Issued:: 2012-06-20
Updated:: 2012-06-20

RHSA-2012:0841 - Low: abrt, libreport, btparser, and python-meh security and bug fix update

Synopsis

Low: abrt, libreport, btparser, and python-meh security and bug fix update

Type/Severity

Security Advisory Low

Topic

Updated abrt, libreport, btparser, and python-meh packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Description

ABRT (Automatic Bug Reporting Tool) is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in applications to different bug targets, such as Bugzilla, FTP, and Trac.

The btparser utility is a backtrace parser and analyzer library, which works with backtraces produced by the GNU Project Debugger. It can parse a text file with a backtrace to a tree of C structures, allowing to analyze the threads and frames of the backtrace and process them.

The python-meh package provides a python library for handling exceptions.

If the C handler plug-in in ABRT was enabled (the abrt-addon-ccpp package installed and the abrt-ccpp service running), and the sysctl fs.suid_dumpable option was set to "2" (it is "0" by default), core dumps of set user ID (setuid) programs were created with insecure group ID permissions. This could allow local, unprivileged users to obtain sensitive information from the core dump files of setuid processes they would otherwise not be able to access. (CVE-2012-1106)

ABRT did not allow users to easily search the collected crash information for sensitive data prior to submitting it. This could lead to users unintentionally exposing sensitive information via the submitted crash reports. This update adds functionality to search across all the collected data. Note that this fix does not apply to the default configuration, where reports are sent to Red Hat Customer Support. It only takes effect for users sending information to Red Hat Bugzilla. (CVE-2011-4088)

Red Hat would like to thank Jan Iven for reporting CVE-2011-4088.

These updated packages include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

All users of abrt, libreport, btparser, and python-meh are advised to upgrade to these updated packages, which correct these issues.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Product	Version	Arch
Red Hat Enterprise Linux for Scientific Computing	6	x86_64
Red Hat Enterprise Linux for Power, big endian	6	ppc64
Red Hat Enterprise Linux for IBM z Systems	6	s390x
Red Hat Enterprise Linux Workstation	6	x86_64
Red Hat Enterprise Linux Workstation	6	i386
Red Hat Enterprise Linux Server	6	x86_64
Red Hat Enterprise Linux Server	6	i386
Red Hat Enterprise Linux Server from RHUI	6	x86_64
Red Hat Enterprise Linux Server from RHUI	6	i386
Red Hat Enterprise Linux Server - Retired Extended Life Cycle Support	6	x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support	6	x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support	6	i386
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension	6	x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension	6	i386
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems)	6	s390x
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)	6	s390x
Red Hat Enterprise Linux Desktop	6	x86_64
Red Hat Enterprise Linux Desktop	6	i386

Updated Packages

abrt-gui-2.0.8-6.el6.ppc64.rpm
btparser-python-0.16-3.el6.s390x.rpm
libreport-devel-2.0.9-5.el6.s390.rpm
libreport-python-2.0.9-5.el6.i686.rpm
abrt-addon-vmcore-2.0.8-6.el6.i686.rpm
libreport-plugin-rhtsupport-2.0.9-5.el6.s390x.rpm
libreport-cli-2.0.9-5.el6.x86_64.rpm
abrt-desktop-2.0.8-6.el6.x86_64.rpm
libreport-gtk-2.0.9-5.el6.x86_64.rpm
abrt-gui-2.0.8-6.el6.s390x.rpm
libreport-python-2.0.9-5.el6.x86_64.rpm
libreport-newt-2.0.9-5.el6.x86_64.rpm
libreport-newt-2.0.9-5.el6.i686.rpm
libreport-plugin-bugzilla-2.0.9-5.el6.s390x.rpm
abrt-2.0.8-6.el6.x86_64.rpm
btparser-python-0.16-3.el6.ppc64.rpm
btparser-debuginfo-0.16-3.el6.i686.rpm
btparser-debuginfo-0.16-3.el6.s390x.rpm
libreport-gtk-2.0.9-5.el6.ppc64.rpm
abrt-tui-2.0.8-6.el6.i686.rpm
abrt-2.0.8-6.el6.i686.rpm
btparser-devel-0.16-3.el6.s390x.rpm
btparser-python-0.16-3.el6.x86_64.rpm
btparser-0.16-3.el6.i686.rpm
libreport-debuginfo-2.0.9-5.el6.ppc64.rpm
abrt-devel-2.0.8-6.el6.i686.rpm
libreport-devel-2.0.9-5.el6.ppc.rpm
abrt-addon-kerneloops-2.0.8-6.el6.s390x.rpm
libreport-devel-2.0.9-5.el6.ppc64.rpm
libreport-gtk-devel-2.0.9-5.el6.ppc64.rpm
libreport-python-2.0.9-5.el6.ppc64.rpm
libreport-plugin-mailx-2.0.9-5.el6.i686.rpm
abrt-debuginfo-2.0.8-6.el6.ppc64.rpm
libreport-plugin-reportuploader-2.0.9-5.el6.s390x.rpm
libreport-python-2.0.9-5.el6.s390x.rpm
abrt-2.0.8-6.el6.src.rpm
libreport-plugin-kerneloops-2.0.9-5.el6.ppc64.rpm
libreport-debuginfo-2.0.9-5.el6.x86_64.rpm
libreport-gtk-devel-2.0.9-5.el6.i686.rpm
abrt-devel-2.0.8-6.el6.s390x.rpm
abrt-libs-2.0.8-6.el6.s390x.rpm
btparser-debuginfo-0.16-3.el6.x86_64.rpm
libreport-plugin-kerneloops-2.0.9-5.el6.i686.rpm
btparser-0.16-3.el6.s390.rpm
libreport-debuginfo-2.0.9-5.el6.s390.rpm
btparser-debuginfo-0.16-3.el6.ppc.rpm
abrt-cli-2.0.8-6.el6.s390x.rpm
abrt-libs-2.0.8-6.el6.s390.rpm
abrt-addon-vmcore-2.0.8-6.el6.x86_64.rpm
libreport-plugin-reportuploader-2.0.9-5.el6.ppc64.rpm
abrt-debuginfo-2.0.8-6.el6.s390x.rpm
libreport-plugin-rhtsupport-2.0.9-5.el6.x86_64.rpm
abrt-libs-2.0.8-6.el6.ppc64.rpm
abrt-tui-2.0.8-6.el6.ppc64.rpm
abrt-addon-python-2.0.8-6.el6.s390x.rpm
libreport-cli-2.0.9-5.el6.s390x.rpm
libreport-devel-2.0.9-5.el6.i686.rpm
libreport-plugin-mailx-2.0.9-5.el6.x86_64.rpm
python-meh-0.12.1-3.el6.noarch.rpm
libreport-gtk-devel-2.0.9-5.el6.x86_64.rpm
btparser-0.16-3.el6.ppc.rpm
libreport-plugin-mailx-2.0.9-5.el6.ppc64.rpm
libreport-plugin-logger-2.0.9-5.el6.i686.rpm
libreport-plugin-rhtsupport-2.0.9-5.el6.i686.rpm
abrt-addon-ccpp-2.0.8-6.el6.i686.rpm
btparser-debuginfo-0.16-3.el6.ppc64.rpm
abrt-addon-vmcore-2.0.8-6.el6.s390x.rpm
abrt-addon-python-2.0.8-6.el6.ppc64.rpm
libreport-gtk-2.0.9-5.el6.ppc.rpm
abrt-libs-2.0.8-6.el6.i686.rpm
libreport-2.0.9-5.el6.ppc64.rpm
libreport-gtk-2.0.9-5.el6.i686.rpm
libreport-plugin-kerneloops-2.0.9-5.el6.x86_64.rpm
btparser-devel-0.16-3.el6.s390.rpm
abrt-devel-2.0.8-6.el6.s390.rpm
libreport-2.0.9-5.el6.s390x.rpm
abrt-addon-kerneloops-2.0.8-6.el6.ppc64.rpm
abrt-cli-2.0.8-6.el6.ppc64.rpm
libreport-debuginfo-2.0.9-5.el6.s390x.rpm
libreport-devel-2.0.9-5.el6.s390x.rpm
libreport-plugin-bugzilla-2.0.9-5.el6.i686.rpm
abrt-devel-2.0.8-6.el6.ppc.rpm
abrt-addon-kerneloops-2.0.8-6.el6.i686.rpm
btparser-python-0.16-3.el6.i686.rpm
libreport-gtk-devel-2.0.9-5.el6.ppc.rpm
abrt-desktop-2.0.8-6.el6.s390x.rpm
libreport-gtk-2.0.9-5.el6.s390.rpm
libreport-plugin-logger-2.0.9-5.el6.s390x.rpm
btparser-devel-0.16-3.el6.ppc.rpm
btparser-debuginfo-0.16-3.el6.s390.rpm
libreport-2.0.9-5.el6.s390.rpm
abrt-libs-2.0.8-6.el6.ppc.rpm
libreport-2.0.9-5.el6.i686.rpm
abrt-addon-vmcore-2.0.8-6.el6.ppc64.rpm
libreport-newt-2.0.9-5.el6.s390x.rpm
btparser-0.16-3.el6.x86_64.rpm
abrt-debuginfo-2.0.8-6.el6.s390.rpm
libreport-plugin-mailx-2.0.9-5.el6.s390x.rpm
abrt-addon-python-2.0.8-6.el6.x86_64.rpm
abrt-devel-2.0.8-6.el6.ppc64.rpm
abrt-2.0.8-6.el6.ppc64.rpm
libreport-plugin-logger-2.0.9-5.el6.ppc64.rpm
abrt-tui-2.0.8-6.el6.s390x.rpm
abrt-devel-2.0.8-6.el6.x86_64.rpm
abrt-tui-2.0.8-6.el6.x86_64.rpm
abrt-addon-ccpp-2.0.8-6.el6.ppc64.rpm
libreport-plugin-rhtsupport-2.0.9-5.el6.ppc64.rpm
libreport-devel-2.0.9-5.el6.x86_64.rpm
abrt-cli-2.0.8-6.el6.x86_64.rpm
libreport-plugin-bugzilla-2.0.9-5.el6.x86_64.rpm
abrt-debuginfo-2.0.8-6.el6.i686.rpm
libreport-debuginfo-2.0.9-5.el6.i686.rpm
btparser-devel-0.16-3.el6.i686.rpm
abrt-gui-2.0.8-6.el6.x86_64.rpm
libreport-plugin-reportuploader-2.0.9-5.el6.x86_64.rpm
btparser-0.16-3.el6.ppc64.rpm
abrt-2.0.8-6.el6.s390x.rpm
abrt-debuginfo-2.0.8-6.el6.x86_64.rpm
abrt-addon-ccpp-2.0.8-6.el6.x86_64.rpm
libreport-plugin-reportuploader-2.0.9-5.el6.i686.rpm
libreport-debuginfo-2.0.9-5.el6.ppc.rpm
libreport-cli-2.0.9-5.el6.ppc64.rpm
libreport-plugin-logger-2.0.9-5.el6.x86_64.rpm
abrt-desktop-2.0.8-6.el6.ppc64.rpm
libreport-newt-2.0.9-5.el6.ppc64.rpm
libreport-2.0.9-5.el6.src.rpm
libreport-plugin-kerneloops-2.0.9-5.el6.s390x.rpm
abrt-addon-kerneloops-2.0.8-6.el6.x86_64.rpm
libreport-2.0.9-5.el6.x86_64.rpm
btparser-devel-0.16-3.el6.ppc64.rpm
btparser-0.16-3.el6.src.rpm
abrt-addon-python-2.0.8-6.el6.i686.rpm
libreport-gtk-devel-2.0.9-5.el6.s390.rpm
libreport-gtk-devel-2.0.9-5.el6.s390x.rpm
abrt-gui-2.0.8-6.el6.i686.rpm
libreport-gtk-2.0.9-5.el6.s390x.rpm
btparser-0.16-3.el6.s390x.rpm
abrt-addon-ccpp-2.0.8-6.el6.s390x.rpm
python-meh-0.12.1-3.el6.src.rpm
abrt-libs-2.0.8-6.el6.x86_64.rpm
abrt-desktop-2.0.8-6.el6.i686.rpm
abrt-debuginfo-2.0.8-6.el6.ppc.rpm
libreport-cli-2.0.9-5.el6.i686.rpm
libreport-2.0.9-5.el6.ppc.rpm
abrt-cli-2.0.8-6.el6.i686.rpm
btparser-devel-0.16-3.el6.x86_64.rpm
libreport-plugin-bugzilla-2.0.9-5.el6.ppc64.rpm

Fixes

CVEs

References

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.