drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in ABRT
Name: |
Mehrere Probleme in ABRT |
|
ID: |
FEDORA-2015-9886 |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 22 |
|
Datum: |
So, 21. Juni 2015, 10:25 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1869
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1870
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3151
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3159
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3315 |
|
Applikationen: |
ABRT |
|
Originalnachricht |
Name : abrt Product : Fedora 22 Version : 2.6.0 Release : 1.fc22 URL : https://github.com/abrt/abrt/wiki/ABRT-Project Summary : Automatic bug detection and reporting tool Description : abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality.
------------------------------------------------------------------------------- - Update Information:
Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159
abrt:
- Move the default dump location from /var/tmp/abrt to /var/spool/abrt
- Use root for owner of all dump directories
- Stop reading hs_error.log from /tmp
- Don not save the system logs by default
- Don not save dmesg if kernel.dmesg_restrict=1
libreport:
- Harden the code against directory traversal, symbolic and hard link attacks
- Fix a bug causing that the first value of AlwaysExcludedElements was ignored
- Fix missing icon for the "Stop" button icon name
- Improve development documentation
- Translations updates
gnome-abrt:
- Enabled the Details also for the System problems
- Do not crash in the testing of availabitlity of XServer
- Fix 'Open problem's data directory'
- Quit Application on Ctrl+Q
- Translation updates
satyr:
- New kernel taint flags
- More secure core stacktraces from core hook ------------------------------------------------------------------------------- - ChangeLog:
* Tue Jun 9 2015 Jakub Filak <jfilak@redhat.com> 2.6.0-1 - move the default dump location to /var/spool/abrt from /var/tmp/abrt - hooks: use root for owner of all dump directories - ccpp: do not unlink failed and big user cores - ccpp: don't save the system logs by default - ccpp: stop reading hs_error.log from /tmp - ccpp: emulate selinux for creation of compat cores - koops: don't save dmesg if kernel.dmesg_restrict=1 - dbus: validate passed arguments - turn off exploring crashed process's root directories - abrt-python: bug fixes and improvements - fixes for CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870 - fixes for CVE-2015-3147, CVE-2015-3151, CVE-2015-3150, CVE-2015-3159 - spec: add abrt-dbus to Rs of abrt-python and abrt-cli - spec: restart abrt-dbus in posttrans * Wed May 20 2015 Matej Habrnal <mhabrnal@redhat.com> 2.5.1-3 - applet: fix problem info double free - upload: validate and sanitize uploaded dump directories - applet: switch to D-Bus methods - lib: add new kernel taint flags - abrt-auto-reporting: require rhtsupport.conf file only on RHEL - doc, polkit: Spelling/grammar fixes - applet: migrate Autoreporting options to GSettings - config UI: read glade from a local file first - config UI: Automatic reporting from GSettings - Resolves: #1211644 ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1216975 [ 2 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214609 [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214452 [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212871 [ 5 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212865 [ 6 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212821 [ 7 ] Bug #1218239 - CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1218239 [ 8 ] Bug #1128400 - ABRT does not honor dmesg_restrict https://bugzilla.redhat.com/show_bug.cgi?id=1128400 ------------------------------------------------------------------------------- -
This update can be installed with the "yum" update program. Use su -c 'yum update abrt' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-announce
|
|
|
|