement>";
++ MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
++ RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
++
++ assertEquals("", rootElement.external);
++ }
++
++ @Test
++ public void readXmlRootElementExternalEntityEnabled() throws Exception {
++ Resource external = new ClassPathResource("external.txt", getClass());
++ String content = "<!DOCTYPE root [" +
++ " <!ELEMENT external ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]>" +
++ " <rootElement><external>&ext;</external></rootElement>";
++ MockHttpInputMessage inputMessage = new MockHttpInputMessage(content.getBytes("UTF-8"));
++ this.converter.setProcessExternalEntities(true);
++ RootElement rootElement = (RootElement) converter.read(RootElement.class, inputMessage);
++
++ assertEquals("Foo Bar", rootElement.external);
++ }
++
+ @Test
+ public void writeXmlRootElement() throws Exception {
+ MockHttpOutputMessage outputMessage = new MockHttpOutputMessage();
+--- a/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/SourceHttpMessageConverterTests.java
++++ b/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/SourceHttpMessageConverterTests.java
+@@ -67,9 +67,10 @@
+ converter = new SourceHttpMessageConverter<Source>();
+ Resource external = new ClassPathResource("external.txt", getClass());
+
+- bodyExternal = "<!DOCTYPE root [" +
+- " <!ELEMENT root ANY >\n" +
+- " <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]><root>&ext;</root>";
++ bodyExternal = "<!DOCTYPE root SYSTEM \"http://192.168.28.42/1.jsp\" [" +
++ " <!ELEMENT root ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" + external.getURI() + "\" >]><root>&ext;</root>";
++
+ }
+
+ @Test
diff -Nru libspring-java-3.0.6.RELEASE/debian/patches/series libspring-java-3.0.6.RELEASE/debian/patches/series
--- libspring-java-3.0.6.RELEASE/debian/patches/series 2014-03-24 14:11:40.000000000 -0700
+++ libspring-java-3.0.6.RELEASE/debian/patches/series 2014-09-05 22:47:22.000000000 -0700
@@ -12,3 +12,4 @@
CVE-2013-6430.patch
CVE-2014-0054.patch
CVE-2014-1904.patch
+CVE-2014-0225.patch
============================================================================================
debdiff of .changes
============================================================================================
File lists identical (after any substitutions)
Control files of package libspring-aop-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libaopalliance-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-beans-java: lines which differ (wdiff format)
--------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libservlet2.5-java, libatinject-jsr330-api-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-context-java: lines which differ (wdiff format)
----------------------------------------------------------------------------------
Depends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-expression-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-instrument-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libbackport-util-concurrent-java, libtomcat6-java, libgeronimo-ejb-3.0-spec-java, libatinject-jsr330-api-java, glassfish-javaee, libjodatime-java, libasm3-java, libaopalliance-java, libcglib-java, libgeronimo-validation-1.0-spec-java, libgeronimo-jms-1.1-spec-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-context-support-java: lines which differ (wdiff format)
------------------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-jdbc-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-core-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Installed-Size: [-474-] {+475+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-expression-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-instrument-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-jdbc-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libc3p0-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-jms-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} glassfish-javaee
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-orm-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-jdbc-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-web-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libjdo-api-java (>= 2.2), glassfish-toplink-essentials, libibatis-java, libhibernate3-java (>= 3.5), libdom4j-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-oxm-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Installed-Size: [-142-] {+144+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-test-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-transaction-java: lines which differ (wdiff format)
--------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} glassfish-javaee
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Installed-Size: [-477-] {+480+}
Recommends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-oxm-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-portlet-java: lines which differ (wdiff format)
--------------------------------------------------------------------------------------
Depends: libspring-web-servlet-java (= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-servlet-java: lines which differ (wdiff format)
--------------------------------------------------------------------------------------
Depends: libspring-web-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libservlet2.5-java
Recommends: libspring-context-support-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libvelocity-tools-java, libjasperreports-java, libtiles-java, libitext-java, libjexcelapi-java, libapache-poi-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-struts-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------------
Depends: libspring-web-servlet-java (= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libstruts1.2-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20140906/0ccc4f64/attachment-0001.sig>
More information about the pkg-java-maintainers
mailing list