lp://staging/ubuntu/hardy-updates/python2.4

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

49. By Jamie Strandboge on 2012-10-15

* SECURITY UPDATE: optionally disallow setting sys.path when setting
  sys.argv
  - debian/patches/CVE-2008-5983.dpatch: add new C API function,
    PySys_SetArgvEx
  - CVE-2008-5983
* SECURITY UPDATE: fix integer overflows in audioop module
  - debian/patches/CVE-2010-1634.dpatch: Fix incorrect and UB-inducing
    overflow checks
  - CVE-2010-1634
* SECURITY UPDATE: fix DoS in audioop module
  - debian/patches/CVE-2010-2089.dpatch: ensure that the input string length
    is a multiple of the frame size
  - CVE-2010-2089
* SECURITY UPDATE: Fix CGIHTTPServer information disclosure.
  - debian/patches/CVE-2011-1015.dpatch: Relative paths are now collapsed
    within the url properly before looking in cgi_directories.
  - CVE-2011-1015
* SECURITY UPDATE: update urllib and urllib2 for invalid redirections
  - debian/patches/CVE-2011-1521.dpatch: only process Location headers for
    http, https, and ftp
  - http://bugs.python.org/issue11662
  - CVE-2011-1521
* SECURITY UPDATE: fix XSS in SimpleHTTPServer
  - debian/patches/CVE-2011-4940.dpatch: add a charset parameter to the
    Content-type
  - CVE-2011-4940
* SECURE UPDATE: http://bugs.python.org/issue13512
  - debian/patches/CVE-2011-4944.dpatch: create ~/.pypirc securely
  - CVE-2011-4944
* SECURITY UPDATE: xmlrpc: Fix an endless loop in SimpleXMLRPCServer upon
  malformed POST request
  - debian/patches/CVE-2012-0845.dpatch: break if don't receive EOF in
    Lib/SimpleXMLRPCServer.py
  - CVE-2012-0845
* SECURITY UPDATE: Denial of service via hash collisions
  - debian.patches/CVE-2012-0876+CVE-2012-1148.dpatch: Add random salt value
    to hash inputs in lib/xmlparse.c
  - CVE-2012-0876
* SECURITY UPDATE: Denial of service via memory leak
  - debian.patches/CVE-2012-0876+CVE-2012-1148.dpatch: Properly reallocate
    memory in lib/xmlparse.c
  - CVE-2012-1148
* SECURITY UPDATE: fix DoS in smtpd.py
  - debian/patches/CVE-2010-3493.dpatch: adds proper error handling on
    accept() when smtpd accepts new incoming connections
  - http://bugs.python.org/issue9129
  - CVE-2010-3493
* debian/patches/testsuite-linux3.dpatch: adjust testsuite for linux3

48. By Jamie Strandboge on 2010-01-21

* SECURITY UPDATE: fix DoS via malformed XML
  - debian/patches/CVE-2009-3720.dpatch: update Modules/expat/xmltok_impl.c
    to not access beyond end of input string
  - CVE-2009-3720
* SECURITY UPDATE: fix DoS via malformed UTF-8 sequences
  - debian/patches/CVE-2009-3560.dpatch: update Modules/expat/xmlparse.c to
    properly recognize the end of a token
  - CVE-2009-3560

47. By Marc Deslauriers on 2009-07-21

* SECURITY UPDATE: arbitrary code execution via multiple integer
  overflows in the imageop module
  - debian/rules, debian/patches/CVE-2008-4864.dpatch: introduce new
    functions for size checks in Modules/imageop.c, introduce tests in
    Lib/test/test_imageop.py.
  - CVE-2008-4864
* SECURITY UPDATE: denial of service or possible arbitrary code execution
  via multiple integer overflows in the expandtabs method
  - debian/rules, debian/patches/CVE-2008-5031.dpatch: make sure we don't
    overflow in Objects/{stringobject,unicodeobject}.c and add tests to
    Lib/test/test_{str,unicode}.py.
  - CVE-2008-5031

46. By Kees Cook on 2008-07-30

* SECURITY UPDATE: arbitrary code execution via multiple integer overflows.
* debian/rules, debian/patches/CVE-2008-3142.dpatch,
  debian/patches/CVE-2008-3144.dpatch, debian/patches/CVE-2008-2315.dpatch:
  upstream fixes, thanks to Robert Buchholz.

45. By Matthias Klose on 2008-04-16

* Fix CVE-2008-1679, integer overflows in the imageop module.
* Fix CVE-2008-1721, integer signedness error in the zlib extension module.
* Fix issue, PyString_FromStringAndSize() to be considered unsafe.

44. By Matthias Klose on 2008-03-12

* Build depend on libdb4.6-dev on amd64, i386, lpia; use libdb4.2-dev
  for all other architectures.
* Backport new function signal.set_wakeup_fd from the trunk.
  Background: http://bugzilla.gnome.org/show_bug.cgi?id=481569
* Regenerate the documentation.

43. By Matthias Klose on 2008-03-11

Python 2.4.5 release.

42. By Matthias Klose on 2008-03-09

* Merge with Debian; remaining changes:
  - Rebuild the control file.
  - Build the -doc package from this source.

41. By Matthias Klose on 2008-02-27

Build-depend on libdb4.2-dev on all architectures; 4.6 is seriously
broken when used with the _bsddb extension. LP: #196147.

40. By Matthias Klose on 2008-02-26

Add gc module to python2.4-minimal.