Stay Secure with the Latest Linux Advisories

security advisoryfedorabuffer overflow

Fedora 29: FEDORA-2018-2f8f5f75f1 Critical: mongo-c-driver Buffer Over-Read

**libbson 1.13.0** **Features:** * New functions to save and restore progress of a bson_iter_t: bson_iter_key_len, bson_iter_offset, and son_iter_init_from_data_at_offset Additional functions bson_iter_overwrite_date_time, bson_iter_overwrite_oid, and bson_iter_overwrite_timestamp. All fixed-length BSON values can now be. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-2f8f5f75f1 2018-09-29 22:00:08.857521 --------------------------------------------------------------------------------Name : mongo-c-driver Product : Fedora 29 Version : 1.13.0 Release : 1.fc29 URL : https://github.com/mongodb/mongo-c-driver Summary : Client library written in C for MongoDB Description : mongo-c-driver is a client library written in C for MongoDB. --------------------------------------------------------------------------------Update Information: **libbson 1.13.0** **Features:** * New functions to save and restore progress of a bson_iter_t: bson_iter_key_len, bson_iter_offset, and son_iter_init_from_data_at_offset Additional functions bson_iter_overwrite_date_time, bson_iter_overwrite_oid, and bson_iter_overwrite_timestamp. All fixed-length BSON values can now be updated in place. **Bug fixes:** * Fix crash when iterating corrupt BSON. --- **libmongoc 1.13.0** **Features:** * Report a new error code, MONGOC_ERROR_GRIDFS_CORRUPT, when a chunk larger than chunkSize is detected. Before, the driver had crashed with an assert. Restructure of install directory. All mongoc headers are under mongoc/ and all bson headers are under bson/. The preferred way of including the headers are mongoc/mongoc.h and bson/bson.h respectively. Forwarding headers in the root are provided for backwards compatibility. * The default CMake build type had been unspecified, now it is RelWithDebInfo. * Support LibreSSL 2.7+. **Bug fixes:** * mongoc_collection_replace_one is nowa correctly exported symbol. * Fix multiple issues with readConcern and writeConcern inheritance. * Fix rare crash with mongodb+srv URIs on Windows. * mongoc_gridfs_create_file_from_stream ignored errors while writing chunks to the server. * The following functions should not have taken a "bypassDocumentValidation" option in bson_t *opts, the option is now prohibited: * mongoc_bulk_operation_insert_with_opts * mongoc_bulk_operation_update_one_with_opts * mongoc_bulk_operation_update_many_with_opts * mongoc_bulk_operation_replace_one_with_opts * The heartbeat-succeeded and heartbeat-failed events (part of SDAM Monitoring) had uninitialized "duration" fields, they are now set correctly. --------------------------------------------------------------------------------References: [ 1 ] Bug #1630042 - CVE-2018-16790 mongo-c-driver: libbson: Heap-based buffer over-read in _bson_iter_next_internal in bson-iter.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1630042 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-2f8f5f75f1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Essential Fedora 29 mongo-c-driver upgrade resolves buffer over-read vulnerabilities with enhancements and bug fixes outlined.. mongo-c-driver update,Fedora 29 security,libbson features,buffer over-read patch. . Severity: Critical. LinuxSecurity.com Team

Sep 29, 2018 •Critical Fedora