diff -Nru firebird2.5-2.5.2~svn+54698.ds4/debian/changelog firebird2.5-2.5.2~svn+54698.ds4/debian/changelog --- firebird2.5-2.5.2~svn+54698.ds4/debian/changelog 2012-06-30 19:26:39.000000000 +0700 +++ firebird2.5-2.5.2~svn+54698.ds4/debian/changelog 2013-02-05 12:08:05.000000000 +0700 @@ -1,3 +1,13 @@ +firebird2.5 (2.5.2~svn+54698.ds4-1ubuntu0.12.10.1) quantal-security; urgency=low + + * SECURITY UPDATE: Fix for NULL pointer Denial of Service in TraceManager + (LP: #1115902) + - debian/patches/CVE-2012-5529.patch: Handle empty query safely. Based on + upstream patch. + - CVE-2012-5529 + + -- Christian Kuersteiner Tue, 05 Feb 2013 11:51:04 +0700 + firebird2.5 (2.5.2~svn+54698.ds4-1) unstable; urgency=low * Snapshot from upstream's 2.5.2 tag, revision 54698. Still not the official diff -Nru firebird2.5-2.5.2~svn+54698.ds4/debian/control firebird2.5-2.5.2~svn+54698.ds4/debian/control --- firebird2.5-2.5.2~svn+54698.ds4/debian/control 2012-05-12 19:22:04.000000000 +0700 +++ firebird2.5-2.5.2~svn+54698.ds4/debian/control 2013-02-05 12:12:05.000000000 +0700 @@ -1,7 +1,8 @@ Source: firebird2.5 Section: database Priority: optional -Maintainer: Debian Firebird Group +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian Firebird Group Uploaders: Damyan Ivanov Build-Depends: autoconf, diff -Nru firebird2.5-2.5.2~svn+54698.ds4/debian/patches/CVE-2012-5529.patch firebird2.5-2.5.2~svn+54698.ds4/debian/patches/CVE-2012-5529.patch --- firebird2.5-2.5.2~svn+54698.ds4/debian/patches/CVE-2012-5529.patch 1970-01-01 07:00:00.000000000 +0700 +++ firebird2.5-2.5.2~svn+54698.ds4/debian/patches/CVE-2012-5529.patch 2013-02-05 12:57:55.000000000 +0700 @@ -0,0 +1,16 @@ +Description: Server crashes on preparing empty query when trace is enabled +Origin: upstream +Author: ckuerste@gmx.ch +Bug: http://tracker.firebirdsql.org/browse/CORE-3884 +Ubuntu-Bug: https://bugs.launchpad.net/ubuntu/+source/firebird2.5/+bug/1115902 +--- a/src/jrd/trace/TraceDSQLHelpers.h ++++ b/src/jrd/trace/TraceDSQLHelpers.h +@@ -88,7 +88,7 @@ + Firebird::string str(*getDefaultMemoryPool(), m_string, m_string_len); + + TraceFailedSQLStatement stmt(str); +- TraceManager::event_dsql_prepare(m_attachment, m_request->req_transaction, ++ TraceManager::event_dsql_prepare(m_attachment, m_request ? m_request->req_transaction:NULL, + &stmt, millis, result); + } + } diff -Nru firebird2.5-2.5.2~svn+54698.ds4/debian/patches/series firebird2.5-2.5.2~svn+54698.ds4/debian/patches/series --- firebird2.5-2.5.2~svn+54698.ds4/debian/patches/series 2012-03-27 19:09:28.000000000 +0700 +++ firebird2.5-2.5.2~svn+54698.ds4/debian/patches/series 2013-02-05 11:39:00.000000000 +0700 @@ -10,3 +10,4 @@ parallel-build.patch versioned-log-filename.patch link_atomic_ops.patch +CVE-2012-5529.patch