[Bug 1376712] New: CVE-2016-1240 tomcat: Local privilege escalation via unsafe file handling in the Tomcat init script
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1376712
Bug ID: 1376712
Summary: CVE-2016-1240 tomcat: Local privilege escalation via
unsafe file handling in the Tomcat init script
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: alee(a)redhat.com, aszczucz(a)redhat.com,
bbaranow(a)redhat.com, bdawidow(a)redhat.com,
bgollahe(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, epp-bugs(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
It was reported that the Tomcat init script performed unsafe file handling,
which could result in local privilege escalation.
References:
http://seclists.org/bugtraq/2016/Sep/26
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 958733] New: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958733
Bug ID: 958733
Summary: plexus-utils: suspicious shell quoting in
org.codehaus.plexus.util.cli
Product: Fedora
Version: 18
Component: plexus-utils
Severity: unspecified
Priority: unspecified
Assignee: fnasser(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fnasser(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 958220
Category: ---
The shell quoting logic in this package (and the
org.codehaus.plexus.util.cli.shell) package looks fairly dangerous. It appears
to be mostly dead code. Client code should be migrated to
java.lang.ProcessBuilder.
The different quoting options (single quotes, double quotes) are difficult to
get right, and the reference to StringUtils is not particularly helpful because
the caller has to provide the correct set of characters to be escaped, which is
platform-dependent.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JhGrfK5sg6&a=cc_unsubscribe
6 years, 3 months
[Bug 1335748] New: jenkins-xstream: bundles XStream
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335748
Bug ID: 1335748
Summary: jenkins-xstream: bundles XStream
Product: Fedora
Version: rawhide
Component: jenkins-xstream
Assignee: msrb(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
msrb(a)redhat.com
Description of problem:
Package jenknis-xstream bundles XStream library:
/usr/share/java/jenkins-xstream/xstream.jar
Version-Release number of selected component (if applicable):
jenkins-xstream-1.4.7-8.jenkins1.fc24.noarch
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months
[Bug 1346139] New: Keyboard not working when entering "console" mode
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1346139
Bug ID: 1346139
Summary: Keyboard not working when entering "console" mode
Product: Fedora
Version: 24
Component: sbt
Assignee: willb(a)redhat.com
Reporter: rvernica(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com
Description of problem:
When entering the "console" mode of sbt, the keyboard locks and only accepted
key press is Ctrl-C which exists the "console" mode.
Version-Release number of selected component (if applicable):
> cat /etc/fedora-release
Fedora release 24 (Twenty Four)
> sudo dnf info sbt
Last metadata expiration check: 1:31:17 ago on Mon Jun 13 21:39:01 2016.
Installed Packages
Name : sbt
Arch : noarch
Epoch : 0
Version : 0.13.1
Release : 8.fc24.1
Size : 21 M
Repo : @System
From repo : @commandline
Summary : The simple build tool for Scala and Java projects
URL : http://www.scala-sbt.org
License : BSD
Description : sbt is the simple build tool for Scala and Java projects.
How reproducible:
Always
Steps to Reproduce:
1. Start "sbt" and then type "console" OR start "sbt console"
2. Pressing any key on the keyboard shows no output on the terminal
3. Pressing Ctrl-C stops "sbt"
> sbt console
[info] Set current project to rares (in build file:/home/.../)
[info] Updating {file:/home/.../}...
[info] Resolving org.scala-lang#scala-reflect;2.10.4 ...
[info] Done updating.
[info] Starting scala interpreter...
[info]
Welcome to Scala version 2.10.4 (OpenJDK 64-Bit Server VM, Java 1.8.0_91).
Type in expressions to have them evaluated.
Type :help for more information.
scala> %
Actual results:
Keyboard does not work. Pressing any key shows no output.
Expected results:
Keyboard should work. Pressing any key should print that key on the terminal.
Additional info:
This has been reported in the past but closed due to EOL:
https://bugzilla.redhat.com/show_bug.cgi?id=1091711
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months
[Bug 1405223] New: fop invocation failure.
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1405223
Bug ID: 1405223
Summary: fop invocation failure.
Product: Fedora
Version: 25
Component: fop
Assignee: r.landmann(a)redhat.com
Reporter: stefan(a)seefeld.name
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
rhbugs(a)n-dimensional.de, r.landmann(a)redhat.com
Description of problem:
Each time I invoke `fop` to build a PDF I get this exception:
$ fop reference.fo reference.pdf
Exception in thread "main" java.lang.NoClassDefFoundError:
org/apache/xml/serializer/OutputPropertiesFactory
at
org.apache.xalan.templates.OutputProperties.<init>(OutputProperties.java:84)
at
org.apache.xalan.transformer.TransformerIdentityImpl.<init>(TransformerIdentityImpl.java:88)
at
org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(TransformerFactoryImpl.java:827)
at org.apache.fop.cli.InputHandler.transformTo(InputHandler.java:264)
at org.apache.fop.cli.InputHandler.renderTo(InputHandler.java:115)
at org.apache.fop.cli.Main.startFOP(Main.java:186)
at org.apache.fop.cli.Main.main(Main.java:216)
Caused by: java.lang.ClassNotFoundException:
org.apache.xml.serializer.OutputPropertiesFactory
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 7 more
This seems to hint at missing dependencies (i.e., prerequisite java packages)
Version-Release number of selected component (if applicable):
fop.noarch 2.0-3.fc24
(Also, there doesn't appear to be any up-to-date fop package for Fedora 25 !)
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months
[Bug 1098424] New: tycho: Java class bundling/"static linking"
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1098424
Bug ID: 1098424
Summary: tycho: Java class bundling/"static linking"
Product: Fedora
Version: rawhide
Component: tycho
Assignee: rgrunber(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mat.booth(a)redhat.com,
mizdebsk(a)redhat.com, rgrunber(a)redhat.com
Blocks: 1098237
tycho-0.20.0-6.fc21.noarch bundles many class files which are also available
from other Fedora packages. Here are a few examples:
/usr/share/java/tycho/org.eclipse.tycho.surefire.junit.jar contains
org/apache/maven/surefire/common/junit3/JUnit3Reflector, also part of
maven-surefire-provider-junit-0:2.17-1.fc21.noarch.
/usr/share/java/tycho/org.eclipse.tycho.surefire.junit4.jar contains
org/apache/maven/surefire/common/junit3/JUnit3TestChecker, also from
maven-surefire-provider-junit-0:2.17-1.fc21.noarch.
/usr/share/java/tycho/org.eclipse.tycho.surefire.osgibooter.jar contains the
class org/codehaus/plexus/util/AbstractScanner, which is part of
plexus-utils-3.0.16-2.fc21.noarch.
/usr/share/java/tycho/tycho-bundles-external.zip contains
org/apache/commons/logging/Log from
apache-commons-logging-1.1.3-11.fc21.noarch,
org/apache/commons/codec/BinaryDecoder from
apache-commons-codec-1.9-2.fc21.noarch, org/apache/http/auth/AUTH from
httpcomponents-client-4.3.3-1.fc21.noarch,
org/apache/http/ConnectionClosedException from
httpcomponents-core-4.3.2-1.fc21.noarch, org/sat4j/AbstractLauncher from
sat4j-2.3.5-3.fc21.noarch.
It seems that at least some of these class files are copied from build
dependencies into the JAR files of the tycho RPM. Such bundling/static linking
is against the Fedora packaging guidelines, specifically
<http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries>.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1098237
[Bug 1098237] Java "static linking"/class bundling in Fedora
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Ws5wsBGzEs&a=cc_unsubscribe
6 years, 4 months