-
sudo (1.7.4p4-2.squeeze.4) stable-security; urgency=high
* Fix cve-2013-1775: authentication bypass when the clock is set to the UNIX
epoch [00:00:00 UTC on 1 January 1970] (closes: #701838).
* Fix cve-2013-1776: session id hijacking from another authorized tty
(closes: #701839).
-- Michael Gilbert <email address hidden> Wed, 06 Mar 2013 18:41:15 +0000
-
sudo (1.7.4p4-2.squeeze.3) stable-security; urgency=high
* CVE-2012-2337
-- Moritz Muehlenhoff <email address hidden> Wed, 23 May 2012 17:01:27 +0000
-
sudo (1.7.4p4-2.squeeze.2) stable; urgency=low
* patch from upstream to resolve interoperability problem between HOME in env_keep and the -H flag, originally closed #596493, applying this to to squeeze also closes: #614232 -- Bdale Garbee <email address hidden> Sun, 20 Feb 2011 09:35:07 -0700
-
sudo (1.7.4p4-2.squeeze.1) testing; urgency=low
* patch from upstream to fix special case in password checking code when only the gid is changing, closes #609641 -- Bdale Garbee <email address hidden> Wed, 26 Jan 2011 09:08:12 +1000
-
sudo (1.7.4p4-2) unstable; urgency=low
* add a NEWS item about change in $HOME handling that impacts programs
like pbuilder
-- Bdale Garbee <email address hidden> Wed, 08 Sep 2010 14:29:16 -0600
-
sudo (1.7.2p7-1) unstable; urgency=high
* new upstream release with security fix for secure path (CVE-2010-1646),
closes: #585394
* move timestamps from /var/run/sudo to /var/lib/sudo, so that the state
about whether to give the lecture is preserved across reboots even when
RAMRUN is set, closes: #581393
* add a note to README.Debian about LDAP needing an entry in
/etc/nsswitch.conf, closes: #522065
* add a note to README.Debian about how to turn off lectures if using
RAMRUN in /etc/default/rcS, closes: #581393
-- Bdale Garbee <email address hidden> Thu, 10 Jun 2010 15:42:14 -0600
-
sudo (1.7.2p6-1) unstable; urgency=low
* new upstream version fixing CVE-2010-1163, closes: #578275, #570737
-- Bdale Garbee <email address hidden> Mon, 19 Apr 2010 10:45:47 -0600
-
sudo (1.7.2p5-1) unstable; urgency=low
* new upstream release, closes a bug filed upstream regarding missing man
page processing scripts in the 1.7.2p1 tarball, also includes the fix
for CVE-2010-0426 previously the subject of a security team nmu
* move to source format 3.0 (quilt) and restructure changes as patches
* fix unprocessed substitution variables in man pages, closes: #557204
* apply patch from Neil Moore to fix Debian-specific content in the
visudo man page, closes: #555013
* update descriptions to better explain sudo-ldap, closes: #573108
* eliminate spurious 'and' in man page, closes: #571620
* fix confusing text in default sudoers, closes: #566607
-- Bdale Garbee <email address hidden> Thu, 11 Mar 2010 15:44:53 -0700
-
sudo (1.7.2p1-1.2) unstable; urgency=high
* Non-maintainer upload by the Security Team.
* Fixed CVE-2010-0426: verify path for the 'sudoedit' pseudo-command
(Closes: #570737)
-- Giuseppe Iuculano <email address hidden> Tue, 02 Mar 2010 14:57:17 +0100
-
sudo (1.7.2p1-1) unstable; urgency=low
* new upstream version
* add support for /etc/sudoers.d using #includedir in default sudoers,
which I think is also a good solution to the request for a crontab-like
API requested in March of 2001, closes: #539994, #271813, #89743
* move init.d script from using rcS.d to rc[0-6].d, closes: #542924
-- Bdale Garbee <email address hidden> Mon, 31 Aug 2009 14:09:32 -0600
-
sudo (1.7.2-2) unstable; urgency=low
* further improve initial sudoers to not include the NOPASSWD option on
the group sudo exception, closes: #539136, #198991
-- Bdale Garbee <email address hidden> Wed, 29 Jul 2009 16:21:04 +0200
-
sudo (1.7.2-1) unstable; urgency=low
* new upstream version, closes: #537103
* improve initial sudoers by having the exemption for users in group
sudo on by default, and including the ability to run any command as
any user. This makes the default install roughly equivalent to our
old use of the --with-exempt=sudo build option, closes: #536220, #536222
-- Bdale Garbee <email address hidden> Wed, 15 Jul 2009 01:29:46 -0600
-
sudo (1.7.0-1) unstable; urgency=low
* new upstream version, closes: #510179, #128268, #520274, #508514
* fix ldap config file path for sudo-ldap package, including creating
a symlink in postinst and cleaning it up in postrm for the sudo-ldap
package, closes: #430826
* fix NOPASSWD entry location in default config file for the sudo-ldap
instance too, closes: #479616
-- Bdale Garbee <email address hidden> Sat, 28 Mar 2009 15:15:01 -0600
-
sudo (1.6.9p17-2) unstable; urgency=high
* patch from upstream to fix privilege escalation with certain configurations
* typo in sudoers man page, closes: #507163
-- Bdale Garbee <email address hidden> Tue, 27 Jan 2009 11:49:02 -0700
