On Wed, 02 Jul 2014 10:36:55 +0200 Moritz Muehlenhoff <j...@inutil.org> wrote: > Package: libspring-java > Severity: grave > Tags: security > Justification: user security hole > > Hi, > please see http://www.gopivotal.com/security/cve-2014-0225
Hello, I have uploaded a a patched version (thanks Stephen!) to unstable and prepared an upload 3.0.6.RELEASE-6+deb7u4 for wheezy-security, for which the debdiff for the .dsc and .changes is attached. (It is essentially identical to the debdiff for unstable.) I also placed the source and binary packages for the wheezy update here: https://people.debian.org/~tmancill/libspring-java_wheezy/ for Security Team review. Thank you, tony
============================================================================================
debdiff of .dsc
============================================================================================
diff -Nru libspring-java-3.0.6.RELEASE/debian/changelog
libspring-java-3.0.6.RELEASE/debian/changelog
--- libspring-java-3.0.6.RELEASE/debian/changelog 2014-03-24
14:20:48.000000000 -0700
+++ libspring-java-3.0.6.RELEASE/debian/changelog 2014-09-05
22:52:45.000000000 -0700
@@ -1,3 +1,11 @@
+libspring-java (3.0.6.RELEASE-6+deb7u4) wheezy-security; urgency=high
+
+ * Team upload.
+ * Add patch for CVE-2014-0225. (Closes: #753470)
+ - Thanks to Stephen Nelson.
+
+ -- tony mancill <tmanc...@debian.org> Fri, 05 Sep 2014 22:47:07 -0700
+
libspring-java (3.0.6.RELEASE-6+deb7u3) wheezy-security; urgency=high
* Team upload.
diff -Nru libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch
libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch
--- libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch
1969-12-31 16:00:00.000000000 -0800
+++ libspring-java-3.0.6.RELEASE/debian/patches/CVE-2014-0225.patch
2014-09-05 22:47:22.000000000 -0700
@@ -0,0 +1,305 @@
+---
a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
++++
b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java
+@@ -21,6 +21,7 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.io.StringReader;
+ import java.io.UnsupportedEncodingException;
+ import java.lang.reflect.GenericArrayType;
+ import java.lang.reflect.ParameterizedType;
+@@ -69,6 +70,7 @@
+
+ import org.apache.commons.logging.Log;
+ import org.apache.commons.logging.LogFactory;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -668,8 +670,11 @@
+ if (xmlReader == null) {
+ xmlReader = XMLReaderFactory.createXMLReader();
+ }
+-
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities";,
+- this.processExternalEntities);
++ String name =
"http://xml.org/sax/features/external-general-entities";;
++ xmlReader.setFeature(name,
isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++
xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+
+ return new SAXSource(xmlReader, inputSource);
+ }
+@@ -865,4 +870,11 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new
EntityResolver() {
++ public InputSource resolveEntity(String publicId, String
systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+---
a/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/support/AbstractMarshaller.java
++++
b/projects/org.springframework.oxm/src/main/java/org/springframework/oxm/support/AbstractMarshaller.java
+@@ -20,6 +20,7 @@
+ import java.io.InputStream;
+ import java.io.OutputStream;
+ import java.io.Reader;
++import java.io.StringReader;
+ import java.io.Writer;
+ import javax.xml.parsers.DocumentBuilder;
+ import javax.xml.parsers.DocumentBuilderFactory;
+@@ -42,6 +43,7 @@
+ import org.apache.commons.logging.LogFactory;
+ import org.w3c.dom.Node;
+ import org.xml.sax.ContentHandler;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -203,6 +205,9 @@
+ protected XMLReader createXmlReader() throws SAXException {
+ XMLReader xmlReader = XMLReaderFactory.createXMLReader();
+
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities";,
isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++ xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ return xmlReader;
+ }
+
+@@ -563,4 +568,11 @@
+ protected abstract Object unmarshalSaxReader(XMLReader xmlReader,
InputSource inputSource)
+ throws XmlMappingException, IOException;
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new
EntityResolver() {
++ public InputSource resolveEntity(String publicId, String
systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+---
a/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java
++++
b/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java
+@@ -17,6 +17,7 @@
+ package org.springframework.http.converter.xml;
+
+ import java.io.IOException;
++import java.io.StringReader;
+ import javax.xml.bind.JAXBElement;
+ import javax.xml.bind.JAXBException;
+ import javax.xml.bind.MarshalException;
+@@ -28,6 +29,8 @@
+ import javax.xml.bind.annotation.XmlType;
+ import javax.xml.transform.Result;
+ import javax.xml.transform.Source;
++import javax.xml.transform.sax.SAXSource;
++import javax.xml.transform.stream.StreamSource;
+
+ import org.springframework.core.annotation.AnnotationUtils;
+ import org.springframework.http.HttpHeaders;
+@@ -36,6 +39,11 @@
+ import org.springframework.http.converter.HttpMessageNotReadableException;
+ import org.springframework.http.converter.HttpMessageNotWritableException;
+ import org.springframework.util.ClassUtils;
++import org.xml.sax.EntityResolver;
++import org.xml.sax.InputSource;
++import org.xml.sax.SAXException;
++import org.xml.sax.XMLReader;
++import org.xml.sax.helpers.XMLReaderFactory;
+
+ /**
+ * Implementation of {@link
org.springframework.http.converter.HttpMessageConverter HttpMessageConverter}
that can read
+@@ -49,6 +57,21 @@
+ */
+ public class Jaxb2RootElementHttpMessageConverter extends
AbstractJaxb2HttpMessageConverter<Object> {
+
++ private boolean processExternalEntities = false;
++
++
++ /**
++ * Indicates whether external XML entities are processed when
converting to a Source.
++ * <p>Default is {@code false}, meaning that external entities are not
resolved.
++ */
++ public void setProcessExternalEntities(boolean processExternalEntities)
{
++ this.processExternalEntities = processExternalEntities;
++ }
++
++ public boolean isProcessExternalEntities() {
++ return this.processExternalEntities;
++ }
++
+ @Override
+ public boolean canRead(Class<?> clazz, MediaType mediaType) {
+ return (clazz.isAnnotationPresent(XmlRootElement.class) ||
clazz.isAnnotationPresent(XmlType.class)) &&
+@@ -69,6 +92,7 @@
+ @Override
+ protected Object readFromSource(Class<?> clazz, HttpHeaders headers,
Source source) throws IOException {
+ try {
++ source = processSource(source);
+ Unmarshaller unmarshaller = createUnmarshaller(clazz);
+ if (clazz.isAnnotationPresent(XmlRootElement.class)) {
+ return unmarshaller.unmarshal(source);
+@@ -87,6 +111,29 @@
+ }
+ }
+
++ protected Source processSource(Source source) {
++ if (source instanceof StreamSource) {
++ StreamSource streamSource = (StreamSource) source;
++ InputSource inputSource = new
InputSource(streamSource.getInputStream());
++ try {
++ XMLReader xmlReader =
XMLReaderFactory.createXMLReader();
++ String featureName =
"http://xml.org/sax/features/external-general-entities";;
++ xmlReader.setFeature(featureName,
isProcessExternalEntities());
++ if (!isProcessExternalEntities()) {
++
xmlReader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
++ return new SAXSource(xmlReader, inputSource);
++ }
++ catch (SAXException ex) {
++ logger.warn("Processing of external entities
could not be disabled", ex);
++ return source;
++ }
++ }
++ else {
++ return source;
++ }
++ }
++
+ @Override
+ protected void writeToResult(Object o, HttpHeaders headers, Result
result) throws IOException {
+ try {
+@@ -109,4 +156,11 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new
EntityResolver() {
++ public InputSource resolveEntity(String publicId, String
systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
+ }
+---
a/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java
++++
b/projects/org.springframework.web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java
+@@ -21,9 +21,11 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.io.StringReader;
+ import javax.xml.parsers.DocumentBuilder;
+ import javax.xml.parsers.DocumentBuilderFactory;
+ import javax.xml.parsers.ParserConfigurationException;
++import javax.xml.stream.XMLResolver;
+ import javax.xml.stream.XMLInputFactory;
+ import javax.xml.stream.XMLStreamException;
+ import javax.xml.stream.XMLStreamReader;
+@@ -38,6 +40,7 @@
+ import javax.xml.transform.stream.StreamSource;
+
+ import org.w3c.dom.Document;
++import org.xml.sax.EntityResolver;
+ import org.xml.sax.InputSource;
+ import org.xml.sax.SAXException;
+ import org.xml.sax.XMLReader;
+@@ -125,8 +128,11 @@
+ try {
+ DocumentBuilderFactory documentBuilderFactory =
DocumentBuilderFactory.newInstance();
+ documentBuilderFactory.setNamespaceAware(true);
+-
documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities";,
processExternalEntities);
++
documentBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities";,
isProcessExternalEntities());
+ DocumentBuilder documentBuilder =
documentBuilderFactory.newDocumentBuilder();
++ if (!isProcessExternalEntities()) {
++ documentBuilder.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ Document document = documentBuilder.parse(body);
+ return new DOMSource(document);
+ }
+@@ -141,8 +147,11 @@
+ private SAXSource readSAXSource(InputStream body) throws IOException {
+ try {
+ XMLReader reader = XMLReaderFactory.createXMLReader();
+-
reader.setFeature("http://xml.org/sax/features/external-general-entities";,
processExternalEntities);
++
reader.setFeature("http://xml.org/sax/features/external-general-entities";,
isProcessExternalEntities());
+ byte[] bytes = StreamUtils.copyToByteArray(body);
++ if (!isProcessExternalEntities()) {
++ reader.setEntityResolver(NO_OP_ENTITY_RESOLVER);
++ }
+ return new SAXSource(reader, new InputSource(new
ByteArrayInputStream(bytes)));
+ }
+ catch (SAXException ex) {
+@@ -219,4 +228,17 @@
+ }
+ }
+
++
++ private static final EntityResolver NO_OP_ENTITY_RESOLVER = new
EntityResolver() {
++ public InputSource resolveEntity(String publicId, String
systemId) {
++ return new InputSource(new StringReader(""));
++ }
++ };
++
++ private static final XMLResolver NO_OP_XML_RESOLVER = new XMLResolver()
{
++ public Object resolveEntity(String publicID, String systemID,
String base, String ns) {
++ return new ByteArrayInputStream(new byte[0]);
++ }
++ };
++
+ }
+---
a/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTest.java
++++
b/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverterTest.java
+@@ -98,6 +98,33 @@
+ assertEquals("Invalid result", "Hello World", result.s);
+ }
+
++ @Test
++ public void readXmlRootElementExternalEntityDisabled() throws Exception
{
++ Resource external = new ClassPathResource("external.txt",
getClass());
++ String content = "<!DOCTYPE root SYSTEM
\"http://192.168.28.42/1.jsp\"; [" +
++ " <!ELEMENT external ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" + external.getURI()
+ "\" >]>" +
++ "
<rootElement><external>&ext;</external></rootElement>";
++ MockHttpInputMessage inputMessage = new
MockHttpInputMessage(content.getBytes("UTF-8"));
++ RootElement rootElement = (RootElement)
converter.read(RootElement.class, inputMessage);
++
++ assertEquals("", rootElement.external);
++ }
++
++ @Test
++ public void readXmlRootElementExternalEntityEnabled() throws Exception {
++ Resource external = new ClassPathResource("external.txt",
getClass());
++ String content = "<!DOCTYPE root [" +
++ " <!ELEMENT external ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" + external.getURI()
+ "\" >]>" +
++ "
<rootElement><external>&ext;</external></rootElement>";
++ MockHttpInputMessage inputMessage = new
MockHttpInputMessage(content.getBytes("UTF-8"));
++ this.converter.setProcessExternalEntities(true);
++ RootElement rootElement = (RootElement)
converter.read(RootElement.class, inputMessage);
++
++ assertEquals("Foo Bar", rootElement.external);
++ }
++
+ @Test
+ public void writeXmlRootElement() throws Exception {
+ MockHttpOutputMessage outputMessage = new
MockHttpOutputMessage();
+---
a/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/SourceHttpMessageConverterTests.java
++++
b/projects/org.springframework.web/src/test/java/org/springframework/http/converter/xml/SourceHttpMessageConverterTests.java
+@@ -67,9 +67,10 @@
+ converter = new SourceHttpMessageConverter<Source>();
+ Resource external = new ClassPathResource("external.txt",
getClass());
+
+- bodyExternal = "<!DOCTYPE root [" +
+- " <!ELEMENT root ANY >\n" +
+- " <!ENTITY ext SYSTEM \"" + external.getURI()
+ "\" >]><root>&ext;</root>";
++ bodyExternal = "<!DOCTYPE root SYSTEM
\"http://192.168.28.42/1.jsp\"; [" +
++ " <!ELEMENT root ANY >\n" +
++ " <!ENTITY ext SYSTEM \"" +
external.getURI() + "\" >]><root>&ext;</root>";
++
+ }
+
+ @Test
diff -Nru libspring-java-3.0.6.RELEASE/debian/patches/series
libspring-java-3.0.6.RELEASE/debian/patches/series
--- libspring-java-3.0.6.RELEASE/debian/patches/series 2014-03-24
14:11:40.000000000 -0700
+++ libspring-java-3.0.6.RELEASE/debian/patches/series 2014-09-05
22:47:22.000000000 -0700
@@ -12,3 +12,4 @@
CVE-2013-6430.patch
CVE-2014-0054.patch
CVE-2014-1904.patch
+CVE-2014-0225.patch
============================================================================================
debdiff of .changes
============================================================================================
File lists identical (after any substitutions)
Control files of package libspring-aop-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libaopalliance-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-beans-java: lines which differ (wdiff format)
--------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libservlet2.5-java, libatinject-jsr330-api-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-context-java: lines which differ (wdiff
format)
----------------------------------------------------------------------------------
Depends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java
(= [-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+}
libspring-expression-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-instrument-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libbackport-util-concurrent-java, libtomcat6-java,
libgeronimo-ejb-3.0-spec-java, libatinject-jsr330-api-java, glassfish-javaee,
libjodatime-java, libasm3-java, libaopalliance-java, libcglib-java,
libgeronimo-validation-1.0-spec-java, libgeronimo-jms-1.1-spec-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-context-support-java: lines which differ
(wdiff format)
------------------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java
(= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-jdbc-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (=
[-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-core-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Installed-Size: [-474-] {+475+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-expression-java: lines which differ (wdiff
format)
-------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-instrument-java: lines which differ (wdiff
format)
-------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+}
libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-jdbc-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libc3p0-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-jms-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-transaction-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} glassfish-javaee
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-orm-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-jdbc-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-web-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libjdo-api-java (>= 2.2),
glassfish-toplink-essentials, libibatis-java, libhibernate3-java (>= 3.5),
libdom4j-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-oxm-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-beans-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+}
libspring-context-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Installed-Size: [-142-] {+144+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-test-java: lines which differ (wdiff format)
-------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-transaction-java: lines which differ (wdiff
format)
--------------------------------------------------------------------------------------
Depends: libspring-core-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Recommends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} glassfish-javaee
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-java: lines which differ (wdiff format)
------------------------------------------------------------------------------
Depends: libspring-beans-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-context-java (=
[-3.0.6.RELEASE-6+deb7u3),-] {+3.0.6.RELEASE-6+deb7u4),+} libspring-core-java
(= [-3.0.6.RELEASE-6+deb7u3)-] {+3.0.6.RELEASE-6+deb7u4)+}
Installed-Size: [-477-] {+480+}
Recommends: libspring-aop-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libspring-oxm-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-portlet-java: lines which differ (wdiff
format)
--------------------------------------------------------------------------------------
Depends: libspring-web-servlet-java (= [-3.0.6.RELEASE-6+deb7u3)-]
{+3.0.6.RELEASE-6+deb7u4)+}
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-servlet-java: lines which differ (wdiff
format)
--------------------------------------------------------------------------------------
Depends: libspring-web-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libservlet2.5-java
Recommends: libspring-context-support-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libvelocity-tools-java, libjasperreports-java,
libtiles-java, libitext-java, libjexcelapi-java, libapache-poi-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
Control files of package libspring-web-struts-java: lines which differ (wdiff
format)
-------------------------------------------------------------------------------------
Depends: libspring-web-servlet-java (= [-3.0.6.RELEASE-6+deb7u3),-]
{+3.0.6.RELEASE-6+deb7u4),+} libstruts1.2-java
Version: [-3.0.6.RELEASE-6+deb7u3-] {+3.0.6.RELEASE-6+deb7u4+}
signature.asc
Description: OpenPGP digital signature
