-dbus 1.12.10 (UNRELEASED)
+dbus 1.12.16 (2019-06-11)
=========================
+The “tree cat” release.
+
+Security fixes:
+
+• CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1
+ authentication for identities that differ from the user running the
+ DBusServer. Previously, a local attacker could manipulate symbolic
+ links in their own home directory to bypass authentication and connect
+ to a DBusServer with elevated privileges. The standard system and
+ session dbus-daemons in their default configuration were immune to this
+ attack because they did not allow DBUS_COOKIE_SHA1, but third-party
+ users of DBusServer such as Upstart could be vulnerable.
+ Thanks to Joe Vennix of Apple Information Security.
+ (dbus#269, Simon McVittie)
+
+dbus 1.12.14 (2019-05-17)
+=========================
+
+The “reclaimed floorboards” release.
+
+Enhancements:
+
+• Raise soft fd limit to match hard limit, even if unprivileged.
+ This makes session buses with many clients, or with clients that make
+ heavy use of fd-passing, less likely to suffer from fd exhaustion.
+ (dbus!103, Simon McVittie)
+
+Fixes:
+
+• If a privileged dbus-daemon has a hard fd limit greater than 64K, don't
+ reduce it to 64K, ensuring that we can put back the original fd limits
+ when carrying out traditional (non-systemd) activation. This fixes a
+ regression with systemd >= 240 in which system services inherited
+ dbus-daemon's hard and soft limit of 64K fds, instead of the intended
+ soft limit of 1K and hard limit of 512K or 1M.
+ (dbus!103, Debian#928877; Simon McVittie)
+
+• Fix build failures caused by an AX_CODE_COVERAGE API change in newer
+ autoconf-archive versions (dbus#249, dbus!88; Simon McVittie)
+
+• Fix build failures with newer autoconf-archive versions that include
+ AX_-prefixed shell variable names (dbus#249, dbus!86; Simon McVittie)
+
+• Parse section/group names in .service files according to the syntax
+ from the Desktop Entry Specification, rejecting control characters
+ and non-ASCII in section/group names (dbus#208, David King)
+
+• Fix various -Wlogical-op issues that cause build failure with newer
+ gcc versions (dbus#225, dbus!109; David King)
+
+• Don't assume we can set permissions on a directory, for the benefit of
+ MSYS and Cygwin builds (dbus#216, dbus!110; Simon McVittie)
+
+• Don't overwrite PKG_CONFIG_PATH and related environment variables when
+ the pkg-config-based version of DBus1Config is used in a CMake project
+ (dbus#267, dbus!96; Clemens Lang)
+
+dbus 1.12.12 (2018-12-04)
+=========================
+
+The “draconic disciple” release.
+
+dbus version control is now hosted on freedesktop.org's Gitlab
+installation, and bug reports and feature requests have switched from
+Bugzilla bugs (indicated by "fd.o #nnn") to Gitlab issues ("dbus#nnn")
+and merge requests ("dbus!nnn").
+
+Enhancements:
+
+• Reference the freedesktop.org Code of Conduct (Simon McVittie)
+
+Fixes:
+
+• Stop the dbus-daemon leaking memory (an error message) if delivering
+ the message that triggered auto-activation is forbidden. This is
+ technically a denial of service because the dbus-daemon will
+ run out of memory eventually, but it's a very slow and noisy one,
+ because all the rejected messages are also very likely to have
+ been logged to the system log, and its scope is typically limited by
+ the finite number of activatable services available.
+ (dbus#234, Simon McVittie)
+
+• Remove __attribute__((__malloc__)) attribute on dbus_realloc(),
+ which does not meet the criteria for that attribute in gcc 4.7+,
+ potentially leading to miscompilation (fd.o #107741, Simon McVittie)
+
+• Fix some small O(1) memory leaks (fd.o #107320, Simon McVittie)
+
+• Fix printf formats for pointer-sized integers on 64-bit Windows
+ (fd.o #105662, Ralf Habacker)
+
+• Always use select()-based poll() emulation on Darwin-based OSs
+ (macOS, etc.) and on Interix, similar to what libcurl does
+ (dbus#232, dbus!19; Simon McVittie)
+
+• Extend a test timeout to avoid spurious failures in CI
+ (dbus!26, Simon McVittie)
+
+Tests and CI:
+
+• Add Travis-CI builds for 64-bit Windows using mingw-w64
+ (fd.o #105662, Ralf Habacker)
+
+• Add Gitlab-CI integration (fd.o #108177, Simon McVittie)
+
+dbus 1.12.10 (2018-08-02)
+=========================
+
+The “beam deflection” release.
+
Fixes:
• Prevent reading up to 3 bytes beyond the end of a truncated message.
projects / platform / upstream / dbus.git / blobdiff