Name        : abrt
Product     : Fedora 22
Version     : 2.6.0
Release     : 1.fc22
URL         : https://github.com/abrt/abrt/wiki/ABRT-Project
Summary     : Automatic bug detection and reporting tool
Description :
abrt is a tool to help users to detect defects in applications and
to create a bug report with all information needed by maintainer to fix it.
It uses plugin system to extend its functionality.

-------------------------------------------------------------------------------
-
Update Information:

Security fixes for:

* CVE-2015-3315

* CVE-2015-3142

* CVE-2015-1869

* CVE-2015-1870

* CVE-2015-3151

* CVE-2015-3150

* CVE-2015-3159



abrt:

- Move the default dump location from /var/tmp/abrt to /var/spool/abrt 

- Use root for owner of all dump directories

- Stop reading hs_error.log from /tmp

- Don not save the system logs by default

- Don not save dmesg if kernel.dmesg_restrict=1



libreport:

- Harden the code against directory traversal, symbolic and hard link attacks

- Fix a bug causing that the first value of AlwaysExcludedElements was ignored

- Fix missing icon for the "Stop" button icon name

- Improve development documentation

- Translations updates



gnome-abrt:

- Enabled the Details also for the System problems

- Do not crash in the testing of availabitlity of XServer

- Fix 'Open problem's data directory'

- Quit Application on Ctrl+Q

- Translation updates



satyr:

- New kernel taint flags

- More secure core stacktraces from core hook
-------------------------------------------------------------------------------
-
ChangeLog:

* Tue Jun  9 2015 Jakub Filak <jfilak@redhat.com> 2.6.0-1
- move the default dump location to /var/spool/abrt from /var/tmp/abrt
- hooks: use root for owner of all dump directories
- ccpp: do not unlink failed and big user cores
- ccpp: don't save the system logs by default
- ccpp: stop reading hs_error.log from /tmp
- ccpp: emulate selinux for creation of compat cores
- koops: don't save dmesg if kernel.dmesg_restrict=1
- dbus: validate passed arguments
- turn off exploring crashed process's root directories
- abrt-python: bug fixes and improvements
- fixes for CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870
- fixes for CVE-2015-3147, CVE-2015-3151, CVE-2015-3150, CVE-2015-3159
- spec: add abrt-dbus to Rs of abrt-python and abrt-cli
- spec: restart abrt-dbus in posttrans
* Wed May 20 2015 Matej Habrnal <mhabrnal@redhat.com> 2.5.1-3
- applet: fix problem info double free
- upload: validate and sanitize uploaded dump directories
- applet: switch to D-Bus methods
- lib: add new kernel taint flags
- abrt-auto-reporting: require rhtsupport.conf file only on RHEL
- doc, polkit: Spelling/grammar fixes
- applet: migrate Autoreporting options to GSettings
- config UI: read glade from a local file first
- config UI: Automatic reporting from GSettings
- Resolves: #1211644
-------------------------------------------------------------------------------
-
References:

  [ 1 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment
 sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1216975
  [ 2 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against
 crafted problem directory path arguments [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1214609
  [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several
 D-Bus methods implemented by abrt-dbus [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1214452
  [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to
 information disclosure [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212871
  [ 5 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow
 symbolic links [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212865
  [ 6 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to
 existing files owned by others [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212821
  [ 7 ] Bug #1218239 - CVE-2015-3315 abrt: Various race-conditions and symlink
 issues found in abrt [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1218239
  [ 8 ] Bug #1128400 - ABRT does not honor dmesg_restrict
        https://bugzilla.redhat.com/show_bug.cgi?id=1128400
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program.  Use
su -c 'yum update abrt' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce