FEDORA-2018-9a4d7ec61e — security update for glusterfs

stable

glusterfs-3.12.14-1.fc27

FEDORA-2018-9a4d7ec61e created by kkeithle 4 years ago for Fedora 27

3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2018-9a4d7ec61e

This update has been submitted for testing by kkeithle.

4 years ago

This update has been pushed to testing.

4 years ago

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

4 years ago

This update has been submitted for batched by kkeithle.

4 years ago

This update has been submitted for stable by kkeithle.

4 years ago

This update has been pushed to stable.

4 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

glusterfs-3.12.14-1.fc27

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

4 years ago

in testing

4 years ago

in stable

4 years ago

BZ#1625067 CVE-2018-10927 glusterfs: File status information leak and denial of service [fedora-all]

BZ#1625068 CVE-2018-10928 glusterfs: Improper resolution of symlinks allows for privilege escalation [fedora-all]

BZ#1625069 CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code [fedora-all]

BZ#1625074 CVE-2018-10913 glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625075 CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625079 CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory [fedora-all]

BZ#1625080 CVE-2018-10907 glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code [fedora-all]

BZ#1625085 CVE-2018-10930 glusterfs: Files can be renamed outside volume [fedora-all]

BZ#1625086 CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations [fedora-all]

BZ#1625091 CVE-2018-10923 glusterfs: I/O to arbitrary devices on storage server [fedora-all]

BZ#1625103 CVE-2018-10904 glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code [fedora-all]

glusterfs-3.12.14-1.fc27

Automated Test Results

ignored