Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

Fedora 22: FEDORA-2015-9886 Moderate: Satyr Security Update

fedora
Calendar Grey June 21, 2015
Dist Fedora Esm H88
Enhancements made to the satyr library for Fedora 22, focusing on rectifying various security vulnerabilities. Detailed fixes and suggestions are included.
Security fixes for: * CVE-2015-3315 * CVE-2015-3142 * CVE-2015-1869 * CVE-2015-1870

Summary

Satyr is a library that can be used to create and process microreports.

Microreports consist of structured data suitable to be analyzed in a fully

automated manner, though they do not necessarily contain sufficient information

to fix the underlying problem. The reports are designed not to contain any

potentially sensitive data to eliminate the need for review before submission.

Included is a tool that can create microreports and perform some basic

operations on them.

Update Information:

Security fixes for: * CVE-2015-3315 * CVE-2015-3142 * CVE-2015-1869 * CVE-2015-1870 * CVE-2015-3151 * CVE-2015-3150 * CVE-2015-3159

abrt: - Move the default dump location from /var/tmp/abrt to /var/spool/abrt - Use root for owner of all dump directories - Stop reading hs_error.log from /tmp - Don not save the system logs by default - Don not save dmesg if kernel.dmesg_restrict=1

libreport: - Harden the code against directory traversal, symbolic and hard link attacks - Fix a bug causing that the first value of AlwaysExcludedElements was ignored - Fix missing icon for the "Stop" button icon name - Improve development documentation - Translations updates

gnome-abrt: - Enabled the Details also for the System problems - Do not crash in the testing of availabitlity of XServer - Fix 'Open problem's data directory' - Quit Application on Ctrl+Q - Translation updates

satyr: - New kernel taint flags - More secure core stacktraces from core hook

Topics%20covered

Topics Covered

security advisory moderate Fedora security fix issue abrt satyr

Change Log

* Tue Jun 9 2015 Martin Milata - 0.18-1 - New upstream version - Remove function fingerprinting - New kernel taint flags - Normalization tweaks - More secure core stacktraces from core hook * Sat May 2 2015 Kalev Lember - 0.16-3 - Rebuilt for GCC 5 C++11 ABI change * Sat Feb 21 2015 Till Maas - 0.16-2 - Rebuilt for Fedora 23 Change https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code

References


[ 1 ] Bug #1216975 - CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1216975 [ 2 ] Bug #1214609 - CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214609 [ 3 ] Bug #1214452 - CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1214452 [ 4 ] Bug #1212871 - CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212871 [ 5 ] Bug #1212865 - CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1212865 [ 6 ] Bug #1212821 - CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to exis...

Read the Full Advisory

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update satyr' at the command line. For more information, refer to "Managing Software with yum", available at .

Name: satyr
Product: Fedora 22
Version: 0.18
Release: 1.fc22
URL: https://github.com/abrt/satyr
Summary: Tools to create anonymous, machine-friendly problem reports

Topics%20covered

Topics Covered

security advisory moderate Fedora security fix issue abrt satyr

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here