Set urgency to high.

[pkg-collectd.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index 248fbb1547e058544cff8be52ffba3a204258d09..34d83ac4bbf5b4f409be3cee30b5668902adec7d 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,67 @@
+collectd (5.4.1-6+deb8u1) jessie-security; urgency=high
+
+  * debian/patches/CVE-2016-6254.dpatch: Fix heap overflow in the network
+    plugin. Emilien Gaspar has identified a heap overflow in parse_packet(),
+    the function used by the network plugin to parse incoming network packets.
+    Thanks to Florian Forster for reporting the bug in Debian.
+    (Closes: #832507, CVE-2016-6254)
+  * debian/patches/bts832577-gcry-control.dpatch: Fix improper usage of
+    gcry_control. A team of security researchers at Columbia University and
+    the University of Virginia discovered that GCrypt's gcry_control is
+    sometimes called without checking its return value for an error. This may
+    cause the program to be initialized without the desired, secure settings.
+    (Closes: #832577)
+
+ -- Sebastian Harl <tokkee@debian.org>  Thu, 28 Jul 2016 22:25:08 +0200
+
+collectd (5.4.1-6) unstable; urgency=medium
+
+  * debian/patches:
+    - Added bts770681_riemann_ack: upstream fix for the write_riemann plugin
+      to avoid locking up a remote Riemann instance; thanks to Marc Fournier
+      for reporting this (Closes: #770681).
+    - Added bts747093_lvm_segfault: upstream fix for a segfault in the LVM
+      plugin; thanks to Bernd Zeimetz and Marc Fournier for reporting this
+      (Closes: #747093).
+    - Added bts770683_curl_init: upstream fix for a segfault in plugins using
+      libcurl caused by concurrent memory access; thanks to Marc Fournier for
+      reporting this (Closes: #770683, cf. #735173).
+    - Added bts750440_config_segfault: upstream fix for a segfault when
+      including empty config files; thanks to Bernd Zeimetz and Marc Fournier
+      for reporting this (Closes: #750440, #770685).
+    - Added bts770688_snmp_memleak: upstream fix for a memory leak in the
+      SNMP plugin; thanks to Marc Fournier for reporting this
+      (Closes: #770688).
+    - Added bts770690_java_jni_thread_detach: upstream fix for locking up the
+      Java plugin by not properly detaching from the JVM in error conditions;
+      thanks to Marc Fournier for reporting this (Closes: #770690).
+    - Added bts770693_timestamps: upstream fix for handling internal
+      timestamps; thanks to Marc Fournier for reporting this (Closes: #770693)
+    - Added bts770694_loglevel: upstream fix to correct logging behavior when
+      using an invalid log level; thanks to Marc Fournier for reporting this
+      (Closes: #770694, #687067).
+
+ -- Sebastian Harl <tokkee@debian.org>  Sun, 23 Nov 2014 15:27:15 +0100
+
+collectd (5.4.1-5) unstable; urgency=medium
+
+  * debian/rules:
+    - Fixed a typo preventing the fix for #760719 to be active
+      (Closes: #760719).
+
+ -- Sebastian Harl <tokkee@debian.org>  Sun, 28 Sep 2014 17:13:07 +0000
+
+collectd (5.4.1-4) unstable; urgency=medium
+
+  * debian/rules:
+    - Disable preprocessor warnings on kfreebsd to work around an error
+      resulting from a redefined macro in PostgreSQL's pg_config_manual.h;
+      thanks to Ivo De Decker for reporting this (Closes: #760719).
+  * debian/control, debian/rules:
+    - Disable the 'java' plugin on sparc for now. It fails to build.
+
+ -- Sebastian Harl <tokkee@debian.org>  Sun, 28 Sep 2014 01:59:14 +0200
+
 collectd (5.4.1-3.1) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -236,6 +300,22 @@ collectd (5.1.0-3.1) unstable; urgency=low
 
  -- gregor herrmann <gregoa@debian.org>  Sun, 26 May 2013 00:52:37 +0200
 
+collectd (5.1.0-3+deb7u1) wheezy-security; urgency=high
+
+  * debian/patches/CVE-2016-6254.dpatch: Fix heap overflow in the network
+    plugin. Emilien Gaspar has identified a heap overflow in parse_packet(),
+    the function used by the network plugin to parse incoming network packets.
+    Thanks to Florian Forster for reporting the bug in Debian.
+    (Closes: #832507, CVE-2016-6254)
+  * debian/patches/bts832577-gcry-control.dpatch: Fix improper usage of
+    gcry_control. A team of security researchers at Columbia University and
+    the University of Virginia discovered that GCrypt's gcry_control is
+    sometimes called without checking its return value for an error. This may
+    cause the program to be initialized without the desired, secure settings.
+    (Closes: #832577)
+
+ -- Sebastian Harl <tokkee@debian.org>  Thu, 28 Jul 2016 20:52:12 +0200
+
 collectd (5.1.0-3) unstable; urgency=low
 
   * debian/patches/migrate-4-5-df.dpatch, debian/collectd-core.postinst: