[Bug 828517] New: CVE-2011-5092 rt3: remote arbitrary code execution and privilege elevation flaw [epel-6]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=828517
Bug ID: 828517
Keywords: Security, SecurityTracking
Blocks: 828512
QA Contact: extras-qa(a)fedoraproject.org
Severity: high
Version: el6
Priority: high
CC: mmahut(a)redhat.com, perl-devel(a)lists.fedoraproject.org,
tremble(a)tremble.org.uk, xavier(a)bachelot.org
Assignee: xavier(a)bachelot.org
Summary: CVE-2011-5092 rt3: remote arbitrary code execution and
privilege elevation flaw [epel-6]
Regression: ---
Story Points: ---
Classification: Fedora
OS: Linux
Reporter: vdanen(a)redhat.com
Type: ---
Documentation: ---
Hardware: All
Mount Type: ---
Status: NEW
Component: rt3
Product: Fedora EPEL
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=828512
epel-6 tracking bug for rt3: see blocks bug list for full details of the
security issue(s).
[bug automatically created by: add-tracking-bugs]
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 8 months
[Bug 1060653] New: SELinux errors with temporary files
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1060653
Bug ID: 1060653
Summary: SELinux errors with temporary files
Product: Red Hat Enterprise Linux 6
Version: 6.6
Component: selinux-policy
Keywords: SELinux
Assignee: mgrepl(a)redhat.com
Reporter: mgrepl(a)redhat.com
QA Contact: qe-baseos-security(a)redhat.com
CC: dwalsh(a)redhat.com, mcepl(a)redhat.com,
mgrepl(a)redhat.com, nathanael(a)gnat.ca,
perl-devel(a)lists.fedoraproject.org
Depends On: 879007
+++ This bug was initially created as a clone of Bug #879007 +++
Description of problem:
#============= httpd_suexec_t ==============
allow httpd_suexec_t httpd_tmp_t:file { read write };
#============= httpd_sys_script_t ==============
allow httpd_sys_script_t devlog_t:sock_file write;
allow httpd_sys_script_t syslogd_t:unix_dgram_socket sendto;
see attached output of
ausearch -m AVC -ts today
Version-Release number of selected component (if applicable):
dspam-3.10.2-2.el6.i686
selinux-policy-targeted-3.7.19-181.el6.noarch
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=879007
[Bug 879007] SELinux errors with temporary files
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RHYoMpsqKq&a=cc_unsubscribe
9 years, 8 months
[Bug 647783] New: perl-Mail-Box shouldn't force spamassassin to be installed
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: perl-Mail-Box shouldn't force spamassassin to be installed
https://bugzilla.redhat.com/show_bug.cgi?id=647783
Summary: perl-Mail-Box shouldn't force spamassassin to be
installed
Product: Fedora
Version: rawhide
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: medium
Priority: low
Component: perl-Mail-Box
AssignedTo: tcallawa(a)redhat.com
ReportedBy: jik(a)kamens.brookline.ma.us
QAContact: extras-qa(a)fedoraproject.org
CC: tcallawa(a)redhat.com, fedora-perl-devel-list(a)redhat.com
Classification: Fedora
People who aren't planning on using spamassassin shouldn't be forced to install
it just to be able to use the modules in perl-Mail-Box, most of which are
totally independent of spamassassin.
One fix would be to remove the dependency on Mail::SpamAssassin completely from
the perl-Mail-Box RPM, in which case, people who try to use spamassassin
functionality in perl-Mail-Box will simply get an error because of the missing
module and know they need to install spamassassin.
Another fix would be to split the perl modules in spamassassin into a separate
RPM, e.g., spamassassin-perl, so they can be installed without the rest of
spamassassin.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
9 years, 8 months
[Bug 890721] New: perl-Net-Amazon-S3 in Fedora 17 is dated and needs to be updated to stop warnings
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=890721
Bug ID: 890721
Summary: perl-Net-Amazon-S3 in Fedora 17 is dated and needs to
be updated to stop warnings
Product: Fedora
Version: 17
Component: perl-Net-Amazon-S3
Severity: medium
Priority: unspecified
Reporter: paulej(a)arid.us
Description of problem:
perl-Net-Amazon-S3 in Fedora 17 is at 0.53. A change in Perl syntax has made
syntax used in Net/Amazon/S3/Request/ListBucket.pm to be considered deprecated
and Perl produces a warning when trying to use the package.
Version-Release number of selected component (if applicable):
perl-Net-Amazon-S3-0.53-3.fc17.noarch
How reproducible:
Easily reproduced with the 1-line Perl program as shown below.
Steps to Reproduce:
1. perl -e "use Net::Amazon::S3"
Actual results:
Use of qw(...) as parentheses is deprecated at
/usr/share/perl5/vendor_perl/Net/Amazon/S3/Request/ListBucket.pm line 22.
Expected results:
No warnings.
Additional info:
CPAN is currently at 0.58. I noted the syntax related to this function was
changed in that version. It's a trivial syntax change and if it's not possible
to use newer source code from CPAN, I would suggest at least incorporating that
small syntax change into 0.53-xx used in Fedora.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pq3py00oEX&a=cc_unsubscribe
9 years, 9 months
[Bug 1037242] New: perl-Proc-ProcessTable FTBFS if "-Werror=format-security" flag is used
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1037242
Bug ID: 1037242
Summary: perl-Proc-ProcessTable FTBFS if
"-Werror=format-security" flag is used
Product: Fedora
Version: rawhide
Component: perl-Proc-ProcessTable
Assignee: andreas(a)bawue.net
Reporter: dkholia(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: andreas(a)bawue.net, perl-devel(a)lists.fedoraproject.org
Description of problem
----------------------
perl-Proc-ProcessTable fails to build if "-Werror=format-security" flag is
used.
...
OS.c:397:5: error: format not a string literal and no format arguments
[-Werror=format-security]
OS.c:638:9: error: format not a string literal and no format arguments
[-Werror=format-security]
...
We are working on a proposal to enable "-Werror=format-security" for all
packages. Once this flag is enabled, GCC will refuse to compile code that could
be vulnerable to a string format security flaw. For more details, please see
https://fedorahosted.org/fesco/ticket/1185 page.
To understand why it is important to fix this, please see
https://fedoraproject.org/wiki/Format-Security-FAQ page.
How to fix this
---------------
The fix for these errors is quite simple. It's a matter of changing a
line like,
printf(foo);
to read,
printf("%s", foo);
That's it.
Please fix this issue in rawhide with a patch (which you should submit
to upstream to merge moving forward). Please do a new build with the
fix in rawhide. Other releases do not need to be directly fixed, but
there should be no harm in pushing out this fix/patch with other needed
changes to those branches.
In the event you don't fix this bug before the next mass rebuild,
provenpackagers may step in and update your package(s) to fix this
issue.
How reproducible
----------------
Build perl-Proc-ProcessTable-0.48-2.fc20.src.rpm with "-Werror=format-security"
flag to reproduce the problem.
To make this process easier, you can use a modified "redhat-rpm-config" package
from http://people.fedoraproject.org/~halfie/artifacts/redhat-rpm-config/ URL.
$ sha256sum redhat-rpm-config-9.1.0-56.fc20.*
faad7594b2080fe76497d0ce50808c905a93dd7b41c1defdde5ca57e3833d3d2
redhat-rpm-config-9.1.0-56.fc20.noarch.rpm
5aa9357174305c7285ffdbc92d7ffe1c07a8a95d5459b930461308f5aad75413
redhat-rpm-config-9.1.0-56.fc20.src.rpm
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=g63zoQoqmq&a=cc_unsubscribe
9 years, 9 months