Fedora 22: satyr Security Update
Summary
Satyr is a library that can be used to create and process microreports.
Microreports consist of structured data suitable to be analyzed in a fully
automated manner, though they do not necessarily contain sufficient information
to fix the underlying problem. The reports are designed not to contain any
potentially sensitive data to eliminate the need for review before submission.
Included is a tool that can create microreports and perform some basic
operations on them.
Update Information:
Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159
abrt:
- Move the default dump location from /var/tmp/abrt to /var/spool/abrt
- Use root for owner of all dump directories
- Stop reading hs_error.log from /tmp
- Don not save the system logs by default
- Don not save dmesg if kernel.dmesg_restrict=1
libreport:
- Harden the code against directory traversal, symbolic and hard link attacks
- Fix a bug causing that the first value of AlwaysExcludedElements was ignored
- Fix missing icon for the "Stop" button icon name
- Improve development documentation
- Translations updates
gnome-abrt:
- Enabled the Details also for the System problems
- Do not crash in the testing of availabitlity of XServer
- Fix 'Open problem's data directory'
- Quit Application on Ctrl+Q
- Translation updates
satyr: - New kernel taint flags - More secure core stacktraces from core hook
Change Log
* Tue Jun 9 2015 Martin Milata
References
[ 1 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1216975 [ 2 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214609 [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214452 [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212871 [ 5 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212865 [ 6 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212821 [ 7 ] Bug #1218239 - CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1218239 [ 8 ] Bug #1128400 - ABRT does not honor dmesg_restrict https://bugzilla.redhat.com/show_bug.cgi?id=1128400
Update Instructions
This update can be installed with the "yum" update program. Use su -c 'yum update satyr' at the command line. For more information, refer to "Managing Software with yum", available at .