Sigurnosni nedostaci programskih paketa gnome-abrt i abrt

——————————————————————————–
Fedora Update Notification
FEDORA-2015-10193
2015-06-20 13:34:35
——————————————————————————–

Name : abrt
Product : Fedora 21
Version : 2.3.0
Release : 7.fc21
URL : https://github.com/abrt/abrt/wiki/ABRT-Project
Summary : Automatic bug detection and reporting tool
Description :
abrt is a tool to help users to detect defects in applications and
to create a bug report with all information needed by maintainer to fix it.
It uses plugin system to extend its functionality.

——————————————————————————–
Update Information:

Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159

abrt:
=====
* Move the default dump location from /var/tmp/abrt to /var/spool/abrt
* Use root for owner of all dump directories
* Stop reading hs_error.log from /tmp
* Don not save the system logs by default
* Don not save dmesg if kernel.dmesg_restrict=1

libreport:
==========
* Harden the code against directory traversal, symbolic and hard link attacks
* Fix a bug causing that the first value of AlwaysExcludedElements was ignored
* Fix missing icon for the “Stop” button icon name
* Improve development documentation
* Translations updates

gnome-abrt:
===========
* Use DBus to get problem data for detail dialog
* Fix an error introduced with the details on System page
* Enabled the Details also for the System problems
——————————————————————————–
ChangeLog:

* Mon Jun 22 2015 Matej Habrnal <mhabrnal@redhat.com> – 2.3.0-7
– dependency fix
* Thu Jun 18 2015 Matej Habrnal <mhabrnal@redhat.com> – 2.3.0-6
– add option always generate backtrace locally
– Resolves: #986876
* Tue Jun 16 2015 Matej Habrnal <mhabrnal@redhat.com> – 2.3.0-5
– move the default dump location to /var/spool/abrt from /var/tmp/abrt
– hooks: use root for owner of all dump directories
– ccpp: do not unlink failed and big user cores
– ccpp: don’t save the system logs by default
– ccpp: stop reading hs_error.log from /tmp
– ccpp: emulate selinux for creation of compat cores
– koops: don’t save dmesg if kernel.dmesg_restrict=1
– dbus: validate passed arguments
– turn off exploring crashed process’s root directories
– abrt-python: bug fixes and improvements
– fixes for CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870
– fixes for CVE-2015-3147, CVE-2015-3151, CVE-2015-3150, CVE-2015-3159
– spec: add abrt-dbus to Rs of abrt-python and abrt-cli
– spec: restart abrt-dbus in posttrans
– Resolves: #1179752
* Tue Feb 24 2015 Matej Habrnal <mhabrnal@redhat.com> – 2.3.0-4
– make gdb aware of the abrt’s debuginfo dir
– python: load the configuration from correct file
– add missing augeas dependency
– console-notifications: add timeout
– Don’t slurp unbounded amounts of data when invoking journalctl
– Resolves: #1177447
——————————————————————————–
References:

[ 1 ] Bug #1214609 – CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214609
[ 2 ] Bug #1216975 – CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1216975
[ 3 ] Bug #1214452 – CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214452
[ 4 ] Bug #1212871 – CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212871
[ 5 ] Bug #1212821 – CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212821
[ 6 ] Bug #1213485 – Can’t extract files from downloaded debuginfo package
https://bugzilla.redhat.com/show_bug.cgi?id=1213485
[ 7 ] Bug #1169774 – failure to extract debuginfo
https://bugzilla.redhat.com/show_bug.cgi?id=1169774
[ 8 ] Bug #1193656 – abrt-gui renders crash list white-on-white when using dark theme
https://bugzilla.redhat.com/show_bug.cgi?id=1193656
[ 9 ] Bug #986876 – RFE: Disallow core dump upload entirely
https://bugzilla.redhat.com/show_bug.cgi?id=986876
[ 10 ] Bug #1212865 – CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212865
[ 11 ] Bug #1218239 – CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1218239
[ 12 ] Bug #1179752 – undocumented options in abrt-cli
https://bugzilla.redhat.com/show_bug.cgi?id=1179752
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update abrt’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce

Name : gnome-abrt
Product : Fedora 21
Version : 1.0.0
Release : 3.fc21
URL : https://fedorahosted.org/abrt/
Summary : A utility for viewing problems that have occurred with the system
Description :
A GNOME application allows users to browse through detected problems and
provides them with convenient way for managing these problems.

——————————————————————————–
Update Information:

Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159

* Mon Jun 22 2015 Matej Habrnal <mhabrnal@redhat.com> – 1.0.0-3
– dependency fix
* Tue Jun 16 2015 Matej Habrnal <mhabrnal@redhat.com> – 1.0.0-2
– Fix an error introduced with the details on System page
– Enabled the Details also for the System problems
– Use DBus to get problem data for detail dialog
– Resolves: #1193656
——————————————————————————–
References:

This update can be installed with the “yum” update program. Use
su -c ‘yum update gnome-abrt’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

Sigurnosni nedostaci programskih paketa gnome-abrt i abrt

Archives

More in Preporuke

Sigurnosni nedostaci programskog paketa libreport