[ubuntu/hardy-security] update-manager_0.87.31.1_hppa_translations.tar.gz, update-manager_0.87.31.1_sparc_translations.tar.gz, update-manager, update-manager_0.87.31.1_lpia_translations.tar.gz, update-manager_0.87.31.1_amd64_translations.tar.gz, update-manager_0.87.31.1_ia64_translations.tar.gz, dist-upgrader_0.87.31.1_all.tar.gz, update-manager_0.87.31.1_i386_translations.tar.gz, update-manager_0.87.31.1_powerpc_translations.tar.gz 1:0.87.31.1 (Accepted)

[Marc Deslauriers]

update-manager (1:0.87.31.1) hardy-security; urgency=low

  * SECURITY UPDATE: arbitrary code execution via directory traversal
    (LP: #881548)
    - UpdateManager/Core/DistUpgradeFetcherCore.py: verify signature before
      unpacking the tarball.
    - CVE-2011-3152
  * SECURITY UPDATE: information leak via insecure temp file (LP: #881541)
    - DistUpgrade/DistUpgradeViewKDE.py: use mkstemp instead of mktemp.
    - CVE-2011-3154

Date: Wed, 23 Nov 2011 09:58:49 -0500
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Michael Vogt <michael.vogt at ubuntu.com>
https://launchpad.net/ubuntu/hardy/+source/update-manager/1:0.87.31.1
-------------- next part --------------
Format: 1.7
Date: Wed, 23 Nov 2011 09:58:49 -0500
Source: update-manager
Binary: update-manager-core update-manager
Architecture: source
Version: 1:0.87.31.1
Distribution: hardy-security
Urgency: low
Maintainer: Michael Vogt <michael.vogt at ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 update-manager - GNOME application that manages apt updates
 update-manager-core - manage release upgrades
Launchpad-Bugs-Fixed: 881541 881548
Changes: 
 update-manager (1:0.87.31.1) hardy-security; urgency=low
 .
   * SECURITY UPDATE: arbitrary code execution via directory traversal
     (LP: #881548)
     - UpdateManager/Core/DistUpgradeFetcherCore.py: verify signature before
       unpacking the tarball.
     - CVE-2011-3152
   * SECURITY UPDATE: information leak via insecure temp file (LP: #881541)
     - DistUpgrade/DistUpgradeViewKDE.py: use mkstemp instead of mktemp.
     - CVE-2011-3154
Files: 
 49860eeb3d37db27970fbf468afac4c3 1496 gnome optional update-manager_0.87.31.1.dsc
 8e9bef4ed82a4c67322c018c1885aa19 2073732 gnome optional update-manager_0.87.31.1.tar.gz