Hello community, here is the log from the commit of package gpg checked in at Tue Nov 28 11:55:28 CET 2006. -------- --- gpg/gpg.changes 2006-08-02 20:19:58.000000000 +0200 +++ /mounts/work_src_done/STABLE/STABLE/gpg/gpg.changes 2006-11-28 11:38:35.000000000 +0100 @@ -1,0 +2,5 @@ +Tue Nov 28 11:37:55 CET 2006 - kssingvo@suse.de + +- fixed security issue with openfile in interactive mode (bugzilla#224108) + +------------------------------------------------------------------- New: ---- gnupg-1.4.5-openfile_overflow.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gpg.spec ++++++ --- /var/tmp/diff_new_pack.y02LCs/_old 2006-11-28 11:52:58.000000000 +0100 +++ /var/tmp/diff_new_pack.y02LCs/_new 2006-11-28 11:52:58.000000000 +0100 @@ -13,8 +13,8 @@ Name: gpg BuildRequires: openldap2 openldap2-devel Version: 1.4.5 -Release: 1 -License: GPL +Release: 22 +License: GNU General Public License (GPL) Group: Productivity/Security %if %suse_version > 811 PreReq: %install_info_prereq @@ -31,6 +31,7 @@ Patch4: gnupg-1.2.5.ppc64-auto.diff Patch5: gnupg-1.2.5.use-agent.diff Patch6: gnupg-1.4.5-files_are_digests.patch +Patch7: gnupg-1.4.5-openfile_overflow.patch URL: http://www.gnupg.de Prefix: /usr BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -60,6 +61,7 @@ %patch4 -p1 -b .auto %patch5 -p1 %patch6 -p1 +%patch7 -p1 chmod a+x checks/verify.test #chown 0:0 -R * # Needed for CVS version @@ -172,6 +174,8 @@ %endif %changelog -n gpg +* Tue Nov 28 2006 - kssingvo@suse.de +- fixed security issue with openfile in interactive mode (bugzilla#224108) * Wed Aug 02 2006 - kssingvo@suse.de - update to version 1.4.5: * Reverted check for valid standard handles under Windows. @@ -229,7 +233,7 @@ * Tue Aug 03 2004 - garloff@suse.de - Update to GnuPG-1.2.5: * New options: --(no-)ask-cert-level, --min-cert-level, ---max-output, --list-config, --gpgconf-list. + --max-output, --list-config, --gpgconf-list. * Performance improvements for large keyrings, --enable-key-cache * Portability fixes and simplified chnies translation. - Update README.SUSE to document the safe allocation of locked @@ -378,7 +382,7 @@ * Signature status storage changed. (Use --rebuild-keydb-caches). * Key validation process (trustdb) reworked. See man page entries for --update-trustdb, --check-trustdb and ---no-auto-check-trustdb + --no-auto-check-trustdb * Read-only keyrings now handled as expected. * Many more ... - Default RSA keysize to 1536 (instead of 1024) ++++++ gnupg-1.4.5-openfile_overflow.patch ++++++ --- gnupg-1.4.5/g10/openfile.c.orig 2006-07-31 16:00:19.000000000 +0200 +++ gnupg-1.4.5/g10/openfile.c 2006-11-28 11:19:43.000000000 +0100 @@ -144,8 +144,8 @@ s = _("Enter new filename"); - n = strlen(s) + namelen + 10; defname = name && namelen? make_printable_string( name, namelen, 0): NULL; + n = strlen(s) + (defname?strlen (defname):0) + 10; prompt = xmalloc(n); if( defname ) sprintf(prompt, "%s [%s]: ", s, defname ); ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org
participants (1)
-
root@suse.de