3:20 p.m.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-10193
2015-06-20 13:34:35
--------------------------------------------------------------------------------
Name : libreport
Product : Fedora 21
Version : 2.3.0
Release : 8.fc21
URL : https://github.com/abrt/abrt/wiki/ABRT-Project
Summary : Generic library for reporting various problems
Description :
Libraries providing API for reporting different problems in applications
to different bug targets like Bugzilla, ftp, trac, etc...
--------------------------------------------------------------------------------
Update Information:
Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159
abrt:
=====
* Move the default dump location from /var/tmp/abrt to /var/spool/abrt
* Use root for owner of all dump directories
* Stop reading hs_error.log from /tmp
* Don not save the system logs by default
* Don not save dmesg if kernel.dmesg_restrict=1
libreport:
==========
* Harden the code against directory traversal, symbolic and hard link attacks
* Fix a bug causing that the first value of AlwaysExcludedElements was ignored
* Fix missing icon for the "Stop" button icon name
* Improve development documentation
* Translations updates
gnome-abrt:
===========
* Use DBus to get problem data for detail dialog
* Fix an error introduced with the details on System page
* Enabled the Details also for the System problems
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jun 18 2015 Matej Habrnal <mhabrnal(a)redhat.com> 2.3.0-8
- introduce a new function ask_yes_no_save_result
* Tue Jun 16 2015 Matej Habrnal <mhabrnal(a)redhat.com> 2.3.0-7
- harden the code against directory traversal, symbolic and hard link attacks
- fix a bug causing that the first value of AlwaysExcludedElements was ignored
- fix missing icon for the "Stop" button icon name
- switch the default dump dir mode to 0640
- fix races in dump directory handling code
- improve development documentation
- translations updates
- Resolves #1213485, #1169774
* Tue Feb 24 2015 Matej Habrnal <mhabrnal(a)redhat.com> 2.3.0-6
- ignore (a|A)ccesib(ility|le) words
- try to reduce false positive sensitive words
- ureport: correct variable initializations
- allow (semi)recursive locking
- ignored words: add a few 'key' and 'access' words
- Resolves: #1175720, #1180135
* Fri Nov 28 2014 Jakub Filak <jfilak(a)redhat.com> 2.3.0-5
- anaconda: filter out rootpw lines
- highglit OpenStack related strings
- ureport: do not bother user with the configuration window
- Resolves: #1041558
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted
problem directory path arguments [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214609
[ 2 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in
abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1216975
[ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods
implemented by abrt-dbus [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1214452
[ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information
disclosure [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212871
[ 5 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing
files owned by others [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212821
[ 6 ] Bug #1213485 - Can't extract files from downloaded debuginfo package
https://bugzilla.redhat.com/show_bug.cgi?id=1213485
[ 7 ] Bug #1169774 - failure to extract debuginfo
https://bugzilla.redhat.com/show_bug.cgi?id=1169774
[ 8 ] Bug #1193656 - abrt-gui renders crash list white-on-white when using dark theme
https://bugzilla.redhat.com/show_bug.cgi?id=1193656
[ 9 ] Bug #986876 - RFE: Disallow core dump upload entirely
https://bugzilla.redhat.com/show_bug.cgi?id=986876
[ 10 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow symbolic links
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1212865
[ 11 ] Bug #1218239 - CVE-2015-3315 abrt: Various race-conditions and symlink issues
found in abrt [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1218239
[ 12 ] Bug #1179752 - undocumented options in abrt-cli
https://bugzilla.redhat.com/show_bug.cgi?id=1179752
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update libreport' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------