[Pkg-mono-svn-commits] [SCM] mono-debugger branch, master, updated. debian/2.6.3-2-14-gfa909e2

Iain Lane laney at debian.org
Thu Oct 20 12:47:29 UTC 2011


The following commit has been merged in the master branch:
commit 386693bf0c076c2f28636ae5a9f2848a1cfa06cd
Author: Jari Aalto <jari.aalto at cante.net>
Date:   Wed Nov 3 16:56:42 2010 +0200

    Imported Debian patch 2.6.3-2.2

diff --git a/debian/changelog b/debian/changelog
index 0fb08ff..5d9e3d4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+mono-debugger (2.6.3-2.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * debian/patches
+    - (CVE-*): refresh. Fix CVE-2010-3369 insecure library loading
+      in more simple manner. See #601199.
+
+ -- Jari Aalto <jari.aalto at cante.net>  Wed, 03 Nov 2010 16:56:42 +0200
+
 mono-debugger (2.6.3-2.1) unstable; urgency=low
 
   * Non-maintainer upload.
diff --git a/debian/patches/cve-2010-3369--bug598299.dpatch b/debian/patches/cve-2010-3369--bug598299.dpatch
index 7704d1c..87135cc 100644
--- a/debian/patches/cve-2010-3369--bug598299.dpatch
+++ b/debian/patches/cve-2010-3369--bug598299.dpatch
@@ -1,5 +1,5 @@
 #! /bin/sh /usr/share/dpatch/dpatch-run
-## /tmp/CVE-2010-3369--bug598299.patch.dpatch by jaalto <jari.aalto at cante.net>
+## /tmp/CVE-2010-3369--bug598299-simple.patch.dpatch by jaalto <jari.aalto at cante.net>
 ##
 ## All lines beginning with `## DP:' are a description of the patch.
 ## DP: 
@@ -15,54 +15,30 @@
 diff --git a/build/mdb-symbolreader.in b/build/mdb-symbolreader.in
 old mode 100644
 new mode 100755
-index 7138bd0..627c2c1
+index 7138bd0..441452d
 --- a/build/mdb-symbolreader.in
 +++ b/build/mdb-symbolreader.in
-@@ -1,3 +1,18 @@
+@@ -1,3 +1,6 @@
  #!/bin/sh
 -export LD_LIBRARY_PATH="@libdir@:${LD_LIBRARY_PATH}"
 -exec @mono@ --debug @twodir@/mdb-symbolreader.exe $*
 +
-+Pathclean ()
-+{
-+   # Vulnerability fix for insecure path content
-+   # Make sure "::", "^:" or ":$" is not left in path arg $1
-+
-+   local tmp
-+   tmp=$(echo "$1" | sed -e 's/::\+// ; s/^:// ; s/:$//' )
-+
-+   [ "$tmp" ] && echo "$tmp"
-+}
-+
 +LD_LIBRARY_PATH="@libdir@${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-+LD_LIBRARY_PATH=$(Pathclean "$LD_LIBRARY_PATH")
 +export LD_LIBRARY_PATH
 +
 +exec @mono@ --debug @twodir@/mdb-symbolreader.exe "$@"
 diff --git a/build/mdb.in b/build/mdb.in
 old mode 100644
 new mode 100755
-index 12da6c3..8546d0b
+index 12da6c3..893e182
 --- a/build/mdb.in
 +++ b/build/mdb.in
-@@ -1,3 +1,18 @@
+@@ -1,3 +1,6 @@
  #!/bin/sh
 -export LD_LIBRARY_PATH="@libdir@:${LD_LIBRARY_PATH}"
 -exec @mono@ --debug @twodir@/mdb.exe $*
 +
-+Pathclean ()
-+{
-+   # Vulnerability fix for insecure path content
-+   # Make sure "::", "^:" or ":$" is not left in path arg $1
-+
-+   local tmp
-+   tmp=$(echo "$1" | sed -e 's/::\+// ; s/^:// ; s/:$//' )
-+
-+   [ "$tmp" ] && echo "$tmp"
-+}
-+
 +LD_LIBRARY_PATH="@libdir@${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-+LD_LIBRARY_PATH=$(Pathclean "$LD_LIBRARY_PATH")
 +export LD_LIBRARY_PATH
 +
 +exec @mono@ --debug @twodir@/mdb.exe "$@"

-- 
mono-debugger



More information about the Pkg-mono-svn-commits mailing list