bubblewrap escape via TIOCSTI ioctl

I noticed the changelog links to the wrong bug in the flatpak and bubblewrap debdiffs.

It links to an older security bug not this one.

Thanks Mathew, I fixed that now.

I've added a second patch to the Flatpak debdiff. Another security-related commit from 0.8.2. I had to refresh the last 3 hunks so the patch would apply cleanly.

https://github.com/flatpak/flatpak/commit/7db0ac595c

@jbicha Thanks for the debdiffs! sbeattie reviewed the flatpak debdiff and I reviewed the bubblewrap debdiff. They've both built in the security-proposed PPA.

As for the bubblewrap changes, I'm going to sponsor them but I do want to say that I worry that we're getting in the habit of doing version bumps for bubblewrap. That's definitely not preferred but all of the changes between 1.5 and 1.7 seem somewhat tangled up with the actual security fix so I'm going to make an exception.

Thanks again for the high quality debdiffs. We really appreciate it!

This bug was fixed in the package flatpak - 0.6.11-1ubuntu0.16.10.0

---------------
flatpak (0.6.11-1ubuntu0.16.10.0) yakkety-security; urgency=medium

  * SECURITY UPDATE: bubblewrap escape via TIOCSTI ioctl (LP: #1657357)
    - Fixed in d/p/Use-seccomp-to-filter-out-TIOCSTI-ioctl.patch:
      Add patch from upstream 0.8.1 to prevent contained apps from using
      TIOCSTI ioctl. This would let the app inject commands into the
      terminal from which it was invoked. Prevent the attack here
      by using seccomp to filter out TIOCSTI ioctl.
    - CVE-2017-5226
  * SECURITY UPDATE: Prevent writing to per-user installed fonts and
    Flatpak extensions (typically locales)
    - Fixed in d/p/Make-sure-all-mounted-sources-are-read-only.patch:
      Add patch from upstream 0.8.2

 -- Jeremy Bicha <email address hidden> Sat, 28 Jan 2017 06:00:41 -0500

This bug was fixed in the package bubblewrap - 0.1.7-0ubuntu0.16.10.1

---------------
bubblewrap (0.1.7-0ubuntu0.16.10.1) yakkety-security; urgency=medium

  * SECURITY UPDATE: bubblewrap escape via TIOCSTI ioctl (LP: #1657357)
    - Fixed in new upstream release 0.1.7 by adding --new-session
      option that use setsid() before executing sandboxed code.
      Users of bubblewrap to confine untrusted programs should either
      add --new-session to the bwrap command line, or prevent the
      TIOCSTI ioctl with a seccomp filter instead (as Flatpak does).
    - New upstream release also adds --unshare-all option to easily
      sandbox all namespaces. A --share-net option can be used with
      --unshare-all to retain the network namespace.
    - CVE-2017-5226
  * debian/bubblewrap.examples: install upstream examples

 -- Jeremy Bicha <email address hidden> Thu, 19 Jan 2017 21:31:11 -0500