BZ#536766

Prior to this update, the "-h" and "-v" options of the getfacl and setfacl utilities were not working although they were listed in the documentation. With this update, a patch has been applied and these options are now recognized by the getfacl and setfacl utilities as expected.

BZ#580572

Prior to this update, the getfacl and setfacl utilities failed to preserve the SUID and SGID Sticky Bits along with ACLs. Consequently, after restoring ACLs from a file using the "setfacl --restore" command, all the SUID and SGID Sticky Bits were missing. This update applies backported patches from the upstream package and the problem no longer occurs in the scenario described.

BZ#729769

Prior to this update, the acpid daemon repeatedly wrote a number of CPU events to the /var/log/acpid file on certain hardware that was set up for high performance. With this update, the acpid daemon has been optimized so that the CPU events are no longer logged to /var/log/acpid.

BZ#545760

The acpid package contains a trigger scriptlet that returns a non-zero exit code if the /var/log/acpid log file does not exist. Prior to this update, if the acpid daemon was installed but never started on the system and the /var/log/acpid file did not exist, the scriptlet did not function properly and caused the package update process to fail, which could have resulted in two different acpid packages being installed on the system and registered with the RPM database (rpmdb). With this update, the acpid package has removed the spurious acpid record from rpmdb so that the problem is now fixed.

BZ#650110

The alsa-delay and alsaloop utilities have been added to alsa-utils to manage the system audio delay.

BZ#477748

When performing the kickstart upgrade with a key for advanced platforms, additional repositories were not enabled, and only the base repository packages were upgraded.

BZ#506361

Adding a VT repository to the kickstart file and using the "key --skip" command resulted in an error when trying to install the Virtualization-en-US package.

BZ#566668

Reusing the LVM logical volumes from the previous installation process caused the bootloader program to use the old disk labels so that the system was unable to boot.

BZ#571513

If the file system label ended with the "0" character, this character was stripped so that the existing file system label was different from what was explicitly specified by the user.

BZ#681219

The "CMSCONFFILE" parameter could have contained wrong syntax. This could have resulted in certain Bash errors on IBM S/390.

BZ#689470

Specifying the "CMSDASD" parameter with a hex number using uppercase letters resulted in the kickstart file not being found.

BZ#684220

The installer environment lacked the symbolic links for stdin, stdout, and stderr. As a result, the console output to the files instead of the screen.

BZ#695299

The installer used the maximum LV size limit based on the LVM 1 limits. Now, the maximum LV size limit is based on the LVM 2 limits.

BZ#702024

Only stderr was logged to the output file during the kickstart installation. Now, stdout is also logged.

BZ#703081

Using the parameter "--no-ssh" in kickstart failed to propagate the same parameter to /root/anaconda-ks.cfg.

BZ#703082

The "--no-ssh" parameter was not documented in /usr/share/doc/anaconda-*/kickstart-docs.txt.

BZ#707143

Downloading the Red Hat Enterprise Linux Release Notes resulted in errors, even though the Release Notes were downloaded successfully.

BZ#708121

The /var/log/ directory required by the Subscription Manager logging was not created.

BZ#709880

The list-harddrives script did not work as expected.

BZ#712443

Errors emitted by the kickstart scripts were not properly reported to the user.

BZ#713120

Even though the installation was run with IPv6 enabled, IPv6 was disabled in the installed environment.

BZ#714243

The Solarflare network adapters were not available to the user during the installation.

BZ#718123

The installation performed on an XTS-encrypted partition failed.

BZ#719578

When specifying the network mask during the manual network setup using the dotted format, a spurious error message was displayed.

BZ#727774

When using the bnx2i iSCSI adapters, the installer did not read IP from iBFT properly.

BZ#737161

The "dhcptimeout" option was not propagated.

BZ#738186

The "--only-use" ignoredisk parameter did not work so that Anaconda terminated unexpectedly.

BZ#742889

portmap was not available in rescue mode so that the rescue environment was unable to mount NFS volumes.

BZ#756707

Adding "-@conflicts" to the kickstart file did not prevent the conflicting packages from the @conflicts group to be installed if other packages depended on the conflicting packages. Now, the conflicting packages and packages that depend on the conflicting packages are not installed.

BZ#758106, BZ#768082

Pressing Esc in certain Anaconda windows had the same result as clicking "OK". With this update, pressing Esc has the same result as clicking "Cancel".

BZ#709931

The Network Configuration interface localization was incomplete.

BZ#711363

The Installation Number screen did not display links under the pa_IN locale.

BZ#660684

Support for the installation over the IP over InfiniBand (IPoIB) interfaces has been added.

BZ#432347

Prior to this update, Aspell terminated unexpectedly with a segmentation fault if an empty file was checked for spelling. This bug was corrected in this update so that Aspell now works as expected.

BZ#681716

Prior to this update, the file name of the spec file in the aspell-sr source package (aspell-sl.spec) was incorrect. With this update, the spec file name has been corrected to aspell-sr.spec.

BZ#654883

When the auditd daemon was in immutable mode and was restarted, the following message appeared: "The audit system is in immutable mode, no rules loaded". This message was not clear and was misleading. The message has been therefore improved to "The audit system is in immutable mode, no changes allowed".

BZ#671261

The audit.rules(7) and auditctl(8) manual pages were not consistent in the order of the "action" and "list" fields for the "-a" option. The auditctl(8) manual page has been modified to inform users that the fields can be used in either order.

BZ#702279

Previously, the autrace utility was not aware of system calls being not available on certain architectures. As a consequence, running the "autrace -r" command on the IBM System z, 64-bit PowerPC, and 32-bit Intel architectures failed to insert audit rules. With this update, autrace is aware of system calls not being available on the aforementioned architectures, and audit rules are now successfully inserted.

BZ#706156

System processes, this means processes with an audit id (auid) of -1, are logged by the audit subsystem. However, if the ausearch utility was used to locate events where the auid was -1, all events were displayed. With this update, the ausearch utility now correctly returns only events with an auid of -1.

BZ#667536

This update adds a new option to the configuration of the audisp syslog plug-in, which allows the plug-in to send syslog audit events to local syslog facilities.

BZ#750463

The recently released erratum RHBA-2011:1374, that corrected a problem with included map entry removal, introduced a new problem with included map key lookup. The condition that was used with the previous patch was too broad and the map key lookup mechanism failed to find keys in an included multi-mount map entry. The condition has been modified so that keys in multi-mount map entries are now found correctly.

BZ#744698

Previously, when a mounted autofs entry was removed from the autofs direct map and the map was reloaded before the map entry expired, the mount failed to unmount. If such a file system was unmounted manually, the next time a process tried to access this file system, the process became unresponsive. With this update, conditions preventing this behavior have been included into the code. The file system can now be accessed normally and the process no longer hangs.

BZ#735935

Prior to this update, automount always used the host's IP address instead of the host names. As a result, users had to look up the host name manually when encountering mount problems. This update modifies the name list check so that automount uses now the host name for hosts that have only one IP address.

BZ#655685

Previously, autofs submounts incorrectly handled shutdown synchronization and lock restrictions. As a consequence, automount could be unresponsive when submounts expired. With this update, the submount shuts down only after the states ST_SHUTDOWN, ST_SHUTDOWN_PENDING, and ST_SHUTDOWN_FORCE, or when the state changes to ST_READY.

BZ#692814

Previously, automount did not correctly parse unmatched brackets in map entry server names. As a consequence, the sanity check for host names in these map entries could fail. Now, unmatched brackets in server names result in a syntax error being reported and the check no longer fails.

BZ#700142

Previously, the automount logged confusing error messages when syntax errors occurred in map entry locations. This update modifies these messages and displays more informative messages were possible.

BZ#700896

Previously, LDAP servers did not correctly return an opaque cookie to check for additional results when getting paged results from the server on 64-bit PowerPC and IBM System z platforms due to slightly different criteria for deciding if there are more results. As a consequence, the autofs internal functions did not detect when paged result sets were not supported. This update modifies the underlying source code so that autofs now correctly detects whether the paged results are updated.

BZ#725536

Previously, an incorrect check for the presence of additional addresses for a host led to the IP address being used for mounting instead of the host name. As a consequence the IP address was displayed instead of the host name when listing system mounts, even when the host had only a single address. This update modifies the check so that the IP address is used only if a host has multiple IP addresses.

BZ#731514, BZ#732333

Previously, incorrect identification of the map entry source caused a failure during the key lookup. As a consequence, map lookups for an automount, where a a key was present in a file map and the same key was also found in an included map, failed if the file map entry was removed and a lookup was performed before a re-load is issued. This update modifies the key lookup code and the lookup works now as expected.

BZ#732332

Previously, automount could become unresponsive when reloading a master map that included a combination of direct and indirect maps due to incorrect lock ordering. This update corrects the logic used to determine if the lookup needs to continue into included maps.

BZ#734675

Previously, map entries were always mounted using proximity and response time instead of bind mounting when adding a random selection of a host if the mount was local. This update modifies this behavior and also adds the "nobind" option to allow the previous behavior to be forced if needed.

BZ#747020

Previously, the map key lookup mechanism did not find keys in an included multi-mount map entry. This update modifies the lookup mechanism so that keys in multi-mount map entries are now found correctly.

BZ#759221

Previously, the stack allocation function of the temporary work space was used within a loop in the function lookup_ghost(). As a consequence, a stack overflow could occur and automount then failed with a segmentation fault. This update corrects the allocation usage and the stack overflows no longer occurs.

BZ#732334

With this update,the "--dumpmaps" option to dump maps has been added to dump in autofs.

Security Fix

CVE-2011-4313

A flaw was discovered in the way BIND handled certain DNS queries, which caused it to cache an invalid record. A remote attacker could use this flaw to send repeated queries for this invalid record, causing the resolvers to exit unexpectedly due to a failed assertion.

BZ#663112

Previously, the "named" name service daemon failed to set the max open files limit to "unlimited" by default. Consequently, the error message "max open files (1024) is smaller than max sockets (4096)" was logged. With this update the problem has been fixed, named now sets max open files limit to "unlimited" as documented, and the problem no longer occurs.

BZ#676242

Prior to this update, the code in libdns which sends DNS requests was not robust enough and suffered from a race condition. If a race condition occurred, the "named" name service daemon logged an error message in the format, "zone xxx.xxx.xxx.in-addr.arpa/IN: refresh: failure trying master xxx.xxx.xxx.xxx#53 (source xxx.xxx.xxx.xxx#0): operation canceled", even when zone refresh was successful. This update improves the code to prevent a race condition in libdns and the error no longer occurs in the scenario described.

BZ#692758

A non-writable working directory is a long time feature on all Red Hat systems. Previously, named wrote "the working directory is not writable" as an error to the system log. This update changes the code so that named now writes this information only into the debug log.

BZ#703451

When the "search" option was present in the "/etc/resolv.conf" file but there were no arguments entered for the option, the contents of the following line in the file was interpreted as the missing argument. Consequently, if the following line contained the only "nameserver" option in the file, the system would have no nameservers specified and therefore fail to resolve any hostnames. With this update the code has been improved, the resolv.conf file is parsed correctly, and the problem no longer occurs in the scenario described.

BZ#712791

The "/usr/sbin/bind-chroot-admin" script created symlinks with a double-slash (//) in the paths. This caused logrotate to fail to rotate "/var/log/named.log" correctly. With this update, the bind-chroot-admin utility is fixed and no longer creates symlinks with a double-slash and as a result "/var/log/named.log" is rotated as expected.

BZ#726120

When /etc/resolv.conf contained nameservers with disabled recursion, nslookup failed to resolve certain host names. With this update, nslookup has been patched and now works as expected in the scenario described.

BZ#733698

During a DNS zone transfer, named sometimes terminated unexpectedly with an assertion failure. With this update, a patch has been applied to make the code more robust, and named no longer crashes in the scenario described.

BZ#758873

The named daemon, configured as master server, sometimes failed to transfer an uncompressible zone. The following error message was logged:

transfer of './IN': sending zone data: ran out of space The code which handles zone transfers has been fixed and this error no longer occurs in the scenario described.

BZ#703442

The manpage of the "dig" utility did not document dig's exit status codes. With this update, the "dig" manual page now describes "/usr/bin/dig" exit codes.

Security Fix

CVE-2011-4313

A flaw was discovered in the way BIND handled certain DNS queries, which caused it to cache an invalid record. A remote attacker could use this flaw to send repeated queries for this invalid record, causing the resolvers to exit unexpectedly due to a failed assertion.

BZ#728404

Prior to this update, got2 offset addends could, under certain circumstances, be wrongly incorporated into the trampoline if code at a PLTREL24 relocation with got2 offset addends referenced a symbol that was resolved locally instead of going through the Procedure Linkage Table (PLT). As a result, the trampoline transferred the code to the wrong target. With this update, the addend of the relocation is, where necessary, cleared. Now, the computation of the trampoline's target address is correct.

BZ#748927

Prior to this update, the dl debug state RT_CONSISTENT incorrectly occurred before applying dynamic relocations. As a consequence, debugging tools could not correctly monitor this call. This update adds systemtap-probes at a superset of the locations where the state RT_CONSISTENT was called.

BZ#755872

Prior to this update, the linker did not allow the local-exec Thread-local storage (TLS) model with -fPIC when creating an executable. As a consequence, the local-exec TLS model did not work with executables compiled with position-independent code (PIC) or position-independent executables (PIE) when creating an executable. This update modifies the underlying code to only disallow the local-exec TLS model when creating a shared library.

BZ#727895

An application compiled against the boost package version prior to 1.33.1-10.el5_7.2, and run with this exact version installed, could be killed by a SIGSEGV signal due to mismatch in the application binary interface (ABI) of the regular expression library. That failure could only be fixed by recompiling the application. This updated package rectifies the ABI changes in aforementioned version of the boost package.

Important: any client application which was recompiled against boost version 1.33.1-10.el5_7.2 should be recompiled against this updated package to ensure a stable ABI and avoid any potential incompatibility.

BZ#727895

Prior to this update, when several regular expression objects were created simultaneously, such as in a multi-threaded program, the construction of one of them sometimes failed. With this update, the object variables have been moved from the shared memory to the stack, thereby making the constructing function thread safe.

Security Fixes

CVE-2008-0171

Invalid pointer dereference flaws were found in the way the Boost regular expression library processed certain, invalid expressions. An attacker able to make an application using the Boost library process a specially-crafted regular expression could cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

CVE-2008-0172

NULL pointer dereference flaws were found in the way the Boost regular expression library processed certain, invalid expressions. An attacker able to make an application using the Boost library process a specially-crafted regular expression could cause that application to crash.

BZ#472384

Prior to this update, the construction of a regular expression object could fail when several regular expression objects were created simultaneously, such as in a multi-threaded program. With this update, the object variables have been moved from the shared memory to the stack. Now, the constructing function is thread safe.

BZ#567722

Prior to this update, header files in several Boost libraries contained preprocessor directives that the GNU Compiler Collection (GCC) 4.4 could not handle. This update instead uses equivalent constructs that are standard C.

BZ#729306

Previously, the bootparamd utility did not convert network byte order (big-endian) to host byte order (little-endian on Linux and x86 platforms). Consequently, the sort functionality of a router's IP addresses did not work correctly because the ulong_compare() function compared values in reverse order. This bug has been fixed, and sorting now works properly in the described scenario.

BZ#761532

Previously, the findfs command did not release used file descriptors. Therefore, the system could run out of free file descriptors on the systems with a large amount (thousands) of block devices. As a consequence, findfs failed to check all existing block devices on the system which could cause other problems, such as a kdump service failure. This update modifies BusyBox so that findfs now releases file descriptors properly and checks all block devices as expected.

Security Fixes

CVE-2006-1168

A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression. If a user were tricked into expanding a specially-crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute arbitrary code with the privileges of the user running BusyBox.

CVE-2011-2716

The BusyBox DHCP client, udhcpc, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname. A malicious DHCP server could send such an option with a specially-crafted value to a DHCP client. If this option's value was saved on the client system, and then later insecurely evaluated by a process that assumes the option is trusted, it could lead to arbitrary code execution with the privileges of that process. Note: udhcpc is not used on Red Hat Enterprise Linux by default, and no DHCP client script is provided with the busybox packages.

BZ#689659

Prior to this update, the cp command wrongly returned the exit code 0 to indicate success if a device ran out of space while attempting to copy files of more than 4 gigabytes. This update modifies BusyBox, so that in such situations, the exit code 1 is returned. Now, the cp command shows correctly whether a process failed.

BZ#756723

Prior to this update, the findfs command failed to check all existing block devices on a system with thousands of block device nodes in "/dev/". This update modifies BusyBox so that findfs checks all block devices even in this case.

BZ#502569

Due to an error in the cdparanoia SGIO (SCSI Generic I/O) layer probing, the gnome-cd utility terminated unexpectedly with a segmentation fault when accessing a device linked to the /dev/cdrom device file but using another device file name. An upstream patch has been provided to address this issue and gnome-cd no longer crashes in the described scenario.

BZ#767573

The RHSA-2011-1533 security advisory, which fixed a security vulnerability in the IPA (Identity, Policy and Audit) web-based service, caused incompatibility with older versions of certmonger. As a consequence, certmonger was unable to correctly submit enrollment requests to IPA's CA. With this update, certmonger has been modified and it now operates correctly with newer versions of IPA. Interoperability with older versions of IPA remains unaffected.

BZ#729803

When submitting a signing request to a Red Hat IPA (Identity, Policy, Audit) CA, certmonger is expected to authenticate using the client's host credentials, and to delegate the client's credentials to the server. Recent updates to libraries on which certmonger depends changed delegation of client credentials from a mandatory operation to an optional operation that is no longer enabled by default, which effectively broke certmonger's support for IPA CAs.

This update gives certmonger the ability to explicitly request credential delegation when used with newer versions of these libraries, which introduce an API that allows certmonger to explicitly request that credential delegation be performed.

BZ#712072

Prior to this update, ipa-getcert list calls from non-root users logged the misleading message ""Number of certificates and requests being tracked: 0". This update modifies the underlying code to display the correct message "Insufficient access. Please retry operation as root." when non-root users call ipa-getcert list.

BZ#756745

Prior to this update, starting the certmonger service as non-root user looged the uninformative message "Error connecting to D-Bus.". This update modifies the underlying code to display the correct message "Insufficient access. Please retry operation as root." when non-root users start the certmonger service.

BZ#757883

Prior to this update, the IPA web-based service was not compatibile with certmonger. As a consequence, certmonger was unable to correctly submit enrollment requests to IPA's CA. With this update, certmonger has been modified and it now operates correctly with newer versions of IPA.

BZ#727864

Prior to this update, libcurl could not delegate Kerberos tickets via XML-RPC to authenticate with Identity, Policy and Audit (IPA). This update adds support for the xmlrpc-c API to allow for Generic Security Services Application Program Interface (GSSAPI) delegation.

BZ#618321

Prior to this update, under certain circumstances, outgoing queues in inter-node communication of the modclusterd service could grow over time. To prevent this behavior, the inter-node communication is now better balanced and queues are restricted in size. Forced queue interventions are logged in the /var/log/clumond.log file.

BZ#736814

Prior to this update, execution of external programs (such as /usr/sbin/clustat) from within the modclusterd daemon or ricci's helper program, modcluster, could make these unresponsive. In such a case, processes depending on the programs could also become unresponsive or indicate an error. For example, in tools like luci, the affected node could be listed as having communications problems, or the cluster creation could become unresponsive. Patches have been applied to address this issue, and deadlocks no longer occur when executing external programs.

BZ#782833

Due to the latest changes of the Representational State Transfer (REST) API for Red Hat Enterprise Virtualization 3, the fence_rhevm fencing agent failed to show correct status of virtual machines. Also, the URL of the API entry point was changed in the REST API, which caused the fence_rhevm to be unable to send GET requests to the REST API. With this update, fence_rhevm has been updated to match the current REST API.

BZ#740181

Prior to this update, only one fenced option could be specified when using the cman init script. This update modifies FENCED_OPTS so that more than one option can be specified.

BZ#731306

With this update, the cman init script now allows a user to pass specific options to the fence daemon, fenced.

Bug Fixes

BZ#739966

The FENCED_OPTS variable was escaped incorrectly. Consequently, only the first option passed to FENCED_OPTS was processed correctly and any further options were ignored. This update corrects the escaping of the FENCED_OPTS and all options are now honored as expected.

BZ#590101

The shutdown_con variable was not cleared if the shutdown process was killed. This caused the cman service to terminate with a segmentation fault in the unbind_con() function if another process shut down the utility. The shutdown_con variable is now cleared after the shutdown process is canceled and the utility shuts down gracefully.

BZ#727215

The cman utility released the connection prematurely on shut down. As a consequence, cman sent spurious messages to the syslog utility. With this update, the connection is released after the shutdown process has finished and the spurious messages are no longer sent to syslog.

BZ#730634

The fence_drac5 agent did not grant enough time to the Dell Remote Access controller 5 (DRAC5) hardware to update its internal connection count. This update adds a sleep function to the respective code to provide the firmware enough time to clean old sessions and new connections are now established as expected. If you are using the DRAC5 firmware released earlier than version 1.60, the firmware needs to be upgrade to 1.60 or later to fix this bug.

BZ#746599

The cman service_cman.lcrso service did not provide debug symbols because the service was built without the -g CFLAGS option. The gcc compiler then built the debuginfo files without debugging symbols. This flag has been added to the Makefile and the service is now built with debugging symbols as expected.

BZ#745536

The ping command examples on the qdisk(5) manual page were missing the -w option. If the ping command is run without the option, the action can timeout. With this update, the -w option has been added to the example ping commands.

BZ#689851

On a blade removal, the prompt does not signal that the blade is no longer available. Previously, the fence reboot command with the --missing-as-off option relied on the prompt, and the fencing failed. With this update, fence reboot works as expected.

BZ#732773

The fence_ipmilan agent did not parse the arguments of the passwd_script option in the cluster.conf file and fencing could fail. The arguments are now parsed correctly and fencing succeeds as expected.

BZ#704243

The qdiskd daemon failed to update a Quorum disk device after it was changed and the clustat command showed an old qdisk device as being used. The interactions between the cman utility and qdisk utility have been improved including cman logging, error reports, and checks of Quorum API usage. The qdiskd daemon can now update device names in cman; the error checking at qdickd startup has been improved.

BZ#718194

Due to a mistake in the fence_drac5 list operation, Dell Drac CMC devices were not working correctly as fence devices. The fence_drac5 list operation has been fixed for Dell DRAC CMC devices.

BZ#727492

The cman(5) manual page contained an invalid multicast address in the example of a multicast address overriding. The example has been changed and now contains a valid multicast address.

BZ#715107

Previously, the fence_vmware_soap utility did not expose valid virtual machine names for fencing. The fence_vmware_soap() function has been updated to support unique virtual machine names.

BZ#753797

Fencing a Red Hat Enterprise Linux cluster node running in a virtual machine on VMWare with the fence_soap_vmware fence agent failed with the following error message:

KeyError: 'config.uuid'

This happened because the fencing agent was not able to work with more than one hundred machines in the cluster. With this update, the underlying code has been modified to support fencing of such clusters.

Enhancements

BZ#731167

The fence_rhevm utility has been updated to conform to the changes in the RHEV-M 3.0 API: The RUNNING status has been changed to the UP status.

BZ#730639

The user can now pass specific options to the fenced daemon.

BZ#726731

The fence_ipmilan fencing agent now supports the -L option for logging in as a non-privileged user and fence with the user session privileges.

BZ#749245

The fence_scsi fencing mechanism now works with CLVM (Clustered Logical Volume Manager) when High Availability LVM (HA-LVM) in CLVM mode is used to provide a data store for services.

BZ#566799

Prior to this update, cmirror could become suspended with the pvmove command on a segmented volume when attempting to connect to the checkpoint service. With this update, cmirror uses a finite number of retries when connecting to the checkpoint service and no longer becomes suspended.

BZ#713295

Prior to this update, the cmirror init script was by default switched on after the RPM installation, while all the other cluster init scripts were switched off. With this update, the cmirror init script is by default switched off.

BZ#761522

Previously, user interface of the Anaconda installer was missing variant icons for Cluster, Cluster Storage and Virtualization. With this update, these icons have been added.

BZ#741169

Prior to this update, when a new cluster was being created with luci, and luci tried to list, install or update cluster packages, the installation process could become unresponsive and could not finish. With this update, the bug has been fixed, and the creation of a new cluster now completes successfully in the described scenario.

Security Fixes

CVE-2010-1104, CVE-2011-1948

Multiple cross-site scripting (XSS) flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's luci session.

Bug Fixes

BZ#709478

Previously, due to incorrect permissions from libvirt, the ricci daemon failed to detect if a host was capable of running a virtual machine. As a consequence, the Add a Virtual Machine Service tab was not displayed under Services when using the luci tool. With this update, calling the virsh program is now avoided, and the Add a Virtual Machine Service tab is now displayed under Services.

BZ#723000

If the user modified in luci the name attribute of a shared resource that was attached to an existing service, the ref attribute for the shared resource in the cluster.conf file was not updated. With this update, luci is modified so that the ref attribute in cluster.conf is correctly updated to reflect the new name of the resource.

BZ#723188

Previously, luci did not allow users to modify the __max_restarts and __restart_expire_time attributes for independent subtrees, but only for non-critical resources. If the user tried to set values for "Maximum number of restart failures before giving up (applies only for non-critical resources)" and "Restart expire time (applies only for non-critical resources)", these values were not added for the resource in the cluster.conf file. This update modifies luci so that users are now able to modify the aforementioned values in luci.

BZ#732483

Prior to this update, execution of external programs (such as /usr/sbin/clustat) from within the modclusterd daemon or ricci's helper program, modcluster, could make these unresponsive. In such a case, processes depending on them could also become unresponsive or indicate an error. For example, in tools like luci, the affected node could be listed as having communications problems, or the cluster creation could become unresponsive. Patches have been applied to address this issue, and deadlocks no longer occur when executing external programs.

BZ#734562

When adding a resource to a service, luci only checked to verify that the name of the resource did not match the name of a resource in the resources stanza. The luci tool did not check to see if any resources in other services shared the same name, and therefore allowed users to create two services with the resources of the same name. This led to unique attribute collisions. With this update, luci's name validation is improved, and adding a resource to a service no longer leads to collisions. In addition, certain error messages have been modified to display more verbose information.

BZ#739600

Previously, users were able to insert the quote character (") with NFS resources in the "resources" section of the cluster configuration in conga. The resource data submitted for this service was not properly formed and converted into the cluster.conf file. With this update, if the user inserts the quote character, the following error message appears:

The resource data submitted for this service is not properly formed

BZ#755941

Previously, the luci_admin restore command did not fully restore a database to the original state. This was because the luci_admin script only added items contained in the previously generated backup XML file. This update adds new options, -u (--update) and -r (--replace), that are used to either keep or remove existing configuration when restoring a database.

Enhancement

BZ#751359

The fence_ipmilan agent has been updated to support the "-L" option of the ipmilan daemon, thus supporting fencing with user session privileges level.

BZ#715072

The crash package has been upgraded to upstream version 5.1.8, which provides a number of enhancements and bug fixes over the previous version.

BZ#676408

On AMD64 and Intel 64 architectures, the "bt" command failed when the shutdown NMI was issued to a 32-bit task that had executed a "sysenter" instruction and the RSP still contained the zero value loaded from the MSR_IA32_SYSENTER_ESP register. Consequently, the backtrace issued the following warning message:

"WARNING: possibly bogus exception frame"

and was unable to make a transition from the NMI exception stack back to the process stack. With this update, the underlying source code has been modified to address this issue, and the aforementioned command no longer fails.

BZ#713050

On AMD64 and Intel 64 architectures, the "bt" command failed with several backtrace errors for non-crashing active tasks:

"bt: cannot resolve stack trace"

This was due to a failure to properly transition from the shutdown NMI stack back to the process stack. This update fixes these errors, and executing the "bt" command on non-crashing active tasks works as expected.

BZ#716327

KVM virtual systems contain an I/O hole in the physical memory region from 0xe0000000 to 0x100000000 (3.5 GB to 4 GB). If a guest is provisioned with more than 3.5 GB of RAM, then the memory above 3.5 GB is "pushed up" to start at 0x100000000 (4 GB). However, the "ram" device headers in the KVM dumpfiles do not reflect that. As a result, numerous error messages were displayed during invocation, and the session would often fail. With this update, the crash utility takes the I/O hole into account despite the fact that the "ram" device headers in KVM dumpfiles do not; consequently, error messages are no longer displayed during invocation.

BZ#715070

The KVM I/O hole size is currently set to either 1 GB or 512 MB, but its setting is hardwired into the Qemu code that was used to create the dumpfile. The dumpfile is a "savevm" file that is designed to be used for guest migration, and since inter-version save/load operations are not supported, the I/O hole information does not have to be encoded into the dumpfile. Prior to this update, the I/O hole for dumpfiles created by older Qemu version was not being set to 1GB, so if the KVM guest was configured with more than 3GB of memory, the crash session would typically display numerous "read error" messages during session initialization. With this update, the crash session does not return any error messages during session initialization.

CVE-2011-2896

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF image file that, when printed, could possibly cause CUPS to crash or, potentially, execute arbitrary code with the privileges of the "lp" user.

BZ#625900

Prior to this update, the "Show Completed Jobs," "Show All Jobs," and "Show Active Jobs" buttons returned results globally across all printers and not the results for the specified printer. With this update, jobs from only the selected printer are shown.

BZ#625955

Prior to this update, the code of the serial backend contained a wrong condition. As a consequence, print jobs on the raw print queue could not be canceled. This update modifies the condition in the serial backend code. Now, the user can cancel these print jobs.

BZ#660518

Prior to this update, the textonly filter did not work if used as a pipe, for example when the command line did not specify the filename and the number of copies was always 1. This update modifies the condition in the textonly filter. Now, the data are sent to the printer regardless of the number of copies specified.

BZ#668009

Prior to this update, the file descriptor count increased until it ran out of resources when the cups daemon was running with enabled Security-Enhanced Linux (SELinux) features. With this update, all resources are allocated only once.

BZ#759081

Prior to this update, CUPS incorrectly handled the en_US.ASCII value for the LANG environment variable. As a consequence, the lpadmin, lpstat, and lpinfo binaries failed to write to standard output if using LANG with the value. This update fixes the handling of the en_US.ASCII value and the binaries now write to standard output properly.

BZ#727884

As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this issue, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly.

BZ#652557

In the FTP implementation, libcurl incorrectly called the accept() function from a system library, which caused a stack overflow under certain circumstances. This update applies a backported upstream patch that corrects this bug, and the stack overflow no longer occurs.

BZ#655073

Previously, an attempt to send an LDAP request through an HTTP proxy tunnel ended up with cURL trying to connect to the LDAP server directly using a wrong port number. With this update, the underlying source code has been modified to fix this problem, and cURL now works as expected.

BZ#688871

Previously, the "multi" interface of libcurl was broken, which caused the "git push" command to work incorrectly over the Web Distributed Authoring and Versioning (WebDAV) protocol. This update applies an upstream patch, which corrects counting of active connections in the "multi" interface. The "git push" command now works as expected over WebDAV.

BZ#723643

As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this problem, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly.

BZ#657396

Previously, curl did not support proxy authentication using Kerberos. With this update, underlying code has been modified and curl now allows Kerberos proxy authentication by using the "--proxy-negotiate" option.

BZ#746849

The cURL utility did not allow Kerberos credential delegation although the libcurl library provided appropriate support for this functionality. This update introduces a new option, "--delegation", which enables Kerberos credential delegation in cURL.

BZ#538376

Previously, the CVS server did not pass the client address to the Pluggable Authentication Modules (PAM) system. As a result, it was not possible to distinguish clients by the network address with the PAM system and the system was not able to utilize the client address and use it for the authentication or authorization purposes. With this update, the client network address is passed to the PAM subsystem as a remote host item (PAM_RHOST). Also, the terminal item (PAM_TTY) is set to a dummy value "cvs" because some PAM modules cannot work with an unset value.

BZ#769298

Previously, when using the "cvs rtag" command with a repository, which included the "." character in the repository path, the CVS server hit the assertion test and terminated. With this update, the assertion check for "." in the CVSROOT path has been removed as CVS can process this path safely now so that "cvs rtag" works with repositories with "." in the CVSROOT path as expected.

Security Fixes

CVE-2011-3372

An authentication bypass flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials.

CVE-2011-3481

A NULL pointer dereference flaw was found in the cyrus-imapd IMAP server, imapd. A remote attacker could send a specially-crafted mail message to a victim that would possibly prevent them from accessing their mail normally, if they were using an IMAP client that relies on the server threading IMAP feature.

Security Fix

CVE-2011-3208

A buffer overflow flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to crash the nntpd child process or, possibly, execute arbitrary code with the privileges of the cyrus user.

BZ#634323

Previously, an error in the code path in the uDAPL layer did not allow the cp_ptr entry to be cleaned up correctly in the internal link list. This could cause new connections to fail. With this update, the entry is cleaned up correctly and subsequent connections work as expected.

BZ#634324

Previously, dapl could leak file descriptors and the application could terminate. With this update, the leak is closed and dapl behaves as expected.

BZ#636193

Previously, verbs CQ and completion channels were not correctly disconnected and freed, which could cause an application crash. With this update, verbs CQ and completion channels behave as expected.

BZ#636197

Previously, an error in the code path in the compat-dapl layer did not allow the cp_ptr entry to be cleaned up correctly in the internal link list. This could cause new connections to fail. With this update, the entry is cleaned up correctly and subsequent connections work as expected.

BZ#645825

Under certain circumstances, the dat_ia_open() call and the programs using the function could become unresponsive. With this update, the underlying code has been modified and the function behaves as expected.

BZ#658950

Due to an invalid error mapping, when dapl received a signal during the execution of the dapls_evd_dto_wait() function, it could fail to set the correct error type, which may have led to an incorrect operation. With this update, the relevant part of the source code has been modified to return the correct value, and dapl now works as expected.

Security Fix

CVE-2011-2200

A denial of service flaw was found in the way the D-Bus library handled endianness conversion when receiving messages. A local user could use this flaw to send a specially-crafted message to dbus-daemon or to a service using the bus, such as Avahi or NetworkManager, possibly causing the daemon to exit or the service to disconnect from the bus.

BZ#454618

The dmeventd daemon was not properly restarted after the package update. Consequently, dmeventd did not apply the newly updated libraries and continued using the old libraries. Therefore, logical volume monitoring failed and had to be re-activated because particular monitoring events were not handled as expected. With this update, dmeventd properly restarts after the package update so that updated libraries are applied and logical volumes are monitored as expected.

BZ#729478

The multipath priority callout programs did not work correctly with CCISS (Compaq Command Interface for SCSI-3 Support) devices because the multipath utility was not able to convert the "!" character in the CCISS sysfs name to the "/" character in the CCISS device name. As a consequence, callout programs failed to set path priorities for these devices. The underlying code has been modified, and the multipath utility now supports the new "%c" wildcard for callout functions, and thus ensures the correct CCISS names conversion.

BZ#728144

Previously, device-mapper-multipath was looking for a CCISS device information at the incorrect location in the sysfs file system. As a consequence, it was impossible to configure multipath on CCISS devices. This bug has been fixed, device-mapper-multipath now finds the device information properly in the described scenario, and multipath can now be properly configured on CCISS devices.

Bug Fixes

BZ#741664

If a multipath device was deleted while its path was being checked, the multipathd daemon did not abort the path check. Consequently, the multipath application terminated unexpectedly if it attempted to access the multipath device information. With this update, multipathd aborts the path check and the daemon no longer crashes in this scenario.

BZ#703501

Previously, the multipathd daemon was looking for Compaq Command Interface for SCSI-3 Support (CCISS) device information at an incorrect location in the sysfs file system. As a consequence, it was impossible to configure multipath on CCISS device. This bug has been fixed, device-mapper-multipath now finds the device information in the described scenario, and multipath can now properly configure CCISS devices.

BZ#702410

The multipathd daemon was printing warning messages on removal of non-multipath Device Mapper devices. With this update, the underlying code has been fixed and no warning messages are logged on removal of such devices.

BZ#737072

Previously, SCSI targets could time out on SCSI commands and consequently become unresponsive. This happened because the mpath_prio_alua priority callout used by the commands was set to five minutes. With this update, the callout timeout has been changed to one minute.

BZ#703277

The multipathd daemon maintains a list of essential directories it needs to be able to access from its private namespace at all times. When unmounting an unnecessary device, multipath checks if the device mount point is not in the list. Previously, multipathd did not check whether the directories listed were symbolic links to the devices and did not consider the devices mounted at the symlinked mount point to be necessary. Consequently, if such a device was marked as unnecessary, multipathd unmounted the device even though the location was listed as essential, because it was listed as a symbolic link. With this update, multipathd detects symbolic links to necessary devices in the list and the symlinked devices are not unmounted. This update also adds a new parameter, keep_dir, which allows users to specify directories that multipathd preserves in its private namespace.

BZ#655203

If the user attempted to delete a multipath device but failed because partitions of the device were in use, some of the device partitions remained deleted. With this update, if multipathd fails to delete the entire device, it restores any partitions, which were already deleted.

BZ#729478

The multipath priority callout programs did not work correctly with CCISS (Compaq Command Interface for SCSI-3 Support) devices because the multipath utility was not able to convert the exclamation mark (!) character in the CCISS sysfs name to the slash (/) character in the CCISS device name. As a consequence, the callout programs failed to set path priorities for these devices. The multipath utility now supports the new %c wildcard for callout functions and the CCISS names are converted correctly.

BZ#650795

The multipathd daemon returned incorrect path groupings for the multipath devices configured to use the group_by_node_name grouping policy. This was due to an incorrect reporting of the target node name for iSCSI targets. With this update, multipath checks the iSCSI target name if the FC (Fibre Channel) path check fails and the target name reporting works as expected.

BZ#716329

Previously, multipathd terminated unexpectedly if the file_timeout parameter was set to 0. With this update, multipathd uses the default file timeout of 90 seconds just as when the parameter is set to a negative value and the problem no longer occurs.

BZ#740512

The mpath_prio_alua callout occasionally failed. This happened because multipathd did not clean some of the buffers used to collect the SCSI data. With this update, the buffers are cleaned properly and the problem no longer occurs.

BZ#740022

Multipath commands failed on a multipath device if the current working directory contained a file with the same name as the multipath device name. This happened because multipathd assumed that the argument was referring to the file. Multipath now performs a check to prevent such an incorrect argument handling and the commands are executed as expected in this scenario.

BZ#655976

On a device set to manual failback, multipath was incorrectly failed back to the primary path group on a path's priority change. With this update, the device no longer fails back to the primary path group under these circumstances.

BZ#711970

Previously, the multipath default configuration defined the path selector using the selector key word, while device sections were using the path_selector key word. To ensure consistency, the default section now accepts both key words, the selector and path_selector.

BZ#719575

The kpartx utility built partition devices for GUID partition tables (GPT) with incorrect partition entry size. This happened because the utility did not validate the size of the GUID partitions. The kpartx utility now checks the size of the partitions, and partitions of an invalid GPT are no longer created.

BZ#715524

Previously, the default config value file_timeout was not documented. This update adds the respective documentation to the multipath.conf.annotated file.

Security Fixes

CVE-2011-2748, CVE-2011-2749

Two denial of service flaws were found in the way the dhcpd daemon handled certain incomplete request packets. A remote attacker could use these flaws to crash dhcpd via a specially-crafted request.

BZ#736515

Previously, the anaconda dhcptimeout value was not fully propagated to libdhcp4client's internal timeout_arg. As a result, it used the insufficient default timeout of 60 seconds. With this update, anaconda dhcptimeout value is correctly propagated and the problem no longer occurs with this update. This update is a dependency of BZ#737155 and BZ#737161.

Security Fix

CVE-2011-1929

A denial of service flaw was found in the way Dovecot handled NULL characters in certain header names. A mail message with specially-crafted headers could cause the Dovecot child process handling the target user's connection to crash, blocking them from downloading the message successfully and possibly leading to the corruption of their mailbox.

Security Fixes

CVE-2011-1831

The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the "ecryptfs" group.

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.

CVE-2011-1832

A race condition flaw in umount.ecryptfs_private could allow a local attacker to unmount an arbitrary file system.

CVE-2011-1834

It was found that mount.ecryptfs_private did not handle certain errors correctly when updating the mtab (mounted file systems table) file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system.

CVE-2011-1835

An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user's encrypted data if existing file permissions allow access.

CVE-2011-1837

A race condition flaw in mount.ecryptfs_private could allow a local attacker to overwrite arbitrary files.

CVE-2011-3145

A race condition flaw in the way temporary files were accessed in mount.ecryptfs_private could allow a malicious, local user to make arbitrary modifications to the mtab file.

CVE-2011-1833

A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of the directory to mount. A local attacker could use this flaw to mount (and then access) a directory they would otherwise not have access to. Note: The fix for this issue is incomplete until a kernel-space change is made. Future Red Hat Enterprise Linux 5 and 6 kernel updates will correct this issue.

BZ#554740

Previously, the eCryptfs daemon, ecryptfsd, failed to start if the ecryptfs kernel module had not already created the files necessary for user space communication under the /dev/ and /dev/misc/ directories, and "No such file or directory" messages were logged. This update avoids this race condition by ensuring that the ecryptfsd daemon waits and then attempts to start again if it discovers that the requisite files have not yet been created.

BZ#553629

Prior to this update ecryptfs did not correctly handle the salt option together with the password file. As a result mounting of the encrypted file system would fail and the error, "Bad address", would be displayed. With this update ecryptfs correctly handles the salt option and mounting of the encrypted file system using eCryptfs no longer fails.

BZ#733090

United States Government Configuration Baseline (USGCB) for Red Hat Enterprise Linux prohibits world-writable directories owned by users. The previous version of ESounD created a temporary directory, /tmp/.esd, with incorrect permissions and placed its socket there. This update ensures that the directory is owned by the root user, and ESounD is thus compliant with the USGCB guidance for Red Hat Enterprise Linux.

BZ#512938

Prior to this update, fcoeadm displayed misleading messages when working with non-existing interfaces. This update modifies the underlying code so that fcoeadm now reports only that no host was found on the interface.

BZ#703374

Prior to this update, the long options "--interface" and "--target" did not report all FCoE instances that were created on the system. This update modifies the commands so that they report all FCoE instances and behave in the same way as the short options "-i" and "-t".

BZ#620640

Previously, fetchmail would fail with a socket error when attempting to write to a BSMTP (Batch Simple Mail Transport Protocol) batch file when downloading mail. It failed with a socket error after writing the first header to the BSMTP batch file and displayed, "socket error while fetching from". As a result, fetchmail could not download mail using BSMTP. With this update to fetchmail, the fetchmail package will now correctly write to the BSMTP batch file.

BZ#486328

Previously, the file utility always checked a section of the core file which was only used by FreeBSD when looking up command names. As a consequence, an incorrect command name could be reported. This update checks this offset only if the core file was generated on a FreeBSD plattfrom. Now, the file utility displays the correct file name.

BZ#489493

Previously, the file utility did not correctly recognize file system dumps generated by the "dump" utility on PowerPC and IBM System z platforms which were wrongly identified as a "JVT NAL" sequence. This update modifies the order of the magic patterns. Now, the file utility correctly identifies these dumps.

BZ#494831

Previously, the Note field stored in Executable and Linkable Format (ELF) binaries was wrongly processed twice. As a consequence, the message "for GNU/Linux X.Y.Z" was displayed twice for certain binary files. This update modifies the process. Now, the Note field is processed only once.

BZ#498671

Previously, the definition for the Multipurpose Internet Mail Extensions (MIME) type "XML" was missing in the magic file. As a consequence, the MIME type for XML files was not displayed. This update adds this MIME type to the magic file.

BZ#504417

Previously, the file utility did not recognize the swap file system on PowerPC platforms. Now, a new magic pattern for swap on PowerPC platforms is added and the file utility now identifies the swapspace correctly.

BZ#505656

Previously, the "msword" MIME type was listed two times in DOC/XLS magic patterns. As a consequence, the "application/msword" MIME type was displayed twice for certain Microsoft Office 2007 files. Now, the second MIME type definition is removed.

BZ#508688

Previously, the magic pattern for detecting the PPD files did not work as expected. As a consequence, the file utility truncated the "version" string of certain PPD files. This update displays the "version" string correctly and no longer truncates the version number.

BZ#548450

Previously, the manual page did not mention that a 0 exit code was returned when input files were not found. This update adds the missing information to the manual page.

BZ#618910

Previously, the file utility always attempted to read complete files from stdin to get additional information about ELF binary even when the file was not an ELF binary. As a consequence, the process used a large amount of memory and took a long time. This update detects if a file is an ELF binary using the ELF magic bytes and reads the complete file only when the file is an ELF binary.

BZ#641838

Previously, the file utility could wrongly recognize gzip files as FLC files. This update changes the order of gzip and FLC magic patterns. Now, the file utility identifies gzip files correctly.

BZ#668125

Previously, the GFS1 and GFS2 file systems shared the same magic number in the superblock which the file utility used to identify the GFS2 file system. As a consequence, the file utility wrongly recognized GFS2 file systems as GFS1 file systems. This update adds a new magic pattern for the GFS2 file system. Now, the file utility identifies GFS2 correctly.

BZ#692435

Previously, two magic patterns for XML identification were wrongly merged into one. As a consequence, the file utility could not identify the MIME type for XML files starting with "?xml". This update splits these two patterns. Now, the correct MIME type is displayed.

BZ#758429

Previously, the file utility could wrongly recognize JPEG files as Minix file systems. This update changes the order of JPEG and Minix magic patterns. Now the file utility recognizes JPEG files correctly.

Security Fixes

CVE-2011-3659

A use-after-free flaw was found in the way Firefox removed nsDOMAttribute child nodes. In certain circumstances, due to the premature notification of AttributeChildRemoved, a malicious script could possibly use this flaw to cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2012-0442

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2012-0444

A flaw was found in the way Firefox parsed Ogg Vorbis media files. A web page containing a malicious Ogg Vorbis media file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2012-0449

A flaw was found in the way Firefox parsed certain Scalable Vector Graphics (SVG) image files that contained eXtensible Style Sheet Language Transformations (XSLT). A web page containing a malicious SVG image file could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-3670

The same-origin policy in Firefox treated http://example.com and http://[example.com] as interchangeable. A malicious script could possibly use this flaw to gain access to sensitive information (such as a client's IP and user e-mail address, or httpOnly cookies) that may be included in HTTP proxy error replies, generated in response to invalid URLs using square brackets.

Security Fixes

CVE-2011-3647

A flaw was found in the way Firefox handled certain add-ons. A web page containing malicious content could cause an add-on to grant itself full browser privileges, which could lead to arbitrary code execution with the privileges of the user running Firefox.

CVE-2011-3648

A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website.

CVE-2011-3650

A flaw was found in the way Firefox handled large JavaScript scripts. A web page containing malicious JavaScript could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

Security Fixes

CVE-2011-2995

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-2372

A flaw was found in the way Firefox processed the "Enter" keypress event. A malicious web page could present a download dialog while the key is pressed, activating the default "Open" action. A remote attacker could exploit this vulnerability by causing the browser to open malicious web content.

CVE-2011-3000

A flaw was found in the way Firefox handled Location headers in redirect responses. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Firefox now treats two copies of the Location, Content-Length, or Content-Disposition header as an error condition.

CVE-2011-2999

A flaw was found in the way Firefox handled frame objects with certain names. An attacker could use this flaw to cause a plug-in to grant its content access to another site or the local file system, violating the same-origin policy.

CVE-2011-2998

An integer underflow flaw was found in the way Firefox handled large JavaScript regular expressions. A web page containing malicious JavaScript could cause Firefox to access already freed memory, causing Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

Security Fix

BZ#735483

The RHSA-2011:1242 Firefox update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted.

Security Fix

BZ#734316

It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Firefox; however, affected certificates issued after this date cannot be re-enabled or used.

Security Fixes

CVE-2011-2982

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-0084

A dangling pointer flaw was found in the Firefox Scalable Vector Graphics (SVG) text manipulation routine. A web page containing a malicious SVG image could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-2378

A dangling pointer flaw was found in the way Firefox handled a certain Document Object Model (DOM) element. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-2981

A flaw was found in the event management code in Firefox. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox.

CVE-2011-2983

A flaw was found in the way Firefox handled malformed JavaScript. A web page containing malicious JavaScript could cause Firefox to access already freed memory, causing Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2011-2984

It was found that a malicious web page could execute arbitrary code with the privileges of the user running Firefox if the user dropped a tab onto the malicious web page.

BZ#642510

Previously, the number of active sound cards was counted incorrectly. As a consequence, even if no sound cards were installed, the sound setup screen could be displayed after the user had set up an account. With this update, the number of active sound cards is counted correctly, and the sound card screen is now displayed only if supported hardware is found.

BZ#653442, BZ#706074

On architectures where the firstboot utility is supported to run only in text mode, firstboot could fail to start with a traceback if the DISPLAY environment variable was set. With this update, an error message is displayed, and informs the user that the firstboot-tui utility can not be run when DISPLAY is set. In addition, users are advised to install the firstboot package, which provides the firstbootWindow.py file and fixes the problem.

Security Fix

CVE-2011-2697

An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the "lp" user.

BZ#439411

Prior to this update, the "ipmi-sel" tool did not properly initialize itself and crashed when reading an empty SEL (System Event Log). With this update, ipmi-sel initialization is fixed and the tool no longer crashes when reading an empty SEL.

BZ#639850

Prior to this update, the "freeipmi-bmc-watchdog" service start did not expect that a Baseboard Management Controller (BMC) watchdog timer could already be running and did not reset the timer. In addition, the service stop did not stop the BMC watchdog timer. This could result in a watchdog timer resetting, or shutting down, the machine. With this update, "service freeipmi-bmc-watchdog start" resets any previously started BMC watchdog timer and "service freeipmi-bmc-watchdog stop" correctly stops the timer. As a result the machine boots up normally.

BZ#546583

The documentation of command-line arguments was incomplete and in some cases erroneous; some commands did not have a man page. The man pages and help output were updated to correct these deficiencies.

BZ#602567

Previously, freeradius2 did not respect the core dump configuration flag. Consequently, the radiusd process did not produce a core dump file when it terminated unexpectedly with a segmentation fault. With this update the problem has been fixed, and now if radiusd aborts, a core dump is now generated if the core dump flag is enabled.

BZ#658508

The freeradius-pam-conf configuration file, /etc/pam.d/radiusd, referenced a non-existent pam configuration "password-auth". This has been fixed to refer to "system-auth".

BZ#756442

The previous version of freeradius generated its temporary SSL certificates the first time the server was run with the "-X" debug flag. Now the temporary certificates are created the first time the freeradius RPM is installed. It is no longer necessary to run the server in debug mode to create the initial certificates.

BZ#760193

The radtest command-line argument to request the PPP hint option was not parsed correctly. Consequently, radclient did not add the PPP hint to the request packet and the test failed. This update corrects the problem and radtest now functions as expected.

Enhancements

BZ#630072

The radtest tool did not send a Message-Authenticator by default in an Access-Request. Consequently, radtest could not connect to a RADIUS server if it required the authenticator as per RFC 5080. With this update the problem has been fixed, and now the Message-Authenticator is always sent.

Security Fixes

CVE-2011-3439

Multiple input validation flaws were found in the way FreeType processed CID-keyed fonts. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Note

These issues only affected the FreeType 2 font engine.

Security Fixes

CVE-2011-3256

Multiple input validation flaws were found in the way FreeType processed bitmap font files. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Note

These issues only affected the FreeType 2 font engine.

BZ#503085

Due to an assertion check, the Gamin server terminated unexpectedly after a certain amount of time. With this update, the assertion has been silenced so that the Gamin server now works as expected.

BZ#629196

Prior to this update gawk interpreted (under certain circumstances) some run-time variables as internal zero-length variable prototypes. When gawk tried to free such run-time variables, it actually freed the internal prototypes, that were allocated just once due to memory savings. Consequently gawk sometimes failed and the error message "awk: double free or corruption" was displayed. With this update the problem has been corrected and the error no longer occurs.

BZ#651098

Previously, the g++ compiler consumed excessive memory when compiling a program that used a vast amount of various data definitions and function overloading. This has been fixed and the g++ compiler uses much less memory under these circumstances.

BZ#745004

Global variable lookup did not match the C code lookup. As a result, a variable appeared to have incorrect values assigned during debugging. This happened if a global variable with the same name was exported by multiple libraries and the libraries were stored at the same location. With this update, the variable lookup has been modified to match the C code lookup.

BZ#706383

The gcov tool incorrectly counted opening brackets in an error handling block specification ("throw") if the specification was not located on the same line as its parent function. With this update, the code handling for such situations has been added and the throw blocks are handled as expected.

BZ#735304

A program compilation could terminate with an internal compiler error because the compiler failed to update hash tables while creating precompiled headers of the libstdc++ library. With this update, the compiler uses the DECL_UID variable when creating the precompiled headers and the problem no longer occurs.

BZ#722252

A GNU Data Language (GDL) program compilation could terminate with an internal compiler error. This happened due to incorrect gimplification of the try-catch block. With this update, the underlying code has been modified and the try-catch blocks are now compiled correctly.

BZ#746405

Under certain circumstances, program compilation with the gfortran compiler could have resulted in the following error:

internal compiler error: in modified_type_die, at dwarf2out.c:8495

With this update, the underlying code has been modified and the problem no longer occurs.

BZ#742118

This update adds binutils for the AMD FX Bulldozer central processing unit (CPU) to support the Bulldozer-capable gcc44 toolchain.

BZ#728151

When the GDB convenience variable contained a structure, accessing a field of this structure caused a GDB internal error. The code has been modified to ensure that internal setting of field address is not executed for GDB convenience variables. As result, GDB can now access fields of structures stored in convenience variables.

BZ#658851

GDB could stop with an error when trying to access the libpthread shared library before the library was relocated. With this update, GDB lets the library relocations be resolved first, allowing GDB to debug programs properly under these circumstances.

BZ#696148

Modifying a string in the executable using the "-write" command line option could fail with an error if the executable was not running. With this update, GDB can modify executables even before they are started.

BZ#720717

When printing data from a string buffer of constant size, GDB, by default, also prints the data following after the first zero byte ("\0") of the string. To display only the data before the zero byte, the "set print null-stop" option has to be set. Previously with this option set, GDB did not display any string content due to an incorrect zero byte test condition in the code. The test condition has been corrected and GDB now properly displays data located before the first zero byte.

BZ#727726

GDB convenience variables allow a user to store and retrieve arbitrary data of arbitrary data types. Previously, when the GDB convenience variable contained a structure data type, accessing a field of the structure caused an internal error. With this update, this problem has been corrected, and GDB now works with structure convenience variables correctly.

BZ#748267

When loading a core dump file for debugging, GDB could incorrectly interpret inappropriate memory content as the pthread_t identifier if the version of the glibc library installed on the system did not match the glibc version used to create the core dump file. Consequently, initialization of the libthread_db library failed due to an unexpected value of pthread_t, which led to a GDB internal error. With this update, GDB only displays a warning message and successfully loads the core file. Instead of the pthread_t identifiers, which are unavailable in this failure scenario, GDB displays the LWP (light-weight process) identifiers that match the Linux TID (Thread Identifier) values of the threads found in the core file.

BZ#217417

Previously, the gdmsetup utility did not automatically add users to the user whitelist file /etc/gdm/custom.conf, although these users were configured for automatic login. With this update, the problem has been fixed and users are now automatically added to the whitelist file, as expected.

BZ#575771

Previously, the GDM GUI was not properly resized when the failed authentication message was displayed for the user. As a result, the failed authentication message was not displayed correctly. With this update, the problem has been fixed so that the GUI is resized properly and the message is displayed as expected.

BZ#658506

When shutting down the X Window System, the gdm-rh-security-token-helper program could have terminated unexpectedly with a segmentation fault under certain circumstances. With this update, the problem has been fixed, and gdm-rh-security-token-helper works as expected.

BZ#732129

Previously, the directory pre-fetching GFS functionality could decrease performance of some applications that were running on the GFS file system. This update introduces a new GFS mounting option, "-o noprefetch", which disables the directory pre-fetching feature. The applications running on the GFS file system mounted with this option no longer experience performance problems caused by this feature.

BZ#761157

When attempting to add files to a GFS file system and the file system became full, the GFS kernel daemon did not properly release resources allocated for inodes that could not be created. This could result in file system corruption. This patch introduces new cleanup code, which removes partially created inodes and releases allocated resources correctly.

BZ#704328

Prior to this update, metawalk.c did not correctly consider leaf continuation blocks. As a result, the offline GFS file system checker (gfs_fsck) did not correctly check file systems with 500,000 or more files. This update modifies the fsck.gfs code so that gfs_fsck now also works on larger file systems.

BZ#766646

Prior to this update, the gfs_mount(8) manual page did not list the recently added the GFS mount options "-o noprefetch", "prefetch", "errors=panic", and "errors=withdraw". This update adds these GFS mount options.

BZ#711451

To expand a GFS2 file system, additional resource groups must be added to manage new space. The gfs2_grow utility ensures this by writing to the rindex file. Previously, if there was not enough free space in the file system to write out new resource group entries, gfs2_grow was unable to update the rindex file. As a consequence, gfs2_grow was unable to expand the file system and failed with the following error message:

Error writing new rindex entries;aborted.

With this update, gfs2_grow writes one resource group at first, and then the rest instead of attempting to write all the new resource groups at once. Now, gfs2_grow successfully expands the file system in the described scenario.

BZ#714739

Previously, the libgfs2 library used the obsolete MAJOR() and MINOR() macros to handle device numbers. These macros did not support device numbers greater than 255, and could cause error messages to be displayed when using gfs2-utils. The macros have been replaced by the major() and minor() functions, and gfs2-utils now works properly with device numbers greater than 255.

BZ#720935

Previously, the "mkfs.gfs2" command worked only on block devices. Using the command on sparse files failed with an error message. An upstream patch has been applied to address this issue, and the mkfs.gfs2 utility now also recognizes regular files.

BZ#730091

Previously, the gfs2_grow utility failed to expand a GFS file system if the file system contained only one resource group. This was due to old code based on GFS1 (which had different fields) that calculated distances between resource groups and did not work with only one resource group. This update adds the rgrp_size() function in libgfs2, which calculates the size of the resource group instead of determining its distance from the previous resource group. The file system with only one resource group can now be expanded successfully.

BZ#745126

Due to a bug in libgfs2, sentinel directory entries were counted as if they were real entries. As a consequence, the mkfs.gfs2 utility created file systems which did not pass the fsck check when a large number of journal metadata blocks was required (for example, a file system with block size of 512, and 9 or more journals). With this update, incrementing the count of the directory entry is now avoided when dealing with sentinel entries. GFS2 file systems created with large numbers of journal metadata blocks now pass the fsck check cleanly.

BZ#702296

Prior to this update, when executing the "gfs2_edit" command with the "savemeta" or "restoremeta" options specified, the command produced uncompressed files that were very large in size. This update allows gfs2_edit to compress metadata while writing by using the "savemeta" option, and also read a compressed metadata file by using the "restoremeta" option.

Security Fixes

CVE-2009-3743

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially-crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code.

CVE-2010-2055

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the "-I" option, or the "-P-" option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.

CVE-2010-4820

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the "-P-" option in an attacker-controlled directory containing a specially-crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.

Note

The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the "-P" option (to always search the current working directory first).

CVE-2010-4054

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially-crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code.

BZ#734764

Prior to this update, the page orientation was incorrect when pages in landscape orientation were converted to the PXL raster format. This update matches landscape page sizes as well as portrait page sizes, and sets the orientation parameter correctly when a match is found.

BZ#734767

Prior to this update, certain input files containing CID Type2 fonts were rendered with incorrect character spacing. This update modifies the code so that all input files with CID Type2 fonts are rendered correctly.

BZ#675307

Previously, using the ps2pdf utility to convert a PostScript file to the PDF format caused the resulting document to be created with non-working hyperlinks. This update applies an upstream patch that resolves this issue, and ps2pdf now creates PDF files with correct hyperlinks.

BZ#688996

Prior to this update, certain input files containing CID Type2 fonts were rendered with incorrect character spacing. This update modifies the code so that all input files with CID Type2 fonts are rendered correctly.

BZ#692165

Prior to this update, the page orientation was incorrect when pages in landscape orientation were converted to the PXL raster format. This update matches landscape page sizes as well as portrait page sizes, and sets the orientation parameter correctly when a match is found.

Enhancement

BZ#710074

Improved support for the PDF/A format has been back-ported from upstream.

Security Fixes

CVE-2009-5029

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

CVE-2009-5064

A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd.

CVE-2010-0830

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

CVE-2011-1089

It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file.

CVE-2011-4609

A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time.

BZ#745487

Previously, the dynamic loader generated an incorrect ordering for initialization according to the ELF specification. Initialization routines for depended-upon objects were not being called before the objects, which depended on them, were being initialized. This manifested itself only when initializing compiled C++ libraries whose global initialization depended upon the global initialization of data in other libraries which they were linked against at link time, generating a DT_NEEDED entry. With this update, implementation of the topological sort algorithm for dependency resolution has been fixed, and functions for initialization and termination are now ordered correctly.

BZ#585433

Priviously, glibc incorrectly computed the amount of memory needed by strcoll_l and strxfrm functions. As a consequence, a stack overflow could occur, especially in multi-threaded applications with small stack sizes. This update fixes the memory usage computations and avoids the stack overflows.

BZ#657570

Prior to this update, glibc used an incorrect matching algorithm in the strptime function. As a result, strptime could misparse months in certain locales including Polish and Vietnamese. This update corrects the matching algorithm in strptime.

BZ#675259

Priviously, the glibc locale information was wrong for certain French, Spanish and German locales. As a result, incorrect numeric output could be reported. This update corrects the information.

BZ#678318

Prior to this update, nss_nis client code in glibc attempted to read the passwd.adjunct table for certain usernames. This typically required more privileges than a normal user has and thus errors were logged on the The Network Information Service (NIS) server. This update changes glibc to only refer to passwd.adjunct when it is actually necessary.

BZ#711924

Priviously, the dl_debug_state RT_CONSISTENT incorrectly occurred before applying dynamic relocations. As a result, debugging tools could not correctly monitor this call. This update adds systemtap-probes at a superset of the locations where the dl_debug_state was called.

BZ#711531

Prior to this update, glibc did not initialize the robust futex list after a fork. As a result, shared robust mutexes were not cleaned up when the child exited. This update ensures that the robust futex list is correctly initialized after a fork system call.

BZ#707998

Prior to this update, glibc returned incorrect error codes from the pthread_create. This could lead some programs to incorrectly issue an error for a transient failure, such as a temporary out of memory condition. This update ensures glibc returns the correct error code when memory allocation fails in pthread_create.

BZ#706894

Prior to this update, the system configuration option _SC_NPROCESSORS_CONF returned the total number of active processors configured rather than the total number of configured processors. This update changes glibc to query system configurations to get the number of configured processors correctly.

BZ#703345

Prior to this update, getpwent could incorrectly query NIS when using the nss_compat option. This could lead to incorrect results (missing entries) for calls to getpwent. This update changes glibc to only query the NIS domain when needed.

BZ#729661

Prior to this update, the dynamic loader generated an incorrect ordering for initialization according to the ELF specification. This could result in incorrect ordering of DSO constructors and destructors. With this update, dependency resolution has been fixed

BZ#756453

Prior to this update, the libresolv routines were not compiled with the stack protector enabled. As a consequence, a buffer overflow attack vector could occur if the libresolv routines had potential stack overflows. This update turns on the stack protector mechanisms for libresolv.

BZ#758252

Prior to this update, the futimes function rounded values rather than truncate them. As a consequence, file modification, access, or creation times could be incorrect. This update correctly truncates values and gives the correct file modification, access & creation times.

BZ#771849

When locking the screen, the gnome-screensaver application takes exclusive control of the mouse and keyboard. If another application has already taken exclusive control of the keyboard, gnome-screensaver is unable to take over that control. Under these circumstances, gnome-screensaver previously did not engage the screen saver but waited for the keyboard to become available. During this time-frame, the system was unresponsive to mouse clicks because gnome-screensaver held on to control of the mouse. With this update, gnome-screensaver has been modified to release control of the mouse until it can get control of both, the mouse and the keyboard, and the system is no longer unresponsive in this scenario.

BZ#766799

Previously, gnome-screensaver's PAM configuration file was not marked as a configuration file in the gnome-screensaver spec file, and thus the configuration file was overwritten when updating the gnome-screensaver package. Therefore, after the screen had been locked, users could not log into the system by using some of the previously specified authentication methods, or when users successfully logged in, automatic re-authentication with some applications could fail. With this update, the spec file has been corrected, and the pre-existing gnome-screensaver's PAM configuration file is now preserved when the package is updated so authentication problems no longer occur.

BZ#616487

The previous version of the gnome-system-monitor utility did not close the socket when it terminated, which may have rendered it unable to start for the second time. This update applies a patch that ensures the socket is properly closed when the utility terminates, and gnome-system-monitor now works as expected.

BZ#722866

Previously, the minimum width of the gnome-system-monitor window was limited by the minimum width of its content. Consequently, running this utility on a system with a large number of CPUs caused this window to be very large. This update adds a horizontal scrollbar to make sure the gnome-system-monitor window can fit to the screen even when the system has multiple CPUs.

BZ#648279

The gpart package was previously only available for the i386 architecture. This update makes the gpart package available for both i386 and 64-bit x86 architectures.

BZ#448158

Prior to this update groff did not have full path commands in some places and used PATH variables when invoking external binaries. When opening a man page in a restricted shell environment the man page would not be displayed or an erroneous error message, "old character encoding and/or character set", appeared. With this update, groff now uses fully defined paths when invoking external binaries. As a result the man pages can now be displayed in a restricted shell environment.

BZ#758019

The GTK+ file chooser did not properly handle the situation of saving a nameless file, which caused GTK+ to become unresponsive. To avoid this problem, an explicit test for this condition has been added in the code, and GTK+ now works as expected.

Bug Fix

BZ#658178

Prior to this update, hmaccalc erroneously truncated the values which it read from a checkfile before comparing them with the computed values. Consequently, comparison between differently truncated sums of files passed in some cases. This update backports a change which modifies the hmaccalc tool so that when it is used to verify checksums, if it is told to truncate computed values during a verification operation, it will not truncate the values which it reads from a checkfile before comparing them with the computed values. As a result hmaccalc correctly detects differences in hmac values.

Security Fix

CVE-2011-3368

It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to the attacker.

BZ#736593, BZ#736594

The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions.

Security Fix

CVE-2011-3192

A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially-crafted Range header.

BZ#700322

In situations when httpd could not allocate memory, httpd sometimes terminated unexpectedly with a segmentation fault rather than terminating the process with an error message. With this update, a patch has been applied to correct this bug and httpd no longer crashes in the scenario described.

BZ#767990

When the "SSLCryptoDevice" config variable in "ssl.conf" was set to an unknown or invalid value, the httpd daemon would terminate unexpectedly with a segmentation fault at startup. With this update the code has been corrected, httpd no longer crashes, and httpd issues an appropriate error message in this scenario.

Enhacements

BZ#677279

The rotatelogs program now provides a new "rotatelogs -c" option to create log files for each set interval, even if empty.

BZ#677288

The rotatelogs program now provides a new "rotatelogs -p" option to execute a custom program after each log rotation.

BZ#709869

The Apache module mod_proxy now allows changing the BalancerMember state in the web interface.

BZ#714725

The Apache module mod_alias now supports redirecting to a local path (that is, a partial URL).

BZ#719907

The Apache module mod_proxy now supports the "connectiontimeout" parameter.

BZ#719941

The httpd service is now automatically restarted after a package upgrade, if the service is running.

BZ#711121

The monitor database has been updated with information about Acer 76ie monitors.

BZ#720938

The pci.ids database has been updated with information about future Intel PCH (Platform Controller Hub) devices.

BZ#714098

The pci.ids database has been updated with information about the latest HP iLO4 devices.

BZ#713068

The pci.ids database has been updated with information about future Atheros wireless devices.

BZ#747861

The pci.ids database has been updated according to the latest upstream changes.

Security Fix

CVE-2008-3277

It was found that the ibmssh executable had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local user able to convince another user to run ibmssh in an attacker-controlled directory could run arbitrary code with the privileges of the victim.

BZ#711779

Under certain circumstances, the "ibdiagnet -r" command could suffer from memory corruption and terminate with a "double free or corruption" message and a backtrace. With this update, the correct memory management function is used to prevent the corruption.

Security Fix

CVE-2011-4599

A stack-based buffer overflow flaw was found in the way ICU performed variant canonicalization for some locale identifiers. If a specially-crafted locale representation was opened in an application linked against ICU, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

BZ#667126

The ifd-egate package is dependent on the pcsc-lite package but pcsc-lite is not a part of the minimal system installation. Previously, the ifd-egate driver generated a spurious error message when it was installed on the system with minimal installation even though pscs-lite was installed during the same installation transaction. With this update, the spec file has been modified to correct this problem and the error message is no longer generated in this scenario.

BZ#759638

The idf-egate.spec file incorrectly used the "%{dist}" flag instead of the "%{?dist}" flag. With this update, the correct flag is now used.

Security Fix

CVE-2010-4167

It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially-crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code.

BZ#502626

Previously, the "identify -verbose" command failed with an assertion if there was no image information available. An upstream patch has been applied, so that GetImageOption() is now called correctly. Now, the "identify -verbose" command works correctly even if no image information is available.

BZ#530592

Previously, an incorrect use of the semaphore data type led to a deadlock. As a consequence, the ImageMagick utility could become unresponsive when converting JPEG files to PDF (Portable Document Format) files. A patch has been applied to address the deadlock issue, and JPEG files can now be properly converted to PDF files.

BZ#616538

Previously, running the "convert" command with the "-color" option failed with a memory allocation error. The source code has been modified to fix problems with memory allocation. Now, using the "convert" command with the "-color" option works correctly.

BZ#693989

Previously, ImageMagick could become unresponsive when using the "display" command on damaged GIF files. The source code has been revised to prevent the issue. ImageMagick now produces an error message in the described scenario. A file selector is now opened so the user can choose another image to display.

BZ#694922

Prior to this update, the "convert" command did not handle rotated PDF files correctly. As a consequence, the output was rendered as a portrait with the content being cropped. With this update, the PDF render geometry is modified, and the output produced by the "convert" command is properly rendered as a landscape.

Security Fix

CVE-2008-1198

With the default IPsec (Internet Protocol Security) ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key (PSK) hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash.

BZ#568896

Prior to this update, the DHCPv6 client was not terminated when the network service was stopped. This update modifies the source so that the client is now terminated when stopping the network service.

BZ#679998

Prior to this update, on some systems the rm command failed and reported the error message "rm: cannot remove directory `/var/run/dovecot/login/': Is a directory" during system boot. This update modifies the source so that this error message no longer appears.

BZ#744734

Prior to this update, the netconsole script could not discover and resolve the MAC address of the router specified in the /etc/sysconfig/netconsole file. This update modifies the netconsole script so that the script no longer fails when the arping tool returns the MAC address of the router more than once.

BZ#745681

Prior to this update, the arp_ip_target was, due to a logic error, not correctly removed via sysfs. As a consequence, the error "ifdown-eth: line 64: echo: write error: Invalid argument" was reported when attempting to shut down a bonding device. This update modifies the script so that the error no longer appears and arp_ip_target is now correctly removed.

BZ#768058

The RHSA-2011-1533 security advisory, which fixed a security vulnerability in the IPA web-based service, caused incompatibility with older versions of ipa-client. As a consequence, ipa-client was unable to correctly submit enrollment requests to IPA. With this update, ipa-client has been modified and it now operates correctly with newer versions of IPA. Interoperability with older versions of IPA remains unaffected.

BZ#736658

Prior to this update, GSSAPI credential delegation was disabled in the curl utility due to a security issue. As a result, applications that rely on delegation did not work properly. This update utilizes a new constructor argument in the xmlrpc-c client API to set the new CURLOPT_GSSAPI_DELEGATION curl option. This option enables the credential delegation, thus fixing this bug.

BZ#723667

Prior to this update, GSSAPI credential delegation was disabled in the curl utility due to a security issue. As a result, applications that rely on the delegation did not work properly. This update utilizes a new constructor argument in the xmlrpc-c client API to set the new CURLOPT_GSSAPI_DELEGATION curl option. This option enables credential delegation.

BZ#752226

A previous change to the Referer server required that a caller to the IPA server API include the Referer header in its request. Previously, requests from the certmonger and ipa administrative tools did not provide the header, and the tool requests could fail with the error "Missing or invalid HTTP Referer". However, the requests are transferred using curl and curl does not allow setting of arbitrary headers. To resolve this problem, the code has been changed so that the curl version is stored in the HTTP request field X-Original-User-Agent and the rest of the header is overridden. As a result, the correct header is used for the requests and the problem no longer occurs.

BZ#739068

If the user ran the ipa-client-install command with the password defined (for example, "ipa-client-install --principal=admin --password=SecretPsswd"), the /var/log/ipaclient-install.log file contained the password in plain text. With this update, the underlying code is modified and the provided password is no longer saved in the logs in this scenario.

BZ#710143

Previously, KDC (Key Distribution Center) autodiscovery failed if the domain name differed from the Kerberos realm name. This happened because the ipa-client-install utility always assumed that the realm name was identical to the domain name. Now the realm is used when performing autodiscovery and the problem no longer occurs.

BZ#750338

The cyrus-sasl-gssapi package is a soft dependency needed by some IPA client tools. Previously, the ipa-client package spec file did not contain the cyrus-sasl-gssapi dependency for some architectures. As a result, installation on some platforms could fail. This update adds the missing dependency to the spec file and the installation process finishes successfully.

BZ#723620

The cyrus-sasl-gssapi package is a soft dependency needed by some IPA client tools. Previously, when installing 32-bit packages on a 64-bit system, the macro determining the required architecture version of the cyrus-sasl-gssapi package did not work correctly. As a result, an incorrect version of cyrus-sasl-gssapi was installed and the system failed to work; for example, the ipa-getkeytab command failed with the following error because the 32-bit GSSAPI SASL mechanism was not available:

SASL Bind failed. This update corrects the macro and the problem no longer occurs.

BZ#645260

Prior to this update, the ARP daemon, "arpd", had several undocumented options, including, "-?", "-B", "-R", "-b", "-h", "-k", and "-l". Consequently users issuing the command "arp --help" to see the usage message, or consulting the man page, did not see an explanation for all the options. With this update the help function's usage message and the man page have been corrected.

BZ#645264

Prior to this update, the "lnstat" usage message and man page contained spelling mistakes for the "-dump" and "-key" options. With this update these errors have been corrected.

BZ#645267

Prior to this update, the "ss" usage message and man page erroneously included an unsupported option ("-query") and omitted three supported options ("-diag", "-D", and "-socket"). With this update these errors and omissions have been corrected.

BZ#727059

Prior to this update, the "ss -4n" command did not distinguish between the "inet" and "inet6" domain when loading the tcp_diag module. Consequently IPv6 information was output in addition to the expected IPv4 information. With this update the code has been corrected and the command functions as expected.

BZ#714257, BZ#760336, BZ#768532

The iprutils package has been updated to provide support for the Serial Attached SCSI (SAS) vRAID functions.

BZ#520797

Prior to this update, the memory alignment of ipt_connlimit_data was incorrect on x86-based systems. An error message in the format "ip_tables: connlimit match: invalid size" was logged. This update adds an explicit alignment attribute to the ipt_connlimit_data structure to correct this.

BZ#552522

The sysctl values for netfilter kernel modules were not restored after a firewall restart. Consequently, the firewall did not always perform as expected after a restart. This update applies a patch to optionally load sysctl settings on iptables start, if specified by the user in the /etc/sysctl.conf file. Users can now define sysctl settings to load on start and restart.

BZ#554340

Prior to this update, the kernel netfilter modules were not loaded at all times. Consequently, some commands did not perform as expected the first time they were executed. With this update, a patch has been applied to ensure the modules are properly loaded and the problem no longer occurs.