[Dragora-bug] Dragora updates 2.2 #010

[Matias A. Fonzo]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The following packages have been updated (#010):

  bash

We recommend that you upgrade your packages as soon as possible.

Details
- -------

  The upgraded for bash has the patch level 51, and 52:

Bug-Description (51):

There are two local buffer overflows in parse.y that can cause the shell
to dump core when given many here-documents attached to a single command
or many nested loops.

Bug-Description (52):

When bash is parsing a function definition that contains a here-document
delimited by end-of-file (or end-of-string), it leaves the closing
delimiter uninitialized.  This can result in an invalid memory access when
the parsed function is later copied.

Obtain the packages from

* 32 bit *

http://gungre.ch/dragora/mirror/dragora-2.2/upgrades/packages/32b/bash-4.2-i486-10.tlz

* 64 bit *

http://gungre.ch/dragora/mirror/dragora-2.2/upgrades/packages/64b/bash-4.2-x86_64-10.tlz

Checksums (SHA1)
- ----------------

1d47362fd4e96626033dc0c8425071d7df9c7370  bash-4.2-i486-10.tlz

4b0632fd1665c2677a9a219a80ec1c562e31a82f  bash-4.2-x86_64-10.tlz

If you need the detached GPG signatures[1] just append .sig to the URLs above.

Upgrading
- ---------

To upgrade a package you issue the following command:
  pkg upgrade <package.tlz>

To upgrade multiple packages, simply type:
  pkg upgrade bash-4.2-i486-10.tlz

Notes
=====

  You can get all the upgrades via RSYNC, for example, to obtain 32-bit
packages, type:

  # rsync -avPiz gungre.ch::dragora/dragora-2.2/upgrades/packages/32b .

Then use the sha1sum(1) tool for a complete checksumming:

  # sha1sums -c SHA1SUMS

  `pkg upgrade' can be used to upgrade all the packages (installed or not
installed); for more information, take a look at:

  http://dragora.org/wiki/doku.php/guides/d2/pkgmanager

Footnotes:

[1] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:

  gpg --verify bash-4.2-i486-10.tlz.sig

If that command fails because you don't have the required public key,
then run these commands to import it:

  wget http://gungre.ch/dragora/mirror/dragora-2.2/KEY
  gpg --import KEY

and re-run the `gpg --verify' sequence.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJULq/UAAoJEKpCZu9BMdKonWEH/1M+Clq/XdZGaxrAjVsa+KT2
QBUIdGH5PRe65DC/FrgV9qU54QX3PoKaqt32GDrDLTa5MtbeVXKIrlRGZ8/AC9bl
EvQMeLYksnXMwhKebg7eQCPza830S4RKNwT2o3+g8hJqdj6KnaiZOO9Asco+qkSH
458Ytwxsaqe039UsfgIItE1pYvVUDI17al1aNfQOqyrzYy8rhrL8gGot5o3ZAb2z
KtrHwSXBVRIOarJLpx+u4PjO9KRt4HJNRXuW/kw4eCJ0zohUaFKUbwaDFjO5qO0w
z/w+/pGb63nwKuD2oKcuDsuqt72n4LLmy9jYVM9wM4nLM+KffGpPMUFTEbkErsI=
=Uv9z
-----END PGP SIGNATURE-----