quantal security update

[Jonathan Riddell]

Security vulnerabilities in quantal need several fixes to the 4.0.7 owncloud package.

Easiest way is to merge with Debian which has 4.0.8+patches (making it equivalent to 4.0.9)

[Jonathan Riddell (jr)]

Updated package uploaded to quantal-security awaiting approval

[Jonathan Riddell (jr)]

New package:

http://starsky.19inch.net/~jr/tmp/owncloud_4.0.8ubuntu-1.1ubuntu1.debian.tar.gz
http://starsky.19inch.net/~jr/tmp/owncloud_4.0.8ubuntu.orig.tar.bz2

[Jonathan Riddell (jr)]

Package successfully runs and works

[Jamie Strandboge (jdstrand)]

What is the status of owncloud in raring?

[Jamie Strandboge (jdstrand)]

I see raring is at 4.0.9debian-0ubuntu1 now.

[Jamie Strandboge (jdstrand)]

The tarball in comment #3 doesn't seem to match Debian or upstream 4.0.8. I think the way to go is to do the original suggestion and use the merge with Debian. I will be examining the suggested debdiff now.

[Jamie Strandboge (jdstrand)]

The debdiff for 4.0.7debian-1ubuntu1 to 4.0.8debian-1.1ubuntu1 that was originally submitted does not account for the changes between 4.0.7 and 4.0.8 for apps/files_odfviewer, so this debdiff should not be used (ie, it doesn't represent the actual change from quantal to what we want in quantal-security.

[Jamie Strandboge (jdstrand)]

In addition to the missing changes in the previous debdiff, it:
 * should use quantal-security, not quantal-proposed
 * did not use the correct version (should use 4.0.8debian-1.1ubuntu0.1)
 * the changelog format was not in the recommended form as detailed in https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging

I've reviewed the changes between 4.0.7 and 4.0.8 and they look reasonable. I then created a merge with Debian unstable for quantal (debdiff between unstable and quantal-security attached).

[Jamie Strandboge (jdstrand)]

Uploaded to https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/+packages. Jonathan, can you test the package and give feedback?

Thanks!

[Jamie Strandboge (jdstrand)]

Per Riddell on IRC:
09:16 < Riddell> jdstrand: yep works with the new package (http://ec2-54-234-63-47.compute-1.amazonaws.com/owncloud/foo/bar )

[Launchpad Janitor (janitor)]

This bug was fixed in the package owncloud - 4.0.8debian-1.1ubuntu0.1

---------------
owncloud (4.0.8debian-1.1ubuntu0.1) quantal-security; urgency=low

  * SECURITY UPDATE: Merge with Debian for new upstream release and security
    fixes. Remaining change:
    - Recommends rather than Suggests mysql-server
    - LP: #1084109

owncloud (4.0.8debian-1.1) unstable; urgency=high

  * Non-maintainer upload, fixes several security issues (Closes: #693990).
  * debian/patches/06_oc-sa-2012-001.patch: Fix multiple XSS vulnerabilities.
  * debian/patches/07_oc-sa-2012-002.patch: Fix timing attack.
  * debian/patches/08_oc-sa-2012-004.patch: Fix code execution in migrate.php.
  * debian/patches/09_oc-sa-2012-005.patch: Fix code execution in
    filesystem.php.

owncloud (4.0.8debian-1) unstable; urgency=low

  * New upstream bugfix release
  * debian/patches:
    - Adjust 05_no_app_store.diff
 -- Jamie Strandboge <email address hidden> Fri, 30 Nov 2012 07:39:09 -0600