webkit (1.0.1-4ubuntu0.1) jaunty-security; urgency=low * SECURITY UPDATE: remote code execution via document with a SVGPathList data structure containing a negative index. - WebCore/svg/SVGList.h: make sure index is valid. - http://trac.webkit.org/changeset/43590 - http://trac.webkit.org/changeset/43795 - CVE-2009-0945 * SECURITY UPDATE: denial of service or arbitrary code execution via JavaScript garbage collector allocation failures. - JavaScriptCore/kjs/collector.cpp: make sure numBlocks is valid. - http://trac.webkit.org/changeset/41854 - CVE-2009-1687 * SECURITY UPDATE: denial of service or arbitrary code execution via use-after-free. - WebCore/html/HTMLParser.{cpp,h}: Fix incorrect handling of the head element. - http://trac.webkit.org/changeset/42532 - CVE-2009-1690 * SECURITY UPDATE: denial of service or arbitrary code execution via attr function call with a large numerical argument. - WebCore/css/{CSSParser,CSSPrimitiveValue}.cpp: fix attr handling. - http://trac.webkit.org/changeset/42081 - CVE-2009-1698 * SECURITY UPDATE: denial of service or arbitrary code execution via Attr DOM objects improper memory initialization. - WebCore/css/CSSStyleSelector.cpp, WebCore/dom/{Attribute.h, MappedAttribute.h,NamedMappedAttrMap.cpp,StyledElement.cpp}, WebCore/html/HTMLInputElement.cpp, WebCore/svg/{SVGStyledElement, SVGForeignObjectElement}.cpp: introduce and use isMappedAttribute(). - http://trac.webkit.org/changeset/36918 - CVE-2009-1711 * SECURITY UPDATE: arbitrary code execution via remote loading of local java applets. - WebCore/html/HTMLAppletElement.cpp, WebCore/loader/FrameLoader.cpp: Use same rule for loading java applets as webkit does for images. - http://trac.webkit.org/changeset/41568 - CVE-2009-1712 * SECURITY UPDATE: denial of service or arbitrary code execution via numeric character references. - WebCore/html/HTMLTokenizer.cpp: increase size of checkBuffer() - http://trac.webkit.org/changeset/44799 - CVE-2009-1725 -- Marc Deslauriers Tue, 22 Sep 2009 08:47:11 -0400 webkit (1.0.1-4) unstable; urgency=high * WebCore/dom/Document.*, WebCore/loader/DocLoader.*: Avoid DoS via crafted CSS import statements. Fixes: CVE-2008-3632. Closes: #499771. -- Mike Hommey Sat, 27 Sep 2008 08:57:48 +0200 webkit (1.0.1-3) unstable; urgency=low * WebCore/platform/graphics/gtk/FontCacheGtk.cpp, WebCore/platform/graphics/gtk/FontGtk.cpp, WebCore/platform/graphics/gtk/FontPlatformData.h, WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp, WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp: cherry-picked change from SVN revision 36309 to fix various font selection problems. Closes: #464477. -- Mike Hommey Sat, 20 Sep 2008 12:02:58 +0200 webkit (1.0.1-2) unstable; urgency=low * symbols.filter: As a workaround for #490173, hide all C++ mangled symbols. This will be enough for now, while fixing FTBFS on ARM. * debian/rules: Build with -Wl,--no-relax on alpha, to work around a binutils bug causing FTBFS. -- Mike Hommey Thu, 10 Jul 2008 21:10:27 +0200 webkit (1.0.1-1) unstable; urgency=low * New upstream release. Closes: #489385. * debian/copyright: - Updated to fit additions/removals of files upstream. - Updated where the source was gotten. - Fixed typos for Collabora. Closes: #484661. * JavaScriptCore/wtf/FastMalloc.cpp, JavaScriptCore/wtf/ListHashSet.h, JavaScriptCore/wtf/Platform.h, JavaScriptCore/wtf/Vector.h, WebCore/platform/text/AtomicString.cpp, WebCore/platform/text/StringHash.h: Fixed some alignment problems on sparc (and some that might occur on arm, too). Closes: #487745. Some compiler warnings about alignment remain, but I don't know if they are a real problem yet. * debian/control: - Added build dependency on libxt-dev. - Relax libwebkit-dev dependency on libwebkit-1.0-1. - Bumped Standards-Version to 3.8.0.1. No changes. * WebCore/page/gtk/AXObjectCacheAtk.cpp: Include stdio.h to avoid FTBFS because of undefined printf. * GNUmakefile.am, symbols.filter: Filter out all std::* symbols exported because of stl headers. * debian/libwebkit-1.0-1.symbols: Add symbols file. * debian/rules: Bump shlibs because of some new symbols. -- Mike Hommey Sun, 06 Jul 2008 15:09:55 +0200 webkit (0~svn32442-1) unstable; urgency=low [ Mike Hommey ] * New upstream snapshot * debian/copyright: Updated to fit additions/removals of files upstream. * debian/control: Add libpango1.0-dev to build dependencies and tighten libgtk2.0-dev build dependency. Closes: #477493. [ Luca Bruno ] * debian/libwebkit-1.0-1.install, debian/rules: Install GtkLauncher and DumpRenderTree in /usr/lib/webkit-1.0/libexec. Closes: #476514. -- Mike Hommey Wed, 23 Apr 2008 22:20:25 +0200 webkit (0~svn31841-1) unstable; urgency=low * New upstream snapshot + Includes proper Requires in .pc file. Closes: #450949. * debian/copyright: Updated to fit additions/removals of files upstream. * debian/control, debian/rules: Don't build QtWebKit, it will be built from Qt sources. * debian/libqtwebkit*: Removed. * debian/rules: Replaced make calls with $(MAKE). * debian/control, debian/rules: Don't use qmake anymore, but use autotools instead. * debian/libwebkitgtk-dev.install: Remove the .prl file that was generated by qmake. * WebCore/WebCore.pro, WebKit.pro: Revert previous changes, as we don't use qmake anymore. * JavaScriptCore/wtf/ASCIICType.h: Revert what were warning fixes, to avoid diverging too much from upstream. * debian/rules: Clean-up autotools generated files in the clean target. * debian/control, debian/rules, debian/libwebkit*: Rename packages to fit new library SONAME. * debian/control: libwebkit-dev doesn't need to depend on libglib2.0-dev. * debian/libwebkit-1.0-1.install, debian/rules: Install GtkLauncher and DumpRenderTree in /usr/lib/webkit-1.0, and don't rename DumpRenderTree, as Qt homonym lie elsewhere. * debian/libwebkit-1.0-1.preinst, debian/libwebkit-1.0-1.postrm: Don't divert anything, since we don't clash with older files anymore. * debian/rules: Ugly hack to add -Wl,--as-needed without it getting reordered by libtool. * WebKitTools/GNUmakefile.am: Don't build GtkLauncher and DumpRenderTree with rpath. -- Mike Hommey Sat, 12 Apr 2008 21:40:00 +0200 webkit (0~svn27674-4) unstable; urgency=low * debian/rules: Revert change from 0~svn27674-3, which was obviously not enough. * WebKit.pro: Don't build testkjs, that provokes the s390 FTBFSes ; we don't install it anyways. Closes: #466848. * JavaScriptCore/kjs/interpreter.cpp, JavaScriptCore/wtf/ASCIICType.h, WebCore/dom/Position.cpp, WebCore/editing/Selection.cpp, WebCore/editing/SelectionController.cpp, WebCore/editing/VisiblePosition.cpp, WebCore/ksvg2/svg/SVGFontFaceElement.cpp, WebCore/loader/FTPDirectoryParser.cpp, WebCore/loader/icon/IconDatabase.cpp, WebCore/platform/TextCodecLatin1.cpp, WebCore/platform/TextCodecUserDefined.cpp, WebCore/platform/TextStream.cpp, WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Fix FTBFS with gcc 4.3 due to missing includes. Closes: #455125. -- Mike Hommey Thu, 21 Feb 2008 23:01:12 +0100 webkit (0~svn27674-3) unstable; urgency=low * debian/rules: Work around #466613 (FTBFS on s390) by building a little bit less optimized (-O1). Thanks to Josselin Mouette. * debian/control: - Add Vcs-Browser and Vcs-Git fields, and turn Homepage indications in descriptions into a control field. - Bumped Standards-Version to 3.7.3.0. No changes. -- Mike Hommey Wed, 20 Feb 2008 21:49:33 +0100 webkit (0~svn29752-1) experimental; urgency=low * New upstream snapshot * debian/copyright: Updated to fit additions/removals of files upstream. * JavaScriptCore/wtf/TCSpinLock.h: Revert our work-around, now that a proper patch has been applied upstream. * WebCore/WebCore.pro: Don't use Qt version as SO version for QtWebKit. * debian/control, debian/rules, debian/lib*0d.install: Bump SO version to 1d because of ABI incompatible changes, and change package names accordingly. * debian/rules: Don't remove -lqtwebico from QtWebKit.pc, since it's not here anymore. * debian/rules, debian/lib*1d.install: - Install new Gtk port's DumpRenderTree tool. - Rename both port's DumpRenderTree tools to DumpRenderTree to avoid conflicting names. * debian/lib*1d.postrm, debian/lib*1d.preinst: Avoid conflicting files with lib*0d packages (*Launcher programs) but allow to install both new and old libraries by using diversions. -- Mike Hommey Fri, 25 Jan 2008 00:31:51 +0100 webkit (0~svn27674-2) unstable; urgency=low * JavaScriptCore/JavaScriptCore.pri: cherry-picked change from revision 28692 to fix FTBFS due to lack of -lpthread on the linker command line. * debian/control: Add dependencies on necessary development packages (essentially for header files) to our own development packages. -- Mike Hommey Sat, 15 Dec 2007 11:04:47 +0100 webkit (0~svn27674-1) unstable; urgency=low * New upstream snapshot * debian/copyright: Updated to fit additions/removals of files upstream. * debian/control: Make libwebkitgtk-dev conflict with the old libwebkitgdk-dev. Closes: #449001. * debian/rules: Bump qtwebkit shlibs. * WebKit/qt/Api/qwebpage.cpp: cherry-picked change from revision 27904 to fix crashes when an event is caught outside of the webkit frame in Qt. This occurred, for example, when hovering over the QtLauncher toolbar. -- Mike Hommey Mon, 19 Nov 2007 23:10:38 +0100 webkit (0~svn26044-1) unstable; urgency=low * New upstream snapshot * debian/rules: - Add support for DEB_BUILD_OPTIONS=noopt. - Bump qtwebkit shlibs, and remove versioning on the webkitgtk ones, as the library is new. * debian/copyright: Updated to fit additions/removals of files upstream. * debian/control, debian/rules, debian/libwebkitgtk-dev.install, debian/libwebkitgtk0d.install: Replace occurences of gdk by gtk, and rename libwebkitgdk*, to fit upstream rename of the Gtk port. Closes: #445060. -- Mike Hommey Fri, 05 Oct 2007 00:05:06 +0200 webkit (0~svn25144-2) unstable; urgency=low * JavaScriptCore/wtf/Platform.h: - Also test if __arm__ is defined, which should fix the FTBFS on arm. - Use better defines for our various arm ports. * JavaScriptCore/kjs/ustring.h, WebCore/platform/DeprecatedString.h: Use these new defines. Thanks Riku Voipio. * debian/control: Build depend on Qt >= 4.3. Thanks Hubert Figuiere. Closes: #439672. * debian/rules: Explicitely use qmake-qt4 instead of qmake to avoid build failures when qt3-dev-tools is installed. Thanks Michael Biebl. Closes: #441007. -- Mike Hommey Thu, 06 Sep 2007 08:12:21 +0200 webkit (0~svn25144-1) unstable; urgency=low * New upstream snapshot * debian/copyright: Updated so as to fit what we actually remove (there were missing removals previously, which were not appropriate for the most anyways), and to fit the additions/removals of files upstream. * JavaScriptCore/wtf/TCSpinLock.h: Work around an FTBFS on PPC due to a probable regression in gcc (#438415). * debian/rules: + Change the place we install QtLauncher from, since it moved. + Set binary packages' shlibs correctly. + Use $(CURDIR) variable more safely to avoid problem with build directories with spaces. * WebKitQt/Plugins/Plugins.pro: Build plugins with hidden symbols, so that they don't expose unwanted symbols. -- Mike Hommey Sun, 19 Aug 2007 15:54:12 +0200 webkit (0~svn24735-1) unstable; urgency=low * Initial release. (Closes: #428855) -- Mike Hommey Wed, 15 Aug 2007 14:19:46 +0200