avahi - Debian Package Tracker

general

source: avahi (main)
version: 0.8-5
maintainer: Utopia Maintenance Team (archive) (DMD)
uploaders: Loic Minier [DMD] – Michael Biebl [DMD] – Sebastian Dröge [DMD] – Sjoerd Simons [DMD]
arch: all any
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.6.32-2
oldstable: 0.7-4+deb10u1
stable: 0.8-5
testing: 0.8-5
unstable: 0.8-5

versioned links

0.6.32-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.7-4+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.8-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

avahi-autoipd (6 bugs: 0, 4, 2, 0)
avahi-daemon (50 bugs: 0, 40, 10, 0)
avahi-discover
avahi-dnsconfd
avahi-ui-utils (1 bugs: 0, 1, 0, 0)
avahi-utils (3 bugs: 0, 3, 0, 0)
gir1.2-avahi-0.6
libavahi-client-dev
libavahi-client3
libavahi-common-data
libavahi-common-dev
libavahi-common3
libavahi-compat-libdnssd-dev
libavahi-compat-libdnssd1
libavahi-core-dev
libavahi-core7
libavahi-glib-dev
libavahi-glib1
libavahi-gobject-dev
libavahi-gobject0
libavahi-ui-gtk3-0
libavahi-ui-gtk3-dev
python3-avahi

action needed

AppStream hints: 3 errors and 3 warnings high

AppStream found metadata issues for packages:

avahi-discover: 1 error and 1 warning
avahi-ui-utils: 2 errors and 2 warnings

You should get rid of them to provide more metadata about this software.

Created: 2020-06-01 Last update: 2022-02-21 12:03

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2021-3468: A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
CVE-2021-3502: A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

Created: 2021-03-27 Last update: 2021-12-05 06:30

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2021-3468: A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
CVE-2021-3502: A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

Created: 2021-08-15 Last update: 2021-12-05 06:30

lintian reports 3 warnings high

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-04-11 Last update: 2021-10-13 21:31

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2021-08-14 Last update: 2022-05-16 19:02

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.8-6, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 1119ce7ae93c7afbf75d6850ffc00dd8436f97a2
Author: Simon McVittie <smcv@debian.org>
Date:   Sun Jan 30 20:47:30 2022 +0000

    Update changelog

commit 51b4f33bebdb2996e9ae017682c6350c36792923
Author: Simon McVittie <smcv@debian.org>
Date:   Sun Jan 30 20:13:37 2022 +0000

    Use recommended debhelper compat level 13

commit 302e1ece12f131f1e00cf3b02977f4353b6f4f77
Author: Simon McVittie <smcv@debian.org>
Date:   Sun Jan 30 19:10:58 2022 +0000

    Standards-Version: 4.6.0 (no changes required)

commit 384541e5957dfe70c822a95076cb9d9537180a21
Author: Simon McVittie <smcv@debian.org>
Date:   Sun Jan 30 19:10:02 2022 +0000

    Add patch to fix display of URLs containing '&' in avahi-discover

commit 26d67372807dd5ace5b64f4304eaf5b22ab920a5
Author: Luca Boccassi <bluca@debian.org>
Date:   Sun Oct 31 11:56:03 2021 +0000

    avahi-daemon: depend on default-dbus-system-bus | dbus-system-bus
    
    This allows the reference implementation to be removed if using a
    different system bus implementation such as dbus-broker.
    
    [smcv: Adjust commit message]

Created: 2022-01-30 Last update: 2022-05-10 15:06

1 low-priority security issue in buster low

There is 1 open security issue in buster.

1 issue left for the package maintainer to handle:

CVE-2021-3468: (needs triaging) A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.

You can find information about how to handle this issue in the security team's documentation.

Created: 2021-03-27 Last update: 2021-12-05 06:30

2 low-priority security issues in bullseye low

There are 2 open security issues in bullseye.

2 issues left for the package maintainer to handle:

CVE-2021-3468: (needs triaging) A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
CVE-2021-3502: (needs triaging) A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-08-14 Last update: 2021-12-05 06:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.5.0).

Created: 2020-11-17 Last update: 2022-05-11 23:24

news

[rss feed]

[2021-03-08] Accepted avahi 0.7-4+deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Sjoerd Simons)
[2021-02-12] avahi 0.8-5 MIGRATED to testing (Debian testing watch)
[2021-02-06] Accepted avahi 0.8-5 (source) into unstable (Sjoerd Simons)
[2021-02-05] Accepted avahi 0.8-4 (source) into unstable (Sjoerd Simons)
[2020-05-31] avahi 0.8-3 MIGRATED to testing (Debian testing watch)
[2020-05-26] Accepted avahi 0.8-3 (source) into unstable (Simon McVittie)
[2020-05-25] Accepted avahi 0.8-2 (all amd64 i386 source) into experimental, experimental (Debian FTP Masters) (signed by: Simon McVittie)
[2020-05-13] avahi 0.8-1 MIGRATED to testing (Debian testing watch)
[2020-05-07] Accepted avahi 0.8-1 (source) into unstable (Simon McVittie)
[2019-12-19] avahi 0.7-5 MIGRATED to testing (Debian testing watch)
[2019-12-13] Accepted avahi 0.7-5 (source) into unstable (Simon McVittie)
[2018-05-03] avahi 0.7-4 MIGRATED to testing (Debian testing watch)
[2018-04-27] Accepted avahi 0.7-4 (source) into unstable (Simon McVittie)
[2018-02-16] avahi 0.7-3.1 MIGRATED to testing (Debian testing watch)
[2018-02-02] Accepted avahi 0.7-3.1 (source) into unstable (Gianfranco Costamagna)
[2017-09-24] avahi 0.7-3 MIGRATED to testing (Debian testing watch)
[2017-09-18] Accepted avahi 0.7-3 (source) into unstable (Michael Biebl)
[2017-09-18] Accepted avahi 0.7-2 (source amd64 all) into unstable, unstable (Michael Biebl)
[2017-09-17] Accepted avahi 0.7-1 (source) into unstable (Michael Biebl)
[2017-02-03] avahi 0.6.32-2 MIGRATED to testing (Debian testing watch)
[2017-01-23] Accepted avahi 0.6.32-2 (source) into unstable (Michael Biebl)
[2016-07-03] avahi 0.6.32-1 MIGRATED to testing (Debian testing watch)
[2016-06-27] Accepted avahi 0.6.32-1 (source) into unstable (Michael Biebl)
[2015-11-10] avahi 0.6.32~rc+dfsg-1 MIGRATED to testing (Britney)
[2015-11-04] Accepted avahi 0.6.32~rc+dfsg-1 (source amd64 all) into unstable (Laurent Bigonville)
[2015-04-18] avahi 0.6.31-5 MIGRATED to testing (Britney)
[2015-04-13] Accepted avahi 0.6.31-5 (source amd64 all) into unstable (Michael Biebl)
[2014-01-01] avahi 0.6.31-4 MIGRATED to testing (Debian testing watch)
[2013-12-26] Accepted avahi 0.6.31-4 (source amd64 all) (Laurent Bigonville)
[2013-12-07] Accepted avahi 0.6.31-3 (source amd64 all) (Laurent Bigonville)

bugs [bug history graph]

all: 62 66
RC: 0
I&N: 50 52
M&W: 11 13
F&P: 1
patch: 1

links

homepage
lintian (0, 3)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
l10n (-, 81)

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.8-5ubuntu5
157 bugs (5 patches)
patches for 0.8-5ubuntu5