-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 09 Jan 2017 18:09:54 +0000 Source: bubblewrap Binary: bubblewrap Architecture: source Version: 0.1.5-2 Distribution: unstable Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Description: bubblewrap - setuid wrapper for unprivileged chroot and namespace manipulation Closes: 850702 Changes: bubblewrap (0.1.5-2) unstable; urgency=high . * d/p/Call-setsid-before-executing-sandboxed-code-CVE-2017-5226.patch: Call setsid() before executing sandboxed code, preventing a sandboxed executable invoked with a controlling terminal (for example in Flatpak) from escalating its privileges by injecting keypresses into the controlling terminal with the TIOCSTI ioctl. (Closes: #850702; CVE-2017-5226) * d/control: remove Maintainer status from Laszlo Boszormenyi at his request. Add him to Uploaders instead, and hand the package over to the Utopia Maintenance Team (the same as OSTree and Flatpak). Checksums-Sha1: 465ce1918329c65e441c2772d939c933479bb9ac 2177 bubblewrap_0.1.5-2.dsc 741a7935a49fb36afdea5fd73b9ce3210901e1a3 5376 bubblewrap_0.1.5-2.debian.tar.xz Checksums-Sha256: 8fb221eb67a948380dc6718e79ace999a6ab9a8d3d1f777441f5abdf5acd02bc 2177 bubblewrap_0.1.5-2.dsc 7164edcf23a4ee7dfee2bacb89634cbdd086843520be4eb45bc84560473e410b 5376 bubblewrap_0.1.5-2.debian.tar.xz Files: f381ca8bd16072592b4efd3e236cab82 2177 admin optional bubblewrap_0.1.5-2.dsc e2546f647dd6d7bf7ac55012a1475a9c 5376 admin optional bubblewrap_0.1.5-2.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAlhz05wACgkQTej/KmPH zJBm9w/+NZHN7IVg3M6ORKYNx9YcuuChJdl86eWnD2NfsxniMgTtDqkEQGTwg6cT Ll1KOogAHgEaZtwCrow+JgtPJ5LcxKces34asD5UmwCcTwGoqP7wlZmPR2M8hXx4 t39T6qoacQMEgS/TrGYhDyXSaSc7iwiqXHnbvEqbT3qvPNhp1evzyTuwmETCfjAt PyykJUNLov4WprEFN0l5T6H8CTPEa/qp0INfJbJlJoauumwK1btyholYog8kw2D+ vkJ7m8mEREvXJR5Fu627bdNbta+bDyMaN5cIba71e0QF6qcSd+LH04FI4/gMQqXT f+HWfoGjtI0ZbJgh/lDXHUmn5uRAl3QohrJxRD85uFaIJVa6YUa5S1W3CTvY3j2p /Nh6nLDBT8BBMglYDbG1DtTjaPDAcj0Qvh2Q7/t5l4iqKTeUYhvQEjYJdNWI4Qz6 wDL51+bYElqlWwok00znsBQhej7jd738gKo/XhMUVbM7yphUQEOX2jdfILzWSUL0 M7mZyRlC1v8+SgqSYVrtMPW0xyzj94/voR4MANRyZN/PehAF3BL/6vf8aWwcqoLX KPuYz5FFuDWiWWsNHBak52AfEJeVrGwFZeIcXZlFQVGA1Q0ESvWVWvMjnAhEmEhu Zo0PNfWkMP7D+daMkDPYC6l8zzwZmu/pPkTGxipb3JwtzcD+aDo= =JSfd -----END PGP SIGNATURE-----