From martin.pitt at ubuntu.com  Tue Apr  6 09:45:10 2010
From: martin.pitt at ubuntu.com (Martin Pitt)
Date: Tue, 06 Apr 2010 08:45:10 -0000
Subject: [ubuntu/jaunty-proposed] tzdata 2010h~repack-0ubuntu0.9.04 (Accepted)
Message-ID: <20100406084510.9245.98647.launchpad@gandwana.canonical.com>

tzdata (2010h~repack-0ubuntu0.9.04) jaunty-proposed; urgency=low

  * New upstream release 2010h:
    - Africa/Tunis (Tunesia): Drop DST permanently. (LP: #550157)
    - Asia/Karachi (Pakistan): Drop DST permanently.

Date: Tue, 06 Apr 2010 10:28:42 +0200
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://edge.launchpad.net/ubuntu/jaunty/+source/tzdata/2010h~repack-0ubuntu0.9.04
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 06 Apr 2010 10:28:42 +0200
Source: tzdata
Binary: tzdata tzdata-java
Architecture: source
Version: 2010h~repack-0ubuntu0.9.04
Distribution: jaunty-proposed
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Description: 
 tzdata     - time zone and daylight-saving time data
 tzdata-java - time zone and daylight-saving time data for use by java runtimes
Launchpad-Bugs-Fixed: 550157
Changes: 
 tzdata (2010h~repack-0ubuntu0.9.04) jaunty-proposed; urgency=low
 .
   * New upstream release 2010h:
     - Africa/Tunis (Tunesia): Drop DST permanently. (LP: #550157)
     - Asia/Karachi (Pakistan): Drop DST permanently.
Checksums-Sha1: 
 84f7511c77d996616e9805d5dfb88682c9da791c 1300 tzdata_2010h~repack-0ubuntu0.9.04.dsc
 6e7babc2e2666297131d54a64e63979691b78a07 188426 tzdata_2010h~repack.orig.tar.gz
 3ef76af8d2cfc545d6995eca9e18f445d7e5f251 218981 tzdata_2010h~repack-0ubuntu0.9.04.diff.gz
Checksums-Sha256: 
 0b257a85024e82a7fbc4e5e4e69b44b133197c5065acf94f03998a684da58869 1300 tzdata_2010h~repack-0ubuntu0.9.04.dsc
 906e479e4b2b2ce1267c74d0201362f7de5681281da4e1e90c83ac22d9a22380 188426 tzdata_2010h~repack.orig.tar.gz
 d308f041a12227fbfbdce0e9efc49a6ef20a7ccb44528301e8679a7be503d3d9 218981 tzdata_2010h~repack-0ubuntu0.9.04.diff.gz
Files: 
 4c92b2ef62d4c8de8ffc09a04e6cd576 1300 libs required tzdata_2010h~repack-0ubuntu0.9.04.dsc
 f13e1cf669cdd503f44a97f88431ba70 188426 libs required tzdata_2010h~repack.orig.tar.gz
 643ed1bcdd1def8a2d05d9a4a99900d4 218981 libs required tzdata_2010h~repack-0ubuntu0.9.04.diff.gz
Original-Maintainer: GNU Libc Maintainers <debian-glibc at lists.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAku68N4ACgkQDecnbV4Fd/JJ/QCbBRakmgWd4Q0tcVw0vt1ruium
bxkAoNzdLHXKan6TsmWDtMDG4rPbilL9
=j8AB
-----END PGP SIGNATURE-----

From doko at ubuntu.com  Tue Apr  6 10:02:34 2010
From: doko at ubuntu.com (Matthias Klose)
Date: Tue, 06 Apr 2010 09:02:34 -0000
Subject: [ubuntu/jaunty-proposed] sun-java6 6.19-0ubuntu1.9.04 (Accepted)
Message-ID: <20100406090234.14248.24971.launchpad@soybean.canonical.com>

sun-java6 (6.19-0ubuntu1.9.04) jaunty-proposed; urgency=low

  * New upstream version. LP: #555800.
    Release notes at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html.

Date: Mon, 05 Apr 2010 17:45:39 +0200
Changed-By: Matthias Klose <doko at ubuntu.com>
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Signed-By: Matthias Klose <matthias.klose at canonical.com>
https://edge.launchpad.net/ubuntu/jaunty/+source/sun-java6/6.19-0ubuntu1.9.04
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 05 Apr 2010 17:45:39 +0200
Source: sun-java6
Binary: sun-java6-jre sun-java6-bin sun-java6-plugin ia32-sun-java6-bin ia32-sun-java6-plugin sun-java6-fonts sun-java6-jdk sun-java6-demo sun-java6-source sun-java6-javadb
Architecture: source
Version: 6.19-0ubuntu1.9.04
Distribution: jaunty-proposed
Urgency: low
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Changed-By: Matthias Klose <doko at ubuntu.com>
Description: 
 ia32-sun-java6-bin - Sun Java(TM) Runtime Environment (JRE) 6 (32-bit)
 ia32-sun-java6-plugin - The Java(TM) Plug-in, Java SE 6 (32-bit)
 sun-java6-bin - Sun Java(TM) Runtime Environment (JRE) 6 (architecture dependent 
 sun-java6-demo - Sun Java(TM) Development Kit (JDK) 6 demos and examples
 sun-java6-fonts - Lucida TrueType fonts (from the Sun JRE)
 sun-java6-javadb - Java(TM) DB, Sun Microsystems' distribution of Apache Derby
 sun-java6-jdk - Sun Java(TM) Development Kit (JDK) 6
 sun-java6-jre - Sun Java(TM) Runtime Environment (JRE) 6 (architecture independen
 sun-java6-plugin - The Java(TM) Plug-in, Java SE 6
 sun-java6-source - Sun Java(TM) Development Kit (JDK) 6 source files
Launchpad-Bugs-Fixed: 555800
Changes: 
 sun-java6 (6.19-0ubuntu1.9.04) jaunty-proposed; urgency=low
 .
   * New upstream version. LP: #555800.
     Release notes at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html.
Checksums-Sha1: 
 428ce582bd15cba7a53412dcddd46c2fcbefb701 1668 sun-java6_6.19-0ubuntu1.9.04.dsc
 32559c3b5339d1dff20e1c0c985730858e8353e5 167178948 sun-java6_6.19.orig.tar.gz
 774ca0c595230dd700809872b824efa8ca45392e 75795 sun-java6_6.19-0ubuntu1.9.04.diff.gz
Checksums-Sha256: 
 fe2c69445aab0ae4b83b29b0d3d16de57919080d22d109726756378949fa2494 1668 sun-java6_6.19-0ubuntu1.9.04.dsc
 35e000e7caee8735ef5111ea9408c2890178935879d2d12b5d8920d377f7b075 167178948 sun-java6_6.19.orig.tar.gz
 fab65cfd1bdf4e0fae3ce138c6517729f653d54442d9a9e5d712ebb8744feee8 75795 sun-java6_6.19-0ubuntu1.9.04.diff.gz
Files: 
 547da5f6dc9f83232daee75739cba816 1668 non-free/devel optional sun-java6_6.19-0ubuntu1.9.04.dsc
 aeabf58432479385e09ca43b952f3290 167178948 non-free/devel optional sun-java6_6.19.orig.tar.gz
 15af88d18184b4f7a75112806976fbb3 75795 non-free/devel optional sun-java6_6.19-0ubuntu1.9.04.diff.gz
Original-Maintainer: Debian QA Group <packages at qa.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAku6C+gACgkQStlRaw+TLJx7HACeJfQex0Z+H+6Wb6QxCXC4g0vf
wpQAmwTjR7C4lg/fDAERH3iHKYSMcZy7
=TjZv
-----END PGP SIGNATURE-----

From archive at ubuntu.com  Wed Apr  7 06:05:11 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Wed, 07 Apr 2010 05:05:11 -0000
Subject: [ubuntu/jaunty-security] krb5,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_ia64_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_amd64_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_powerpc_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_lpia_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_hppa_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_i386_translations.tar.gz,
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_sparc_translations.tar.gz (delayed),
	krb5_1.6.dfsg.4~beta1-5ubuntu2.3_armel_translations.tar.gz
	1.6.dfsg.4~beta1-5ubuntu2.3 (Accepted)
Message-ID: <20100407050511.29402.6530.launchpad@cocoplum.canonical.com>

krb5 (1.6.dfsg.4~beta1-5ubuntu2.3) jaunty-security; urgency=low

  * SECURITY UPDATE: unauthenticated remote KDC service crash.
    - debian/patches/MITKRB5-SA-2010-003 applied inline.
  * SECURITY UPDATE: potential service crashes.
    - debian/patches/likewise-krb5-gssapi: fixed to not re-introduce
      CVE-2007-5901 and CVE-2007-5971.

Date: Tue, 06 Apr 2010 17:46:29 -0700
Changed-By: Kees Cook <kees at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/krb5/1.6.dfsg.4~beta1-5ubuntu2.3
-------------- next part --------------
Format: 1.8
Date: Tue, 06 Apr 2010 17:46:29 -0700
Source: krb5
Binary: libkadm55 libkrb53 krb5-user krb5-clients krb5-rsh-server krb5-ftpd krb5-telnetd krb5-kdc krb5-kdc-ldap krb5-admin-server libkrb5-dev libkrb5-dbg krb5-pkinit krb5-doc
Architecture: source
Version: 1.6.dfsg.4~beta1-5ubuntu2.3
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Kees Cook <kees at ubuntu.com>
Description: 
 krb5-admin-server - MIT Kerberos master server (kadmind)
 krb5-clients - Secure replacements for ftp, telnet and rsh using MIT Kerberos
 krb5-doc   - Documentation for MIT Kerberos
 krb5-ftpd  - Secure FTP server supporting MIT Kerberos
 krb5-kdc   - MIT Kerberos key server (KDC)
 krb5-kdc-ldap - MIT Kerberos key server (KDC) LDAP plugin
 krb5-pkinit - PKINIT plugin for MIT Kerberos
 krb5-rsh-server - Secure replacements for rshd and rlogind using MIT Kerberos
 krb5-telnetd - Secure telnet server supporting MIT Kerberos
 krb5-user  - Basic programs to authenticate using MIT Kerberos
 libkadm55  - MIT Kerberos administration runtime libraries
 libkrb5-dbg - Debugging files for MIT Kerberos
 libkrb5-dev - Headers and development libraries for MIT Kerberos
 libkrb53   - MIT Kerberos runtime libraries
Changes: 
 krb5 (1.6.dfsg.4~beta1-5ubuntu2.3) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: unauthenticated remote KDC service crash.
     - debian/patches/MITKRB5-SA-2010-003 applied inline.
   * SECURITY UPDATE: potential service crashes.
     - debian/patches/likewise-krb5-gssapi: fixed to not re-introduce
       CVE-2007-5901 and CVE-2007-5971.
Checksums-Sha1: 
 90910a20da031eae68a6a91c8205508d49569819 1671 krb5_1.6.dfsg.4~beta1-5ubuntu2.3.dsc
 44073b60e025bb2fab8495aa1474a0ef3dca7f3b 884759 krb5_1.6.dfsg.4~beta1-5ubuntu2.3.diff.gz
Checksums-Sha256: 
 e46ef63117d3a66a1345ba58d75df143f5c0ea35001fde2433333c89e93870de 1671 krb5_1.6.dfsg.4~beta1-5ubuntu2.3.dsc
 f8226496888e6d86497ee98a0275e08407464a530b9c41e87a1143b6369ee4fc 884759 krb5_1.6.dfsg.4~beta1-5ubuntu2.3.diff.gz
Files: 
 2df8fc05d522a39465b516106eb1c720 1671 net standard krb5_1.6.dfsg.4~beta1-5ubuntu2.3.dsc
 6834e06b9b7420e013639e5f0177dde7 884759 net standard krb5_1.6.dfsg.4~beta1-5ubuntu2.3.diff.gz
Original-Maintainer: Sam Hartman <hartmans at debian.org>

From archive at ubuntu.com  Wed Apr  7 06:05:31 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Wed, 07 Apr 2010 05:05:31 -0000
Subject: [ubuntu/jaunty-security] openjdk-6,
	openjdk-6 (delayed) 6b14-1.4.1-0ubuntu13 (Accepted)
Message-ID: <20100407050531.29402.49227.launchpad@cocoplum.canonical.com>

openjdk-6 (6b14-1.4.1-0ubuntu13) jaunty-security; urgency=low

  * Security updates:
    - 6626217: Loader-constraint table allows arrays instead of only
      the base-classes.
    - 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
    - 6639665: ThreadGroup finalizer allows creation of false root ThreadGroups.
    - 6736390: File TOCTOU deserialization vulnerability.
    - 6745393: Inflater/Deflater clone issues.
    - 6887703: Unsigned applet can retrieve the dragged information before drop
      action occur.
    - 6888149: AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error.
    - 6892265: System.arraycopy unable to reference elements beyond
      Integer.MAX_VALUE bytes.
    - 6893947: Deserialization of RMIConnectionImpl objects should enforce
      stricter checks [ZDI-CAN-588].
    - 6893954: Subclasses of InetAddress may incorrectly interpret network
      addresses [ZDI-CAN-603].
    - 6894807: No ClassCastException for HashAttributeSet constructors if run
      with -Xcomp.
    - 6898622: ObjectIdentifer.equals is not capable of detecting incorrectly
      encoded CommonName OIDs.
    - 6898739: TLS renegotiation issue.
    - 6899653: Java Runtime CMM readMabCurveData Buffer Overflow Vulnerability.
    - 6902299: Java JAR "unpack200" must verify input parameters.
    - 6904691: Java Applet Trusted Methods Chaining Privilege Escalation
      Vulnerability.
    - 6909597: Java Runtime Environment JPEGImageReader stepX Integer Overflow
      Vulnerability.
    - 6910590: Application can modify command array, in ProcessBuilder.
    - 6914823: Java AWT Library Invalid Index Vulnerability.
    - 6914866: JRE ImagingLib arbitrary code execution vulnerability.
    - 6932480: Crash in CompilerThread/Parser.

Date: Mon, 29 Mar 2010 22:53:11 +0200
Changed-By: Matthias Klose <doko at ubuntu.com>
Maintainer: OpenJDK Team <openjdk at lists.launchpad.net>
https://launchpad.net/ubuntu/jaunty/+source/openjdk-6/6b14-1.4.1-0ubuntu13
-------------- next part --------------
Format: 1.8
Date: Mon, 29 Mar 2010 22:53:11 +0200
Source: openjdk-6
Binary: openjdk-6-jdk openjdk-6-jre-headless openjdk-6-jre openjdk-6-jre-lib openjdk-6-demo openjdk-6-source openjdk-6-doc openjdk-6-dbg icedtea6-plugin openjdk-6-source-files icedtea-6-jre-cacao openjdk-6-jre-zero
Architecture: source
Version: 6b14-1.4.1-0ubuntu13
Distribution: jaunty-security
Urgency: low
Maintainer: OpenJDK Team <openjdk at lists.launchpad.net>
Changed-By: Matthias Klose <doko at ubuntu.com>
Description: 
 icedtea-6-jre-cacao - Alternatve JVM for OpenJDK, using Cacao
 icedtea6-plugin - web browser plugin based on OpenJDK and IcedTea to execute Java a
 openjdk-6-dbg - Java runtime based on OpenJDK (debugging symbols)
 openjdk-6-demo - Java runtime based on OpenJDK (demos and examples)
 openjdk-6-doc - OpenJDK Development Kit (JDK) documentation
 openjdk-6-jdk - OpenJDK Development Kit (JDK)
 openjdk-6-jre - OpenJDK Java runtime, using ${vm:Name}
 openjdk-6-jre-headless - OpenJDK Java runtime, using ${vm:Name} (headless)
 openjdk-6-jre-lib - OpenJDK Java runtime (architecture independent libraries)
 openjdk-6-jre-zero - Alternatve JVM for OpenJDK, using Zero/Shark
 openjdk-6-source - OpenJDK Development Kit (JDK) source files
 openjdk-6-source-files - OpenJDK 6 source files (used as a build dependency)
Changes: 
 openjdk-6 (6b14-1.4.1-0ubuntu13) jaunty-security; urgency=low
 .
   * Security updates:
     - 6626217: Loader-constraint table allows arrays instead of only
       the base-classes.
     - 6633872: Policy/PolicyFile leak dynamic ProtectionDomains.
     - 6639665: ThreadGroup finalizer allows creation of false root ThreadGroups.
     - 6736390: File TOCTOU deserialization vulnerability.
     - 6745393: Inflater/Deflater clone issues.
     - 6887703: Unsigned applet can retrieve the dragged information before drop
       action occur.
     - 6888149: AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error.
     - 6892265: System.arraycopy unable to reference elements beyond
       Integer.MAX_VALUE bytes.
     - 6893947: Deserialization of RMIConnectionImpl objects should enforce
       stricter checks [ZDI-CAN-588].
     - 6893954: Subclasses of InetAddress may incorrectly interpret network
       addresses [ZDI-CAN-603].
     - 6894807: No ClassCastException for HashAttributeSet constructors if run
       with -Xcomp.
     - 6898622: ObjectIdentifer.equals is not capable of detecting incorrectly
       encoded CommonName OIDs.
     - 6898739: TLS renegotiation issue.
     - 6899653: Java Runtime CMM readMabCurveData Buffer Overflow Vulnerability.
     - 6902299: Java JAR "unpack200" must verify input parameters.
     - 6904691: Java Applet Trusted Methods Chaining Privilege Escalation
       Vulnerability.
     - 6909597: Java Runtime Environment JPEGImageReader stepX Integer Overflow
       Vulnerability.
     - 6910590: Application can modify command array, in ProcessBuilder.
     - 6914823: Java AWT Library Invalid Index Vulnerability.
     - 6914866: JRE ImagingLib arbitrary code execution vulnerability.
     - 6932480: Crash in CompilerThread/Parser.
Checksums-Sha1: 
 b81aea89eeca886424180651807f930104c83af3 2415 openjdk-6_6b14-1.4.1-0ubuntu13.dsc
 620188a2f211721f10fdc556376ae31aa17472ac 4320319 openjdk-6_6b14-1.4.1-0ubuntu13.diff.gz
Checksums-Sha256: 
 d3a0c376915ff40b34ff6a1d076e888f82ac5ec63152748c8411e93b83fa6e6e 2415 openjdk-6_6b14-1.4.1-0ubuntu13.dsc
 9a4e77f04286369b541540464dbb9039c5108f4106fe17296325a7956fab9765 4320319 openjdk-6_6b14-1.4.1-0ubuntu13.diff.gz
Files: 
 c7756818c527a60c1ae5a4ea1411813b 2415 devel extra openjdk-6_6b14-1.4.1-0ubuntu13.dsc
 4021c8fcd4c1614a2451160790a85405 4320319 devel extra openjdk-6_6b14-1.4.1-0ubuntu13.diff.gz

From archive at ubuntu.com  Wed Apr  7 14:03:18 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Wed, 07 Apr 2010 13:03:18 -0000
Subject: [ubuntu/jaunty-security]
	mahara_1.0.9-2ubuntu0.6_i386_translations.tar.gz (delayed),
	mahara 1.0.9-2ubuntu0.6 (Accepted)
Message-ID: <20100407130318.14496.47850.launchpad@cocoplum.canonical.com>

mahara (1.0.9-2ubuntu0.6) jaunty-security; urgency=low

  * SECURITY UPDATE: SQL injection (LP: #556369)
    - debian/patches/CVE-2010-0400.dpatch: fix from upstream
    - CVE-2010-0400

Date: Tue, 06 Apr 2010 22:58:53 +1200
Changed-By: Francois Marier <francois at debian.org>
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/mahara/1.0.9-2ubuntu0.6
-------------- next part --------------
Format: 1.8
Date: Tue, 06 Apr 2010 22:58:53 +1200
Source: mahara
Binary: mahara mahara-apache2
Architecture: source
Version: 1.0.9-2ubuntu0.6
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Changed-By: Francois Marier <francois at debian.org>
Description: 
 mahara     - Electronic portfolio, weblog, and resume builder
 mahara-apache2 - Electronic portfolio, weblog, and resume builder - apache2 config
Launchpad-Bugs-Fixed: 556369
Changes: 
 mahara (1.0.9-2ubuntu0.6) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: SQL injection (LP: #556369)
     - debian/patches/CVE-2010-0400.dpatch: fix from upstream
     - CVE-2010-0400
Checksums-Sha1: 
 256ab8b8fb9efb3ed27462302076f950b957211b 1388 mahara_1.0.9-2ubuntu0.6.dsc
 2103a59ddee525d2da1531d5fe82ac931804bce0 26346 mahara_1.0.9-2ubuntu0.6.diff.gz
Checksums-Sha256: 
 913e34705d906b2a5730da0d79027b3d5d327325bcc243a806d6dbb1f411af0b 1388 mahara_1.0.9-2ubuntu0.6.dsc
 23b224c9be3443d2f56fed2797d867e59fbaeb11066006c453b779db62883755 26346 mahara_1.0.9-2ubuntu0.6.diff.gz
Files: 
 9934cf7dc6179bd21180267b486435ec 1388 web optional mahara_1.0.9-2ubuntu0.6.dsc
 651865365dd7074772ca932bf3f5d0fd 26346 web optional mahara_1.0.9-2ubuntu0.6.diff.gz
Original-Maintainer: Mahara Debian Packaging Team <pkg-debian at mahara.org>

From archive at ubuntu.com  Thu Apr  8 17:03:25 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 08 Apr 2010 16:03:25 -0000
Subject: [ubuntu/jaunty-security] moin,
	moin_1.8.2-2ubuntu2.3_i386_translations.tar.gz (delayed)
	1.8.2-2ubuntu2.3 (Accepted)
Message-ID: <20100408160325.11489.59873.launchpad@cocoplum.canonical.com>

moin (1.8.2-2ubuntu2.3) jaunty-security; urgency=low

  * SECURITY UPDATE: fix XSS in Despam action
    - debian/patches/30004_CVE-2010-0828.patch: use wikiutil.escape()
      in revert_pages()
    - CVE-2010-0828

Date: Tue, 30 Mar 2010 13:55:32 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/moin/1.8.2-2ubuntu2.3
-------------- next part --------------
Format: 1.8
Date: Tue, 30 Mar 2010 13:55:32 -0500
Source: moin
Binary: python-moinmoin
Architecture: source
Version: 1.8.2-2ubuntu2.3
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 python-moinmoin - Python clone of WikiWiki - library
Changes: 
 moin (1.8.2-2ubuntu2.3) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: fix XSS in Despam action
     - debian/patches/30004_CVE-2010-0828.patch: use wikiutil.escape()
       in revert_pages()
     - CVE-2010-0828
Checksums-Sha1: 
 7f52346a154c321d5b75a2126652556144878b71 1354 moin_1.8.2-2ubuntu2.3.dsc
 ce2783c02987effc9a68c21a44dd45d71fdc7f0b 104942 moin_1.8.2-2ubuntu2.3.diff.gz
Checksums-Sha256: 
 a2ccbffb8a7c76d58839a967cbbd4a7dacb563e0ff39636f4be6f5efe5d217eb 1354 moin_1.8.2-2ubuntu2.3.dsc
 973ffd112abe04af93b6f141ee10569114387d70451867c8bed45e934665052c 104942 moin_1.8.2-2ubuntu2.3.diff.gz
Files: 
 8c79801a1d045a921232b98bd4d7f786 1354 net optional moin_1.8.2-2ubuntu2.3.dsc
 9dfd747b7096aa4c41e5bd0a5c62475a 104942 net optional moin_1.8.2-2ubuntu2.3.diff.gz
Original-Maintainer: Jonas Smedegaard <dr at jones.dk>

From martin.pitt at ubuntu.com  Thu Apr  8 18:49:31 2010
From: martin.pitt at ubuntu.com (Martin Pitt)
Date: Thu, 08 Apr 2010 17:49:31 -0000
Subject: [ubuntu/jaunty-proposed] postgresql-8.3 8.3.10-0ubuntu9.04 (Accepted)
Message-ID: <20100408174931.21347.62914.launchpad@cocoplum.canonical.com>

postgresql-8.3 (8.3.10-0ubuntu9.04) jaunty-proposed; urgency=low

  * New upstream bug fix release: (LP: #557408)
    - Add new configuration parameter ssl_renegotiation_limit to control
      how often we do session key renegotiation for an SSL connection.
      This can be set to zero to disable renegotiation completely, which
      may be required if a broken SSL library is used. In particular,
      some vendors are shipping stopgap patches for CVE-2009-3555 that
      cause renegotiation attempts to fail.
    - Fix possible deadlock during backend startup.
    - Fix possible crashes due to not handling errors during relcache
      reload cleanly.
    - Fix possible crash due to use of dangling pointer to a cached plan.
    - Fix possible crashes when trying to recover from a failure in
      subtransaction start.
    - Fix server memory leak associated with use of savepoints and a
      client encoding different from server's encoding.
    - Fix incorrect WAL data emitted during end-of-recovery cleanup of a
      GIST index page split.
      This would result in index corruption, or even more likely an error
      during WAL replay, if we were unlucky enough to crash during
      end-of-recovery cleanup after having completed an incomplete GIST
      insertion.
    - Make substring() for bit types treat any negative length as meaning
      "all the rest of the string".
      The previous coding treated only -1 that way, and would produce an
      invalid result value for other negative values, possibly leading to
      a crash (CVE-2010-0442). (Closes: #567058)
    - Fix integer-to-bit-string conversions to handle the first
      fractional byte correctly when the output bit width is wider than
      the given integer by something other than a multiple of 8 bits.
    - Fix some cases of pathologically slow regular expression matching.
    - Fix assorted crashes in xml processing caused by sloppy memory
      management.
      This is a back-patch of changes first applied in 8.4. The 8.3 code
      was known buggy, but the new code was sufficiently different to not
      want to back-patch it until it had gotten some field testing.
    - Fix bug with trying to update a field of an element of a
      composite-type array column.
    - Fix the STOP WAL LOCATION entry in backup history files to report
      the next WAL segment's name when the end location is exactly at a
      segment boundary.
    - Fix some more cases of temporary-file leakage.
      This corrects a problem introduced in the previous minor release.
      One case that failed is when a plpgsql function returning set is
      called within another function's exception handler.
    - Improve constraint exclusion processing of boolean-variable cases,
      in particular make it possible to exclude a partition that has a
      "bool_column = false" constraint.
    - When reading "pg_hba.conf" and related files, do not treat
      @something as a file inclusion request if the @ appears inside
      quote marks; also, never treat @ by itself as a file inclusion
      request.
      This prevents erratic behavior if a role or database name starts
      with @. If you need to include a file whose path name contains
      spaces, you can still do so, but you must write @"/path to/file"
      rather than putting the quotes around the whole construct.
    - Prevent infinite loop on some platforms if a directory is named as
      an inclusion target in "pg_hba.conf" and related files.
    - Fix possible infinite loop if SSL_read or SSL_write fails without
      setting errno.
      This is reportedly possible with some Windows versions of openssl.
    - Disallow GSSAPI authentication on local connections, since it
      requires a hostname to function correctly.
    - Make ecpg report the proper SQLSTATE if the connection disappears.
    - Fix psql's numericlocale option to not format strings it shouldn't
      in latex and troff output formats.
    - Make psql return the correct exit status (3) when ON_ERROR_STOP and
      --single-transaction are both specified and an error occurs during
      the implied "COMMIT".
    - Fix plpgsql failure in one case where a composite column is set to
      NULL.
    - Fix possible failure when calling PL/Perl functions from PL/PerlU
      or vice versa.
    - Add volatile markings in PL/Python to avoid possible
      compiler-specific misbehavior.
    - Ensure PL/Tcl initializes the Tcl interpreter fully.
      The only known symptom of this oversight is that the Tcl clock
      command misbehaves if using Tcl 8.5 or later.
    - Prevent crash in "contrib/dblink" when too many key columns are
      specified to a dblink_build_sql_- function.
    - Allow zero-dimensional arrays in "contrib/ltree" operations.
      This case was formerly rejected as an error, but it's more
      convenient to treat it the same as a zero-element array. In
      particular this avoids unnecessary failures when an ltree operation
      is applied to the result of ARRAY(SELECT ...) and the sub-select
      returns no rows.
    - Fix assorted crashes in "contrib/xml2" caused by sloppy memory
      management.

Date: Wed, 07 Apr 2010 18:45:05 +0200
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Maintainer: Martin Pitt <mpitt at debian.org>
https://launchpad.net/ubuntu/jaunty/+source/postgresql-8.3/8.3.10-0ubuntu9.04
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 07 Apr 2010 18:45:05 +0200
Source: postgresql-8.3
Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-8.3 postgresql-client-8.3 postgresql-server-dev-8.3 postgresql-doc-8.3 postgresql-contrib-8.3 postgresql-plperl-8.3 postgresql-plpython-8.3 postgresql-pltcl-8.3 postgresql postgresql-client postgresql-doc postgresql-contrib
Architecture: source
Version: 8.3.10-0ubuntu9.04
Distribution: jaunty-proposed
Urgency: low
Maintainer: Martin Pitt <mpitt at debian.org>
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Description: 
 libecpg-compat3 - older version of run-time library for ECPG programs
 libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
 libecpg6   - run-time library for ECPG programs
 libpgtypes3 - shared library libpgtypes for PostgreSQL 8.3
 libpq-dev  - header files for libpq5 (PostgreSQL library)
 libpq5     - PostgreSQL C client library
 postgresql - object-relational SQL database (supported version)
 postgresql-8.3 - object-relational SQL database, version 8.3 server
 postgresql-client - front-end programs for PostgreSQL (supported version)
 postgresql-client-8.3 - front-end programs for PostgreSQL 8.3
 postgresql-contrib - additional facilities for PostgreSQL (supported version)
 postgresql-contrib-8.3 - additional facilities for PostgreSQL
 postgresql-doc - documentation for the PostgreSQL database management system
 postgresql-doc-8.3 - documentation for the PostgreSQL database management system
 postgresql-plperl-8.3 - PL/Perl procedural language for PostgreSQL 8.3
 postgresql-plpython-8.3 - PL/Python procedural language for PostgreSQL 8.3
 postgresql-pltcl-8.3 - PL/Tcl procedural language for PostgreSQL 8.3
 postgresql-server-dev-8.3 - development files for PostgreSQL 8.3 server-side programming
Closes: 567058
Launchpad-Bugs-Fixed: 557408
Changes: 
 postgresql-8.3 (8.3.10-0ubuntu9.04) jaunty-proposed; urgency=low
 .
   * New upstream bug fix release: (LP: #557408)
     - Add new configuration parameter ssl_renegotiation_limit to control
       how often we do session key renegotiation for an SSL connection.
       This can be set to zero to disable renegotiation completely, which
       may be required if a broken SSL library is used. In particular,
       some vendors are shipping stopgap patches for CVE-2009-3555 that
       cause renegotiation attempts to fail.
     - Fix possible deadlock during backend startup.
     - Fix possible crashes due to not handling errors during relcache
       reload cleanly.
     - Fix possible crash due to use of dangling pointer to a cached plan.
     - Fix possible crashes when trying to recover from a failure in
       subtransaction start.
     - Fix server memory leak associated with use of savepoints and a
       client encoding different from server's encoding.
     - Fix incorrect WAL data emitted during end-of-recovery cleanup of a
       GIST index page split.
       This would result in index corruption, or even more likely an error
       during WAL replay, if we were unlucky enough to crash during
       end-of-recovery cleanup after having completed an incomplete GIST
       insertion.
     - Make substring() for bit types treat any negative length as meaning
       "all the rest of the string".
       The previous coding treated only -1 that way, and would produce an
       invalid result value for other negative values, possibly leading to
       a crash (CVE-2010-0442). (Closes: #567058)
     - Fix integer-to-bit-string conversions to handle the first
       fractional byte correctly when the output bit width is wider than
       the given integer by something other than a multiple of 8 bits.
     - Fix some cases of pathologically slow regular expression matching.
     - Fix assorted crashes in xml processing caused by sloppy memory
       management.
       This is a back-patch of changes first applied in 8.4. The 8.3 code
       was known buggy, but the new code was sufficiently different to not
       want to back-patch it until it had gotten some field testing.
     - Fix bug with trying to update a field of an element of a
       composite-type array column.
     - Fix the STOP WAL LOCATION entry in backup history files to report
       the next WAL segment's name when the end location is exactly at a
       segment boundary.
     - Fix some more cases of temporary-file leakage.
       This corrects a problem introduced in the previous minor release.
       One case that failed is when a plpgsql function returning set is
       called within another function's exception handler.
     - Improve constraint exclusion processing of boolean-variable cases,
       in particular make it possible to exclude a partition that has a
       "bool_column = false" constraint.
     - When reading "pg_hba.conf" and related files, do not treat
       @something as a file inclusion request if the @ appears inside
       quote marks; also, never treat @ by itself as a file inclusion
       request.
       This prevents erratic behavior if a role or database name starts
       with @. If you need to include a file whose path name contains
       spaces, you can still do so, but you must write @"/path to/file"
       rather than putting the quotes around the whole construct.
     - Prevent infinite loop on some platforms if a directory is named as
       an inclusion target in "pg_hba.conf" and related files.
     - Fix possible infinite loop if SSL_read or SSL_write fails without
       setting errno.
       This is reportedly possible with some Windows versions of openssl.
     - Disallow GSSAPI authentication on local connections, since it
       requires a hostname to function correctly.
     - Make ecpg report the proper SQLSTATE if the connection disappears.
     - Fix psql's numericlocale option to not format strings it shouldn't
       in latex and troff output formats.
     - Make psql return the correct exit status (3) when ON_ERROR_STOP and
       --single-transaction are both specified and an error occurs during
       the implied "COMMIT".
     - Fix plpgsql failure in one case where a composite column is set to
       NULL.
     - Fix possible failure when calling PL/Perl functions from PL/PerlU
       or vice versa.
     - Add volatile markings in PL/Python to avoid possible
       compiler-specific misbehavior.
     - Ensure PL/Tcl initializes the Tcl interpreter fully.
       The only known symptom of this oversight is that the Tcl clock
       command misbehaves if using Tcl 8.5 or later.
     - Prevent crash in "contrib/dblink" when too many key columns are
       specified to a dblink_build_sql_- function.
     - Allow zero-dimensional arrays in "contrib/ltree" operations.
       This case was formerly rejected as an error, but it's more
       convenient to treat it the same as a zero-element array. In
       particular this avoids unnecessary failures when an ltree operation
       is applied to the result of ARRAY(SELECT ...) and the sub-select
       returns no rows.
     - Fix assorted crashes in "contrib/xml2" caused by sloppy memory
       management.
Checksums-Sha1: 
 440d65b09384d85d34bb89a9a71409efc6b169a6 1676 postgresql-8.3_8.3.10-0ubuntu9.04.dsc
 d69dc84821208f51b878583d552ed5803926d1f8 13870846 postgresql-8.3_8.3.10.orig.tar.gz
 db28e97464acc959c5923b860ef8d774838395e7 68921 postgresql-8.3_8.3.10-0ubuntu9.04.diff.gz
Checksums-Sha256: 
 1189a9773ed9c986e1b7f1798e598b0bc8939f8dd5652fa09fb687ce5d22f363 1676 postgresql-8.3_8.3.10-0ubuntu9.04.dsc
 6c4e55918df0050cdf71896a8577f6b03c28cf20bd959c77c43165bfcb8abd12 13870846 postgresql-8.3_8.3.10.orig.tar.gz
 5ee32691f119feafad3056bff318f7459919b49520bb55f345dd8ac9a5865f34 68921 postgresql-8.3_8.3.10-0ubuntu9.04.diff.gz
Files: 
 49cdba8499758728ded0df162eadbc08 1676 misc optional postgresql-8.3_8.3.10-0ubuntu9.04.dsc
 6c528104faf2808dcbdbd4a644920fe1 13870846 misc optional postgresql-8.3_8.3.10.orig.tar.gz
 5125cb460112952be1cb07d9f174d928 68921 misc optional postgresql-8.3_8.3.10-0ubuntu9.04.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAku8weIACgkQDecnbV4Fd/LNoQCfdpTTJXqRwvrSPzWushJwmXC7
Ds4AoPZ+N0Ao12DgdDbrTZ3uEyNUXTAW
=+Nxz
-----END PGP SIGNATURE-----

From archive at ubuntu.com  Thu Apr  8 21:03:33 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 08 Apr 2010 20:03:33 -0000
Subject: [ubuntu/jaunty-security]
	mediawiki_1.13.3-1ubuntu2.2_hppa_translations.tar.gz,
	mediawiki_1.13.3-1ubuntu2.2_lpia_translations.tar.gz,
	mediawiki_1.13.3-1ubuntu2.2_armel_translations.tar.gz,
	mediawiki_1.13.3-1ubuntu2.2_sparc_translations.tar.gz (delayed),
	mediawiki_1.13.3-1ubuntu2.2_amd64_translations.tar.gz,
	mediawiki_1.13.3-1ubuntu2.2_ia64_translations.tar.gz, mediawiki,
	mediawiki_1.13.3-1ubuntu2.2_i386_translations.tar.gz,
	mediawiki_1.13.3-1ubuntu2.2_powerpc_translations.tar.gz
	1:1.13.3-1ubuntu2.2 (Accepted)
Message-ID: <20100408200333.16410.47832.launchpad@cocoplum.canonical.com>

mediawiki (1:1.13.3-1ubuntu2.2) jaunty-security; urgency=low

  * SECURITY UPDATE: MediaWiki was found to be vulnerable to login CSRF. An
    attacker who controls a user account on the target wiki can force the
    victim to login as the attacker, via a script on an external website.
    IMPORTANT: Fix includes a breaking change to the API login action. Any
    clients using it will need to be updated. (LP: #557159)
    - debian/patches/CSRF-no-CVE_rev-64680.patch
    - patch based on upstream SVN rev. 64680
    - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
    - https://bugzilla.wikimedia.org/show_bug.cgi?id=23076
    - CVE-2010-1150

Date: Wed, 07 Apr 2010 11:56:59 +0200
Changed-By: Andreas Wenning <awen at awen.dk>
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/mediawiki/1:1.13.3-1ubuntu2.2
-------------- next part --------------
Format: 1.8
Date: Wed, 07 Apr 2010 11:56:59 +0200
Source: mediawiki
Binary: mediawiki mediawiki-math
Architecture: source
Version: 1:1.13.3-1ubuntu2.2
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Changed-By: Andreas Wenning <awen at awen.dk>
Description: 
 mediawiki  - website engine for collaborative work
 mediawiki-math - math rendering plugin for MediaWiki
Launchpad-Bugs-Fixed: 557159
Changes: 
 mediawiki (1:1.13.3-1ubuntu2.2) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: MediaWiki was found to be vulnerable to login CSRF. An
     attacker who controls a user account on the target wiki can force the
     victim to login as the attacker, via a script on an external website.
     IMPORTANT: Fix includes a breaking change to the API login action. Any
     clients using it will need to be updated. (LP: #557159)
     - debian/patches/CSRF-no-CVE_rev-64680.patch
     - patch based on upstream SVN rev. 64680
     - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
     - https://bugzilla.wikimedia.org/show_bug.cgi?id=23076
     - CVE-2010-1150
Checksums-Sha1: 
 6f907ecf6981aafaf1cff529181e9f32b610507e 1344 mediawiki_1.13.3-1ubuntu2.2.dsc
 a0df2a9d58cdf7be39c7b7b71ff1d6046d030f1b 53903 mediawiki_1.13.3-1ubuntu2.2.diff.gz
Checksums-Sha256: 
 1219cf2bbb347903c3e20ab66f434e29295741c76ca50e200fdb4f30d828a6ee 1344 mediawiki_1.13.3-1ubuntu2.2.dsc
 eb389ec5148d2721d6cfc51beee9702a245e969c7d383944266cd9c523199d5a 53903 mediawiki_1.13.3-1ubuntu2.2.diff.gz
Files: 
 51a0febba97c8041b514e21c3ac1b764 1344 web optional mediawiki_1.13.3-1ubuntu2.2.dsc
 bd4299d40a840cbfcc783aa6ca222e5e 53903 web optional mediawiki_1.13.3-1ubuntu2.2.diff.gz
Original-Maintainer: Mediawiki Maintenance Team <pkg-mediawiki-devel at lists.alioth.debian.org>

From archive at ubuntu.com  Thu Apr  8 22:03:36 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 08 Apr 2010 21:03:36 -0000
Subject: [ubuntu/jaunty-security]
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_lpia_translations.tar.gz,
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_sparc_translations.tar.gz (delayed),
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_armel_translations.tar.gz, clamav, 
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_powerpc_translations.tar.gz,
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_amd64_translations.tar.gz,
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_i386_translations.tar.gz,
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_hppa_translations.tar.gz,
	clamav_0.95.3+dfsg-1ubuntu0.09.04.1_ia64_translations.tar.gz
	0.95.3+dfsg-1ubuntu0.09.04.1 (Accepted)
Message-ID: <20100408210336.7378.59444.launchpad@cocoplum.canonical.com>

clamav (0.95.3+dfsg-1ubuntu0.09.04.1) jaunty-security; urgency=low

  * SECURITY UPDATE: (LP: #553266)
  * References clamav bugs #1771 and #1826
  * libclamav/mspack.c: fix Quantum decompressor (bb#1771)
    - clamav git 224fee54dd6cd8933d7007331ec2bfca0398d4b4
  * libclamav/mspack.c: improve unpacking of malformed cabinets (bb#1826)
    - clamav git 31b77b3fb589ab07e7b4d84f8b3825178864ee51
  * based on work by Scott Kitterman

Date: Tue, 06 Apr 2010 14:21:16 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/clamav/0.95.3+dfsg-1ubuntu0.09.04.1
-------------- next part --------------
Format: 1.8
Date: Tue, 06 Apr 2010 14:21:16 -0500
Source: clamav
Binary: clamav-base clamav-docs clamav-dbg clamav libclamav-dev libclamav6 clamav-daemon clamav-testfiles clamav-freshclam clamav-milter
Architecture: source
Version: 0.95.3+dfsg-1ubuntu0.09.04.1
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 clamav     - anti-virus utility for Unix - command-line interface
 clamav-base - anti-virus utility for Unix - base package
 clamav-daemon - anti-virus utility for Unix - scanner daemon
 clamav-dbg - debug symbols for ClamAV
 clamav-docs - anti-virus utility for Unix - documentation
 clamav-freshclam - anti-virus utility for Unix - virus database update utility
 clamav-milter - anti-virus utility for Unix - sendmail integration
 clamav-testfiles - anti-virus utility for Unix - test files
 libclamav-dev - anti-virus utility for Unix - development files
 libclamav6 - anti-virus utility for Unix - library
Launchpad-Bugs-Fixed: 553266
Changes: 
 clamav (0.95.3+dfsg-1ubuntu0.09.04.1) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: (LP: #553266)
   * References clamav bugs #1771 and #1826
   * libclamav/mspack.c: fix Quantum decompressor (bb#1771)
     - clamav git 224fee54dd6cd8933d7007331ec2bfca0398d4b4
   * libclamav/mspack.c: improve unpacking of malformed cabinets (bb#1826)
     - clamav git 31b77b3fb589ab07e7b4d84f8b3825178864ee51
   * based on work by Scott Kitterman
Checksums-Sha1: 
 030e6f7c82b3d2b8de72a86021cdf8728c1a50ea 1560 clamav_0.95.3+dfsg-1ubuntu0.09.04.1.dsc
 bca5fe12548524e1e71823d093117e4ce0994816 265222 clamav_0.95.3+dfsg-1ubuntu0.09.04.1.diff.gz
Checksums-Sha256: 
 12c168647cdcaad964079134ddcd0b291d1239e0e06d533034b13a0f1e386a50 1560 clamav_0.95.3+dfsg-1ubuntu0.09.04.1.dsc
 6f67af832e9ad7be6445f2b7875e128e8371461a57b7a1ee8cf91b331df0d467 265222 clamav_0.95.3+dfsg-1ubuntu0.09.04.1.diff.gz
Files: 
 c8e482ff18b929831fbd8dc8c6f7a412 1560 utils optional clamav_0.95.3+dfsg-1ubuntu0.09.04.1.dsc
 1bad05a140a22bd9c74ae09ccdec9143 265222 utils optional clamav_0.95.3+dfsg-1ubuntu0.09.04.1.diff.gz
Original-Maintainer: ClamAV Team <pkg-clamav-devel at lists.alioth.debian.org>

From brian.thomason at canonical.com  Wed Apr 14 15:46:08 2010
From: brian.thomason at canonical.com (Brian Thomason)
Date: Wed, 14 Apr 2010 14:46:08 -0000
Subject: [ubuntu/jaunty] acroread 9.3.2-jaunty1 (Accepted)
Message-ID: <20100414144608.6956.96838.launchpad@cocoplum.canonical.com>

acroread (9.3.2-jaunty1) jaunty; urgency=low

  * Initial release of 9.3.2 for karmic

Date: Wed, 14 Apr 2010 00:07:16 -0400
Changed-By: Brian Thomason <brian.thomason at canonical.com>
https://launchpad.net/ubuntu/jaunty/+source/acroread/9.3.2-jaunty1
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 14 Apr 2010 00:07:16 -0400
Source: acroread
Binary: acroread
Architecture: source
Version: 9.3.2-jaunty1
Distribution: jaunty
Urgency: low
Maintainer: Brian Thomason <brian.thomason at canonical.com>
Changed-By: Brian Thomason <brian.thomason at canonical.com>
Description: 
 acroread   - Adobe Reader
Changes: 
 acroread (9.3.2-jaunty1) jaunty; urgency=low
 .
   * Initial release of 9.3.2 for karmic
Checksums-Sha1: 
 fffe7c5153e13f86024392e5579145e0fc3173e8 1199 acroread_9.3.2-jaunty1.dsc
 b8aa47426e65ba792efcc7e68e87e61a5796963d 5588 acroread_9.3.2-jaunty1.diff.gz
Checksums-Sha256: 
 19f83f2dde0f8c3c8ff309943de932c72e3e8c992e70445ba347e1a3bdd726c1 1199 acroread_9.3.2-jaunty1.dsc
 69748d966f90b2ff5170101e2a3cc4528634022bdf777dc3f384bf009a760a6a 5588 acroread_9.3.2-jaunty1.diff.gz
Files: 
 f8d68b019f669e91809483c7e90de34c 1199 partner/text extra acroread_9.3.2-jaunty1.dsc
 c1c6671350f90b7ceba46b607e7f61e5 5588 partner/text extra acroread_9.3.2-jaunty1.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvF1KAACgkQOb4zNfJqN5fbaQCffW0I0rPmd2+1Ic5LzOc0iH9K
25sAnjX7+RAKa+8mOepTWz6A9fHowk2X
=5eGo
-----END PGP SIGNATURE-----

From archive at ubuntu.com  Thu Apr 15 17:04:49 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 15 Apr 2010 16:04:49 -0000
Subject: [ubuntu/jaunty-security] sudo,
	sudo (delayed) 1.6.9p17-1ubuntu3.2 (Accepted)
Message-ID: <20100415160449.24274.34995.launchpad@cocoplum.canonical.com>

sudo (1.6.9p17-1ubuntu3.2) jaunty-security; urgency=low

  * SECURITY UPDATE: properly verify path in find_path.c for the 'sudoedit'
    pseudo-command when running from the current working directory and
    secure_path is disabled
    - CVE-2010-XXXX

Date: Wed, 07 Apr 2010 15:38:30 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Martin Pitt <martin.pitt at ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/sudo/1.6.9p17-1ubuntu3.2
-------------- next part --------------
Format: 1.8
Date: Wed, 07 Apr 2010 15:38:30 -0500
Source: sudo
Binary: sudo sudo-ldap
Architecture: source
Version: 1.6.9p17-1ubuntu3.2
Distribution: jaunty-security
Urgency: low
Maintainer: Martin Pitt <martin.pitt at ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Changes: 
 sudo (1.6.9p17-1ubuntu3.2) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: properly verify path in find_path.c for the 'sudoedit'
     pseudo-command when running from the current working directory and
     secure_path is disabled
     - CVE-2010-XXXX
Checksums-Sha1: 
 528ad681ce846193fa66e43762d1c58ba5b74dd8 1098 sudo_1.6.9p17-1ubuntu3.2.dsc
 74c674c3db49794702658d3d66e4c9a4f47291ad 26708 sudo_1.6.9p17-1ubuntu3.2.diff.gz
Checksums-Sha256: 
 8ad179dc6dd766b12d5e889fd3ccc76221a5cb1ab256961918775f8447e0f192 1098 sudo_1.6.9p17-1ubuntu3.2.dsc
 c2126fa6bb518ed7e5be477d9fbb0cf368eb0253af835d987ced79c6927eb84c 26708 sudo_1.6.9p17-1ubuntu3.2.diff.gz
Files: 
 82922ad2f30bdc41b29192335f28f084 1098 admin optional sudo_1.6.9p17-1ubuntu3.2.dsc
 75f28b3212a9d34a3c1ea84e8dc421de 26708 admin optional sudo_1.6.9p17-1ubuntu3.2.diff.gz
Original-Maintainer: Bdale Garbee <bdale at gag.com>

From archive at ubuntu.com  Thu Apr 15 20:05:31 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 15 Apr 2010 19:05:31 -0000
Subject: [ubuntu/jaunty-security] cmake,
	cmake (delayed) 2.6.2-1ubuntu1.1 (Accepted)
Message-ID: <20100415190531.3313.31438.launchpad@cocoplum.canonical.com>

cmake (2.6.2-1ubuntu1.1) jaunty-security; urgency=low

  * SECURITY UPDATE: fix DoS via malformed XML
    - debian/patches/CVE_2009_3720.patch: xmltok_impl.c to not access beyond
      end of input string
    - CVE-2009-3720
  * SECURITY UPDATE: fix DoS via malformed UTF-8 sequences
    - debian/patches/CVE_2009_3560.patch: update xmlparse.c to properly
      recognize the end of a token
    - CVE-2009-3560

Date: Tue, 13 Apr 2010 20:49:21 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Kubuntu Developers <kubuntu-devel at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/cmake/2.6.2-1ubuntu1.1
-------------- next part --------------
Format: 1.8
Date: Tue, 13 Apr 2010 20:49:21 -0500
Source: cmake
Binary: cmake cmake-gui
Architecture: source
Version: 2.6.2-1ubuntu1.1
Distribution: jaunty-security
Urgency: low
Maintainer: Kubuntu Developers <kubuntu-devel at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 cmake      - A cross-platform, open-source make system
 cmake-gui  - GUI for cmake cross-platform make system
Changes: 
 cmake (2.6.2-1ubuntu1.1) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: fix DoS via malformed XML
     - debian/patches/CVE_2009_3720.patch: xmltok_impl.c to not access beyond
       end of input string
     - CVE-2009-3720
   * SECURITY UPDATE: fix DoS via malformed UTF-8 sequences
     - debian/patches/CVE_2009_3560.patch: update xmlparse.c to properly
       recognize the end of a token
     - CVE-2009-3560
Checksums-Sha1: 
 c5fb6aff62880b97d1822bceaeefce1609d8af18 1241 cmake_2.6.2-1ubuntu1.1.dsc
 cfa5edf5e37c1ddb07021dc152931aedafd24637 28215 cmake_2.6.2-1ubuntu1.1.diff.gz
Checksums-Sha256: 
 b20533288ead11f61d05c63cb644ac064c9cda1dda4f25238e6bf3454285869e 1241 cmake_2.6.2-1ubuntu1.1.dsc
 6747e532c237bd079771217a98095d491b81d165f2c3d43e6574980ca1ee50c3 28215 cmake_2.6.2-1ubuntu1.1.diff.gz
Files: 
 a001577d3d45df9bd41d6fb80307561f 1241 devel optional cmake_2.6.2-1ubuntu1.1.dsc
 1aa2652fdd0711a9c58614fcf13b73c5 28215 devel optional cmake_2.6.2-1ubuntu1.1.diff.gz
Original-Maintainer: A. Maitland Bottoms <bottoms at debian.org>

From archive at ubuntu.com  Fri Apr 16 00:03:31 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 15 Apr 2010 23:03:31 -0000
Subject: [ubuntu/jaunty-security] irssi (delayed),
	irssi 0.8.12-6ubuntu1.2 (Accepted)
Message-ID: <20100415230331.24644.26145.launchpad@cocoplum.canonical.com>

irssi (0.8.12-6ubuntu1.2) jaunty-security; urgency=low

  * SECURITY UPDATE: perform certificate host validation
    - debian/patches/91_CVE-2010-1155.patch: adjust to verify hostname against
      CN. Also use one SSL_CTX per connection and use default trusted CAs if
      nothing specified.
    - CVE-2010-1155
  * SECURITY UPDATE: fix crash when checking for fuzzy nick match when not on
    the channel
    - debian/patches/91_CVE-2010-1156.patch: verify channel is non-NULL in
      src/core/nicklist.c
    - CVE-2010-1156
  * debian/patches/92_disable_sslv2.patch: do not use SSLv2 protocol

Date: Wed, 14 Apr 2010 15:43:34 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/irssi/0.8.12-6ubuntu1.2
-------------- next part --------------
Format: 1.8
Date: Wed, 14 Apr 2010 15:43:34 -0500
Source: irssi
Binary: irssi irssi-dev
Architecture: source
Version: 0.8.12-6ubuntu1.2
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 irssi      - terminal based IRC client
 irssi-dev  - text-mode version of the irssi IRC client development files
Changes: 
 irssi (0.8.12-6ubuntu1.2) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: perform certificate host validation
     - debian/patches/91_CVE-2010-1155.patch: adjust to verify hostname against
       CN. Also use one SSL_CTX per connection and use default trusted CAs if
       nothing specified.
     - CVE-2010-1155
   * SECURITY UPDATE: fix crash when checking for fuzzy nick match when not on
     the channel
     - debian/patches/91_CVE-2010-1156.patch: verify channel is non-NULL in
       src/core/nicklist.c
     - CVE-2010-1156
   * debian/patches/92_disable_sslv2.patch: do not use SSLv2 protocol
Checksums-Sha1: 
 6a5e21f55944300a1e5285e09ad9a1854c734ab8 1391 irssi_0.8.12-6ubuntu1.2.dsc
 967538468183bf05f4df9faff47d11bbfd2ce690 24807 irssi_0.8.12-6ubuntu1.2.diff.gz
Checksums-Sha256: 
 bcd8e9b4b1129806d505a59436d83fc5f93e883b446c559f4bed1dc5fee4eb3b 1391 irssi_0.8.12-6ubuntu1.2.dsc
 7984426c92124e9e21064b9d7540107ca5c758aaadab4db3251049643ed5f6b6 24807 irssi_0.8.12-6ubuntu1.2.diff.gz
Files: 
 960eaacca58feaaa6291c03f4faa8848 1391 net optional irssi_0.8.12-6ubuntu1.2.dsc
 caae22ec37b9db5ade9c4b23215f6b82 24807 net optional irssi_0.8.12-6ubuntu1.2.diff.gz
Original-Maintainer: David Pashley <david at davidpashley.com>

From archive at ubuntu.com  Mon Apr 19 19:03:43 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Mon, 19 Apr 2010 18:03:43 -0000
Subject: [ubuntu/jaunty-security] spamass-milter,
	spamass-milter (delayed) 0.3.1-8+lenny1build0.9.04.1 (Accepted)
Message-ID: <20100419180343.3160.39659.launchpad@cocoplum.canonical.com>

spamass-milter (0.3.1-8+lenny1build0.9.04.1) jaunty-security; urgency=low

  * fake sync from Debian

spamass-milter (0.3.1-8+lenny1) stable-security; urgency=high

  * Use new popenenv function instead of open; fixes remote code exploit
    as the spamass-milter user when run using -x. (closes: #573228)

Date: Fri, 16 Apr 2010 15:53:21 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Don Armstrong <don at debian.org>
https://launchpad.net/ubuntu/jaunty/+source/spamass-milter/0.3.1-8+lenny1build0.9.04.1
-------------- next part --------------
Format: 1.8
Date: Fri, 16 Apr 2010 15:53:21 -0500
Source: spamass-milter
Binary: spamass-milter
Architecture: source
Version: 0.3.1-8+lenny1build0.9.04.1
Distribution: jaunty-security
Urgency: high
Maintainer: Don Armstrong <don at debian.org>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 spamass-milter - milter for filtering mail through spamassassin
Closes: 573228
Changes: 
 spamass-milter (0.3.1-8+lenny1build0.9.04.1) jaunty-security; urgency=low
 .
   * fake sync from Debian
 .
 spamass-milter (0.3.1-8+lenny1) stable-security; urgency=high
 .
   * Use new popenenv function instead of open; fixes remote code exploit
     as the spamass-milter user when run using -x. (closes: #573228)
Checksums-Sha1: 
 3feb4c3e1e8b41d7ca51ba903753ef6a38950b41 1105 spamass-milter_0.3.1-8+lenny1build0.9.04.1.dsc
 fb731581e9f2764b2f595819c022043ee7a84185 35469 spamass-milter_0.3.1-8+lenny1build0.9.04.1.diff.gz
Checksums-Sha256: 
 b647c6c99199a6f340ed8fc42acf43230ccfbc1bf82a13e9ed44b727ce01d01c 1105 spamass-milter_0.3.1-8+lenny1build0.9.04.1.dsc
 e2e04fe2e12729784556895650bca17cef3c760ad256984c0b5a120950d1a46d 35469 spamass-milter_0.3.1-8+lenny1build0.9.04.1.diff.gz
Files: 
 e27c13cab7a3a283ef82016b136a5c52 1105 mail extra spamass-milter_0.3.1-8+lenny1build0.9.04.1.dsc
 8f610a4e97db955bf969663f3116a376 35469 mail extra spamass-milter_0.3.1-8+lenny1build0.9.04.1.diff.gz

From archive at ubuntu.com  Mon Apr 19 19:03:48 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Mon, 19 Apr 2010 18:03:48 -0000
Subject: [ubuntu/jaunty-security] ffmpeg-debian,
	ffmpeg-debian (delayed) 3:0.svn20090303-1ubuntu6.1 (Accepted)
Message-ID: <20100419180348.3160.35077.launchpad@cocoplum.canonical.com>

ffmpeg-debian (3:0.svn20090303-1ubuntu6.1) jaunty-security; urgency=low

  * SECURITY UPDATE: Fix a multitude of security issues
    - debian/patches/CVE-2009-46XX/security-issue03.patch: check stream
      existence before assignment
    - debian/patches/CVE-2009-46XX/security-issue04.patch: check submap
      indexes
    - debian/patches/CVE-2009-46XX/security-issue05.patch: check classbook
      value
    - debian/patches/CVE-2009-46XX/security-issue06.patch: add checks for
      per-packet mode indexes and per-header mode mapping indexes
    - debian/patches/CVE-2009-46XX/security-issue07.patch: check masterbook
      index and subclass book index.
    - debian/patches/CVE-2009-46XX/security-issue08.patch: check
      res_setup->books
    - debian/patches/CVE-2009-46XX/security-issue09.patch: check
      begin/end/partition_size
    - debian/patches/CVE-2009-46XX/security-issue10.patch: check validity
      of channels & samplerate
    - debian/patches/CVE-2009-46XX/security-issue11.patch: fix book_idx
      check
    - debian/patches/CVE-2009-46XX/security-issue12.patch: sanity checks
      for magnitude and angle
    - debian/patches/CVE-2009-46XX/security-issue13.patch: fix = -> == typo
    - debian/patches/CVE-2009-46XX/security-issue14.patch: check dimensions
      against 0 too
    - debian/patches/CVE-2009-46XX/security-issue15.patch: fix
      init_get_bits() buffer size
    - debian/patches/CVE-2009-46XX/security-issue17.patch: make sure that
      all memory allocations succeed
    - debian/patches/CVE-2009-46XX/security-issue18.patch: fix possible
      buffer over-read in vorbis_comment
    - debian/patches/CVE-2009-46XX/security-issue19.patch: set data_size to
      0 to avoid having it uninitialized
    - debian/patches/CVE-2009-46XX/security-issue20.patch: disable parsing
      for ogg streams where no ogg header was found
    - debian/patches/CVE-2009-46XX/security-issue22.patch: check codec_id
      and codec_type, make sure priv_data is freed and codec is set to NULL
    - CVE-2009-4632
    - CVE-2009-4633
    - CVE-2009-4634
    - CVE-2009-4635
    - CVE-2009-4637
    - CVE-2009-4639
    - CVE-2009-4640

Date: Thu, 08 Apr 2010 09:12:45 -0400
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/ffmpeg-debian/3:0.svn20090303-1ubuntu6.1
-------------- next part --------------
Format: 1.8
Date: Thu, 08 Apr 2010 09:12:45 -0400
Source: ffmpeg-debian
Binary: ffmpeg ffmpeg-dbg ffmpeg-doc libavutil49 libavcodec52 libavdevice52 libavformat52 libavfilter0 libpostproc51 libswscale0 libavutil-dev libavcodec-dev libavdevice-dev libavformat-dev libavfilter-dev libpostproc-dev libswscale-dev
Architecture: source
Version: 3:0.svn20090303-1ubuntu6.1
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 ffmpeg     - multimedia player, server and encoder
 ffmpeg-dbg - Debug symbols for ffmpeg related packages
 ffmpeg-doc - documentation of the ffmpeg API
 libavcodec-dev - development files for libavcodec
 libavcodec52 - ffmpeg codec library
 libavdevice-dev - development files for libavdevice
 libavdevice52 - ffmpeg device handling library
 libavfilter-dev - development files for libavfilter
 libavfilter0 - ffmpeg video filtering library
 libavformat-dev - development files for libavformat
 libavformat52 - ffmpeg file format library
 libavutil-dev - development files for libavutil
 libavutil49 - ffmpeg utility library
 libpostproc-dev - development files for libpostproc
 libpostproc51 - ffmpeg video postprocessing library
 libswscale-dev - development files for libswscale
 libswscale0 - ffmpeg video scaling library
Changes: 
 ffmpeg-debian (3:0.svn20090303-1ubuntu6.1) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: Fix a multitude of security issues
     - debian/patches/CVE-2009-46XX/security-issue03.patch: check stream
       existence before assignment
     - debian/patches/CVE-2009-46XX/security-issue04.patch: check submap
       indexes
     - debian/patches/CVE-2009-46XX/security-issue05.patch: check classbook
       value
     - debian/patches/CVE-2009-46XX/security-issue06.patch: add checks for
       per-packet mode indexes and per-header mode mapping indexes
     - debian/patches/CVE-2009-46XX/security-issue07.patch: check masterbook
       index and subclass book index.
     - debian/patches/CVE-2009-46XX/security-issue08.patch: check
       res_setup->books
     - debian/patches/CVE-2009-46XX/security-issue09.patch: check
       begin/end/partition_size
     - debian/patches/CVE-2009-46XX/security-issue10.patch: check validity
       of channels & samplerate
     - debian/patches/CVE-2009-46XX/security-issue11.patch: fix book_idx
       check
     - debian/patches/CVE-2009-46XX/security-issue12.patch: sanity checks
       for magnitude and angle
     - debian/patches/CVE-2009-46XX/security-issue13.patch: fix = -> == typo
     - debian/patches/CVE-2009-46XX/security-issue14.patch: check dimensions
       against 0 too
     - debian/patches/CVE-2009-46XX/security-issue15.patch: fix
       init_get_bits() buffer size
     - debian/patches/CVE-2009-46XX/security-issue17.patch: make sure that
       all memory allocations succeed
     - debian/patches/CVE-2009-46XX/security-issue18.patch: fix possible
       buffer over-read in vorbis_comment
     - debian/patches/CVE-2009-46XX/security-issue19.patch: set data_size to
       0 to avoid having it uninitialized
     - debian/patches/CVE-2009-46XX/security-issue20.patch: disable parsing
       for ogg streams where no ogg header was found
     - debian/patches/CVE-2009-46XX/security-issue22.patch: check codec_id
       and codec_type, make sure priv_data is freed and codec is set to NULL
     - CVE-2009-4632
     - CVE-2009-4633
     - CVE-2009-4634
     - CVE-2009-4635
     - CVE-2009-4637
     - CVE-2009-4639
     - CVE-2009-4640
Checksums-Sha1: 
 67b43bf3bd6dc7d4c073b5f0a745c824e62e14d6 2274 ffmpeg-debian_0.svn20090303-1ubuntu6.1.dsc
 bbbda4bc92afcfcd6aad06457698c3700bdfa1d9 36802 ffmpeg-debian_0.svn20090303-1ubuntu6.1.diff.gz
Checksums-Sha256: 
 f2592225bacb66315263f0fc5907069fc7a35992156114da5db098490d202c87 2274 ffmpeg-debian_0.svn20090303-1ubuntu6.1.dsc
 1af7c0aef73fa8f995b9495510ad2083a83b5529f9f46d4b309be70ed60791b3 36802 ffmpeg-debian_0.svn20090303-1ubuntu6.1.diff.gz
Files: 
 7cd8257af686257eeb3dc4899ead5485 2274 libs optional ffmpeg-debian_0.svn20090303-1ubuntu6.1.dsc
 e33208eef1c16818c14cb2438c2f76bb 36802 libs optional ffmpeg-debian_0.svn20090303-1ubuntu6.1.diff.gz
Original-Maintainer: Debian multimedia packages maintainers <pkg-multimedia-maintainers at lists.alioth.debian.org>

From archive at ubuntu.com  Mon Apr 19 23:04:49 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Mon, 19 Apr 2010 22:04:49 -0000
Subject: [ubuntu/jaunty-security]
	kdebase-workspace_4.2.2-0ubuntu2.1_powerpc_translations.tar.gz,
	kdebase-workspace_4.2.2-0ubuntu2.1_ia64_translations.tar.gz,
	kdebase-workspace_4.2.2-0ubuntu2.1_lpia_translations.tar.gz,
	kdebase-workspace_4.2.2-0ubuntu2.1_sparc_translations.tar.gz (delayed), 
	kdebase-workspace_4.2.2-0ubuntu2.1_i386_translations.tar.gz,
	kdebase-workspace_4.2.2-0ubuntu2.1_amd64_translations.tar.gz,
	kdebase-workspace 4:4.2.2-0ubuntu2.1 (Accepted)
Message-ID: <20100419220449.19033.45001.launchpad@cocoplum.canonical.com>

kdebase-workspace (4:4.2.2-0ubuntu2.1) jaunty-security; urgency=low

  * SECURITY UPDATE: KDM Local Privilege Escalation Vulnerability (LP: #562440).
   - Add debian/patches/CVE-2010-0436_fix_kdm_local_exploit.diff
   - kdm/backend/ctrl.c: prevent race condition during user login which could
     allow execution of arbitrary code as root
   - CVE-2010-0436
   - http://www.kde.org/info/security/advisory-20100413-1.txt

Date: Fri, 16 Apr 2010 19:16:35 +0100
Changed-By: Jonathan Riddell <jriddell at ubuntu.com>
Maintainer: Kubuntu Developers <kubuntu-devel at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/kdebase-workspace/4:4.2.2-0ubuntu2.1
-------------- next part --------------
Format: 1.8
Date: Fri, 16 Apr 2010 19:16:35 +0100
Source: kdebase-workspace
Binary: kdebase-workspace kdebase-workspace-bin kdebase-workspace-libs4+5 kdebase-workspace-data kdebase-workspace-wallpapers kdebase-workspace-dev kdm klipper ksysguardd ksysguard kde-window-manager libkdecorations4 libkwineffects1 systemsettings kdebase-workspace-dbg kwin python-plasma
Architecture: source
Version: 4:4.2.2-0ubuntu2.1
Distribution: jaunty-security
Urgency: low
Maintainer: Kubuntu Developers <kubuntu-devel at lists.ubuntu.com>
Changed-By: Jonathan Riddell <jriddell at ubuntu.com>
Description: 
 kde-window-manager - the KDE 4 window manager (KWin)
 kdebase-workspace - base workspace components from the official KDE 4 release
 kdebase-workspace-bin - core binaries for the KDE 4 base workspace module
 kdebase-workspace-data - shared data files for the KDE 4 base workspace module
 kdebase-workspace-dbg - debugging symbols for the KDE 4 base workspace module
 kdebase-workspace-dev - development files for the KDE 4 base workspace module
 kdebase-workspace-libs4+5 - libraries provided by the KDE 4 base workspace module
 kdebase-workspace-wallpapers - extra wallpapers from the KDE 4 base module
 kdm        - KDE Display Manager for X11
 klipper    - clipboard utility for KDE 4
 ksysguard  - System Guard for KDE 4
 ksysguardd - System Guard Daemon for KDE 4
 kwin       - the KDE 4 window manager (KWin)
 libkdecorations4 - library used by decorations for the KDE 4 window manager
 libkwineffects1 - library used by effects for the KDE 4 window manager
 python-plasma - python support libraries for plasma applets
 systemsettings - KDE 4 System Settings
Launchpad-Bugs-Fixed: 562440
Changes: 
 kdebase-workspace (4:4.2.2-0ubuntu2.1) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: KDM Local Privilege Escalation Vulnerability (LP: #562440).
    - Add debian/patches/CVE-2010-0436_fix_kdm_local_exploit.diff
    - kdm/backend/ctrl.c: prevent race condition during user login which could
      allow execution of arbitrary code as root
    - CVE-2010-0436
    - http://www.kde.org/info/security/advisory-20100413-1.txt
Checksums-Sha1: 
 a94b0d63f03a9714b3f63815f59d2ddd9fa1a779 2663 kdebase-workspace_4.2.2-0ubuntu2.1.dsc
 ece4d9029600f5e84e7cba95c92918f24c85be9b 143650 kdebase-workspace_4.2.2-0ubuntu2.1.diff.gz
Checksums-Sha256: 
 8da9485fdb63a984bc1ad7037f982b5810d705799e911da2c08d60a779a2ebfd 2663 kdebase-workspace_4.2.2-0ubuntu2.1.dsc
 e6004fd064bd1b14824eb2592c6880b21ea59a45e8d9b645fbcc62bade2c20ba 143650 kdebase-workspace_4.2.2-0ubuntu2.1.diff.gz
Files: 
 019a27939b9deb26721b11c506386879 2663 kde optional kdebase-workspace_4.2.2-0ubuntu2.1.dsc
 e8a8a5cf5cf1dacd2956739c0c9f1065 143650 kde optional kdebase-workspace_4.2.2-0ubuntu2.1.diff.gz
Original-Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org>

From archive at ubuntu.com  Tue Apr 20 18:03:19 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Tue, 20 Apr 2010 17:03:19 -0000
Subject: [ubuntu/jaunty-security] irssi (delayed),
	irssi 0.8.12-6ubuntu1.3 (Accepted)
Message-ID: <20100420170319.16331.50833.launchpad@cocoplum.canonical.com>

irssi (0.8.12-6ubuntu1.3) jaunty-security; urgency=low

  * debian/patches/91_ssl_proxy.patch: when we have a proxy setting, we expect
    the CN to match the proxy hostname, not the server hostname. Patch thanks
    to Steve Langasek. (LP: #565182)

Date: Mon, 19 Apr 2010 13:01:12 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/irssi/0.8.12-6ubuntu1.3
-------------- next part --------------
Format: 1.8
Date: Mon, 19 Apr 2010 13:01:12 -0500
Source: irssi
Binary: irssi irssi-dev
Architecture: source
Version: 0.8.12-6ubuntu1.3
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 irssi      - terminal based IRC client
 irssi-dev  - text-mode version of the irssi IRC client development files
Launchpad-Bugs-Fixed: 565182
Changes: 
 irssi (0.8.12-6ubuntu1.3) jaunty-security; urgency=low
 .
   * debian/patches/91_ssl_proxy.patch: when we have a proxy setting, we expect
     the CN to match the proxy hostname, not the server hostname. Patch thanks
     to Steve Langasek. (LP: #565182)
Checksums-Sha1: 
 be8abefff99e70a9a4eba3286bbe5dff3db6dc89 1391 irssi_0.8.12-6ubuntu1.3.dsc
 ba8aa9b0cf752ff876a0d1e51f0363af20968aa9 25260 irssi_0.8.12-6ubuntu1.3.diff.gz
Checksums-Sha256: 
 a3501ea5dfdc2f27f51d88d55e961c4b3bc5ec1c54ce0445269578ca5317210c 1391 irssi_0.8.12-6ubuntu1.3.dsc
 2a1f564eb0b930a301fec39ba7d1d05d3d6c4e27657d70b6577af1f963379c4c 25260 irssi_0.8.12-6ubuntu1.3.diff.gz
Files: 
 21778ad10c27b938c6ed2cfcfdaf1782 1391 net optional irssi_0.8.12-6ubuntu1.3.dsc
 5eae245c14716a4c1c4d1d42867004cd 25260 net optional irssi_0.8.12-6ubuntu1.3.diff.gz
Original-Maintainer: David Pashley <david at davidpashley.com>

From doko at ubuntu.com  Fri Apr 23 12:29:49 2010
From: doko at ubuntu.com (Matthias Klose)
Date: Fri, 23 Apr 2010 11:29:49 -0000
Subject: [ubuntu/jaunty-proposed] sun-java6 6.20dlj-0ubuntu1.9.04 (Accepted)
Message-ID: <20100423112949.15988.9293.launchpad@palladium.canonical.com>

sun-java6 (6.20dlj-0ubuntu1.9.04) jaunty-proposed; urgency=low

  * New upstream version. LP: #566353.
    Release notes at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html.

Date: Mon, 19 Apr 2010 13:54:52 +0200
Changed-By: Matthias Klose <doko at ubuntu.com>
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Signed-By: Matthias Klose <matthias.klose at canonical.com>
https://edge.launchpad.net/ubuntu/jaunty/+source/sun-java6/6.20dlj-0ubuntu1.9.04
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 19 Apr 2010 13:54:52 +0200
Source: sun-java6
Binary: sun-java6-jre sun-java6-bin sun-java6-plugin ia32-sun-java6-bin ia32-sun-java6-plugin sun-java6-fonts sun-java6-jdk sun-java6-demo sun-java6-source sun-java6-javadb
Architecture: source
Version: 6.20dlj-0ubuntu1.9.04
Distribution: jaunty-proposed
Urgency: low
Maintainer: Ubuntu MOTU Developers <ubuntu-motu at lists.ubuntu.com>
Changed-By: Matthias Klose <doko at ubuntu.com>
Description: 
 ia32-sun-java6-bin - Sun Java(TM) Runtime Environment (JRE) 6 (32-bit)
 ia32-sun-java6-plugin - The Java(TM) Plug-in, Java SE 6 (32-bit)
 sun-java6-bin - Sun Java(TM) Runtime Environment (JRE) 6 (architecture dependent 
 sun-java6-demo - Sun Java(TM) Development Kit (JDK) 6 demos and examples
 sun-java6-fonts - Lucida TrueType fonts (from the Sun JRE)
 sun-java6-javadb - Java(TM) DB, Sun Microsystems' distribution of Apache Derby
 sun-java6-jdk - Sun Java(TM) Development Kit (JDK) 6
 sun-java6-jre - Sun Java(TM) Runtime Environment (JRE) 6 (architecture independen
 sun-java6-plugin - The Java(TM) Plug-in, Java SE 6
 sun-java6-source - Sun Java(TM) Development Kit (JDK) 6 source files
Launchpad-Bugs-Fixed: 566353
Changes: 
 sun-java6 (6.20dlj-0ubuntu1.9.04) jaunty-proposed; urgency=low
 .
   * New upstream version. LP: #566353.
     Release notes at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html.
Checksums-Sha1: 
 635851498c00962231d06c66d07432514e2057e1 1689 sun-java6_6.20dlj-0ubuntu1.9.04.dsc
 3ff1202ae6f5bc91f5410967272be016d632d242 167182085 sun-java6_6.20dlj.orig.tar.gz
 3a4635518e756924110313f04124a324fcdec26e 75849 sun-java6_6.20dlj-0ubuntu1.9.04.diff.gz
Checksums-Sha256: 
 9c263d2c523b0cb49b33a7ed08823192094baa3d188226d6b07fe27b09bbf74a 1689 sun-java6_6.20dlj-0ubuntu1.9.04.dsc
 3b9260b9d2bcf1c33e4d663f35c8b6ac4c61dee6fe5a8a88162b393828b3d2bc 167182085 sun-java6_6.20dlj.orig.tar.gz
 00ca3bfb05c4ee9bfea24fdc252d1929cd91b033a1bff73d31aa50f5c952d3d9 75849 sun-java6_6.20dlj-0ubuntu1.9.04.diff.gz
Files: 
 5931dc1e8298f67950489a7855b8c547 1689 non-free/devel optional sun-java6_6.20dlj-0ubuntu1.9.04.dsc
 4e03cf20eed2c47b44a841a507a5db3e 167182085 non-free/devel optional sun-java6_6.20dlj.orig.tar.gz
 c50431da36543e595d7ee51005f5db6d 75849 non-free/devel optional sun-java6_6.20dlj-0ubuntu1.9.04.diff.gz
Original-Maintainer: Debian QA Group <packages at qa.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvMiQcACgkQStlRaw+TLJzOGwCghhRJWuDRVQGysfBnlmHma4TM
Go0An0HPzNdGOV2eBB+VSTQkyvinIxZs
=cxTC
-----END PGP SIGNATURE-----

From archive at ubuntu.com  Mon Apr 26 14:20:26 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Mon, 26 Apr 2010 13:20:26 -0000
Subject: [ubuntu/jaunty-security] ffmpeg-debian,
	ffmpeg-debian (delayed) 3:0.svn20090303-1ubuntu6.2 (Accepted)
Message-ID: <20100426132026.32585.53153.launchpad@cocoplum.canonical.com>

ffmpeg-debian (3:0.svn20090303-1ubuntu6.2) jaunty-security; urgency=low

  * debian/patches/CVE-2009-46XX/security-issue22.patch: removed this
    patch as it was causing a regression. (LP: #567913)

Date: Fri, 23 Apr 2010 08:12:31 -0400
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/ffmpeg-debian/3:0.svn20090303-1ubuntu6.2
-------------- next part --------------
Format: 1.8
Date: Fri, 23 Apr 2010 08:12:31 -0400
Source: ffmpeg-debian
Binary: ffmpeg ffmpeg-dbg ffmpeg-doc libavutil49 libavcodec52 libavdevice52 libavformat52 libavfilter0 libpostproc51 libswscale0 libavutil-dev libavcodec-dev libavdevice-dev libavformat-dev libavfilter-dev libpostproc-dev libswscale-dev
Architecture: source
Version: 3:0.svn20090303-1ubuntu6.2
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 ffmpeg     - multimedia player, server and encoder
 ffmpeg-dbg - Debug symbols for ffmpeg related packages
 ffmpeg-doc - documentation of the ffmpeg API
 libavcodec-dev - development files for libavcodec
 libavcodec52 - ffmpeg codec library
 libavdevice-dev - development files for libavdevice
 libavdevice52 - ffmpeg device handling library
 libavfilter-dev - development files for libavfilter
 libavfilter0 - ffmpeg video filtering library
 libavformat-dev - development files for libavformat
 libavformat52 - ffmpeg file format library
 libavutil-dev - development files for libavutil
 libavutil49 - ffmpeg utility library
 libpostproc-dev - development files for libpostproc
 libpostproc51 - ffmpeg video postprocessing library
 libswscale-dev - development files for libswscale
 libswscale0 - ffmpeg video scaling library
Launchpad-Bugs-Fixed: 567913
Changes: 
 ffmpeg-debian (3:0.svn20090303-1ubuntu6.2) jaunty-security; urgency=low
 .
   * debian/patches/CVE-2009-46XX/security-issue22.patch: removed this
     patch as it was causing a regression. (LP: #567913)
Checksums-Sha1: 
 be79d94d4fc6f1d236b78b1c4a11f1ee24a8705f 2274 ffmpeg-debian_0.svn20090303-1ubuntu6.2.dsc
 90551c0df8a8a9f8acf46424e6e7ba1697ea5f3f 36376 ffmpeg-debian_0.svn20090303-1ubuntu6.2.diff.gz
Checksums-Sha256: 
 7c35ccdfa1d932bb8516e83e47ba9235191d11c0487fd90d88f4703573664f20 2274 ffmpeg-debian_0.svn20090303-1ubuntu6.2.dsc
 1efa58b125aa5e89a8ac5920cbbfc651ce1991f6dac1af5418cc62ce24b1bf45 36376 ffmpeg-debian_0.svn20090303-1ubuntu6.2.diff.gz
Files: 
 653a90249bb5197ecc6873ba6512bb4f 2274 libs optional ffmpeg-debian_0.svn20090303-1ubuntu6.2.dsc
 4c20e5745cd4f10076260f13b640386f 36376 libs optional ffmpeg-debian_0.svn20090303-1ubuntu6.2.diff.gz
Original-Maintainer: Debian multimedia packages maintainers <pkg-multimedia-maintainers at lists.alioth.debian.org>

From archive at ubuntu.com  Wed Apr 28 23:04:47 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Wed, 28 Apr 2010 22:04:47 -0000
Subject: [ubuntu/jaunty-security]
	postgresql-8.3_8.3.10-0ubuntu9.04.1_hppa_translations.tar.gz,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_i386_translations.tar.gz,
	postgresql-8.3,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_armel_translations.tar.gz,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_sparc_translations.tar.gz (delayed),
	postgresql-8.3_8.3.10-0ubuntu9.04.1_ia64_translations.tar.gz,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_lpia_translations.tar.gz,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_amd64_translations.tar.gz,
	postgresql-8.3_8.3.10-0ubuntu9.04.1_powerpc_translations.tar.gz
	8.3.10-0ubuntu9.04.1 (Accepted)
Message-ID: <20100428220447.30420.36684.launchpad@cocoplum.canonical.com>

postgresql-8.3 (8.3.10-0ubuntu9.04.1) jaunty-security; urgency=low

  * no change rebuild for -security

postgresql-8.3 (8.3.10-0ubuntu9.04) jaunty-proposed; urgency=low

  * New upstream bug fix release: (LP: #557408)
    - Add new configuration parameter ssl_renegotiation_limit to control
      how often we do session key renegotiation for an SSL connection.
      This can be set to zero to disable renegotiation completely, which
      may be required if a broken SSL library is used. In particular,
      some vendors are shipping stopgap patches for CVE-2009-3555 that
      cause renegotiation attempts to fail.
    - Fix possible deadlock during backend startup.
    - Fix possible crashes due to not handling errors during relcache
      reload cleanly.
    - Fix possible crash due to use of dangling pointer to a cached plan.
    - Fix possible crashes when trying to recover from a failure in
      subtransaction start.
    - Fix server memory leak associated with use of savepoints and a
      client encoding different from server's encoding.
    - Fix incorrect WAL data emitted during end-of-recovery cleanup of a
      GIST index page split.
      This would result in index corruption, or even more likely an error
      during WAL replay, if we were unlucky enough to crash during
      end-of-recovery cleanup after having completed an incomplete GIST
      insertion.
    - Make substring() for bit types treat any negative length as meaning
      "all the rest of the string".
      The previous coding treated only -1 that way, and would produce an
      invalid result value for other negative values, possibly leading to
      a crash (CVE-2010-0442). (Closes: #567058)
    - Fix integer-to-bit-string conversions to handle the first
      fractional byte correctly when the output bit width is wider than
      the given integer by something other than a multiple of 8 bits.
    - Fix some cases of pathologically slow regular expression matching.
    - Fix assorted crashes in xml processing caused by sloppy memory
      management.
      This is a back-patch of changes first applied in 8.4. The 8.3 code
      was known buggy, but the new code was sufficiently different to not
      want to back-patch it until it had gotten some field testing.
    - Fix bug with trying to update a field of an element of a
      composite-type array column.
    - Fix the STOP WAL LOCATION entry in backup history files to report
      the next WAL segment's name when the end location is exactly at a
      segment boundary.
    - Fix some more cases of temporary-file leakage.
      This corrects a problem introduced in the previous minor release.
      One case that failed is when a plpgsql function returning set is
      called within another function's exception handler.
    - Improve constraint exclusion processing of boolean-variable cases,
      in particular make it possible to exclude a partition that has a
      "bool_column = false" constraint.
    - When reading "pg_hba.conf" and related files, do not treat
      @something as a file inclusion request if the @ appears inside
      quote marks; also, never treat @ by itself as a file inclusion
      request.
      This prevents erratic behavior if a role or database name starts
      with @. If you need to include a file whose path name contains
      spaces, you can still do so, but you must write @"/path to/file"
      rather than putting the quotes around the whole construct.
    - Prevent infinite loop on some platforms if a directory is named as
      an inclusion target in "pg_hba.conf" and related files.
    - Fix possible infinite loop if SSL_read or SSL_write fails without
      setting errno.
      This is reportedly possible with some Windows versions of openssl.
    - Disallow GSSAPI authentication on local connections, since it
      requires a hostname to function correctly.
    - Make ecpg report the proper SQLSTATE if the connection disappears.
    - Fix psql's numericlocale option to not format strings it shouldn't
      in latex and troff output formats.
    - Make psql return the correct exit status (3) when ON_ERROR_STOP and
      --single-transaction are both specified and an error occurs during
      the implied "COMMIT".
    - Fix plpgsql failure in one case where a composite column is set to
      NULL.
    - Fix possible failure when calling PL/Perl functions from PL/PerlU
      or vice versa.
    - Add volatile markings in PL/Python to avoid possible
      compiler-specific misbehavior.
    - Ensure PL/Tcl initializes the Tcl interpreter fully.
      The only known symptom of this oversight is that the Tcl clock
      command misbehaves if using Tcl 8.5 or later.
    - Prevent crash in "contrib/dblink" when too many key columns are
      specified to a dblink_build_sql_- function.
    - Allow zero-dimensional arrays in "contrib/ltree" operations.
      This case was formerly rejected as an error, but it's more
      convenient to treat it the same as a zero-element array. In
      particular this avoids unnecessary failures when an ltree operation
      is applied to the result of ARRAY(SELECT ...) and the sub-select
      returns no rows.
    - Fix assorted crashes in "contrib/xml2" caused by sloppy memory
      management.

Date: Tue, 27 Apr 2010 10:15:08 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/postgresql-8.3/8.3.10-0ubuntu9.04.1
-------------- next part --------------
Format: 1.8
Date: Tue, 27 Apr 2010 10:15:08 -0500
Source: postgresql-8.3
Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-8.3 postgresql-client-8.3 postgresql-server-dev-8.3 postgresql-doc-8.3 postgresql-contrib-8.3 postgresql-plperl-8.3 postgresql-plpython-8.3 postgresql-pltcl-8.3 postgresql postgresql-client postgresql-doc postgresql-contrib
Architecture: source
Version: 8.3.10-0ubuntu9.04.1
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 libecpg-compat3 - older version of run-time library for ECPG programs
 libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
 libecpg6   - run-time library for ECPG programs
 libpgtypes3 - shared library libpgtypes for PostgreSQL 8.3
 libpq-dev  - header files for libpq5 (PostgreSQL library)
 libpq5     - PostgreSQL C client library
 postgresql - object-relational SQL database (supported version)
 postgresql-8.3 - object-relational SQL database, version 8.3 server
 postgresql-client - front-end programs for PostgreSQL (supported version)
 postgresql-client-8.3 - front-end programs for PostgreSQL 8.3
 postgresql-contrib - additional facilities for PostgreSQL (supported version)
 postgresql-contrib-8.3 - additional facilities for PostgreSQL
 postgresql-doc - documentation for the PostgreSQL database management system
 postgresql-doc-8.3 - documentation for the PostgreSQL database management system
 postgresql-plperl-8.3 - PL/Perl procedural language for PostgreSQL 8.3
 postgresql-plpython-8.3 - PL/Python procedural language for PostgreSQL 8.3
 postgresql-pltcl-8.3 - PL/Tcl procedural language for PostgreSQL 8.3
 postgresql-server-dev-8.3 - development files for PostgreSQL 8.3 server-side programming
Closes: 567058
Launchpad-Bugs-Fixed: 557408
Changes: 
 postgresql-8.3 (8.3.10-0ubuntu9.04.1) jaunty-security; urgency=low
 .
   * no change rebuild for -security
 .
 postgresql-8.3 (8.3.10-0ubuntu9.04) jaunty-proposed; urgency=low
 .
   * New upstream bug fix release: (LP: #557408)
     - Add new configuration parameter ssl_renegotiation_limit to control
       how often we do session key renegotiation for an SSL connection.
       This can be set to zero to disable renegotiation completely, which
       may be required if a broken SSL library is used. In particular,
       some vendors are shipping stopgap patches for CVE-2009-3555 that
       cause renegotiation attempts to fail.
     - Fix possible deadlock during backend startup.
     - Fix possible crashes due to not handling errors during relcache
       reload cleanly.
     - Fix possible crash due to use of dangling pointer to a cached plan.
     - Fix possible crashes when trying to recover from a failure in
       subtransaction start.
     - Fix server memory leak associated with use of savepoints and a
       client encoding different from server's encoding.
     - Fix incorrect WAL data emitted during end-of-recovery cleanup of a
       GIST index page split.
       This would result in index corruption, or even more likely an error
       during WAL replay, if we were unlucky enough to crash during
       end-of-recovery cleanup after having completed an incomplete GIST
       insertion.
     - Make substring() for bit types treat any negative length as meaning
       "all the rest of the string".
       The previous coding treated only -1 that way, and would produce an
       invalid result value for other negative values, possibly leading to
       a crash (CVE-2010-0442). (Closes: #567058)
     - Fix integer-to-bit-string conversions to handle the first
       fractional byte correctly when the output bit width is wider than
       the given integer by something other than a multiple of 8 bits.
     - Fix some cases of pathologically slow regular expression matching.
     - Fix assorted crashes in xml processing caused by sloppy memory
       management.
       This is a back-patch of changes first applied in 8.4. The 8.3 code
       was known buggy, but the new code was sufficiently different to not
       want to back-patch it until it had gotten some field testing.
     - Fix bug with trying to update a field of an element of a
       composite-type array column.
     - Fix the STOP WAL LOCATION entry in backup history files to report
       the next WAL segment's name when the end location is exactly at a
       segment boundary.
     - Fix some more cases of temporary-file leakage.
       This corrects a problem introduced in the previous minor release.
       One case that failed is when a plpgsql function returning set is
       called within another function's exception handler.
     - Improve constraint exclusion processing of boolean-variable cases,
       in particular make it possible to exclude a partition that has a
       "bool_column = false" constraint.
     - When reading "pg_hba.conf" and related files, do not treat
       @something as a file inclusion request if the @ appears inside
       quote marks; also, never treat @ by itself as a file inclusion
       request.
       This prevents erratic behavior if a role or database name starts
       with @. If you need to include a file whose path name contains
       spaces, you can still do so, but you must write @"/path to/file"
       rather than putting the quotes around the whole construct.
     - Prevent infinite loop on some platforms if a directory is named as
       an inclusion target in "pg_hba.conf" and related files.
     - Fix possible infinite loop if SSL_read or SSL_write fails without
       setting errno.
       This is reportedly possible with some Windows versions of openssl.
     - Disallow GSSAPI authentication on local connections, since it
       requires a hostname to function correctly.
     - Make ecpg report the proper SQLSTATE if the connection disappears.
     - Fix psql's numericlocale option to not format strings it shouldn't
       in latex and troff output formats.
     - Make psql return the correct exit status (3) when ON_ERROR_STOP and
       --single-transaction are both specified and an error occurs during
       the implied "COMMIT".
     - Fix plpgsql failure in one case where a composite column is set to
       NULL.
     - Fix possible failure when calling PL/Perl functions from PL/PerlU
       or vice versa.
     - Add volatile markings in PL/Python to avoid possible
       compiler-specific misbehavior.
     - Ensure PL/Tcl initializes the Tcl interpreter fully.
       The only known symptom of this oversight is that the Tcl clock
       command misbehaves if using Tcl 8.5 or later.
     - Prevent crash in "contrib/dblink" when too many key columns are
       specified to a dblink_build_sql_- function.
     - Allow zero-dimensional arrays in "contrib/ltree" operations.
       This case was formerly rejected as an error, but it's more
       convenient to treat it the same as a zero-element array. In
       particular this avoids unnecessary failures when an ltree operation
       is applied to the result of ARRAY(SELECT ...) and the sub-select
       returns no rows.
     - Fix assorted crashes in "contrib/xml2" caused by sloppy memory
       management.
Checksums-Sha1: 
 c7e275595eefb4f1d03b95ecb80d11e7bd78b1db 1768 postgresql-8.3_8.3.10-0ubuntu9.04.1.dsc
 2d76aad9449ea2577efa1629ff50d54e915230e8 68607 postgresql-8.3_8.3.10-0ubuntu9.04.1.diff.gz
Checksums-Sha256: 
 62154dba45f197541315c491e5987b4f90e4c404e7ccb5743bf32175ed78164e 1768 postgresql-8.3_8.3.10-0ubuntu9.04.1.dsc
 142fa0f6c754dbda3a96d07c0954999ff8a53ad7f471ba212a20660c957e335f 68607 postgresql-8.3_8.3.10-0ubuntu9.04.1.diff.gz
Files: 
 7454f28deecedf089c24276ff513348d 1768 misc optional postgresql-8.3_8.3.10-0ubuntu9.04.1.dsc
 8a83a19afbd33c4c8c622d46f6ef7085 68607 misc optional postgresql-8.3_8.3.10-0ubuntu9.04.1.diff.gz
Original-Maintainer: Martin Pitt <mpitt at debian.org>

From archive at ubuntu.com  Thu Apr 29 23:03:20 2010
From: archive at ubuntu.com (Ubuntu Installer)
Date: Thu, 29 Apr 2010 22:03:20 -0000
Subject: [ubuntu/jaunty-security] netpbm-free,
	netpbm-free (delayed) 2:10.0-12ubuntu0.9.04.1 (Accepted)
Message-ID: <20100429220320.31432.96546.launchpad@cocoplum.canonical.com>

netpbm-free (2:10.0-12ubuntu0.9.04.1) jaunty-security; urgency=low

  * SECURITY UPDATE: fix stack-based overflow in ppm/xpmtoppm.c
    - http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076
    - CVE-2009-4274

Date: Fri, 16 Apr 2010 17:16:36 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/jaunty/+source/netpbm-free/2:10.0-12ubuntu0.9.04.1
-------------- next part --------------
Format: 1.8
Date: Fri, 16 Apr 2010 17:16:36 -0500
Source: netpbm-free
Binary: netpbm libnetpbm10 libnetpbm10-dev libnetpbm9 libnetpbm9-dev
Architecture: source
Version: 2:10.0-12ubuntu0.9.04.1
Distribution: jaunty-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 libnetpbm10 - Shared libraries for netpbm
 libnetpbm10-dev - Development libraries and header files
 libnetpbm9 - Shared libraries for netpbm
 libnetpbm9-dev - Development libraries and header files
 netpbm     - Graphics conversion tools
Changes: 
 netpbm-free (2:10.0-12ubuntu0.9.04.1) jaunty-security; urgency=low
 .
   * SECURITY UPDATE: fix stack-based overflow in ppm/xpmtoppm.c
     - http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076
     - CVE-2009-4274
Checksums-Sha1: 
 751cb4bae5a15c0e62268d8ddda45af3de57404f 1282 netpbm-free_10.0-12ubuntu0.9.04.1.dsc
 71841313b1f59b89f98157a78d4e5554254bda35 51469 netpbm-free_10.0-12ubuntu0.9.04.1.diff.gz
Checksums-Sha256: 
 118d304c3b8e1569d5e3231ce72ccdee595f62b03e2b29d6ca1aee6789b27aae 1282 netpbm-free_10.0-12ubuntu0.9.04.1.dsc
 ecffdf3bee8a90e707bd681b84c7f529636711d22aaaaa65591055b885613bbe 51469 netpbm-free_10.0-12ubuntu0.9.04.1.diff.gz
Files: 
 80711ad731ed5a21e5833c619a704050 1282 graphics optional netpbm-free_10.0-12ubuntu0.9.04.1.dsc
 78f6a3a70f29dbd3de3518e514d02422 51469 graphics optional netpbm-free_10.0-12ubuntu0.9.04.1.diff.gz
Original-Maintainer: Andreas Barth <aba at not.so.argh.org>

From luke at faraone.cc  Fri Apr 30 04:21:25 2010
From: luke at faraone.cc (Luke Faraone)
Date: Fri, 30 Apr 2010 03:21:25 -0000
Subject: [ubuntu/jaunty-proposed] etoys 3.0.1916+svn132-2ubuntu0.9.04.1
	(Accepted)
Message-ID: <20100430032125.20610.39792.launchpad@soybean.canonical.com>

etoys (3.0.1916+svn132-2ubuntu0.9.04.1) jaunty-proposed; urgency=low

  * etoys.in: Remove "-xshm" parameter from call to squeak-vm to work around
    lack of SHM support in squeak-vm. (LP: #301190)
  * Update maintainer field.

Date: Thu, 15 Apr 2010 18:09:15 -0400
Changed-By: Luke Faraone <luke at faraone.cc>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Signed-By: Brandon Holtsclaw <me at brandonholtsclaw.com>
https://launchpad.net/ubuntu/jaunty/+source/etoys/3.0.1916+svn132-2ubuntu0.9.04.1
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Thu, 15 Apr 2010 18:09:15 -0400
Source: etoys
Binary: etoys etoys-doc
Architecture: source
Version: 3.0.1916+svn132-2ubuntu0.9.04.1
Distribution: jaunty-proposed
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Luke Faraone <luke at faraone.cc>
Description: 
 etoys      - A media-rich model, simulation construction kit and authoring too
 etoys-doc  - Documentation for etoys
Launchpad-Bugs-Fixed: 301190
Changes: 
 etoys (3.0.1916+svn132-2ubuntu0.9.04.1) jaunty-proposed; urgency=low
 .
   * etoys.in: Remove "-xshm" parameter from call to squeak-vm to work around
     lack of SHM support in squeak-vm. (LP: #301190)
   * Update maintainer field.
Checksums-Sha1: 
 63006a66b3cb7295f5b5628b3c5dd64b5ebe6d4e 1237 etoys_3.0.1916+svn132-2ubuntu0.9.04.1.dsc
 1bb75d03d6269c4dd8a8a6f75cc7ee1e87b8c9c5 29692 etoys_3.0.1916+svn132-2ubuntu0.9.04.1.diff.gz
Checksums-Sha256: 
 dda2a1de46b200d610633232644a376cb14318a46b0cd3e527611dda10d843e9 1237 etoys_3.0.1916+svn132-2ubuntu0.9.04.1.dsc
 9a607c8f61da53ad0f88083da39c72bdb6729872ee23e2b0bb0597e6ceebbf95 29692 etoys_3.0.1916+svn132-2ubuntu0.9.04.1.diff.gz
Files: 
 0b0c54a276568cfb80049c3540b2aa09 1237 non-free/games extra etoys_3.0.1916+svn132-2ubuntu0.9.04.1.dsc
 9464be84b09f2f506a1f456edbbd8683 29692 non-free/games extra etoys_3.0.1916+svn132-2ubuntu0.9.04.1.diff.gz
Original-Maintainer: Jos? L. Redrejo Rodr?guez <jredrejo at debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvTRUcACgkQIv9bxIr1jzl5qgCeKmMoxPRr8RtYrCK1sbVUnZ7y
lAUAnRDQ7IEpoIxEF5/yus/LBfm04bid
=pbXF
-----END PGP SIGNATURE-----

From martin.pitt at ubuntu.com  Fri Apr 30 09:25:04 2010
From: martin.pitt at ubuntu.com (Martin Pitt)
Date: Fri, 30 Apr 2010 08:25:04 -0000
Subject: [ubuntu/jaunty-proposed] tzdata 2010i~repack-0ubuntu0.9.04 (Accepted)
Message-ID: <20100430082504.20710.68439.launchpad@soybean.canonical.com>

tzdata (2010i~repack-0ubuntu0.9.04) jaunty-proposed; urgency=low

  * New upstream release 2010i: (LP: #572103)
    - Morocco: Update DST rules (effective from May 2)
    - Taiwan: Update historic DST rules
    - SanLuis: Update DST rules (effective from April 11)

Date: Fri, 30 Apr 2010 10:02:54 +0200
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://edge.launchpad.net/ubuntu/jaunty/+source/tzdata/2010i~repack-0ubuntu0.9.04
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 30 Apr 2010 10:02:54 +0200
Source: tzdata
Binary: tzdata tzdata-java
Architecture: source
Version: 2010i~repack-0ubuntu0.9.04
Distribution: jaunty-proposed
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Martin Pitt <martin.pitt at ubuntu.com>
Description: 
 tzdata     - time zone and daylight-saving time data
 tzdata-java - time zone and daylight-saving time data for use by java runtimes
Launchpad-Bugs-Fixed: 572103
Changes: 
 tzdata (2010i~repack-0ubuntu0.9.04) jaunty-proposed; urgency=low
 .
   * New upstream release 2010i: (LP: #572103)
     - Morocco: Update DST rules (effective from May 2)
     - Taiwan: Update historic DST rules
     - SanLuis: Update DST rules (effective from April 11)
Checksums-Sha1: 
 9546111766306b1ea0a637002108ed2183a7a6bc 1300 tzdata_2010i~repack-0ubuntu0.9.04.dsc
 62907e69f8c56b2b36de7c963ddb148224bec126 189252 tzdata_2010i~repack.orig.tar.gz
 16b7fac7ecd8ac3c4ebc3e884f9a778fba0c772a 219049 tzdata_2010i~repack-0ubuntu0.9.04.diff.gz
Checksums-Sha256: 
 6203845652a0558f65ea540dab8995b37c66a8654a930d767500c4f675e95410 1300 tzdata_2010i~repack-0ubuntu0.9.04.dsc
 6b73f9e2d8e6a78cea4e50a5ee6946f89261d559a269ad02de33a0b9d6f311e8 189252 tzdata_2010i~repack.orig.tar.gz
 26dd59bdccfb5b756873898c64cc805d9be0dcd98de3d9d618b85570e5211d0c 219049 tzdata_2010i~repack-0ubuntu0.9.04.diff.gz
Files: 
 7cd83efc8380f37141cff567bc62520d 1300 libs required tzdata_2010i~repack-0ubuntu0.9.04.dsc
 993c7b33ed6af555ad69fbbc13192210 189252 libs required tzdata_2010i~repack.orig.tar.gz
 125e0ab430321589eb855a2ddc3fb894 219049 libs required tzdata_2010i~repack-0ubuntu0.9.04.diff.gz
Original-Maintainer: GNU Libc Maintainers <debian-glibc at lists.debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvajvEACgkQDecnbV4Fd/JRzQCgonVsdJaHoR5RLSiqfgCGjtyr
a8sAnRg/sYR5wnLlXVbfxtot+dE3nFv2
=hpDv
-----END PGP SIGNATURE-----

