Alerts This Week
Warning Icon 1 681
Alerts This Week
Warning Icon 1 681

Fedora 21: 2015-10193 Critical Update for ABRT Multiple Threats

fedora
Calendar Grey June 30, 2015
Dist Fedora Esm H88
Discover the new CentOS 7 kernel security patches that tackle severe vulnerabilities, enhancing your system's defenses effectively.
Security fixes for: * CVE-2015-3315 * CVE-2015-3142 * CVE-2015-1869 * CVE-2015-1870

Summary

abrt is a tool to help users to detect defects in applications and

to create a bug report with all information needed by maintainer to fix it.

It uses plugin system to extend its functionality.

Update Information:

Security fixes for: * CVE-2015-3315 * CVE-2015-3142 * CVE-2015-1869 * CVE-2015-1870 * CVE-2015-3151 * CVE-2015-3150 * CVE-2015-3159

abrt: ====* Move the default dump location from /var/tmp/abrt to /var/spool/abrt * Use root for owner of all dump directories * Stop reading hs_error.log from /tmp * Don not save the system logs by default * Don not save dmesg if kernel.dmesg_restrict=1

libreport: =========* Harden the code against directory traversal, symbolic and hard link attacks * Fix a bug causing that the first value of AlwaysExcludedElements was ignored * Fix missing icon for the "Stop" button icon name * Improve development documentation * Translations updates

gnome-abrt: ==========* Use DBus to get problem data for detail dialog * Fix an error introduced with the details on System page * Enabled the Details also for the System problems

Topics%20covered

Topics Covered

security advisory critical software update Fedora multiple threats abrt

Change Log

* Mon Jun 22 2015 Matej Habrnal - 2.3.0-7 - dependency fix * Thu Jun 18 2015 Matej Habrnal - 2.3.0-6 - add option always generate backtrace locally - Resolves: #986876 * Tue Jun 16 2015 Matej Habrnal - 2.3.0-5 - move the default dump location to /var/spool/abrt from /var/tmp/abrt - hooks: use root for owner of all dump directories - ccpp: do not unlink failed and big user cores - ccpp: don't save the system logs by default - ccpp: stop reading hs_error.log from /tmp - ccpp: emulate selinux for creation of compat cores - koops: don't save dmesg if kernel.dmesg_restrict=1 - dbus: validate passed arguments - turn off exploring crashed process's root directories - abrt-python: bug fixes and improvements - fixes for CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870 - fixes for CVE-2015-3147, CVE-2015-3151, CVE-2015-3150, CVE-2015-3159 - spec: add abrt-dbus to Rs of abrt-python and abrt-cli - spec: restart abrt-dbus in posttrans - Resolves: #1179752 * Tue Feb 24 2015 Matej Habrnal - 2.3.0-4 - make gdb aware of the abrt's debuginfo dir - python: load the configuration from correct file - add missing augeas dependency - console-notifications: add timeout - Don't slurp unbounded amounts of data when invoking journalctl - Resolves: #1177447

References


[ 1 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214609 [ 2 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1216975 [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214452 [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212871 [ 5 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212821 [ 6 ] Bug #1213485 - Can't extract files from downloaded d...

Read the Full Advisory

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update abrt' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: abrt
Product: Fedora 21
Version: 2.3.0
Release: 7.fc21
URL: https://github.com/abrt/abrt/wiki/ABRT-Project
Summary: Automatic bug detection and reporting tool

Topics%20covered

Topics Covered

security advisory critical software update Fedora multiple threats abrt

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here