Stay Secure with the Latest Linux Advisories

security advisoryFedoramusic player

Fedora 28 Cantata Security Advisory: Insecure Mount Code Removal

Latest upstream release, omits some mounting code found to be insecure and not well tested.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-d1f6c8957f 2018-07-06 16:41:36.936407 --------------------------------------------------------------------------------Name : cantata Product : Fedora 28 Version : 2.3.1 Release : 1.fc28 URL : https://github.com/cdrummond/cantata Summary : Music Player Daemon (MPD) graphical client Description : Cantata is a graphical client for the music player daemon (MPD). Features: * Multiple MPD collections. * Highly customisable layout. * Songs grouped by album in play queue. * Context view to show artist, album, and song information of current track. * Simple tag editor. * File organizer - use tags to organize files and folders. * Ability to calculate ReplyGain tags. * Dynamic playlists. * Online services; Jamendo, Magnatune, SoundCloud, and Podcasts. * Radio stream support - with the ability to search for streams via TuneIn and ShoutCast. * USB-Mass-Storage and MTP device support. * Audio CD ripping and playback. * Playback of non-MPD songs, via simple in-built HTTP server. * MPRISv2 DBUS interface. * Support for KDE global shortcuts (KDE builds), GNOME media keys, and generic media keys (via Qxt support) * Ubuntu/ambiance theme integration. --------------------------------------------------------------------------------Update Information: Latest upstream release, omits some mounting code found to be insecure and not well tested. --------------------------------------------------------------------------------ChangeLog: * Wed Jun 27 2018 Rex Dieter - 2.3.1-1 - cantata-2.3.1 - include upstream commit that removes samba share mounting code * Fri Apr 27 2018 Rex Dieter - 2.3.0-1 - cantata-2.3.0 --------------------------------------------------------------------------------References: [ 1 ] Bug #1595570 - CVE-2018-12562 cantata:Insufficient input validation in the 'mount.cifs.wrapper' script https://bugzilla.redhat.com/show_bug.cgi?id=1595570 [ 2 ] Bug #1595569 - CVE-2018-12561 cantata: Possible injection of additional mount options by manipulating the domain parameters of the samba URL https://bugzilla.redhat.com/show_bug.cgi?id=1595569 [ 3 ] Bug #1595567 - CVE-2018-12560 cantata: Directory traversal in the D-Bus service of cantata-mounter https://bugzilla.redhat.com/show_bug.cgi?id=1595567 [ 4 ] Bug #1595566 - CVE-2018-12559 cantata: Directory traversal due to insufficient mount target check in mounter.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1595566 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-d1f6c8957f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/SRPK34PZQUXA4WOTTHRLN4M6QG45WY72/ . The Cantata music application undergoes a security enhancement in Fedora 28, addressing vulnerabilities in the mounting process while significantly improving overall system safety.. Fedora Security Update,cantata music player,insecure code fix,mountingissues. . Severity: Important. LinuxSecurity.com Team

Jul 06, 2018 •Important Fedora