-
apport (2.19.1-0ubuntu5) wily-proposed; urgency=medium
* apport/ui.py: set "_MarkForUpload" field to False for cases where the
apport report is damaged, about a not installed package, or when an
error occurred processing the report. (LP: #1512902)
-- Brian Murray <email address hidden> Wed, 04 Nov 2015 10:00:38 -0800
-
apport (2.19.1-0ubuntu4) wily-security; urgency=medium
* test_backend_apt_dpkg.py: Reset internal apt caches between tests. Avoids
random test failures due to leaking paths from previous test cases.
* SECURITY FIX: When determining the path of a Python module for a program
like "python -m module_name", avoid actually importing and running the
module; this could lead to local root privilege escalation. Thanks to
Gabriel Campana for discovering this and the fix!
(CVE-2015-1341, LP: #1507480)
-- Martin Pitt <email address hidden> Thu, 22 Oct 2015 14:46:22 +0200
-
apport (2.19.1-0ubuntu3) wily; urgency=medium
* Disable Launchpad crash upload for final Ubuntu 15.10.
* Fix backend_apt_dpkg.test_install_packages_system for recent "Fall back to
direct Launchpad ddeb download" fix. coreutils-dbgsym should now always be
available independent of whether the local system has ddeb apt sources.
(Cherry-picked from trunk).
-- Martin Pitt <email address hidden> Mon, 19 Oct 2015 08:48:25 +0200
-
apport (2.19.1-0ubuntu2) wily; urgency=medium
* apt/dpkg: Don't mark packages downloaded from Launchpad for installation
by apt. Thanks Brian Murray. (Cherry-picked from trunk.)
apport (2.19.1-0ubuntu1) wily; urgency=medium
[ Martin Pitt ]
* New upstream release:
- Consistently intercept "report file already exists" errors in all writers
of report files (package_hook, kernel_crashdump, and similar) to avoid
unhandled exceptions on those. (LP: #1500450)
- apt/dpkg: Fall back to direct Launchpad ddeb download if we can't find it
in the apt cache. Thanks Brian Murray! (LP: #1500557)
- doc/data-format.tex: Clarify that key names are being treated as case
sensitive (unlike RFC822).
[ Brian Murray ]
* data/iwlwifi_error_dump: fix add_package call. (LP: #1496268)
[ Sebastien Bacher ]
* data/package-hooks/sources_ubiquity.py: Don't try decode() a str
(LP: #1501773).
-- Martin Pitt <email address hidden> Thu, 08 Oct 2015 08:04:12 +0200
-
apport (2.19.1-0ubuntu1) wily; urgency=medium
[ Martin Pitt ]
* New upstream release:
- Consistently intercept "report file already exists" errors in all writers
of report files (package_hook, kernel_crashdump, and similar) to avoid
unhandled exceptions on those. (LP: #1500450)
- apt/dpkg: Fall back to direct Launchpad ddeb download if we can't find it
in the apt cache. Thanks Brian Murray! (LP: #1500557)
- doc/data-format.tex: Clarify that key names are being treated as case
sensitive (unlike RFC822).
[ Brian Murray ]
* data/iwlwifi_error_dump: fix add_package call. (LP: #1496268)
[ Sebastien Bacher ]
* data/package-hooks/sources_ubiquity.py: Don't try decode() a str
(LP: #1501773).
-- Martin Pitt <email address hidden> Wed, 07 Oct 2015 10:58:13 +0200
-
apport (2.19-0ubuntu1) wily; urgency=medium
* New upstream release:
- apport: Drop re-nicing. This might decrease the time a user has to wait
for apport to finish the core dump for a crashed/hanging foreground
process. (See LP #1278780)
- kernel_crashdump: Enforce that the log/dmesg files are not a symlink.
This prevents normal users from pre-creating a symlink to the
predictable .crash file, and thus triggering a "fill up disk" DoS attack
when the .crash report tries to include itself. Thanks to halfdog for
discovering this! (CVE-2015-1338, part of LP #1492570)
- SECURITY FIX: Fix all writers of report files (package_hook,
kernel_crashdump, and similar) to open the report file exclusively,
i. e. fail if they already exist. This prevents privilege escalation
through symlink attacks. Note that this will also prevent overwriting
previous reports with the same same. Thanks to halfdog for discovering
this! (CVE-2015-1338, LP: #1492570)
- apport: Ignore process restarts from systemd's watchdog. Their traces
are usually useless as they don't have any information about the actual
reasaon why processes hang (like VM suspends or kernel lockups with bad
hardware) (LP: #1433320)
-- Martin Pitt <email address hidden> Thu, 24 Sep 2015 14:41:54 +0200
-
apport (2.18.1-0ubuntu1) wily; urgency=medium
* New upstream bug fix release. Changes since our previous snapshot:
- packaging.py: Only consider first word in /etc/os-release's NAME value.
This works around Debian's inconsistent value. (LP: #1408245)
- Unify and simplify Package: field generation in kernel_crashdump,
kernel_oops, and package_hook by using the new Report.add_package()
method. (LP: #1485787)
- sandboxutils.py, make_sandbox(): Make "Cannot find package which ships
Executable/InterpreterPath" fatal, to save some unnecessary package
unpack cycles. (LP: #1487174)
* etc/apport/crashdb.conf: Enable crash reports on Launchpad for wily.
Really late, sorry about that!
-- Martin Pitt <email address hidden> Thu, 10 Sep 2015 11:48:46 +0200
-
apport (2.18-0ubuntu9) wily; urgency=medium
* Revert changes to data/package_hook to include the package version. This
just hides the problem that somewhere during whoopsie add_package_info()
is not called. (See LP #1485787)
* packaging-apt-dpkg.py, is_distro_package(): If there is no origin and
/etc/system-image/channel.ini exists, assume the package is from a
read-only system image and accept it as distro package. With this we don't
need /var/lib/apt/lists/ indexes any more just to confirm the origin.
(LP: #1489410)
* Merge fixes from trunk:
- whoopsie-upload-all: Intercept OSError too (e. g. "No space left on
device"). (LP: #1476258)
- apport-retrace: Only consider the file name of a source file, not its
path; the latter often contains parts like "../" or directories which are
specific to a build machine. This fixes most broken StacktraceSource
results. (LP: #1462491)
-- Martin Pitt <email address hidden> Mon, 31 Aug 2015 11:35:54 +0200
-
apport (2.18-0ubuntu8) wily; urgency=medium
* data/package-hooks/source_ubiquity.py: resolve tracebacks parsing syslog
and adding the debug log file.
-- Brian Murray <email address hidden> Fri, 28 Aug 2015 10:03:59 -0700
-
apport (2.18-0ubuntu7) wily; urgency=medium
* data/package_hook: When creating a Package problem write the version of
the package to the report. (LP: #1485787)
-- Brian Murray <email address hidden> Mon, 17 Aug 2015 15:40:39 -0700
-
apport (2.18-0ubuntu6) wily; urgency=medium
* Drop apport-noui from test dependencies, as whoopsie interferes with the
test crashes while the test suite runs. (LP: #1478115)
* Restore whoopsie dependency of apport-noui.
* apport-noui.service: Add missing Type=oneshot, to fix restart limits with
crashes happening in rapid succession.
* Merge test fixes from trunk.
* data/package-hooks/source_linux.py: Fix PEP-8 error.
-- Martin Pitt <email address hidden> Mon, 10 Aug 2015 11:25:07 +0200
-
apport (2.18-0ubuntu5) wily; urgency=medium
* apport-noui: Remove the dependency on whoopsie as it causes test failures.
-- Brian Murray <email address hidden> Fri, 24 Jul 2015 13:23:03 -0700
-
apport (2.18-0ubuntu4) wily; urgency=medium
* whoopsie-upload-all: restore import of apport.fileutils which seems to
resolve some test failures.
-- Brian Murray <email address hidden> Thu, 23 Jul 2015 12:17:01 -0700
-
apport (2.18-0ubuntu3) wily; urgency=medium
* apport-noui: Depend on watershed and whoopsie since whoopsie-upload-all
requires whoopsie to upload crashes.
* apport-noui.upstart: Utilize watershed to only launch one instance of
whoopsie-upload-all.
* apport-noui.paths: When monitoring /var/crash switch to PathExistsGlob
since PathChanged will cause whoopsie-upload-all to run more often e.g.
when .upload and .uploaded files are created.
-- Brian Murray <email address hidden> Mon, 20 Jul 2015 14:09:23 -0700
-
apport (2.18-0ubuntu2) wily; urgency=medium
* Fix PEP-8 error in test/test_backend_apt_dpkg.py.
apport (2.18-0ubuntu1) wily; urgency=medium
* New upstream release. Changes since our last merge from trunk:
- apport-gtk: Use GtkWidget::valign property instead of GtkMisc::yalign
which is deprecated in GTK 3.16. Thanks Iain Lane.
- sandboxutils, make_sandbox(): Don't exit with 0 (success) if the
ExecutablePath does not exist. (LP: #1462469)
- sandboxutils, make_sandbox(): Fix second round of package installs to go
into permanent root dir as well.
- apt/dpkg install_packages(): If a requested package version is not
available from apt in the given archive, try to download it from
Launchpad. Thanks to Brian Murray!
- kerneloops: Fix crash when determining the version of a custom kernel.
Thanks Brian Murray. (LP: #1468154)
- apt/dpkg install_packages(): Ignore -dbg packages whose descriptions
contain "transitional". (LP: #1469635)
- Keep "[origin: ...]" information in Package: and Dependencies: fields
for native-origins.d/ origins, so that it's possible to retrace them.
Thanks Brian Murray! (LP: #1470572)
- Add support for retracing with discovering and enabling foreign
Launchpad PPA origins, as specified in reports' Package:/Dependencies:
fields. Thanks Brian Murray!
- hookutils.attach_wifi(): Shorten value of CRDA if iw isn't available on
the system. Thanks Brian Murray.
- Fix wrong assertion in crashdb.test_check_duplicate() which surfaces
under Python 3.5. (LP: #1474539)
* test/test_backend_apt_dpkg.py: Disable new test assertion for
unity-services-dbgsym, which doesn't currently work in the autopkgtest
(but works fine in trunk and on the retracers). To be investigated.
-- Martin Pitt <email address hidden> Fri, 17 Jul 2015 11:43:37 +0200
-
apport (2.18-0ubuntu1) wily; urgency=medium
* New upstream release. Changes since our last merge from trunk:
- apport-gtk: Use GtkWidget::valign property instead of GtkMisc::yalign
which is deprecated in GTK 3.16. Thanks Iain Lane.
- sandboxutils, make_sandbox(): Don't exit with 0 (success) if the
ExecutablePath does not exist. (LP: #1462469)
- sandboxutils, make_sandbox(): Fix second round of package installs to go
into permanent root dir as well.
- apt/dpkg install_packages(): If a requested package version is not
available from apt in the given archive, try to download it from
Launchpad. Thanks to Brian Murray!
- kerneloops: Fix crash when determining the version of a custom kernel.
Thanks Brian Murray. (LP: #1468154)
- apt/dpkg install_packages(): Ignore -dbg packages whose descriptions
contain "transitional". (LP: #1469635)
- Keep "[origin: ...]" information in Package: and Dependencies: fields
for native-origins.d/ origins, so that it's possible to retrace them.
Thanks Brian Murray! (LP: #1470572)
- Add support for retracing with discovering and enabling foreign
Launchpad PPA origins, as specified in reports' Package:/Dependencies:
fields. Thanks Brian Murray!
- hookutils.attach_wifi(): Shorten value of CRDA if iw isn't available on
the system. Thanks Brian Murray.
- Fix wrong assertion in crashdb.test_check_duplicate() which surfaces
under Python 3.5. (LP: #1474539)
* test/test_backend_apt_dpkg.py: Disable new test assertion for
unity-services-dbgsym, which doesn't currently work in the autopkgtest
(but works fine in trunk and on the retracers). To be investigated.
-- Martin Pitt <email address hidden> Fri, 17 Jul 2015 11:03:21 +0200
-
apport (2.17.3-0ubuntu4) wily; urgency=medium
* apport-gtk.ui: Use "valign" to align the icon on the crash dialog.
"yalign" is deprecated with GTK 3.16 and the consequent warning causes a
testsuite failure. Cherry-pick from upstream MP.
-- Iain Lane <email address hidden> Fri, 05 Jun 2015 11:52:04 +0100
-
apport (2.17.3-0ubuntu3) wily; urgency=medium
* Merge from trunk:
- Fix backend_apt_dpkg.test_install_packages_permanent_sandbox test to
restore proxy settings at the right time.
-- Martin Pitt <email address hidden> Thu, 28 May 2015 16:01:34 +0200
-
apport (2.17.3-0ubuntu2) wily; urgency=medium
* Merge from trunk:
- Fix backend_apt_dpkg.test_install_packages_permanent_sandbox test to
more carefully restore the environment and apt config.
- Enable suid_dumpable in the init.d script to also get Apport reports
about suid, unreadable, and otherwise protected binaries. These will be
"system reports" owned and readable by root only.
- init.d script: Fix tab usage inconsistencies.
-- Martin Pitt <email address hidden> Thu, 28 May 2015 10:05:40 +0200
-
apport (2.17.3-0ubuntu1) wily; urgency=medium
* New upstream release:
- SECURITY UPDATE: When /proc/sys/fs/suid_dumpable is enabled, crashing a
program that is suid root or not readable for the user would create
root-owned core files in the current directory of that program. Creating
specially crafted core files in /etc/logrotate.d or similar could then
lead to arbitrary code execution with root privileges.
Now core files do not get written for these kinds of programs, in
accordance with the intention of core(5).
Thanks to Sander Bos for discovering this issue!
(CVE-2015-1324, LP: #1452239)
- SECURITY UPDATE: When writing a core dump file for a crashed packaged
program, don't close and reopen the .crash report file but just rewind
and re-read it. This prevents the user from modifying the .crash report
file while "apport" is running to inject data and creating crafted core
dump files. In conjunction with the above vulnerability of writing core
dump files to arbitrary directories this could be exploited to gain root
privileges.
Thanks to Philip Pettersson for discovering this issue!
(CVE-2015-1325, LP: #1453900)
- apportcheckresume: Fix "occured" typo, thanks Matthew Paul Thomas.
(LP: #1448636)
- signal_crashes test: Fix test_crash_setuid_* to look at whether
suid_dumpable was enabled.
- test/run: Run UI tests under dbus-launch, newer GTK versions require this
now.
-- Martin Pitt <email address hidden> Wed, 20 May 2015 16:58:35 +0200
-
apport (2.17.2-0ubuntu2) wily; urgency=medium
[ Brian Murray ]
* Update Vcs information in debian/control.
* general-hooks/ubuntu.py: update checks for corrupt packages.
[ Martin Pitt ]
* Disable KDE tests for the time being. apport-kde consistently crashes
in PyQT5 since vivid (LP #1442512), don't block package migration on this.
-- Martin Pitt <email address hidden> Mon, 18 May 2015 08:36:07 +0200
-
apport (2.17.2-0ubuntu1) vivid; urgency=medium
* New upstream bug fix release:
- SECURITY UPDATE: Disable crash forwarding to containers. The previous
fix in 2.17.1 was not sufficient against all attack scenarios. By
binding to specially crafted sockes, a normal user program could forge
arbitrary entries in /proc/net/unix. We cannot currently rely on a
kernel-side solution for this; this feature will be re-enabled once it
gets re-done to be secure. (LP: #1444518)
- apport-kde: Fix crash when showing byte array values. Thanks Jonathan
Riddell. (LP: #1443659)
- Really create a better duplicate signature for recoverable problems,
using ExecutablePath. Thanks Brian Murray. (LP: #1316763)
* Disable Launchpad crash upload for final Ubuntu 15.04.
-- Martin Pitt <email address hidden> Thu, 16 Apr 2015 17:51:18 -0500
