You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa abrt

Sigurnosni nedostaci programskog paketa abrt

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LFE

Fedora Update Notification
2015-06-13 00:14:24

Name : abrt
Product : Fedora 22
Version : 2.6.0
Release : 1.fc22
Summary : Automatic bug detection and reporting tool
Description :
abrt is a tool to help users to detect defects in applications and
to create a bug report with all information needed by maintainer to fix it.
It uses plugin system to extend its functionality.

Update Information:

Security fixes for:
* CVE-2015-3315
* CVE-2015-3142
* CVE-2015-1869
* CVE-2015-1870
* CVE-2015-3151
* CVE-2015-3150
* CVE-2015-3159

– Move the default dump location from /var/tmp/abrt to /var/spool/abrt
– Use root for owner of all dump directories
– Stop reading hs_error.log from /tmp
– Don not save the system logs by default
– Don not save dmesg if kernel.dmesg_restrict=1

– Harden the code against directory traversal, symbolic and hard link attacks
– Fix a bug causing that the first value of AlwaysExcludedElements was ignored
– Fix missing icon for the “Stop” button icon name
– Improve development documentation
– Translations updates

– Enabled the Details also for the System problems
– Do not crash in the testing of availabitlity of XServer
– Fix ‘Open problem’s data directory’
– Quit Application on Ctrl+Q
– Translation updates

– New kernel taint flags
– More secure core stacktraces from core hook

* Tue Jun 9 2015 Jakub Filak <> 2.6.0-1
– move the default dump location to /var/spool/abrt from /var/tmp/abrt
– hooks: use root for owner of all dump directories
– ccpp: do not unlink failed and big user cores
– ccpp: don’t save the system logs by default
– ccpp: stop reading hs_error.log from /tmp
– ccpp: emulate selinux for creation of compat cores
– koops: don’t save dmesg if kernel.dmesg_restrict=1
– dbus: validate passed arguments
– turn off exploring crashed process’s root directories
– abrt-python: bug fixes and improvements
– fixes for CVE-2015-3315, CVE-2015-3142, CVE-2015-1869, CVE-2015-1870
– fixes for CVE-2015-3147, CVE-2015-3151, CVE-2015-3150, CVE-2015-3159
– spec: add abrt-dbus to Rs of abrt-python and abrt-cli
– spec: restart abrt-dbus in posttrans
* Wed May 20 2015 Matej Habrnal <> 2.5.1-3
– applet: fix problem info double free
– upload: validate and sanitize uploaded dump directories
– applet: switch to D-Bus methods
– lib: add new kernel taint flags
– abrt-auto-reporting: require rhtsupport.conf file only on RHEL
– doc, polkit: Spelling/grammar fixes
– applet: migrate Autoreporting options to GSettings
– config UI: read glade from a local file first
– config UI: Automatic reporting from GSettings
– Resolves: #1211644

[ 1 ] Bug #1216975 – CVE-2015-3159 abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache [fedora-all]
[ 2 ] Bug #1214609 – CVE-2015-3150 abrt: abrt-dbus does not guard against crafted problem directory path arguments [fedora-all]
[ 3 ] Bug #1214452 – CVE-2015-3151 abrt: directory traversals in several D-Bus methods implemented by abrt-dbus [fedora-all]
[ 4 ] Bug #1212871 – CVE-2015-1870 abrt: default abrt event scripts lead to information disclosure [fedora-all]
[ 5 ] Bug #1212865 – CVE-2015-1869 abrt: default event scripts follow symbolic links [fedora-all]
[ 6 ] Bug #1212821 – CVE-2015-3142 abrt: abrt-hook-ccpp writes core dumps to existing files owned by others [fedora-all]
[ 7 ] Bug #1218239 – CVE-2015-3315 abrt: Various race-conditions and symlink issues found in abrt [fedora-all]
[ 8 ] Bug #1128400 – ABRT does not honor dmesg_restrict

This update can be installed with the “yum” update program. Use
su -c ‘yum update abrt’ at the command line.
For more information, refer to “Managing Software with yum”,
available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list

AutorMarko Stanec
Cert idNCERT-REF-2015-06-0007-ADV
More in Preporuke
Sigurnosni nedostaci programskog paketa gnome-abrt

Otkriveni su sigurnosni nedostaci u programskom paketu gnome-abrt za operacijski sustav Fedora. Otkriveni nedostaci potencijalnim napadačima omogućuju stjecanje povećanih korisničkih...