——————————————————————————–
Fedora Update Notification
FEDORA-2015-9886
2015-06-13 00:14:24
——————————————————————————–

Name : libreport
Product : Fedora 22
Version : 2.6.0
Release : 1.fc22
URL : https://github.com/abrt/abrt/wiki/ABRT-Project
Summary : Generic library for reporting various problems
Description :
Libraries providing API for reporting different problems in applications
to different bug targets like Bugzilla, ftp, trac, etc…

——————————————————————————–
Update Information:

Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159

abrt:
– Move the default dump location from /var/tmp/abrt to /var/spool/abrt
– Use root for owner of all dump directories
– Stop reading hs_error.log from /tmp
– Don not save the system logs by default
– Don not save dmesg if kernel.dmesg_restrict=1

libreport:
– Harden the code against directory traversal, symbolic and hard link attacks
– Fix a bug causing that the first value of AlwaysExcludedElements was ignored
– Fix missing icon for the “Stop” button icon name
– Improve development documentation
– Translations updates

gnome-abrt:
– Enabled the Details also for the System problems
– Do not crash in the testing of availabitlity of XServer
– Fix ‘Open problem’s data directory’
– Quit Application on Ctrl+Q
– Translation updates

satyr:
– New kernel taint flags
– More secure core stacktraces from core hook
——————————————————————————–
ChangeLog:

* Tue Jun 9 2015 Jakub Filak <jfilak@redhat.com> 2.6.0-1
– harden the code against directory traversal, symbolic and hard link attacks
– fix a bug causing that the first value of AlwaysExcludedElements was ignored
– fix missing icon for the “Stop” button icon name
– switch the default dump dir mode to 0640
– fix races in dump directory handling code
– improve development documentation
– translations updates
* Wed May 20 2015 Matej Habrnal <mhabrnal@redhat.com> 2.5.1-2
– reporter-mantisbt: switch from ‘analyzer’ to ‘type’
– report client: provide cpio log when unpacking fails
– report client: check owner of /var/cache/abrt-di when unpacking fails
– reporter-mantisbt: add event for reporting AVCs
– translations updates
– bugzilla: Spell Bugzilla, not BZ in UI
——————————————————————————–
References:

[ 1 ] Bug #1216975 – CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1216975
[ 2 ] Bug #1214609 – CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214609
[ 3 ] Bug #1214452 – CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214452
[ 4 ] Bug #1212871 – CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212871
[ 5 ] Bug #1212865 – CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212865
[ 6 ] Bug #1212821 – CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212821
[ 7 ] Bug #1218239 – CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1218239
[ 8 ] Bug #1128400 – ABRT does not honor dmesg_restrict
https://bugzilla.redhat.com/show_bug.cgi?id=1128400
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update libreport’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce