Changes since 3.3.10
--------------------
o Jeremy Allison <jra@samba.org>
* BUG 6557: Fix vfs_full_audit.
* BUG 7036: Fix 'net rpc getsid' in hardened Windows environments.
* BUG 7045: Fix bad (non memory copying) interfaces in smbc_setXXXX calls.
* BUG 7067: Fix failing of smbd to respond to a read or a write caused by
Linux asynchronous IO (aio).
* BUG 7072: Fix unlocking of accounts from ldap.
* BUG 7104: "wide links" and "unix extensions" are incompatible.
* BUG 7122: Fix reading of large browselist.
* BUG 7154: "mangling method = hash" can crash storing a name containing
a '.'.
* BUG 7155: Valgrind Conditional jump or move depends on uninitialised
value(s) error when "mangling method = hash".
o Gunther Deschner <gd@samba.org>
* BUG 7043: Fix crash bug in "SMBC_parse_path".
o Volker Lendecke <vl@samba.org>
* BUG 5626: Fix build on AIX.
* BUG 5885: Fix bogus ip address in SWAT.
* BUG 7046: Fix a crash in libsmbclient used against the OpenSolaris CIFS
server.
o Stefan Metzmacher <metze@samba.org>
* BUG 7098: Fix results of 'smbclient -L' with a large browse list.
* BUG 7170: Fix handling of external domains in setups with one way trusts.
o William Jojo <w.jojo@hvcc.edu>
* BUG 7052: Fix DFS on AIX (maybe others).
o Bo Yang <boyang@samba.org>
* BUG 7106: Fix malformed require_membership_of_sid.
by Wen Heping.
Changelog:
QA release - stable.
* Updated minimum dependencies (Net_SMTP, PEAR, PHP)
* Doc Bug #15620 Licence change to BSD
* Bug #13659 Mail parse error in special condition
* Bug #16200 - Security hole allow to read/write Arbitrary File
* _hasUnclosedQuotes() doesn't properly handle a double slash before an end
quote (slusarz at curecanti.org, Bug #9137).
* Make sure Net_SMTP is defined when calling getSMTPObject() directly
(slusarz at curecanti.org, Bug #13772).
* Add addServiceExtensionParameter() to the SMTP driver
(slusarz at curecanti.org, Bug #13764).
* Add a method to obtain the Net_SMTP object from the SMTP driver
(slusarz at curecanti.org, Bug #13766).
Upstream changes:
0.27 2010-02-28 00:00
Use param to Wx::Yield (Wx 0.9701+) to avoid recursive
Yield calls and pass tests with debugging wxWidgets
(e.g. pre-installed wxWidgets on OSX);
0.26 2010-02-26 00:00
Changed behaviour of $process->IsAlive
will now return false if process has
already returned an exit code.
0.25 2010-02-25 00:00
Continuous stream will hang app rt.cpan.org #54962
Fixed by adding SetMaxLines setting with default 1000
Added PeekStdErrBuffer, PeekStdOutBuffer
Added GetStdErrBufferLineCount GetStdOutBufferLineCount
Added EVT_WXP_PROCESS_STREAM_MAXLINES
Stopped tests displaying frame (not necessary in this case)
based on package by @anyakichi via twiter.
== 1.5.2
* Added support for using the ffi-ncurses gem which is supported in JRuby.
* Added gem build instructions.
== 1.5.1
* Fixed the long standing echo true bug.
(reported by Lauri Tuominen)
* Improved Windows API calls to support the redirection of STDIN.
(patch by Aaron Simmons)
* Updated gem specification to avoid a deprecated call.
* Made a minor documentation clarification about character mode support.
* Worked around some API changes in Ruby's standard library in Ruby 1.9.
(patch by Jake Benilov)
== 1.5.0
* Fixed a bug that would prevent Readline from showing all completions.
(reported by Yaohan Chen)
* Added the ability to pass a block to HighLine#agree().
(patch by Yaohan Chen)
Changes in version 0.2.1.24 - 2010-02-21
Tor 0.2.1.24 makes Tor work again on the latest OS X -- this time
for sure!
o Minor bugfixes:
- Work correctly out-of-the-box with even more vendor-patched versions
of OpenSSL. In particular, make it so Debian and OS X don't need
customized patches to run/build.
Changes in version 0.2.1.23 - 2010-02-13
Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work
again on the latest OS X, and updates the location of a directory
authority.
o Major bugfixes (performance):
- We were selecting our guards uniformly at random, and then weighting
which of our guards we'd use uniformly at random. This imbalance
meant that Tor clients were severely limited on throughput (and
probably latency too) by the first hop in their circuit. Now we
select guards weighted by currently advertised bandwidth. We also
automatically discard guards picked using the old algorithm. Fixes
bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.
o Major bugfixes:
- Make Tor work again on the latest OS X: when deciding whether to
use strange flags to turn TLS renegotiation on, detect the OpenSSL
version at run-time, not compile time. We need to do this because
Apple doesn't update its dev-tools headers when it updates its
libraries in a security patch.
- Fix a potential buffer overflow in lookup_last_hid_serv_request()
that could happen on 32-bit platforms with 64-bit time_t. Also fix
a memory leak when requesting a hidden service descriptor we've
requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found
by aakova.
o Minor bugfixes:
- Refactor resolve_my_address() to not use gethostbyname() anymore.
Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.
o Minor features:
- Avoid a mad rush at the beginning of each month when each client
rotates half of its guards. Instead we spread the rotation out
throughout the month, but we still avoid leaving a precise timestamp
in the state file about when we first picked the guard. Improves
over the behavior introduced in 0.1.2.17.
Overview of changes for 0.10.2
==============================
* Documentation fixes for GBoxed transformation functions
* Zero all fields of JsonObject on creation
Hex-a-Hop is a hexagonal tile-based puzzle game with one simple
goal: destroy all green tiles! There are infinite undos and no time
limits -- you just have to find a way to destroy all the green
tiles and step on a safe tile at the end.
Many bugfixes. New features include:
* multi-threading was introduced
* add new recipients to address book automatically on sending was added.
* The new filter match type 'is in addressbook' was added.
* Address book is now sortable by each column.
* Address book search feature was added.
* The setup dialog on the first run became user-friendly.
* The new account setup dialog was implemented. Easy Gmail setup.
* SHA1/MD5 fingerprint and validity period of certificate is now displayed
* menu item to request disposition notification was added
* The feature to customize the color label text was added.
* The option to set only mail address of recipients when replying was added.
AST-2010-003. AST-2010-002 was just a warning about dialplan
scripting errors that could lead to security issues.
Asterisk 1.6.1.13: general bug fixes
Asterisk 1.6.1.14: fix AST-2010-001
Asterisk 1.6.1.15: not released, skipped for security releases
Asterisk 1.6.1.16: fix AST-2010-002
Asterisk 1.6.1.17: fix AST-2010-003
Note that the only change in Asterisk 1.6.1.16 was the addtion of
a README file. However, the package doesn't install random docs.
That is planned for a future update seperate from the upstream
updates.
-----
Asterisk 1.6.1.13:
The release of Asterisk 1.6.1.13 resolved several issues reported
by the community, and would have not been possible without your
participation. Thank you!
* Restarts busydetector (if enabled) when DTMF is received after
call is bridged
(Closes issue #16389. Reported, Tested, Patched by alecdavis.)
* Send parking lot announcement to the channel which parked the
call, not the park-ee.
(Closes issue #16234. Reported, Tested by yeshuawatso. Patched
by tilghman.)
* When the field is blank, don't warn about the field being unable
to be coerced just skip the column.
(Closes
http://lists.digium.com/pipermail/asterisk-dev/2009-December/041362.html)
Reported by Nic Colledge on the -dev list.)
* Don't queue frames to channels that have no means to process
them.
(Closes issue #15609. Reported, Tested by aragon. Patched by
tilghman.)
* Fixes holdtime playback issue in app_queue.
(Closes issue #16168. Reported, Patched by nickilo. Tested by
wonderg, nickilo.)
A summary of changes in this release can be found in the release
summary:
http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-1.6.1.13-summary.t
xt
For a full list of changes in this releases, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.13
-----
Asterisk 1.6.1.14:
The releases of Asterisk 1.6.0.22, 1.6.1.14, and 1.6.2.2 include
the fix described in security advisory AST-2010-001.
The issue is that an attacker attempting to negotiate T.38 over
SIP can remotely crash Asterisk by modifying the FaxMaxDatagram
field of the SDP to contain either a negative or exceptionally
large value. The same crash will occur when the FaxMaxDatagram
field is omitted from the SDP, as well.
For more information about the details of this vulnerability, please
read the security advisory AST-2009-009, which was released at the
same time as this announcement.
For a full list of changes in the current releases, please see the
ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.14
Security advisory AST-2010-001 is available at:
http://downloads.asterisk.org/pub/security/AST-2010-001.pdf
-----
Asterisk 1.6.1.16:
The releases of Asterisk 1.2.40, 1.4.29.1, 1.6.0.24, 1.6.1.16, and
1.6.2.4 include documention describing a possible dialplan string
injection with common usage of the ${EXTEN} (and other expansion
variables). The issue and resolution are described in the AST-2010-002
security advisory.
If you have a channel technology which can accept characters other
than numbers and letters (such as SIP) it may be possible to craft
an INVITE which sends data such as 300&Zap/g1/4165551212 which
would create an additional outgoing channel leg that was not
originally intended by the dialplan programmer.
Please note that this is not limited to an specific protocol or
the Dial() application.
The expansion of variables into programmatically-interpreted strings
is a common behavior in many script or script-like languages,
Asterisk included. The ability for a variable to directly replace
components of a command is a feature, not a bug - that is the entire
point of string expansion.
However, it is often the case due to expediency or design
misunderstanding that a developer will not examine and filter string
data from external sources before passing it into potentially
harmful areas of their dialplan.
With the flexibility of the design of Asterisk come these risks if
the dialplan designer is not suitably cautious as to how foreign
data is allowed to enter the system unchecked.
This security release is intended to raise awareness of how it is
possible to insert malicious strings into dialplans, and to advise
developers to read the best practices documents so that they may
easily avoid these dangers.
For more information about the details of this vulnerability, please
read the security advisory AST-2010-002, which was released at the
same time as this announcement.
For a full list of changes in the current releases, please see the
ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.16
Security advisory AST-2010-002 is available at:
http://downloads.asterisk.org/pub/security/AST-2010-002.pdf
The README-SERIOUSLY.bestpractices.txt document is available in
the top-level directory of your Asterisk sources, or available in
all Asterisk branches from 1.2 and up.
http://svn.asterisk.org/svn/asterisk/trunk/README-SERIOUSLY.bestpractices.txt
-----
Asterisk 1.6.1.17:
The releases of Asterisk 1.6.0.25, 1.6.1.17, and 1.6.2.5 resolve
an issue with invalid parsing of ACL (Access Control List) rules
leading to a possible compromise in security. The issue and resolution
are described in the AST-2010-003 security advisory.
For more information about the details of this vulnerability, please
read the security advisory AST-2010-003, which was released at the
same time as this announcement.
For a full list of changes in the current releases, please see the
ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.17
Security advisory AST-2010-003 is available at:
http://downloads.asterisk.org/pub/security/AST-2010-003.pdf
-----
Changelog:
* *nix: Add support for forward and backward mouse buttons
* Speed limits can be re-enabled on SFTP connections
* Changed settings did not come into effect unless FileZilla was restarted
* Small performance improvements
* Spelling fixes
* Rebuilt due to timer problems
* Speed limits can be quickly set using the menu and a new indicator in the status bar
* Display number of bytes transferred and duration of transfer in log
* MSW: React to back button of mouse in file lists
* Updated blukis icon set
* Refactored large parts of the toolbar and menubar code
* A race condition in the socket code could lead to crashes
* Fix connecting to addresses longer than 15 characters if using SOCKS proxy
* Get add to queue in local directory tree context menu working again
* Do not open request dialogs if user is holding a mouse button
* Forward all Ctrl+Tab key events to tab bar
* Do not report SFTP exitcodes that do not originate from the server
----------------
Release 20
----------------
* Fixes: model names starting with a number (1n4001) are now correctly parsed. The .global
command has been reinstated (it was previously disabled) and error messages now display
the corresponding line numberin the input deck.
* New Features: .measure command for transient, ac and dc analyses (still not complete, e.g.
DERIV is missing).
* Devices: Updated BISM4 model to revision 4.6.5. Added PWL (PieceWise Linear) functionality
for B (arbitrary generator) sources.
----------------
Release 19
----------------
Reveals an important work in compile scripts, many bug fixes in memory management, interface, and
work in device models.
* Compile scripts: tclspice and ADMS compiling fixes. Architecture compiling fixes for SunOS,
MS Visual Studio, MINGW, Cygwin.
* Memory management: fixed memory leaks, modifies memory management for MS Windos, integration of
espice bugfixes and enhancements, bug fixes in plots and cli interface.
* Rework of BSim models, integration of EPFL-EKV model V2.63, ADMS models mextram, hicum0, hicum2.
----------------
Release 18
----------------
Rework-18 is introduces several new features into ngspice. This is a major
release that comes after more than three years. During the silent years
ngspice developers worked in CVS to stabilize and introduce new features
into the simulator.
- Tclspice simulator library has been merged with ngspice. Now you can
compile ngapice or tclspice by asserting a configure switch. See README.tcl
- New options have been introduced: brief, listing, autostop and scale
- Support for .lib file has been introduced. This allows the use of
third party model libraries in ngspice.
- .measure statements: avg, integ, rms, max, min, delay, param
- .global statements t support for global nodes whose name is not expanded
when flattening the netlist.
- .func macros for inlining functions into netlists.
- Improved the numparam library to support fully parametrized netlists.
- BSIM model binning.
- new multi-input gate VCVS using XSPICE extensions.
