Updates for krb5-1.12.5

diff --git a/README b/README
index 007f48e9e3f2fed61dce56148681ee6f7576a146..1a8221924c46da243eec9319e20b6e857048d99c 100644 (file)
--- a/README
+++ b/README
@@ -74,6 +74,52 @@ variable that enables "weak" enctypes, which defaults to "false"
 beginning with krb5-1.8.
 
 
+Major changes in 1.12.5 (2015-12-16)
+------------------------------------
+
+This is a bugfix release.  The krb5-1.12 release series has reached
+the end of its maintenance period, and krb5-1.12.5 is the last planned
+release in the krb5-1.12 series.  For new deployments, installers
+should prefer the krb5-1.14 release series or later.
+
+* Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
+  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
+  [CVE-2015-2698]
+
+* Fix build_principal memory bug that could cause a KDC
+  crash. [CVE-2015-2697]
+
+* Allow an iprop slave to receive full resyncs from KDCs running
+  krb5-1.10 or earlier.
+
+krb5-1.12.5 changes by ticket ID
+--------------------------------
+
+8302    Document multi-component profile paths
+8303    Tolerate null oid pointer in gss_release_oid()
+8304    Fix leak in gss_acquire_cred_with_password
+8305    Fix uncommon null dereference in PKINIT client
+8306    Fix uncommon leak in krb5_init_creds_step()
+8307    Do not allow stream socket retries in libkrad
+8308    Fix gss_inquire_name() name_is_MN result
+8310    Check for null name_type in gss_display_name_ext
+8311    Fix error handling in gss_export_sec_context()
+8312    Fix KDC client referrals
+8313    SPNEGO and IAKERB context aliasing bugs [CVE-2015-2695][CVE-2015-2696]
+8314    Fix mechglue gss_acquire_cred_impersonate_name
+8315    Fix build_principal memory bug [CVE-2015-2697]
+8316    Fix IAKERB context export/import [CVE-2015-2698]
+8317    Fix compatibility with pre-1.11 iprop dump files
+8318    Remove ksu -D flag documentation
+8319    Untabify kerberos.schema and kerberos.ldif
+8320    Fix error mappings for IOV MIC mechglue funcs
+8321    Fix minor utf8-to-ucs2s read overrun bug
+8322    Define error status GSS_S_BAD_MIC
+8323    Fix typo in GSS_S_UNAUTHORIZED error message
+8324    Fix gss_inquire_names_for_mech() on MS krb5 mech
+8325    Check output params on GSS OID set functions
+
+
 Major changes in 1.12.4 (2015-05-29)
 ------------------------------------
 
@@ -553,12 +599,14 @@ reports, suggestions, and valuable resources:
     David Bantz
     Alex Baule
     David Benjamin
+    Thomas Bernard
     Adam Bernstein
     Arlene Berry
     Jeff Blaine
     Radoslav Bodo
     Sumit Bose
     Emmanuel Bouillon
+    Philip Brown
     Michael Calmer
     Andrea Campi
     Julien Chaffraix
@@ -571,6 +619,7 @@ reports, suggestions, and valuable resources:
     Kevin Coffman
     Simon Cooper
     Sylvain Cortes
+    Ian Crowther
     Arran Cudbard-Bell
     Jeff D'Angelo
     Nalin Dahyabhai
@@ -592,6 +641,8 @@ reports, suggestions, and valuable resources:
     Ronni Feldt
     Bill Fellows
     JC Ferguson
+    Remi Ferrand
+    Paul Fertser
     William Fiveash
     Ákos Frohner
     Sebastian Galiano
@@ -660,6 +711,7 @@ reports, suggestions, and valuable resources:
     Mark Phalan
     Brett Randall
     Jonathan Reams
+    Jonathan Reed
     Robert Relyea
     Martin Rex
     Jason Rogers
@@ -694,6 +746,7 @@ reports, suggestions, and valuable resources:
     Ross Wilper
     Augustin Wolf
     David Woodhouse
+    Tsu-Phong Wu
     Xu Qiang
     Neng Xue
     Nickolai Zeldovich

diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 73f392f10a2698fc01cb741239ac3ae8e83aa410..99a3e9944c7273ed915c624b2afafb9125e4879f 100644 (file)
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5IDENTITY" "5" " " "1.12.4" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 k5identity \- Kerberos V5 client principal selection rules
 .

diff --git a/src/man/k5login.man b/src/man/k5login.man
index 92cc2749c7701c13af428e94f4cc6227c959d7b0..95aeacd15d1ffc4a2058a83cce7c2345a2160221 100644 (file)
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5LOGIN" "5" " " "1.12.4" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 k5login \- Kerberos V5 acl file for host access
 .

diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index a8ee9f8d2c3a5506b62f28849833eac753ff54d0..c248b7a7a62476dd95ebdcdfd95802ff3f53d1fd 100644 (file)
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5SRVUTIL" "1" " " "1.12.4" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 k5srvutil \- host key table (keytab) manipulation utility
 .

diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index 89cc5f41599b877f3633f22f9f53bac088f1e04d..956de20bd6fb88c22fb04daa889a454537ab7463 100644 (file)
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADM5.ACL" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kadm5.acl \- Kerberos ACL file
 .

diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index 178679af203727df14e6f5af605159265b7b1981..b3cc3e61d92733e03ca95140488a44de9b190fac 100644 (file)
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIN" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kadmin \- Kerberos V5 database administration program
 .

diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index ddf33752d2935d3ba79ea14fb7319a9e5087faf3..fab7e3c007b7b06e818cbbfb2405171f60f409d8 100644 (file)
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIND" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kadmind \- KADM5 administration server
 .

diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 40a1172ee754ea8ed4c4d6ce3148744b378b69a6..49890066c159605ac5a3a797e932f9a0aab31e1c 100644 (file)
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_LDAP_UTIL" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kdb5_ldap_util \- Kerberos configuration utility
 .

diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index e258b7a15943e9213173544e1c1436f23b970971..a403455ac633450696a438ab456e6a9829d62903 100644 (file)
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_UTIL" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kdb5_util \- Kerberos database maintenance utility
 .

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 65054e0594744add1d158c6e1f603a387e6bbc88..bb58669daba614cb14cbab1df92aad35b4e94a1c 100644 (file)
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDC.CONF" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .

diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index 9a3f7c6c4bf61df0e4ec30d7fe66d85dff062746..d8b237a75f4a2a5dea6a67803ac5608829426885 100644 (file)
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDESTROY" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kdestroy \- destroy Kerberos tickets
 .

diff --git a/src/man/kinit.man b/src/man/kinit.man
index c3cfbb40190cd38fd7f7f85bd72870adfa937c96..974deaf9d3d3a45bf596fd53332a822ce091cb1c 100644 (file)
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KINIT" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kinit \- obtain and cache Kerberos ticket-granting ticket
 .

diff --git a/src/man/klist.man b/src/man/klist.man
index d5975196ad0c4351f59f55a0050fcc71a21f3abc..8c1379e1bff645b885e0c78ea57bc92012029fc1 100644 (file)
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KLIST" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 klist \- list cached Kerberos tickets
 .

diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index d3fb09915e50b94bf3ff608777406bf1676d910b..8fc6d56b3bb7352ae7e02ca56fd1f1f5f53db254 100644 (file)
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPASSWD" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .

diff --git a/src/man/kprop.man b/src/man/kprop.man
index efab59f1078793473256dac5fc8294cb8e907118..ec81359b29207fe63677e544125a5f705cf072fa 100644 (file)
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROP" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kprop \- propagate a Kerberos V5 principal database to a slave server
 .

diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index 89182f5a638f03cb70829fb1fd2e71050833d199..1175e7eabc6b3a8d3d45f875b812177fc78c1c6f 100644 (file)
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPD" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kpropd \- Kerberos V5 slave KDC update server
 .

diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 40ccabc526a6f127a6023dddda7b175adf34e344..15b23bac6ae2a5d164d14482442279aa0eec9c2e 100644 (file)
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPLOG" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kproplog \- display the contents of the Kerberos principal update log
 .

diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index d953296f286ef6cc034f2e99bc243ac89a6e5e2f..d330e7f7b9cd828050ca10b25b247a68d46ebaa6 100644 (file)
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5-CONFIG" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 krb5-config \- tool for linking against MIT Kerberos libraries
 .

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index b06d2f910e0e9c29a19de8d5cac239082d12286a..3b6d6e5a9cf1025f1f2b3e0852f4b6c1bbee7a6c 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5.CONF" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .

diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 79677e00523499b9466168efbe9a713847437243..96c0a3255e7522b1bbd9bbd3c4fd3fddb63dcb97 100644 (file)
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5KDC" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 krb5kdc \- Kerberos V5 KDC
 .

diff --git a/src/man/ksu.man b/src/man/ksu.man
index 42a88bb7b70879a7e12c047a1b0a4b994fd2f227..2ad96013bd57b6753c1d06a53f093c5cb9deb761 100644 (file)
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSU" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KSU" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 ksu \- Kerberized super-user
 .

diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 50afb40d04fe9dfa6b93d35b6e027e7ed8db9be0..d6746e2e8a6d0d2dcf62fb787dec9c430dba036b 100644 (file)
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSWITCH" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kswitch \- switch primary ticket cache
 .

diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index cc6c0464de9384eb5d43452c7665f2c58ce1391a..fbb16f21a289ddd98e2a27fbcd849fe18a4ca8cc 100644 (file)
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KTUTIL" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 ktutil \- Kerberos keytab file maintenance utility
 .

diff --git a/src/man/kvno.man b/src/man/kvno.man
index f9282febdf818403b3471a4729e23eeb9f183399..ce9b9185b11b5041d7a52453808bd5b50922c423 100644 (file)
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KVNO" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 kvno \- print key version numbers of Kerberos principals
 .

diff --git a/src/man/sclient.man b/src/man/sclient.man
index 4f06722f28acd50e9216938128d80121ce0ca3da..687c71fe87072d81ddf18748ddfc638ab8a15ea6 100644 (file)
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SCLIENT" "1" " " "1.12.4" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 sclient \- sample Kerberos version 5 client
 .

diff --git a/src/man/sserver.man b/src/man/sserver.man
index d64205446fc9bf26df79855d96db678c7a3249ea..ee46ced2d586f252c0d5da2ba379a3ae9c59c79c 100644 (file)
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SSERVER" "8" " " "1.12.4" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.12.5" "MIT Kerberos"
 .SH NAME
 sserver \- sample Kerberos version 5 server
 .

diff --git a/src/patchlevel.h b/src/patchlevel.h
index 1e6c4ddac76c7b0df40c5c247bca41e6e5a5c03b..252c56d60d4fda4ced3e6a5e3c28b932e718d07a 100644 (file)
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
  */
 #define KRB5_MAJOR_RELEASE 1
 #define KRB5_MINOR_RELEASE 12
-#define KRB5_PATCHLEVEL 4
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 5
+/* #undef KRB5_RELTAIL */
 /* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.12"
+#define KRB5_RELTAG "krb5-1.12.5-final"

diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index 5be612256e6844c1c95a1b39589926612705b79c..61e73513935847786a981db66363b4ba123ed4e5 100644 (file)
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: mit-krb5 1.12.4-postrelease\n"
+"Project-Id-Version: mit-krb5 1.12.5\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2015-12-14 15:34-0500\n"
+"POT-Creation-Date: 2015-12-14 16:59-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"