——————————————————————————–
Fedora Update Notification
FEDORA-2014-17415
2014-12-21 05:23:19
——————————————————————————–

Name : thermostat
Product : Fedora 20
Version : 1.0.6
Release : 1.fc20
URL : http://icedtea.classpath.org/thermostat/
Summary : A monitoring and serviceability tool for OpenJDK
Description :
Thermostat is a monitoring and instrumentation tool for the Hotspot JVM,
with support for monitoring multiple JVM instances. The system is made
up of two processes: an Agent, which collects data, and a Client which
allows users to visualize this data. These components communicate via
a MongoDB-based storage layer. A pluggable agent and gui framework allows
for collection and visualization of performance data beyond that which is
included out of the box.

——————————————————————————–
Update Information:

Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-8120)
——————————————————————————–
ChangeLog:

* Thu Dec 18 2014 Elliott Baron <ebaron@redhat.com> – 1.0.6-1
– Update to latest maintenance release.
– Resolves: CVE-2014-8120
* Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.5
– Use /etc/alternatives/java_sdk_openjdk as jdk_base.
* Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.4
– Remove obsolete requires on gnome-icon-theme.
* Thu Sep 4 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.3
– Fix hawtjni-runtime symlink and use OpenJDK 8 in
scripts, R/BRs.
* Tue Sep 2 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.2
– Rebuild for updated jcommon/jfreechart versions.
* Tue Aug 19 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.1
– Rebuild for updated httpcomponents-client version (v4.3.5).
* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 1.0.4-4
– Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Tue Jun 10 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-3
– Drop manual requires in favour of mvn()-style auto-requires.
– Switch to mvn()-style BRs.
– Use io.netty:netty over org.jboss.netty:netty in order to keep
thermostat installable.
* Fri Jun 6 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-2
– Rebuild for updated httpcomonents-client (v4.3.4) and
apache-commons-beanutils (v1.9.2) builds.
* Wed Jun 4 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-1
– Update to latest upstream release.
* Fri Feb 14 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.2-1
– Update to latest upstream release.
* Tue Feb 11 2014 Omair Majid <omajid@redhat.com> – 1.0.0-3
– Update license field to match the tarball license
* Fri Jan 17 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.0-2
– Fix path to jdk/tools.jar in boot scripts.
* Thu Nov 28 2013 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.0-1
– Update to upstream 1.0.0 release.
– Add support for building release branch snapshots.
* Tue Nov 5 2013 Severin Gehwolf <sgehwolf@redhat.com> – 0.15.0-1
– Update to latest upstream release.
– Use osgi-style R/BR in order to ensure that things work during
runtime.
– Use custom CATALINA_BASE for thermostat-webapp deployment.
– Reduce symlinked jars in thermostat-webapp classpath.
– Thermostat tomcat is started via:
$ systemctl start tomcat@thermostat
* Wed Oct 23 2013 Severin Gehwolf <sgehwolf@redhat.com> – 0.9.2-7
– SCL-ize thermostat.
——————————————————————————–
References:

[ 1 ] Bug #1168977 – CVE-2014-8120 thermostat: local JMX URL disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1168977
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update thermostat’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce

——————————————————————————–
Fedora Update Notification
FEDORA-2014-17384
2014-12-21 05:22:05
——————————————————————————–

Name : thermostat
Product : Fedora 21
Version : 1.0.6
Release : 1.fc21
URL : http://icedtea.classpath.org/thermostat/
Summary : A monitoring and serviceability tool for OpenJDK
Description :
Thermostat is a monitoring and instrumentation tool for the Hotspot JVM,
with support for monitoring multiple JVM instances. The system is made
up of two processes: an Agent, which collects data, and a Client which
allows users to visualize this data. These components communicate via
a MongoDB-based storage layer. A pluggable agent and gui framework
allows for collection and visualization of performance data beyond that
which is included out of the box.

——————————————————————————–
Update Information:

Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-8120)
——————————————————————————–
ChangeLog:

* Thu Dec 18 2014 Elliott Baron <ebaron@redhat.com> – 1.0.6-1
– Update to latest maintenance release.
– Resolves: CVE-2014-8120
* Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.5
– Use /etc/alternatives/java_sdk_openjdk as jdk_base.
* Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> – 1.0.4-4.4
– Remove obsolete requires on gnome-icon-theme.
——————————————————————————–
References:

[ 1 ] Bug #1168977 – CVE-2014-8120 thermostat: local JMX URL disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1168977
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update thermostat’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce