-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 3.0 (quilt) Source: libcommons-collections3-java Binary: libcommons-collections3-java, libcommons-collections3-java-doc Architecture: all Version: 3.2.1-7+deb8u1 Maintainer: Debian Java Maintainers <[email protected]> Uploaders: Varun Hiremath <[email protected]>, Emmanuel Bourg <[email protected]> Homepage: http://commons.apache.org/collections/ Standards-Version: 3.9.5 Vcs-Browser: http://anonscm.debian.org/viewvc/pkg-java/trunk/libcommons-collections3-java Vcs-Svn: svn://anonscm.debian.org/pkg-java/trunk/libcommons-collections3-java Build-Depends: debhelper (>= 9), cdbs, default-jdk Build-Depends-Indep: default-jdk-doc, maven-repo-helper, ant, ant-optional, junit Package-List: libcommons-collections3-java deb java optional arch=all libcommons-collections3-java-doc deb doc optional arch=all Checksums-Sha1: d33ad9aa2d1388d1caf347770eb32076ffd1e195 611057 libcommons-collections3-java_3.2.1.orig.tar.gz 796d80aa41678743a74e7eead6b82d72ec269727 8740 libcommons-collections3-java_3.2.1-7+deb8u1.debian.tar.xz Checksums-Sha256: 36b4a1fb1e9a31e41f8d6b1abdbb76967035b20c06850506a13a782d51e68ecd 611057 libcommons-collections3-java_3.2.1.orig.tar.gz 0aac6d93b7d4b9c000c17b9ff15353c5e9fa5464b81802e4605f316d40ae596a 8740 libcommons-collections3-java_3.2.1-7+deb8u1.debian.tar.xz Files: ca4f5a29715733d2622cd0bb2f6bb48b 611057 libcommons-collections3-java_3.2.1.orig.tar.gz 1cb8c4fc8be768d2d9d9df30b98f38ea 8740 libcommons-collections3-java_3.2.1-7+deb8u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJWVF+RAAoJEPUTxBnkudCsW7IP/23JS+7VZP/j+y7KMyW9Pa0E f5hMT0Snz+cKIEWMmWfGWpXCdTNz8ZU0dooMvWDe7DK3Xxyz5uBkh+uh6H/l6tBU ziw4P987nrnXIdeaVRKKsB94KbxMYSyuhNizSQI+/RzfQyXuRuvxSfh6axTLJv2b NZ/sGDD7PugUau0rVJwzDnN1gQQkB+aJke6J69ypfuYd+UKVbEL8h+KFQD/mg3iD 2EC47PItvArs+kDdD8kJ0PilQmLkhsQ5uLxcIt0zUcXASTgF/R0Iy4URxoTmRkCO ZOzor8JUjhazn6aDjEYKzlGIM8wUoP5xStOtZNewXvznHtS2FGEgml0PVN+FBCzf rfLL8ebqadSKbVpwuCdkA9rzF5VMSOEdN7GBbu1upemV2qfL4FRjIRdu70jt1YiG aQ6GbFtC7ZCKxq2LTJEhx0J1ZFdSIfBGaVEQez/67M3sif+ZfigWR2ReGW3pFDyU OcyFhWb2t4uqTgFa6WBcqKJz6KEO8pM1wuK0qIvHF+WoFXwxE/nNcpun7ylmzliM K6yF32kZsEMT57MJA5f1U2CkvB2kDdcvythMnM3zMugyUzhJeVOqJPLNFH63zglL BYjUhNSLlPcKNRVPe3um2sYaFSafHDweqtU2u/ixag4ariv0lrIJixbOHvA+4vNo 9XC6fId9AZqfnxWLZTID =M/3E -----END PGP SIGNATURE----- Changes: libcommons-collections3-java (3.2.1-7+deb8u1) jessie-security; urgency=medium * Backported a modification from commons-collections 3.2.2 disabling the deserialization of the functors classes unless the system property org.apache.commons.collections.enableUnsafeSerialization is set to true. This fixes a vulnerability in unsafe applications deserializing objects from untrusted sources without sanitizing the input data. -- Emmanuel Bourg <[email protected]> Tue, 24 Nov 2015 12:18:15 +0100
