Changes between Initial Version and Version 3 of Ticket #6713


Ignore:
Timestamp:
11/23/2015 02:18:35 PM (8 years ago)
Author:
Fernando de Oliveira
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #6713

    • Property Owner changed from blfs-book@… to bdubbs@…
    • Property Status new → closed
    • Property Resolution → fixed
    • Property Priority normal → high

  • Ticket #6713 – Description

    initial v3  
     1 == Security Update ==
     2
    13New minor version
     4
     5After this ticket has been closed, I discovered that it solved a
     6security vulnerability.
     7
     8CVE-2015-2059
     9
     10Thus, I decided to change the ticket.
     11
     12'''Users are advised to  update to this version or, preferably,
     13later.''' Book now is at version 1.32.
     14
     15[https://ftp.gnu.org/gnu/libidn/libidn-1.31.tar.gz]
     16
     17or
     18
     19[ftp://ftp.gnu.org/gnu/libidn/libidn-1.31.tar.gz]
     20
     21[https://ftp.gnu.org/gnu/libidn/libidn-1.31.tar.gz.sig]
     22
     23[https://lists.gnu.org/archive/html/help-libidn/2015-07/msg00011.html]
     24
     25or
     26
     27[http://git.savannah.gnu.org/gitweb/?p=libidn.git;a=blob_plain;f=NEWS;hb=HEAD]
     28
     29SHA1 0bb34003a0fe05a91e60d346803401f16c82a1fb  libidn-1.31.tar.gz
     30
     31{{{
     32Libidn 1.31 released
     33From:   Simon Josefsson
     34Subject:        Libidn 1.31 released
     35Date:   Wed, 08 Jul 2015 23:33:00 +0200
     36User-agent:     Gnus/5.130014 (Ma Gnus v0.14) Emacs/24.4 (gnu/linux)
     37
     38GNU Libidn is a fully documented implementation of the Stringprep,
     39Punycode and IDNA specifications.  Libidn's purpose is to encode and
     40decode internationalized domain name strings.  There are native C, C#
     41and Java libraries.
     42
     43Noteworthy changes since the last release (from NEWS file):
     44
     45* Version 1.31 (released 2015-07-08) [beta]
     46
     47** libidn: stringprep_utf8_to_ucs4 now rejects invalid UTF-8. CVE-2015-2059
     48This function has always been documented to not validate that the
     49input UTF-8 string is actually valid UTF-8.  Like the rest of the API,
     50when you call a function that works on UTF-8 data, you have to pass it
     51valid UTF-8 data.  Application writers appear to have difficulties
     52using interfaces designed like that, as bugs triggered by invalid
     53UTF-8 has been identified in a number of projects (jabberd2, gnutls,
     54wget, and curl).  While we could introduce a new API to perform UTF-8
     55validation, so that applications can easily implement the proper
     56checks, this appear error prone because there is a risk that the check
     57will be forgotten.  Instead, we took the more radical approach of
     58modifying the documentation and the implementation of the API.  The
     59intention is that all functions that accepts UTF-8 data should
     60validate it before use.  This will solve the problem for applications,
     61without needing to change them.  This change has the unfortunate
     62side-effect that Surrogate codes (see section 5.5 of RFC 3454) no
     63longer trigger the STRINGPREP_CONTAINS_PROHIBITED error code but
     64instead will trigger the newly introduced STRINGPREP_ICONV_ERROR error
     65code, as the gnulib/libunistring-based code that we use to test
     66UTF-8-compliance rejects Surrogate codes.  We hope that this is an
     67acceptable cost to live with in order to improve application security.
     68We welcome feedback on this solution, and we are marking this release
     69as beta rather than stable to signal that we may reconsider this
     70approach if people disagree.  Reported by several people including
     71Thijs Alkemade, Gustavo Grieco, Daniel Stenberg, and Nikos
     72Mavrogiannopoulos.
     73
     74** libidn: Added STRINGPREP_ICONV_ERROR error code.
     75
     76** libidn: Workaround valgrind/gcc/glibc issue.
     77Valgrind reported a 'Invalid read of size 4' that was caused by
     78optimized strlen implementation.  Reported and patch by Alessandro
     79Ghedini <address@hidden>.
     80
     81** build: Use LOG_COMPILER instead of TESTS_ENVIRONMENT to fix valgrind use.
     82Errors caught by valgrind did not always trigger 'make check' failures
     83before.
     84
     85** i18n: Updated Danish translation.
     86Thanks to Joe Hansen.
     87
     88** API and ABI is backwards compatible with the previous version.
     89
     90Happy hacking,
     91Simon
     92}}}