--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-9886
2015-06-13 00:14:24
--------------------------------------------------------------------------------

Name        : gnome-abrt
Product     : Fedora 22
Version     : 1.2.0
Release     : 1.fc22
URL         : https://fedoraproject.org/wiki/Infrastructure/Fedorahosted-retirement
Summary     : A utility for viewing problems that have occurred with the system
Description :
A GNOME application allows users to browse through detected problems and
provides them with convenient way for managing these problems.

--------------------------------------------------------------------------------
Update Information:

Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159

abrt:
- Move the default dump location from /var/tmp/abrt to /var/spool/abrt 
- Use root for owner of all dump directories
- Stop reading hs_error.log from /tmp
- Don not save the system logs by default
- Don not save dmesg if kernel.dmesg_restrict=1

libreport:
- Harden the code against directory traversal, symbolic and hard link attacks
- Fix a bug causing that the first value of AlwaysExcludedElements was ignored
- Fix missing icon for the "Stop" button icon name
- Improve development documentation
- Translations updates

gnome-abrt:
- Enabled the Details also for the System problems
- Do not crash in the testing of availabitlity of XServer
- Fix 'Open problem's data directory'
- Quit Application on Ctrl+Q
- Translation updates

satyr:
- New kernel taint flags
- More secure core stacktraces from core hook
--------------------------------------------------------------------------------
ChangeLog:

* Tue Jun  9 2015 Jakub Filak  1.2.0-1
- Enabled the Details also for the System problems
- Do not crash in the testing of availabitlity of XServer
- Remove a debug print introduced with port to Python3
- Fix 'Open problem's data directory'
- Quit Application on Ctrl+Q
- Translation updates
- Resolves: #1211759
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1216975
  [ 2 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1214609
  [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1214452
  [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212871
  [ 5 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212865
  [ 6 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1212821
  [ 7 ] Bug #1218239 - CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1218239
  [ 8 ] Bug #1128400 - ABRT does not honor dmesg_restrict
        https://bugzilla.redhat.com/show_bug.cgi?id=1128400
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update gnome-abrt' at the command line.
For more information, refer to "Managing Software with yum",
available at .

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/