stable

FEDORA-2021-c9848cf37f created by kalev a year ago for Fedora 33
  • Fix various instances within GLib where g_memdup() was vulnerable to a silent integer truncation and heap overflow problem (discovered by Kevin Backhouse, work by Philip Withnall) (#2319)

  • Fix some issues with handling over-long (invalid) input when parsing for GDate (!1824)

  • Don’t load GIO modules or parse other GIO environment variables when AT_SECURE is set (i.e. in a setuid/setgid/setcap process). GIO has always been documented as not being safe to use in privileged processes, but people persist in using it unsafely, so these changes should harden things against potential attacks at least a little. Unfortunately they break a couple of projects which were relying on reading DBUS_SESSION_BUS_ADDRESS, so GIO continues to read that for setgid/setcap (but not setuid) processes. This loophole will be closed in GLib 2.70 (see issue #2316), which should give modules 6 months to change their behaviour. (Work by Simon McVittie and Philip Withnall) (#2168, #2305)

  • Fix g_spawn() searching PATH when it wasn’t meant to (work by Simon McVittie and Thomas Haller) (!1913)

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2021-c9848cf37f

This update has been submitted for testing by kalev.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

This update's test gating status has been changed to 'waiting'.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

kalev edited this update.

New build(s):

  • glib2-2.66.6-1.fc33

Removed build(s):

  • glib2-2.66.5-1.fc33

Karma has been reset.

a year ago

This update has been pushed to testing.

a year ago
User Icon atim provided feedback a year ago
karma
User Icon bojan provided feedback a year ago
karma

This update can be pushed to stable now if the maintainer wishes

a year ago
User Icon ersen provided feedback a year ago
karma
User Icon filiperosset commented & provided feedback a year ago
karma

no regressions noted

User Icon ibims commented & provided feedback a year ago
karma

LGTM.

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please login to add feedback.

Metadata
Type
bugfix
Karma
5
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-5
Stable by Karma
5
Stable by Time
14 days
Dates
submitted
a year ago
in testing
a year ago
in stable
a year ago
modified
a year ago

Automated Test Results