-
gnupg2 (2.0.20-1ubuntu3.1) saucy-security; urgency=medium
* SECURITY UPDATE: denial of service via uncompressing garbled packets
- debian/patches/CVE-2014-4617.patch: limit number of extra bytes in
g10/compress.c.
- CVE-2014-4617
-- Marc Deslauriers <email address hidden> Thu, 26 Jun 2014 09:20:05 -0400
-
gnupg2 (2.0.20-1ubuntu3) saucy; urgency=low
* SECURITY UPDATE: incorrect no-usage-permitted flag handling
- debian/patches/CVE-2013-4351.patch: correctly handle empty key flags
in g10/getkey.c, g10/keygen.c, include/cipher.h.
- CVE-2013-4351
* SECURITY UPDATE: denial of service via infinite recursion
- debian/patches/CVE-2013-4402.patch: set limits on number of filters
and nested packets in common/iobuf.c, g10/mainproc.c.
- CVE-2013-4402
-- Marc Deslauriers <email address hidden> Mon, 07 Oct 2013 15:38:03 -0400
-
gnupg2 (2.0.20-1ubuntu2) saucy; urgency=low
* Drop sh prefix from openpgp test environment as it leads to exec
invocations of sh /bin/bash leading to syntax errors from sh.
Fixes FTBFS detected in Ubuntu saucy archive rebuild.
-- Andy Whitcroft <email address hidden> Fri, 20 Sep 2013 12:19:01 +0100
-
gnupg2 (2.0.20-1ubuntu1) saucy; urgency=low
* Resynchronize on Debian, remaining changes:
- Add udev rules to give gpg access to some smartcard readers;
Debian #543217.
. debian/gnupg2.udev: udev rules to set ACLs on SCM smartcard readers.
- Add upstart user job for gpg-agent.
gnupg2 (2.0.20-1) unstable; urgency=low
* New upstream release. (Closes: #691237, #583893)
* debian/patches/02-cve-2012-6085.diff: Remove, merged upstream.
* debian/control: Upgrade Standards-Version to 3.9.4.
* debian/compat, debian/control: Upgrade to debhelper v9.
* debian/control, debian/rules: Drop hardening-wrapper, now that we use
debhelper v9.
* debian/scdaemon.install: scdaemon has moved under $libexecdir.
* debian/control: Tighten dependency on scdaemon.
* debian/rules: Turn on all hardening options.
* debian/patches/01-gnupg2-rename.diff: Refresh patch.
* debian/gnupg-agent.install, debian/gnupg2.install,
debian/scdaemon.install: Fix /usr/lib paths for multi-arch.
* debian/rules: Pass ${pkglibdir} to --libexecdir since dh v9 passes
${libdir} by default.
-- Stephane Graber <email address hidden> Fri, 24 May 2013 18:27:04 -0400
-
gnupg2 (2.0.19-2ubuntu2) saucy; urgency=low
* Add upstart user job for gpg-agent.
-- Stephane Graber <email address hidden> Fri, 03 May 2013 09:13:11 -0700
-
gnupg2 (2.0.19-2ubuntu1) raring; urgency=low
* Resynchronize on Debian, remaining changes:
- Add udev rules to give gpg access to some smartcard readers;
Debian #543217.
. debian/gnupg2.udev: udev rules to set ACLs on SCM smartcard readers.
gnupg2 (2.0.19-2) unstable; urgency=high
* debian/patches/02-cve-2012-6085.diff: Patch from upstream to fix
CVE-2012-6085, "gnupg key import memory corruption". (Closes: #697251)
* debian/control: Use canonical addresses for VCS.
* debian/control: Fix scdaemon short description.
-- Marc Deslauriers <email address hidden> Thu, 10 Jan 2013 09:02:23 -0500
