[Pkg-utopia-maintainers] Pre-approval for dbus upload

[Michael Biebl]

Hi release team!

A potential local DoS attack was found in dbus, which can lead to a crash of the
bus damon due to infinite recursion in the message validation.

The relevant CVE is CVE-2010-4352 , see
http://www.remlab.net/op/dbus-variant-recursion.shtml for more details.

For experimental the bug was fixed in 1.4.1 and I uploaded an updated package
already.

The package in unstable/testing (1.2.24-3) is also affected.

Upstream has released 1.2.26 including the fix. The complete changelog is:

D-Bus 1.2.26 (21 December 2010)
==

• Fix for CVE-2010-4352: sending messages with excessively-nested variants can
  crash the bus. The existing restriction to 64-levels of nesting previously
  only applied to the static type signature; now it also applies to dynamic
  nesting using variants. Thanks to Rémi Denis-Courmont for discoving this
  issue.
• Corrected thread problem causing some calls to hang for 25s
• Enable address reuse on TCP sockets
• Fix use of $servicename in init script


I've attached the complete debdiff for 1.2.26.
I have to add that we already backported the fix for kqueue set_watched_dirs
from 1.2.x, so the actual diff is a bit smaller.
See also http://cgit.freedesktop.org/dbus/dbus/log/?h=dbus-1.2

Please let me know, if you prefer a 1.2.24-4 upload with a cherry-pick of only
the CVE fix or if a 1.2.26-1 upload including the other fixes, which seem
reasonable and relatively small, would be ok.

Cheers,
Michael


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dbus-debdiff.patch
Type: text/x-diff
Size: 23760 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-utopia-maintainers/attachments/20101221/02d3abff/attachment-0001.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 900 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-utopia-maintainers/attachments/20101221/02d3abff/attachment-0001.pgp>