5.11 Technical Notes

Bug Fix

BZ#1065876

Previously, the am-utils automount utility (amd) did not properly handle possible "no such entity" error (ENOENT) returns when executing the umount system calls on file systems mounted within the autofs file system. As a consequence, amd terminated unexpectedly with a segmentation fault under some circumstances. With this update, amd handles ENOENT returns as expected, and the problem no longer occurs.

Bug Fix

BZ#1049017

In a previous version, a check for mounted file systems was removed from autofs mount control script if a miscellaneous device was not used. However, a subsequent update introduced a mount export function that requires this check. As a consequence, autofs mounts sometimes became unresponsive when re-reading the mount map. This update fixes the bug and autofs mounts no longer hang in the scenario described.

Security Fix

CVE-2012-3386

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck".

Security Fix

CVE-2014-0591

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash.

Bug Fix

BZ#1059118

Previously, the bind97 initscript did not check for the existence of the ROOTDIR variable when shutting down the named daemon. As a consequence, some parts of the file system that are mounted when using bind97 in a chroot environment were unmounted on daemon shut down, even if bind97 was not running in a chroot environment. With this update, the initscript has been fixed to check for the existence of the ROOTDIR variable when unmounting some parts of the file system on named daemon shut down. Now, when shutting down bind97 that is not running in a chroot environment, no parts of the file system are unmounted.

Bug Fix

BZ#1076714

The modcluter module is a ricci module shipped with the clustermon packages. Previously, modcluster mishandled requests with size in bytes divisible by 4096, which is the size of the read buffer in bytes. Consequently, modcluster incorrectly evaluated such requests as errors. This bug has been fixed and modcluster now processes all requests as expected. See also RHBA-2014:17045 for the information about the remaining ricci modules shipped with the ricci packages.

Bug Fixes

BZ#1043484

Due to a regression, the fence_bladecenter fence agent was not able to login to fence devices. The login code for fencing.py has been fixed, and a fence agent now logins to fence devices as expected.

BZ#1043358

Previously, under some circumstances on a two-node cluster, both cluster nodes could be granted a lock on the same file at the same time on a GFS2 (Global File System 2) file system. A patch has been provided to fix this bug. With this update, only one cluster node is able to lock the file, the other cluster node waits till the lock is released.

Bug Fix

BZ#1021811

Previously, the fence_cisco_ucs fence agent did not respect the "delay" attribute, which could lead to the situation in which two nodes fence each other. With this update, a fence agent waits for given amount of time as expected.

Bug Fix

BZ#1073821

Previously, the fence_vmware_soap fence agent did not respect the "delay" attribute, which could cause a situation where two nodes fenced each other at the same time. With this update, the agent waits for the given amount of time as expected, and race conditions no longer occur.

Bug Fixes

BZ#994187

Due to incorrect quorum disk configuration, some cluster nodes could display an incorrect "Member status" value if the cluster was restarted by the qdisk quorum daemon. This update amends the quorum disk configuration and cluster nodes now display the correct status in the scenario described.

BZ#994228

Previously, the fence_cisco_ucs fence agent did not respect the "delay" attribute, which could lead to a situation in which two nodes fenced each other. This bug has been fixed and fence_cisco_ucs now waits for the given amount of time as expected.

BZ#1017916

A node on a two-node cluster could, under some circumstances, fail to unlink a checkpoint. As a consequence, both cluster nodes on the cluster could simultaneously be granted a lock on the same file located on a GFS2 file system. With this update, checkpoints on two-node clusters are unlinked as intended, and only one cluster can now hold a lock to a file at a time.

BZ#1029191

Due to a configuration error, qdisk in some situations used an incorrect tko parameter for its wait period when initializing. Consequently, qdisk initialization could be significantly delayed and, under some circumstances, it failed entirely. With this update, the cluster configuration file has been amended and qdisk initialization now proceeds as expected.

BZ#1040099

Due to errors in the login code for the fencing.py file, the fence_bladecenter fence agent was not able to log into fence devices. The login code for fencing.py has been fixed, and fence_bladecenter now logs into fence devices as expected.

BZ#1075691

Prior to this update, fence agents that connected using the SSH protocol failed on login if an identity file was used as the method of authentication. The bug has been fixed and these fence agents now successfully authenticate using an identity file.

Enhancement

BZ#1072605

The support for the "--delay" option has been added to the fence_vmware_soap fencing agent. This option allows the user to avoid fence races, and thus prevents nodes from potentially fencing each other.

Security Fixes

CVE-2014-3521

It was discovered that various components in the luci site extensions-related URLs were not properly restricted to administrative users. A remote, authenticated attacker could elevate their privileges to perform certain actions that should be restricted to administrative users, such as adding users and systems, and viewing log data.

CVE-2013-6496

Multiple information leak flaws were found in the way conga processed luci site extensions-related URL requests. A remote, unauthenticated attacker could issue a specially-crafted HTTP request that, when processed, would lead to unauthorized information disclosure.

CVE-2012-5500

It was discovered that Plone, included as part of luci, allowed a remote anonymous user to change titles of content items due to improper permissions checks.

CVE-2012-5499

It was discovered that Plone, included as part of luci, did not properly handle the processing of very large values passed to an internal utility function. A remote attacker could use a specially-crafted URL that, when processed, would lead to excessive memory consumption.

CVE-2012-5498

It was discovered that Plone, included as part of luci, did not properly handle the processing of requests for certain collections. A remote attacker could use a specially-crafted URL that, when processed, would lead to excessive I/O and/or cache resource consumption.

CVE-2012-5497

It was discovered that Plone, included as part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially-crafted URL that, when processed, could allow the attacker to enumerate user account names.

CVE-2012-5485

It was discovered that Plone, included as part of luci, did not properly protect the administrator interface (control panel) which could allow a remote attacker to inject a specially-crafted Python statement or script into Plone's restricted Python sandbox that, when the administrator interface was accessed, would be executed with the privileges of that admin user.

CVE-2012-5486

It was discovered that Plone, included as part of luci, did improper sanitization of HTTP headers provided within certain URL requests. A remote attacker would use a specially-crafted URL that, when processed, would lead to the injected HTTP headers being returned as part of the Plone HTTP response, which could lead to various negative consequences.

CVE-2012-5488

It was discovered that Plone, included as part of luci, improperly protected the privilege of running RestrictedPython scripts. A remote attacker could use a specially-crafted URL that, when processed, would allow the attacker to submit and perform expensive computations or, in conjunction with other attacks, be able to access or alter privileged information.

Bug Fixes

BZ#970288

Due to a bug in the underlying source code that checks the return value when stopping the luci service, luci was reported as stopped even if it was not. This bug has been fixed and the return value is correctly checked, so that luci works properly in the described scenario.

BZ#106526

The startup_wait parameter has been added to the ostgreSQL 8P resource agent. For more information, see RHBA-2014:17291. With this update the luci service has been modified to reflect this change.

BZ#1072075

Previously, the luci service did not parse distribution release string from the remote ricci agent correctly; any minor version with two or more digits in that string was unexpectedly truncated to the initial digit. This behavior caused several regressions in offered configuration options starting with Red Hat Enterprise Linux 5.10 identification understood as version 5.1. This bug has been fixed with this update, and luci now correctly parses minor versions, thus no regressions occur.

BZ#1076711

Previously, ricci modules shipped directly with the ricci package mishandled requests with size in bytes divisible by 4096, which is the size of the read buffer in bytes. Consequently, these modules incorrectly evaluated such requests as errors. This bug has been fixed and the modules now process all requests as expected. See also RHBA-2014:17436 for the information about a remaining ricci module shipped with the modcluster package.

Bug Fix

BZ#995560

Previously, the number of encryption keys that the coolkey applet can process was increased from 8 to 24. However, this number was not increased in the coolkey library. As a consequence, a token running the coolkey application failed to recover the encryption key, when nine or more encryption keys were set by the coolkey applet. This update introduces the support for up to 24 encryption keys to the coolkey library, and recovering more than 8 encryption keys now proceeds correctly.

Bug Fix

BZ#1078211

Previously, certain AMD processors were not entirely compatible with the CPU frequency scaling. As a consequence, a kernel panic could occur on some AMD-based Hardware Virtual Machine (HVM) guests when CPU frequency scaling was enabled. With this patch, the default CPU governor value has been set to "performance", which prevents this problem. Thus, unless the user changes the CPU governor setting, the kernel now no longer panics when CPU frequency scaling is enabled on HVM guests.

Bug Fix

BZ#1065229

Previously, if the user created duplicate aliases, or aliases that matched the user_friendly names, those devices switched their paths, and thus caused multipath device path corruption. The underlying code has been fixed, and the multipath utility now refuses to reload a device with an existing duplicate alias. In addition, multipath now issues a warning message on potentially conflicting aliases. As a result, multipath no longer corrupts data if users name two devices identically.

Bug Fixes

BZ#1092603

A bug in Device Mapper Multipath (DM-Multipath) allowed the main multipathd thread to free memory that was still being used by other multipathd threads during system shutdown. Consequently, the multipathd daemon terminated unexpectedly due to use-after-free memory corruption. This update avoids this problem by ensuring that memory being used by multipathd threads is freed in the final cleanup upon the exit of multipathd.

BZ#1039935

DM-Multipath allowed configurations with duplicate name aliases mapped to different World Wide Identifiers (WWIDs). However, such configurations could result in path corruption when a device was reloaded and used the paths of another device. This update ensures that DM-Multipath refuses to reload a device if its alias matches another device. DM-Multipath now also warns the user on potentially conflicting aliases.

BZ#1086949

The multipathd daemon could attempt to reconfigure before it was completely set up after receiving the SIGHUP signal on startup. As a consequence, multipathd terminated unexpectedly with a segmentation fault. With this update, multipathd now blocks the SIGHUP signal until it has completed its initialization.

Enhancement

BZ#1048920

The dmidecode package has been upgraded to version 2.12, which adds support for SMBIOS specification version 2.8 to Red Hat Enterprise Linux 5.

Bug Fixes

BZ#885073

Previously, under certain circumstances, the e2fsck utility handled incorrectly a file system error state stored in the journal superblock, which could cause the file system to be marked as "in error". With this update, such errors are properly propagated from the journal to the file system superblock, and e2fsck now clears errors from the journal properly if no recovery is required.

BZ#905027

Previously, the /usr/sbin/uuidd daemon was incorrectly assigned a user and group of root/root. Consequently, this deamon could gain root privileges and be directly executed by root. Moreover, the UID could have been reused in the passwd database, potentially causing a security leak. With this update, the uuidd daemon is assigned the "uuidd" user and group, thus fixing this bug.

BZ#910214

Previously, the chattr and lsattr commands did not properly return an error when operating on symbolic links. The underlying source code has been fixed, and performing these operations on symbolic links now correctly returns the "Operation not supported" message.

Bug Fix

BZ#1033548

Previously, the resize4fs utility mishandled the resizing of an ext4 file system to a smaller size. As a consequence, files containing many extents could become corrupted if they were moved during the resize process. With this update, resize4fs now maintains a consistent extent tree when moving files containing many extents, and such files no longer become corrupted in this scenario.

Security Fix

CVE-2014-1533, CVE-2014-1538, CVE-2014-1541

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

Security Fixes

CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2013-5612

A flaw was found in the way Firefox rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross-site scripting (XSS) attacks.

CVE-2013-5614

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox.

Security Fixes

CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2013-5595

It was found that the Firefox JavaScript engine incorrectly allocated memory for certain functions. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox.

CVE-2013-5604

A flaw was found in the way Firefox handled certain Extensible Stylesheet Language Transformations (XSLT) files. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox.

Security Fixes

CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2014-1532

A use-after-free flaw was found in the way Firefox resolved hosts in certain circumstances. An attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2014-1523

An out-of-bounds read flaw was found in the way Firefox decoded JPEG images. Loading a web page containing a specially crafted JPEG image could cause Firefox to crash.

CVE-2014-1530

A flaw was found in the way Firefox handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks.

Security Fixes

CVE-2014-1477, CVE-2014-1482, CVE-2014-1486

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2014-1487

A flaw was found in the way Firefox handled error messages related to web workers. An attacker could use this flaw to bypass the same-origin policy, which could lead to cross-site scripting (XSS) attacks, or could potentially be used to gather authentication tokens and other data from third-party websites.

CVE-2014-1479

A flaw was found in the implementation of System Only Wrappers (SOW). An attacker could use this flaw to crash Firefox. When combined with other vulnerabilities, this flaw could have additional security implications.

CVE-2014-1481

It was found that the Firefox JavaScript engine incorrectly handled window objects. A remote attacker could use this flaw to bypass certain security checks and possibly execute arbitrary code.

Security Fixes

CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

CVE-2014-1497, CVE-2014-1508, CVE-2014-1505

Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash.

CVE-2014-1509

A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox.

Security Fix

CVE-2013-5329, CVE-2013-5330

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB13-26. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.

Security Fixes

CVE-2014-0534, CVE-2014-0535, CVE-2014-0536

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-16.

Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.

CVE-2014-0531, CVE-2014-0532, CVE-2014-0533

Multiple flaws in flash-plugin could allow an attacker to conduct cross-site scripting (XSS) attacks if a victim were tricked into visiting a specially crafted web page.

Security Fix

CVE-2014-0515

This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed in the Adobe Security Bulletin APSB14-13.

A flaw was found in the way flash-plugin displayed certain SWF content. An attacker could use this flaw to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.

Security Fixes

CVE-2014-0510, CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-14.

Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.

CVE-2014-0516

A flaw in flash-plugin could allow an attacker to bypass the same-origin policy.

Security Fix

CVE-2014-0491, CVE-2014-0492

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB14-02. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.

Security Fix

CVE-2014-0498, CVE-2014-0499, CVE-2014-0502

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB14-07. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.

Security Fix

CVE-2014-0497

This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed in the Adobe Security bulletin APSB14-04. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.

Security Fix

CVE-2013-5331, CVE-2013-5332

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB13-28. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content.

Security Fixes

CVE-2014-0503

This update fixes two vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security bulletin APSB14-08.

A vulnerability was reported that could be used to bypass the same origin policy.

CVE-2014-0504

A vulnerability was reported that could be used to read the contents of the clipboard.

Security Fixes

CVE-2014-0506, CVE-2014-0507

This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-09.

Two flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.

CVE-2014-0508

A flaw in flash-plugin could allow an attacker to obtain sensitive information if a victim were tricked into visiting a specially crafted web page.

CVE-2014-0509

A flaw in flash-plugin could allow an attacker to conduct cross-site scripting (XSS) attacks if a victim were tricked into visiting a specially crafted web page.

Bug Fixes

BZ#799592

Due to corruption of internal GCC structures, GCC could terminate unexpectedly with a segmentation fault when compiling a certain code with optimizations and coverage options enabled, causing the Garbage Collector to fail. The related GCC code has been fixed and the crash no longer occurs.

BZ#901750

GCC could terminate unexpectedly when compiling a code with arithmetics on TI mode (16-byte integer mode) values on AMD64 and Intel 64 architectures. The relevant GCC code has been fixed so that the crash no longer occurs. Note that the 128-bit integer support in GCC version 4.1 has several deficiencies; this support is better implemented in the gcc44 packages.

BZ#1008819

Previously, GCC could terminate unexpectedly with a segmentation fault when compiling a code that initializes nested structures which define a type of an array of structures (using typedef). A fix has been applied and GCC now compiles such code correctly.

Bug Fixes

BZ#1099592

Prior to this update, system logs did not log important context of system events concerning the running fsck.gfs2 utility. Consequently, users and system administrators had difficulties examining the circumstances under which a problem occurred. With this update, fsck.gfs2 adds an informative message to the system logs on its start and exit, which helps in further debugging processes and administrative actions.

BZ#1100803

Previously, GFS2 metadata dumps returned by the "gfs2_edit savemeta" command held no information about the time at which they were created. Without this information, users and system administrators could not easily find out when the GFS2 metadata was saved in relation to file system checks. With this update, "gfs2_edit savemeta" adds a header to the metadata file containing a time stamp relating to the creation of the file.

Bug Fix

BZ#1086861

Prior to this update, when the gfs2_grow, gfs2_tool, gfs2_jadd and gfs2_quota utilities cleaned up the /etc/mtab file, the file's permissions were changed from the default of 644 to 600. As a consequence, non-root processes could not read /etc/mtab. This update fixes the code that cleans up the /etc/mtab file so that it no longer modifies the /etc/mtab file's permissions. As a result, processes are able to access the /etc/mtab file as expected.

Bug Fixes

BZ#902918

Under rare circumstances, certain leaf blocks are written to the incorrect index nodes. Thus, some directories have improper leaf blocks attached. In certain cases, the fsck.gfs2 utility was unable to detect and repair this corruption. With this update, a patch has been provided to fix this bug and fsck.gfs2 now correctly detects and fixes the corruption.

BZ#1073384

After the gfs2_grow, gfs2_tool, gfs2_jadd, or gfs2_quota utilities cleaned up the /etc/mtab file, the file's permissions were changed from the default of 644 to 600. As a consequence, non-root processes could not read /etc/mtab. This update fixes the code that cleans up the /etc/mtab file so that it no longer modifies the /etc/mtab file's permissions. As a result, processes are able to access the /etc/mtab file as expected.

BZ#1084140

Under certain circumstances, an attempt to use the gfs2_convert utility caused the system to terminate unexpectedly with a segmentation fault. This update provides a patch to fix this bug so that the system no longer crashes in the described scenario.

BZ#1097348

Previously, the fsck.gfs2 utility did not log important context of system events. Consequently, users and system administrators had difficulties examining the circumstances under which a problem occurred. With this update, fsck.gfs2 adds an informative message to the system logs on its start and exit, which helps in further debugging processes and administrative actions.

BZ#1097349

Previously, GFS2 metadata dumps returned by the "gfs2_edit savemeta" command held no information about the time at which they were created. Without this information, users and system administrators could not easily find out when the GFS2 metadata was saved in relation to file system checks. With this update, "gfs2_edit savemeta" adds a header to the metadata file containing a time stamp.

Bug Fix

BZ#1066181

Previously, the gfs utility was not synchronizing the inode attributes to disk along with the data for shared mmap() writes. Consequently, files did not have their mtime (modification time) value updated. With this update, gfs writes the inode time stamps to disk when the msync() function is called, and gfs now synchronizes the inode attributes to disk as intended.

Security Fix

CVE-2012-5576, CVE-2013-1913, CVE-2013-1978

A stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP.

Security Fix

CVE-2013-4332

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Bug Fix

BZ#1011424

Prior to this update, the size of the L3 cache in certain CPUs for SMP (Symmetric Multiprocessing) servers was not correctly detected. The incorrect cache size detection resulted in less than optimal performance for routines that used this information, including the memset() function. To fix this bug, the cache size detection has been corrected and core routines including memset() have their performance restored to expected levels.

Bug Fixes

BZ#979413

An attempt to start an already running service by using the "service" command should result in a zero exit code. However, due to an error in the nscd init script, the "service nscd start" command returned a non-zero exit code. This update corrects the nscd init script and this command returns a zero exit code as expected in the described situation.

BZ#995207

The getgroups() function incorrectly accepted a negative size value and then terminated unexpectedly if a related program was compiled with optimizations enabled and the FORTIFY_SOURCE parameter was set to 2. This update corrects the getgroups() function to return an EINVAL error in such cases.

BZ#1003420

The size of the L3 cache in certain CPUs for SMP (Symmetric Multiprocessing) servers was not correctly detected. The incorrect cache size detection resulted in less than optimal performance for routines that used this information, including the memset() function. To fix this problem, the cache size detection has been corrected and core routines including memset() work with the expected efficiency.

BZ#1020486

The getnameinfo() function previously failed on a reverse lookup of an IP address that had a large number of PTR records associated with it. This problem has been corrected and getnameinfo() now correctly returns one of the PTR records as the response.

Security Fixes

CVE-2013-4242

It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret exponent. An attacker able to execute a process on the logical CPU that shared the L3 cache with the GnuPG process (such as a different local user or a user of a KVM guest running on the same host with the kernel same-page merging functionality enabled) could possibly use this flaw to obtain portions of the RSA secret key.

CVE-2013-4402

A denial of service flaw was found in the way GnuPG parsed certain compressed OpenPGP packets. An attacker could use this flaw to send specially crafted input data to GnuPG, making GnuPG enter an infinite loop when parsing data.

CVE-2012-6085

It was found that importing a corrupted public key into a GnuPG keyring database corrupted that keyring. An attacker could use this flaw to trick a local user into importing a specially crafted public key into their keyring database, causing the keyring to be corrupted and preventing its further use.

CVE-2013-4351

It was found that GnuPG did not properly interpret the key flags in a PGP key packet. GPG could accept a key for uses not indicated by its holder.

Security Fix

CVE-2013-4576

It was found that GnuPG was vulnerable to side-channel attacks via acoustic cryptanalysis. An attacker in close range to a target system that is decrypting ciphertexts could possibly use this flaw to recover the RSA secret key from that system.

Security Fixes

CVE-2013-4402

A denial of service flaw was found in the way GnuPG parsed certain compressed OpenPGP packets. An attacker could use this flaw to send specially crafted input data to GnuPG, making GnuPG enter an infinite loop when parsing data.

CVE-2012-6085

It was found that importing a corrupted public key into a GnuPG keyring database corrupted that keyring. An attacker could use this flaw to trick a local user into importing a specially crafted public key into their keyring database, causing the keyring to be corrupted and preventing its further use.

CVE-2013-4351

It was found that GnuPG did not properly interpret the key flags in a PGP key packet. GPG could accept a key for uses not indicated by its holder.

Security Fixes

CVE-2014-3466

A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code.

CVE-2014-3468

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data. Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.

CVE-2014-3467

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash.

CVE-2014-3469

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way.

Security Fixes

CVE-2014-0092

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker.

CVE-2009-5138

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid.

Bug Fix

BZ#1034595

A regular expression in the grub-install program could not match multipath devices when the "user_friendly_name" option was set to "no". As a consequence, the user was not able to install the GRUB utility on a specified device. To fix this bug, the regular expression has been updated to match the requested device names. As a result, GRUB now installs successfully.

Bug Fix

BZ#1012892

Due to a bug in the mod_proxy_httpd module, the error message "proxy: error reading response" was logged into the global error log file even when there was a specific VirtualHost error log file configured. This bug is now fixed and the aforementioned error message is now logged into the correct log file.

Security Fixes

CVE-2013-6438

It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.

CVE-2014-0098

A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled (on Red Hat Enterprise Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header.

Bug Fixes

BZ#976465

Previously, the mod_proxy_connect module did not correctly handle signals while waiting for a backend server to close the connection. With this update, signals are ignored while processing connection closure, thus fixing the bug.

BZ#1003073

Due to a bug in the mod_proxy_http module, the "proxy: error reading response" error message was logged into the global error log even when there was a VirtualHost-specific error log configured. With this update, the aforementioned error message is logged into the correct log file.

BZ#1047319

Previously, a bug in handling the attribute values in the mod_ldap module could lead to a segmentation fault when LDAP dynamic groups were configured. The handling of attribute values has been fixed, and mod_ldap now works as intended.

BZ#1101385

Due to a bug in the lock handling in the mod_ldap module, httpd processes could enter a loop continually consuming CPU time in some LDAP configurations. A patch has been applied to correct the lock handling, and LDAP configurations now work correctly.

Enhancements

BZ#1038276

The mod_authnz_ldap module can set environment variables based on LDAP attributes. However, these variables were only available when LDAP authentication was configured. With this update, environment variables are set for LDAP attributes if LDAP is used for authorization only.

BZ#1058426

A mod_ssl configuration with very large Certificate Revocation Lists (CRLs) could result in excessive memory consumption as the CRLs could be cached in the memory. A new configuration directive, "SSLDisableCRLCaching", which disables CRL caching and allows lower memory use in such configurations, has been added to mod_ssl.

Enhancement

BZ#1064366

The PCI, USB, and vendor ID files have been updated with data for the recently released hardware so it can be correctly identified by hardware identification tools.

Bug Fixes

BZ#1055573

Previously, the source code did not handle the network interface controller (NIC) coming up on layer 2 appropriately, which caused a race condition. As a consequence, the ifup-eth scripts failed to determine if a duplicate IP address existed. After this update, the user can now set a value of the "-w" option of the arping command to specify a timeout, and duplicate IP addresses are detected as expected.

BZ#836679

Prior to this update, the rc.sysinit script did not appropriately verify the conditions before executing the init_crypto() function. Consequently, a harmless error message was displayed when booting with an encrypted logical volume. With this update, rc.sysinit verifies the existence of the block devices listed in the /etc/crypttab file, and the error message no longer appears.

Enhancement

BZ#662617

The bridge configuration options have been enhanced by adding a possibility to set bridge priorities and aging in a standardized way.

Security Fix

CVE-2013-5907, CVE-2014-0368, CVE-2014-0373, CVE-2014-0376, CVE-2014-0411, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0428

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2013-3829, CVE-2013-4041, CVE-2013-5372, CVE-2013-5375, CVE-2013-5774, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5814, CVE-2013-5817, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5849

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0446, CVE-2014-0451, CVE-2014-2427, CVE-2014-2412, CVE-2014-0460, CVE-2013-6629, CVE-2014-2401, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-2428, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2013-3829, CVE-2013-4041, CVE-2013-5372, CVE-2013-5375, CVE-2013-5457, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fixes

CVE-2014-0429

An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine.

CVE-2014-0456, CVE-2014-2397, CVE-2014-2421

Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions.

CVE-2014-0457, CVE-2014-0461

Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427

Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2014-0460

Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks.

CVE-2014-2403

It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability.

CVE-2014-0453

It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption.

CVE-2014-2398

It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks.

CVE-2014-1876

An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200.

Bug Fix

BZ#1085373

The OpenJDK update to IcedTea version 1.13 introduced a regression related to the handling of the jdk_version_info variable. This variable was not properly zeroed out before being passed to the Java Virtual Machine, resulting in a memory leak in the java.lang.ref.Finalizer class. This update fixes this issue, and memory leaks no longer occur.

Security Fixes

CVE-2013-5907

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

CVE-2014-0428, CVE-2014-0422

Multiple improper permission check issues were discovered in the CORBA and JNDI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2014-0423

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability.

CVE-2014-0411

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to a disclosure of information about the used encryption keys.

Security Fixes

CVE-2013-5782

Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine.

CVE-2013-5830

The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine.

CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850

Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2013-5809

Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions.

CVE-2013-5802

The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions.

CVE-2013-5825, CVE-2013-4002, CVE-2013-5823

Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed.

CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784

Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2013-5778

It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory.

CVE-2013-5804, CVE-2013-5797

Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks.

CVE-2013-5780

Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data.

CVE-2013-5772

The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks.

CVE-2013-5803

The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit.

Enhancement

BZ#1059178

An expired GlobalSign Certification Authority certificate was replaced by an updated certificate in the /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0[.x86_64]/jre/lib/security/cacerts file, which contains the certificates of trusted certification authorities.

Security Fix

CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2013-3829, CVE-2013-4041, CVE-2013-5372, CVE-2013-5375, CVE-2013-5456, CVE-2013-5457, CVE-2013-5458, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5788, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5800, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5838, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fix

CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-0455, CVE-2014-2428, CVE-2014-0448, CVE-2014-0454, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2402, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0459, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420

This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page.

Security Fixes

CVE-2014-0429

An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine.

CVE-2014-0456, CVE-2014-2397, CVE-2014-2421

Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions.

CVE-2014-0457, CVE-2014-0455, CVE-2014-0461

Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402, CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459

Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2014-0460

Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks.

CVE-2014-2403

It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability.

CVE-2014-0453

It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption.

CVE-2014-2398

It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks.

CVE-2014-1876

An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200.

Security Fixes

CVE-2013-5907

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

CVE-2014-0428, CVE-2014-0422, CVE-2013-5893

Multiple improper permission check issues were discovered in the CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2014-0373, CVE-2013-5878, CVE-2013-5910, CVE-2013-5896, CVE-2013-5884, CVE-2014-0416, CVE-2014-0376, CVE-2014-0368

Multiple improper permission check issues were discovered in the Serviceability, Security, CORBA, JAAS, JAXP, and Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2014-0423

It was discovered that the Beans component did not restrict processing of XML external entities. This flaw could cause a Java application using Beans to leak sensitive information, or affect application availability.

CVE-2014-0411

It was discovered that the JSSE component could leak timing information during the TLS/SSL handshake. This could possibly lead to disclosure of information about the used encryption keys.

Security Fixes

CVE-2013-5782

Multiple input checking flaws were found in the 2D component native image parsing code. A specially crafted image file could trigger a Java Virtual Machine memory corruption and, possibly, lead to arbitrary code execution with the privileges of the user running the Java Virtual Machine.

CVE-2013-5830

The class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine.

CVE-2013-5829, CVE-2013-5814, CVE-2013-5817, CVE-2013-5842, CVE-2013-5850, CVE-2013-5838

Multiple improper permission check issues were discovered in the 2D, CORBA, JNDI, and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CVE-2013-5809

Multiple input checking flaws were discovered in the JPEG image reading and writing code in the 2D component. An untrusted Java application or applet could use these flaws to corrupt the Java Virtual Machine memory and bypass Java sandbox restrictions.

CVE-2013-5802

The FEATURE_SECURE_PROCESSING setting was not properly honored by the javax.xml.transform package transformers. A remote attacker could use this flaw to supply a crafted XML that would be processed without the intended security restrictions.

CVE-2013-5825, CVE-2013-4002, CVE-2013-5823

Multiple errors were discovered in the way the JAXP and Security components processes XML inputs. A remote attacker could create a crafted XML that would cause a Java application to use an excessive amount of CPU and memory when processed.

CVE-2013-3829, CVE-2013-5840, CVE-2013-5774, CVE-2013-5783, CVE-2013-5820, CVE-2013-5851, CVE-2013-5800, CVE-2013-5849, CVE-2013-5790, CVE-2013-5784

Multiple improper permission check issues were discovered in the Libraries, Swing, JAX-WS, JAXP, JGSS, AWT, Beans, and Scripting components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2013-5778

It was discovered that the 2D component image library did not properly check bounds when performing image conversions. An untrusted Java application or applet could use this flaw to disclose portions of the Java Virtual Machine memory.

CVE-2013-5804, CVE-2013-5797

Multiple input sanitization flaws were discovered in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting attacks.

CVE-2013-5780

Various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. These flaws could possibly lead to an unexpected exposure of sensitive key data.

CVE-2013-5772

The Java Heap Analysis Tool (jhat) failed to properly escape all data added into the HTML pages it generated. Crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct cross-site scripting attacks.

CVE-2013-5803

The Kerberos implementation in OpenJDK did not properly parse KDC responses. A malformed packet could cause a Java application using JGSS to exit.

Enhancement

BZ#1059179

An expired GlobalSign Certification Authority certificate was replaced by an updated certificate in the /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51[.x86_64]/jre/lib/security/cacerts file, which contains the certificates of trusted certification authorities.

Bug Fix

BZ#1101263

Prior to this update, an error in the SSL socket code caused the write() and close() calls to be invoked simultaneously on the same socket, but in two different threads. As a consequence, the socket entered a deadlock. With this update, a measure has been implemented to ensure that calls to close() and read() do not interfere with each other, and the deadlock no longer occurs.

Security Fix

CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0382, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page.

Security Fix

CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page.

Security Fix

CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5775, CVE-2013-5776, CVE-2013-5777, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5788, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5800, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5810, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5838, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5844, CVE-2013-5846, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851, CVE-2013-5852, CVE-2013-5854

This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page.

Enhancement

BZ#1063294

After this update, kdelibs is no longer maintaining its own list of GlobalSign Certification Authority (CA) certificate certificates. The expired kdelibs CA certificate has been replaced by an updated certificate from the openssl package in the /etc/pki/tls/certs/ca-bundle.crt file, which contains the certificates of trusted certification authorities.

Bug Fixes

BZ#1045457

Previously, the "up arrow" key triggered the KSnapshot tool on a konsole window instead of displaying command history. A patch has been applied to fix this bug, and when pressed on konsole screen, the "up arrow" key now displays the command history.

BZ#1058930

Prior to this update, the /usr/share/apps/kssl/ca-bundle.crt file contained an expired "GlobalSign Root CA" entry. The old ca-bundle.crt has been replaced with ca-bundle.crt from the openssl rpm, thus fixing this bug.

Security Fixes

CVE-2012-6638, Moderate

A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled TCP packets with both the SYN and FIN flags set. A remote attacker could use this flaw to consume an excessive amount of resources on the target system, potentially resulting in a denial of service.

CVE-2013-2888, Moderate

* A flaw was found in the way the Linux kernel handled HID (Human Interface Device) reports with an out-of-bounds Report ID. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.

Bug Fixes

BZ#1073731

A previous change to the sunrpc code introduced a race condition between the rpc_wake_up_task() and rpc_wake_up_status() functions. A race between threads operating on these functions could result in a deadlock situation, subsequently triggering a "soft lockup" event and rendering the system unresponsive. This problem has been fixed by re-ordering tasks in the RPC wait queue.

BZ#1073953

Running a process in the background on a GFS2 file system could sometimes trigger a glock recursion error that resulted in a kernel panic. This happened when a readpage operation attempted to take a glock that had already been held by another function. To prevent this error, GFS2 now verifies whether the glock is already held when performing the readpage operation.

BZ#1077045

A previous patch backport to the IUCV (Inter User Communication Vehicle) code was incomplete. Consequently, when establishing an IUCV connection, the kernel could, under certain circumstances, dereference a NULL pointer, resulting in a kernel panic. A patch has been applied to correct this problem by calling the proper function when removing IUCV paths.

Enhancement

BZ#1073123

The lpfc driver had a fixed timeout of 60 seconds for SCSI task management commands. With this update, the lpfc driver enables the user to set this timeout within the range from 5 to 180 seconds. The timeout can be changed by modifying the "lpfc_task_mgmt_tmo" parameter for the lpfc driver.

Security Fix

CVE-2013-4494, Moderate

It was found that the Xen hypervisor did not always lock 'page_alloc_lock' and 'grant_table.lock' in the same order. This could potentially lead to a deadlock. A malicious guest administrator could use this flaw to cause a denial of service on the host.

Bug Fixes

BZ#1029865

A recent patch to the CIFS code that introduced the NTLMSSP (NT LAN Manager Security Support Provider) authentication mechanism caused a regression in CIFS behavior. As a result of the regression, an encryption key that is returned during the SMB negotiation protocol response was only used for the first session that was created on the SMB client. Any subsequent mounts to the same server did not use the encryption key returned by the initial negotiation with the server. As a consequence, it was impossible to mount multiple SMB shares with different credentials to the same server. A patch has been applied to correct this problem so that an encryption key or a server challenge is now provided for every SMB session during the SMB negotiation protocol response.

BZ#1041694

The igb driver previously used a 16-bit mask when writing values of the flow control high-water mark to hardware registers on a network device. Consequently, the values were truncated on some network devices, disrupting the flow control. A patch has been applied to the igb driver so that it now uses a 32-bit mask as expected.

BZ#1049731

The IPMI driver did not properly handle kernel panic messages. Consequently, when a kernel panic occurred on a system that was utilizing IPMI without Kdump being set up, a second kernel panic could be triggered. A patch has been applied to the IPMI driver to fix this problem, and a message handler now properly waits for a response to panic event messages.

Security Fixes

CVE-2013-0343, Moderate

A flaw was found in the way the Linux kernel handled the creation of temporary IPv6 addresses. If the IPv6 privacy extension was enabled (/proc/sys/net/ipv6/conf/eth0/use_tempaddr is set to '2'), an attacker on the local network could disable IPv6 temporary address generation, leading to a potential information disclosure.

CVE-2013-4299, Moderate

* An information leak flaw was found in the way Linux kernel's device mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. An attacker could use this flaw to read data from disk blocks in free space, which are normally inaccessible.

CVE-2013-4345, Moderate

* An off-by-one flaw was found in the way the ANSI CPRNG implementation in the Linux kernel processed non-block size aligned requests. This could lead to random numbers being generated with less bits of entropy than expected when ANSI CPRNG was used.

CVE-2013-4368, Moderate

* An information leak flaw was found in the way Xen hypervisor emulated the OUTS instruction for 64-bit paravirtualized guests. A privileged guest user could use this flaw to leak hypervisor stack memory to the guest.

Bug Fix

BZ#1014714

A bug in the GFS2 code prevented glock work queues from freeing glock-related memory while the glock memory shrinker repeatedly queued a large number of demote requests, for example when performing a simultaneous backup of several live GFS2 volumes with a large file count. As a consequence, the glock work queues became overloaded which resulted in a high CPU usage and the GFS2 file systems being unresponsive for a significant amount of time. A patch has been applied to alleviate this problem by calling the yield() function after scheduling a certain amount of tasks on the glock work queues. The problem can now occur only with extremely high work loads.

Security Fixes

CVE-2014-1737, Important

A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory.

CVE-2014-1738, Low

* It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement.

CVE-2014-1737, CVE-2014-1738

Note: A local user with write access to /dev/fdX could use these two flaws

CVE-2013-7339, Moderate

to escalate their privileges on the system.

* A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system.

Bug Fixes

BZ#1091832

A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes this bug by limiting very large positive timeouts to the maximal supported value.

BZ#1092869

A new Linux Security Module (LSM) functionality related to the setrlimit hooks should produce a warning message when used by a third party module that could not cope with it. However, due to a programming error, the kernel could print this warning message when a process was setting rlimits for a different process, or if rlimits were modified by another than the main thread even though there was no incompatible third party module. This update fixes the relevant code and ensures that the kernel handles this warning message correctly.

BZ#1094152

Previously, the kernel was unable to detect KVM on system boot if the Hyper-V emulation was enabled. A patch has been applied to ensure that both KVM and Hyper-V hypervisors are now correctly detected during system boot.

BZ#1095062

A function in the RPC code responsible for verifying whether cached credentials match the current process did not perform the check correctly. The code checked only whether the groups in the current process credentials appear in the same order as in the cached credentials but did not ensure that no other groups are present in the cached credentials. As a consequence, when accessing files in NFS mounts, a process with the same UID and GID as the original process but with a non-matching group list could have been granted an unauthorized access to a file, or under certain circumstances, the process could have been wrongly prevented from accessing the file. The incorrect test condition has been fixed and the problem can no longer occur.

BZ#1096061

When being under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario.

Security Fix

CVE-2013-4355, Moderate

An information leak flaw was found in the way the Xen hypervisor handled error conditions when reading guest memory during certain guest-originated operations, such as port or memory mapped I/O writes. A privileged user in a fully-virtualized guest could use this flaw to leak hypervisor stack memory to a guest.

Bug Fixes

BZ#1014715

A previous fix to the kernel did not contain a memory barrier in the percpu_up_write() function. Consequently, under certain circumstances, a race condition could occur leading to memory corruption and a subsequent kernel panic. This update introduces a new memory barrier pair, light_mb() and heavy_mb(), for per-CPU basis read and write semaphores (percpu-rw-semaphores) ensuring that the race condition can no longer occur. In addition, the read path performance of "percpu-rw-semaphores" has been improved.

BZ#1014973

Due to a bug in the tg3 driver, systems that had the Wake-on-LAN (WOL) feature enabled on their NICs could not have been woken up from suspension or hibernation using WOL. A missing pci_wake_from_d3() function call has been added to the tg3 driver, which ensures that WOL functions properly by setting the PME_ENABLE bit.

BZ#1018458

Due to an incorrect test condition in the mpt2sas driver, the driver was unable to catch failures to map a SCSI scatter-gather list. The test condition has been corrected so that the mpt2sas driver now handles SCSI scatter-gather mapping failures as expected.

BZ#1023348

A previous patch to the kernel introduced the "VLAN tag re-insertion" workaround to resolve a problem with incorrectly handled VLAN-tagged packets with no assigned VLAN group while the be2net driver was in promiscuous mode. However, this solution led to packet corruption and a subsequent kernel oops if such a processed packed was a GRO packet. Therefore, a patch has been applied to restrict VLAN tag re-insertion only to non-GRO packets. The be2net driver now processes VLAN-tagged packets with no assigned VLAN group correctly in this situation.

Security Fixes

CVE-2013-6381, Important

A buffer overflow flaw was found in the way the qeth_snmp_command() function in the Linux kernel's QETH network device driver implementation handled SNMP IOCTL requests with an out-of-bounds length. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

CVE-2013-4483, Moderate

* A flaw was found in the way the ipc_rcu_putref() function in the Linux kernel's IPC implementation handled reference counter decrementing. A local, unprivileged user could use this flaw to trigger an Out of Memory (OOM) condition and, potentially, crash the system.

CVE-2013-4554, Moderate

* It was found that the Xen hypervisor implementation did not correctly check privileges of hypercall attempts made by HVM guests, allowing hypercalls to be invoked from protection rings 1 and 2 in addition to ring 0. A local attacker in an HVM guest able to execute code on privilege levels 1 and 2 could potentially use this flaw to further escalate their privileges in that guest. Note: Xen HVM guests running unmodified versions of Red Hat Enterprise Linux and Microsoft Windows are not affected by this issue because they are known to only use protection rings 0 (kernel) and 3 (userspace).

CVE-2013-6383, Moderate

* A flaw was found in the way the Linux kernel's Adaptec RAID controller (aacraid) checked permissions of compat IOCTLs. A local attacker could use this flaw to bypass intended security restrictions.

CVE-2013-6885, Moderate

* It was found that, under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang on certain AMD CPUs (for more information, refer to AMD CPU erratum 793). A privileged user in a guest running under the Xen hypervisor could use this flaw to cause a denial of service on the host system. This update adds a workaround to the Xen hypervisor implementation, which mitigates the AMD CPU issue. Note: this issue only affects AMD Family 16h Models 00h-0Fh Processors. Non-AMD CPUs are not vulnerable.

CVE-2013-7263, Low

* It was found that certain protocol handlers in the Linux kernel's networking implementation could set the addr_len value without initializing the associated data structure. A local, unprivileged user could use this flaw to leak kernel stack memory to user space using the recvmsg, recvfrom, and recvmmsg system calls.

CVE-2013-2929, Low

* A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information.

Bug fixes

BZ#1026388

A previous patch backport to the IUCV (Inter User Communication Vehicle) code was incomplete. Consequently, when establishing an IUCV connection, the kernel could, under certain circumstances, dereference a NULL pointer, resulting in a kernel panic. A patch has been applied to correct this problem by calling the proper function when removing IUCV paths.

BZ#1013469

Due to a bug in the cifs module, the calculation of the number of virtual circuits was handled incorrectly when establishing SMB sessions. As a consequence in environments with multiple TCP connections between the same SMB client and SMB server, each time a TCP connection was established, all other TCP connections from the client to the server were reset, resulting in an endless loop. With this update, the number of virtual circuits is constantly set to 1, which ensures the correct behavior of the cifs module in this situation.

BZ#1036115

The igb driver previously used a 16-bit mask when writing values of the flow control high-water mark to hardware registers on a network device. Consequently, the values were truncated on some network devices, disrupting the flow control. A patch has been applied to the igb driver so that it now uses 32-bit mask as expected.

BZ#1008691

A previous patch to the kernel introduced the "VLAN tag re-insertion" workaround to resolve a problem with incorrectly handled VLAN-tagged packets with no assigned VLAN group while the be2net driver was in promiscuous mode. However, this solution led to packet corruption and a subsequent kernel oops if such a processed packed was a GRO packet. Therefore, a patch has been applied to restrict VLAN tag re-insertion only to non-GRO packets. The be2net driver now processes VLAN-tagged packets with no assigned VLAN group correctly in this situation.

BZ#867570

The NFSv4 server did not handle multiple OPEN operations to the same file separately, which could cause the NFSv4 client to repeatedly send CLOSE requests with the same state ID, even though the NFS server rejected the request with an NFS4ERR_OLD_STATEID (10024) error code. This update ensures that the NFSv4 client no longer re-sends the same CLOSE request after receiving NFS4ERR_OLD_STATEID.

BZ#867997

A previous fix to the kernel did not contain a memory barrier in the percpu_up_write() function. Consequently, under certain circumstances, a race condition could occur leading to memory corruption and a subsequent kernel panic. This update introduces a new memory barrier pair, light_mb() and heavy_mb(), for per-CPU basis read and write semaphores (percpu-rw-semaphores) ensuring that the race condition can no longer occur. In addition, the read path performance of "percpu-rw-semaphores" has been improved.

BZ#1063434

Running a process in the background on a GFS2 file system could sometimes trigger a glock recursion error that resulted in a kernel panic. This happened when a readpage operation attempted to take a glock that had already been held by another function. To prevent this error, GFS2 now verifies whether the glock is already held when performing the readpage operation.

BZ#1075228

When being under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario.

BZ#1080194

Due to a bug in the page writeback code, the system could become unresponsive when being under memory pressure and heavy NFS load. This update fixes the code responsible for handling of dirty pages, and dirty page write outs no longer flood the work queue.

BZ#924590

A workaround to a DMA read problem in the tg3 driver was incorrectly applied to the whole Broadcom 5719 and 5720 chipset family. This workaround is valid only to the A0 revision of the 5719 chips and for other revisions and chips causes occasional Tx timeouts. This update correctly applies the aforementioned workaround only to the A0 revision of the 5719 chips.

BZ#928518

A bug in the GFS2 code prevented glock work queues from freeing glock-related memory while the glock memory shrinker repeatedly queued a large number of demote requests, for example when performing a simultaneous backup of several live GFS2 volumes with a large file count. As a consequence, the glock work queues became overloaded which resulted in a high CPU usage and the GFS2 file systems being unresponsive for a significant amount of time. A patch has been applied to alleviate this problem by calling the yield() function after scheduling a certain amount of tasks on the glock work queues. The problem can now occur only with extremely high work loads.

BZ#1080606

Recent changes in the d_splice_alias() function introduced a bug that allowed d_splice_alias() to return a dentry from a different directory than was the directory being looked up. As a consequence in cluster environment, a kernel panic could be triggered when a directory was being removed while a concurrent cross-directory operation was performed on this directory on another cluster node. This update avoids the kernel panic in this situation by correcting the search logic in the d_splice_alias() function so that the function can no longer return a dentry from an incorrect directory.

BZ#998126

A previous change to the sunrpc code introduced a race condition between the rpc_wake_up_task() and rpc_wake_up_status() functions. A race between threads operating on these functions could result in a deadlock situation, subsequently triggering a "soft lockup" event and rendering the system unresponsive. This problem has been fixed by ensuring that entries in the RPC wait queue that are being woken up do not block the entire queue.

BZ#956132

Certain storage device or storage environment failures could cause all SCSI commands and task management functions that were sent to a SCSI target to time out, without any other indication of an error. As a consequence, the Linux SCSI error handling code stopped issuing any I/O operations on the entire HBA adapter until the recovery operations completed. Additionally when using DM Multipath, I/O operations did not fail over to a working path in this situation. To resolve this problem, a new sysfs parameter, "eh_deadline", has been added to the SCSI host object. This parameter allows to set the maximum amount of time for which the SCSI error handling attempts to perform error recovery before resetting the entire HBA adapter. This timeout is disabled by default. The default value of this timeout can be reset for all SCSI HBA adapters on the system using the "eh_deadline" kernel parameter. The described scenario no longer occurs if eh_deadline is properly used.

BZ#956330

Due to an incorrect test condition in the mpt2sas driver, the driver was unable to catch failures to map a SCSI scatter-gather list. The test condition has been corrected so that the mpt2sas driver now handles SCSI scatter-gather mapping failures as expected.

BZ#995293

The IPMI driver did not properly handle kernel panic messages. Consequently, when a kernel panic occurred on a system that was utilizing IPMI without Kdump being set up, a second kernel panic could be triggered. A patch has been applied to the IPMI driver to fix this problem, and a message handler now properly waits for a response to panic event messages.

BZ#1090806

After a statically defined gateway became unreachable and its corresponding neighbor entry entered a FAILED state, the gateway stayed in the FAILED state even after it became reachable again. As a consequence, traffic was not routed through that gateway. This update allows probing such a gateway automatically so that the traffic can be routed through this gateway again once it becomes reachable.

BZ#976201

A function in the RPC code responsible for verifying whether the cached credentials match the current process did not perform the check correctly. The code checked only whether the groups in the current process credentials appear in the same order as in the cached credentials but did not ensure that no other groups are present in the cached credentials. As a consequence, when accessing files in NFS mounts, a process with the same UID and GID as the original process but with a non-matching group list could have been granted an unauthorized access to a file, or under certain circumstances, the process could have been wrongly prevented from accessing the file. The incorrect test condition has been fixed and the problem can no longer occur.

BZ#995277

Due to an incorrect condition check in the IPv6 code, the ipv6 driver was unable to correctly assemble incoming packet fragments, which resulted in a high IPv6 packet loss rate. This update fixes the said check for a fragment overlap and ensures that incoming IPv6 packet fragments are now processed as expected.

BZ#980268

A bug in the journaling block device (jbd and jbd2) code could, under certain circumstances, trigger a BUG_ON() assertion and result in a kernel oops. This happened when an application performed an extensive number of commits to the journal of the ext3 file system and there was no currently active transaction while synchronizing the file's in-core state. This problem has been resolved by correcting respective test conditions in the jbd and jbd2 code.

BZ#1081785

A bug in the journaling code (jbd and jbd2) could, under very heavy workload of fsync() operations, trigger a BUG_ON and result in a kernel oops. Also, fdatasync() could fail to immediately write out changes in the file size only. These problems have been resolved by backporting a series of patches that fixed these problems in the respective code on Red Hat Enterprise Linux 6. This update also improves performance of ext3 and ext4 file systems.

BZ#1084168

A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes the bug by limiting very large positive timeouts to the maximal supported value.

BZ#996331

Due to a bug in the tg3 driver, systems that had the Wake-on-LAN (WOL) feature enabled on their NICs could not have been woken up from suspension or hibernation using WOL. A missing pci_wake_from_d3() function call has been added to the tg3 driver, which ensures that WOL functions properly by setting the PME_ENABLE bit.

BZ#916235

A new Linux Security Module (LSM) functionality related to the setrlimit hooks should produce a warning message when used by a third party module that could not cope with it. However, due to a programming error, the kernel could print this warning message when a process was setting rlimits for a different process, or if rlimits were modified by another than the main thread even though there was no incompatible third party module. This update fixes the relevant code and ensures that the kernel handles this warning message correctly.

BZ#1102768

Due to a bug in the ext4 code, the fdatasync() system call did not force the inode size change to be written to the disk if it was the only metadata change in the file. This could result in the wrong inode size and possible data loss if the system terminated unexpectedly. The code handling inode updates has been fixed and fdatasync() now writes data to the disk as expected in this situation.

BZ#1018286

A recent patch to the CIFS code that introduced the NTLMSSP (NT LAN Manager Security Support Provider) authentication mechanism caused a regression in CIFS behavior. As a result of the regression, an encryption key that is returned during the SMB negotiation protocol response was only used for the first session that was created on the SMB client. Any subsequent mounts to the same server did not use the encryption key returned by the initial negotiation with the server. As a consequence, it was impossible to mount multiple SMB shares with different credentials to the same server. A patch has been applied to correct this problem so that an encryption key or a server challenge is now provided for every SMB session during the SMB negotiation protocol response.

BZ#985767

Previously, the kernel was unable to detect KVM on system boot if the Hyper-V emulation was enabled. A patch has been applied to ensure that both KVM and Hyper-V hypervisors are now correctly detected during system boot.

BZ#1007995

A previous change that corrected a bug preventing communication between NICs using be2net introduced a memory leak in the be2net transmitter (Tx) code path. The memory leak has been fixed by applying a series of patches that corrects handling of socket buffers (SKBs) in the Tx code path.

Enhancements

BZ#1061120

The lpfc driver had a fixed timeout of 60 seconds for SCSI task management commands. With this update, the lpfc driver enables the user to set this timeout within the range from 5 to 180 seconds. The timeout can be changed by modifying the "lpfc_task_mgmt_tmo" parameter for the lpfc driver.

BZ#662558

Support for a kernel symbol that allows printing a binary blob of data as a hex dump to syslog has been added to kABI (Kernel Application Binary Interface).

BZ#826060

This update introduces the "eh_timeout" variable to the SCSI error handling code in order to allow users to control the timeout value for I/O error recovery commands.

Bug Fix

BZ#1028595

Previously, kdump did not support custom names for network devices. As a consequence, kdump failed to capture a core file on a remote target over a network if the respective network device had a custom name. This update modifies the mkdumprd utility to recognize bridge, bonding and VLAN devices with custom names, thus allowing to dump a core file to a remote target over such a device.

Bug Fix

BZ#1095364

Previously, when the krb5 client library was waiting for a response from a server, the timeout variable in certain cases became a negative number. Consequently, the client could enter a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs.

Security Fix

CVE-2014-4345

A buffer overflow was found in the KADM5 administration server (kadmind) when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind.

Security Fixes

CVE-2013-1418, CVE-2013-6800

It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request.

CVE-2014-4344

A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application.

CVE-2014-4341

A buffer over-read flaw was found in the way MIT Kerberos handled certain requests. A man-in-the-middle attacker with a valid Kerberos ticket who is able to inject packets into a client or server application's GSSAPI session could use this flaw to crash the application.

Bug Fixes

BZ#1004632

Prior to this update, the libkrb5 library occasionally attempted to free already freed memory when encrypting credentials. As a consequence, the calling process terminated unexpectedly with a segmentation fault. With this update, libkrb5 frees memory correctly, which allows the credentials to be encrypted appropriately and thus prevents the mentioned crash.

BZ#1089732

Previously, when the krb5 client library was waiting for a response from a server, the timeout variable in certain cases became a negative number. Consequently, the client could enter a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs.

Bug Fix

BZ#1076215

Prior to this update, a fix was introduced for a bug where, under some circumstances, ksh did not execute command substitution in here-documents. However, this fix caused a regression. As a consequence, scripts in which command substitution was used after the pipe character ("|") did not function properly. With this patch, the fix for the previous bug has been reverted, and command substitution now works in combination with pipes as intended. Nevertheless, the reversion also reintroduces the previous bug, which may cause loss of content in here-documents.

Bug Fixes

BZ#1058563

Previously, the ksh shell forking during variable assignment failed to close the file descriptors in the child process prior to execution. This could lead to a file descriptor leak, and certain applications could consequently report error messages. With this update, file descriptors are marked to be closed on execution if appropriate, so file descriptor leaks no longer occur.

BZ#1079947

Previously, the brace expansion, a mechanism by which arbitrary strings may be generated, could not be disabled using the "set +B" command. The underlying source code has been fixed, and now it is possible to disable brace expansion when needed.

Security Fixes

CVE-2013-6367

A divide-by-zero flaw was found in the apic_get_tmcct() function in KVM's Local Advanced Programmable Interrupt Controller (LAPIC) implementation. A privileged guest user could use this flaw to crash the host.

CVE-2013-6368

A memory corruption flaw was discovered in the way KVM handled virtual APIC accesses that crossed a page boundary. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

Security Fix

CVE-2013-4242

It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret exponent. An attacker able to execute a process on the logical CPU that shared the L3 cache with the GnuPG process (such as a different local user or a user of a KVM guest running on the same host with the kernel same-page merging functionality enabled) could possibly use this flaw to obtain portions of the RSA secret key.

Security Fix

CVE-2013-6629

An uninitialized memory read issue was found in the way libjpeg decoded images with missing Start Of Scan (SOS) JPEG markers. A remote attacker could create a specially crafted JPEG image that, when decoded, could possibly lead to a disclosure of potentially sensitive information.

Security Fixes

CVE-2013-1960, CVE-2013-4232

A heap-based buffer overflow and a use-after-free flaw were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code.

CVE-2013-4231, CVE-2013-4243, CVE-2013-4244

Multiple buffer overflow flaws were found in the gif2tiff tool. An attacker could use these flaws to create a specially crafted GIF file that could cause gif2tiff to crash or, possibly, execute arbitrary code.

CVE-2013-1961

Multiple buffer overflow flaws were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash.

Security Fix

CVE-2013-6462

A stack-based buffer overflow flaw was found in the way the libXfont library parsed Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.

Bug Fixes

BZ#966283

Incorrect validation of the clvmd daemon request could lead to a failure with numerous error messages logged. This bug also caused considerable CPU consumption, locking up all logical volume (LVM) commands due to false interpretation of the requests and exhaustive logging. A set of patches has been provided to improve the clvmd request validation, thus fixing the aforementioned bug.

BZ#1005408

When one of the logical volume (LVM) client processes was killed, the clvmd daemon had to wait for a mutual exclusion (mutex) to stop the LVM client thread. Consequently, lvm utility commands in a cluster became indefinitely blocked. This update introduces a patch which fixes the deadlock, and lvm utility commands now work correctly.

BZ#1025881

Due to a regression, the "clvmd -R" command failed to execute with the following error message:

"EOF reading CLVMD"

The underlying source code has been fixed, and "clvmd -R" now works as intended.

Bug Fixes

BZ#204997

Prior to this update, the user had to specify major number together with minor number when using persistent (-My/--persistent y) device numbers for logical volumes (LVs). However, in kernel versions higher than 2.4, the "--major" option is ignored because the kernel now assigns major numbers by itself. This behavior cannot be overridden. Now, when specifying the persistent minor number with the "lvcreate/lvchange -My/--persistent y --minor !" command, the user no longer needs to specify the major number with the "--major" argument. If the "--major" argument is used, the user is now informed by the following message:

"Ignoring supplied major number - kernel assigns major numbers dynamically. Using major number <major number assigned by kernel> instead."

BZ#1053849

Previously, if the pvmove command was executed on clustered volume groups, temporarily activated pvmove devices were activated on all nodes. This was incorrect and in some situations, such as using tags or HA-LVM configuration, it caused pvmove failures. With this update, pvmove activates all needed pvmove devices exclusively when moving logical volumes are already exclusively activated.

Enhancement

BZ#569511

Previously, the lvm-dumpconfig utility displayed the whole configuration but without the logical volume (LVM) configuration tags set for the host. This update introduces the "lvm tags" command which displays the configuration tags set for the current host including the tag configuration which is used on the host.

Enhancement

BZ#1064359

With this update, the Intel CPU microcode has been updated to version 20140430.

Bug Fixes

BZ#1006058

A previous fix to a related security issue introduced to the libnss library a new run-time dependency on the libsqlite library. However, libsqlite was not included in the initrd.img file. As a consequence, the kernel verification was not successful and caused the system boot to fail with a kernel panic. With this update, the mkinitrd utility verifies that libsqlite is included when building a new initrd image and the kernel panic no longer occurs.

BZ#978245

Prior to this update, the Advanced Host Controller Interface (AHCI) driver was not included in the initrd.img file. As a consequence, a Red Hat Enterprise Linux 5 guest in some cases failed to boot on a Red Hat Enterprise Linux 7 hypervisor. With this update, installing Red Hat Enterprise Linux 5 as a guest now always includes the AHCI driver, and the guest is therefore able to boot as expected.

BZ#988020

Previously, mkinitrd searched an incorrect path for the cciss block driver device and the findstoragedriver() function could therefore not find cciss in the /sys/block directory. Consequently, the kernel failed to boot after it was updated. This update amends the cciss path and findstoragedriver() is thus able to detect cciss devices correctly. As a result, the kernel now boots as expected.

Enhancement

BZ#472764

In order to simplify the process of adding a new direct access storage device (DASD), running a mkinitrd command without parameters now prompts the user to re-create the initial RAM disk for the currently running kernel in the /boot/ directory.

Security Fix

CVE-2013-4566

A flaw was found in the way mod_nss handled the NSSVerifyClient setting for the per-directory context. When configured to not require a client certificate for the initial connection and only require it for a specific directory, mod_nss failed to enforce this requirement and allowed a client to access the directory when no valid client certificate was provided.

Security Fix

CVE-2014-2436, CVE-2014-2440, CVE-2014-0384, CVE-2014-2419, CVE-2014-2430, CVE-2014-2431, CVE-2014-2432, CVE-2014-2438

This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page.

Security Fixes

CVE-2013-5807, CVE-2013-5891, CVE-2014-0386, CVE-2014-0393, CVE-2014-0401, CVE-2014-0402, CVE-2014-0412, CVE-2014-0420, CVE-2014-0437, CVE-2013-3839, CVE-2013-5908

This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory January 2014 page and October 2014 page.

CVE-2014-0001

A buffer overflow flaw was found in the way the MySQL command line client tool (mysql) processed excessively long version strings. If a user connected to a malicious MySQL server via the mysql client, the server could use this flaw to crash the mysql client or, potentially, execute arbitrary code as the user running the mysql client.

Security Fixes

CVE-2012-6151

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash.

CVE-2014-2285

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp-perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string.

Bug Fixes

BZ#1015547

When the "netstat --sctp -n" command was run on a system with large number of Stream Control Transmission Protocol (SCTP) connections, the netstat utility terminated unexpectedly with a segmentation fault. A patch that makes netstat sanitize input has been applied and netstat no longer crashes.

BZ#1015550

Running the "netstat --sctp -n" command caused netstat to print IP addresses incorrectly for the SCTP protocol. A patch has been back-ported from Red Hat Enterprise Linux 6 and netstat now shows correct IP addresses for SCTP protocol.

Bug Fixes

BZ#513217

Previously, the summary string in the nfs-utils RPM contained a typo. The text has been fixed, and the string describing the nfs-utils utility is now spelled correctly.

BZ#863241

The rpc.gssd daemon always tried to use a compiler cache (ccache) which had higher mtime but did not verify whether a new ccache is expired or not. Consequently, as rpc.gssd kept on sticking with the ccache until it was deleted, secure NFS context was not created. With this update, rpc.gssd uses a ccache with higher mtime, and if the current is expired, marks it as expired and uses the current valid ccache.

Security Fixes

CVE-2013-5605

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

CVE-2013-1739

It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash.

CVE-2013-1741, CVE-2013-5607

An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash.

CVE-2013-5606

It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate.

Bug Fix

BZ#1033499

The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the "NSS_HASH_ALG_SUPPORT" environment variable to "-MD5".

Security Fixes

CVE-2013-1740

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server.

CVE-2014-1490

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application.

CVE-2014-1491

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server.

CVE-2014-1545

An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox.

CVE-2014-1492

It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid.

Bug Fixes

BZ#1035281

Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended.

BZ#1042684

Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks.

BZ#11015864

Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5.

Bug Fix

BZ#1037272

Previously, with a complex Name Service Switch (NSS) configured and large NTP request rate, the ntpd daemon needed more memory than was allowed by the memory locking limit. As a consequence, the ntpd process could terminate unexpectedly. To fix this bug, the memory locking limit has been doubled. As a result, ntpd no longer crashes.

Security Fix

CVE-2013-4449

A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request.

Bug Fix

BZ#1096634

Previously, the replication process in LDAP did not function correctly. As a consequence, replicated data could be inconsistent and, under some circumstances, the Stand-alone LDAP Daemon, slapd, terminated unexpectedly. With this update, LDAP has been modified to properly lock critical sections. Therefore, the replicated data now stays consistent and slapd no longer crashes.

Bug Fix

BZ#1055235

Previously, when the window manager was set as MWM (Motif Window Manager) and the Mwm*freezeOnConfig and Mwm*moveOpaque options were set to "False", only icons appeared while moving a window anywhere on the screen, and no frame border was drawn. Consequently, users were having problems navigating the applications on their touch screen monitors. A patch has been provided to fix this bug, and windows are now displayed correctly when being moved anywhere on the screen.

Bug Fix

BZ#997241

Previously, when the window manager was set to Motif Window Manager (MWM) and the "Mwm*freezeOnConfig" and "Mwm*moveOpaque" options were set to "False", only icons appeared while moving a window anywhere on the screen, and no frame border was drawn. Consequently, users were having problems navigating the applications on their touch screen monitors. A patch has been provided to fix this bug, and windows are now displayed correctly when being moved anywhere on the screen.

Security Fix

CVE-2014-0224

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.

Security Fix

CVE-2014-0224

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.

Security Fix

CVE-2013-6466

A NULL pointer dereference flaw was discovered in the way Openswan's IKE daemon processed IKEv2 payloads. A remote attacker could send specially crafted IKEv2 payloads that, when processed, would lead to a denial of service (daemon crash), possibly causing existing VPN connections to be dropped.

Bug Fix

BZ#1070358

Previously, Openswan supported a NAT-T negotiation method which used a notification number that was assigned by the Internet Assigned Numbers Authority (IANA) for another option. This incorrect option was therefore removed. As a consequence, clients supporting non-RFC versions of NAT-T could not establish an Openswan connection. With this update, Openswan has been modified to fully ignore that option, and clients can send both the incorrect option and the draft or the RFC option to connect to Openswan successfully.

Bug Fixes

BZ#991854

When a Perl script was installing a custom signal handler and then received a signal while exiting, the code tried to access the interpreter structure which had already been torn down. As a consequence, Perl terminated with a segmentation fault. With this update, the code resets the signal handler to SIG_DFL before calling the perl_destruct() function, so it does not request thread-specific interpreter structure. Now, Perl scripts no longer crash in the described situation.

BZ#1018721

An incorrect implementation of the NDBM_File module caused using the exists() function on dbmopen()-bound variables to fail with the following warning:

AnyDBM_File doesn't define an EXISTS method

The database preference list has been modified to move the NDBM_File module to a less significant place. Now, Perl code which uses dbmopen() defaults to the Berkeley DB database type and no longer fails in the described situation.

BZ#1029016

The Perl Locale::Maketext localization framework did not properly translate the backslash (\) characters. As a consequence, Perl rendered the backslashes as double (\\). With this update, Perl no longer escapes the backslashes in literal output strings, and they appear correctly.

BZ#1057047

Previously, it was not possible to convert dates beyond year 2038 using the timegm() function on 64-bit systems. After this update, Perl detects 64-bit systems correctly and timegm() successfully converts calendar time into seconds since the Unix epoch. Note that using timegm() with dates beyond year 2038 is still not possible on a 32-bit system, because the time_t type is not large enough.

Security Fixes

CVE-2013-6420

A memory corruption flaw was found in the way the openssl_x509_parse() function of the PHP openssl extension parsed X.509 certificates. A remote attacker could use this flaw to provide a malicious self-signed certificate or a certificate signed by a trusted authority to a PHP application using the aforementioned function, causing the application to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the user running the PHP interpreter.

CVE-2011-1398

It was found that PHP did not check for carriage returns in HTTP headers, allowing intended HTTP response splitting protections to be bypassed. Depending on the web browser the victim is using, a remote attacker could use this flaw to perform HTTP response splitting attacks.

CVE-2012-2688

An integer signedness issue, leading to a heap-based buffer underflow, was found in the PHP scandir() function. If a remote attacker could upload an excessively large number of files to a directory the scandir() function runs on, it could cause the PHP interpreter to crash or, possibly, execute arbitrary code.

CVE-2013-1643

It was found that the PHP SOAP parser allowed the expansion of external XML entities during SOAP message parsing. A remote attacker could possibly use this flaw to read arbitrary files that are accessible to a PHP application using a SOAP extension.

Security Fixes

CVE-2009-0689

A buffer overflow flaw was found in the way PHP parsed floating point numbers from their text representation. If a PHP application converted untrusted input strings to numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application.

CVE-2006-7243

It was found that PHP did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.

Security Fix

CVE-2013-6420

A memory corruption flaw was found in the way the openssl_x509_parse() function of the PHP openssl extension parsed X.509 certificates. A remote attacker could use this flaw to provide a malicious self-signed certificate or a certificate signed by a trusted authority to a PHP application using the aforementioned function, causing the application to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the user running the PHP interpreter.

Security Fixes

CVE-2013-6485

A heap-based buffer overflow flaw was found in the way Pidgin processed certain HTTP responses. A malicious server could send a specially crafted HTTP response, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin.

CVE-2013-6487, CVE-2013-6489, CVE-2013-6490

Multiple heap-based buffer overflow flaws were found in several protocol plug-ins in Pidgin (Gadu-Gadu, MXit, SIMPLE). A malicious server could send a specially crafted message, causing Pidgin to crash or potentially execute arbitrary code with the permissions of the user running Pidgin.

CVE-2012-6152, CVE-2013-6477, CVE-2013-6481, CVE-2013-6482, CVE-2013-6484, CVE-2014-0020

Multiple denial of service flaws were found in several protocol plug-ins in Pidgin (Yahoo!, XMPP, MSN, stun, IRC). A remote attacker could use these flaws to crash Pidgin by sending a specially crafted message.

CVE-2013-6483

It was found that the Pidgin XMPP protocol plug-in did not verify the origin of "iq" replies. A remote attacker could use this flaw to spoof an "iq" reply, which could lead to injection of fake data or cause Pidgin to crash via a NULL pointer dereference.

CVE-2013-6479

A flaw was found in the way Pidgin parsed certain HTTP response headers. A remote attacker could use this flaw to crash Pidgin via a specially crafted HTTP response header.

CVE-2013-6478

It was found that Pidgin crashed when a mouse pointer was hovered over a long URL. A remote attacker could use this flaw to crash Pidgin by sending a message containing a long URL string.

Security Fix

CVE-2013-6425

An integer overflow, which led to a heap-based buffer overflow, was found in the way pixman handled trapezoids. If a remote attacker could trick an application using pixman into rendering a trapezoid shape with specially crafted coordinates, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

Bug Fixes

BZ#915901

Previously, the postfix packages had redundant explicitly specified dependencies. This could block from installing third party packages which fulfilled the implicit dependencies. To fix this bug, the redundant explicit dependencies have been removed. As a result, any third party packages can now be used.

BZ#977629

Previously, the Transport Layer Security (TLS) session cache was created in the /var/spool/postfix/ directory with the root user as owner. This could cause various problems if the cache was accessed by an unprivileged process of the tlsmgr daemon, including a tlsmgr failure. With this update, the TLS session cache I/O operations are redirected and the cache is now created in /var/lib/postfix/ with the correct Postfix owner.

Security Fixes

CVE-2014-0063

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0064

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in various type input functions in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0065

Multiple potential buffer overflow flaws were found in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0060

It was found that granting an SQL role to a database user in a PostgreSQL database without specifying the "ADMIN" option allowed the grantee to remove other users from their granted role. An authenticated database user could use this flaw to remove a user from an SQL role which they were granted access to.

CVE-2014-0061

A flaw was found in the validator functions provided by PostgreSQL's procedural languages (PLs). An authenticated database user could possibly use this flaw to escalate their privileges.

CVE-2014-0062

A race condition was found in the way the CREATE INDEX command performed multiple independent lookups of a table that had to be indexed. An authenticated database user could possibly use this flaw to escalate their privileges.

CVE-2014-0066

It was found that the chkpass extension of PostgreSQL did not check the return value of the crypt() function. An authenticated database user could possibly use this flaw to crash PostgreSQL via a null pointer dereference.

Security Fixes

CVE-2013-0255

An array index error, leading to a heap-based out-of-bounds buffer read flaw, was found in the way PostgreSQL performed certain error processing using enumeration types. An unprivileged database user could issue a specially crafted SQL query that, when processed by the server component of the PostgreSQL service, would lead to a denial of service (daemon crash) or disclosure of certain portions of server memory.

CVE-2013-1900

A flaw was found in the way the pgcrypto contrib module of PostgreSQL (re)initialized its internal random number generator. This could lead to random numbers with less bits of entropy being used by certain pgcrypto functions, possibly allowing an attacker to conduct other attacks.

Security Fixes

CVE-2014-0063

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0064

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in various type input functions in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0065

Multiple potential buffer overflow flaws were found in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL.

CVE-2014-0060

It was found that granting an SQL role to a database user in a PostgreSQL database without specifying the "ADMIN" option allowed the grantee to remove other users from their granted role. An authenticated database user could use this flaw to remove a user from an SQL role which they were granted access to.

CVE-2014-0061

A flaw was found in the validator functions provided by PostgreSQL's procedural languages (PLs). An authenticated database user could possibly use this flaw to escalate their privileges.

CVE-2014-0062

A race condition was found in the way the CREATE INDEX command performed multiple independent lookups of a table that had to be indexed. An authenticated database user could possibly use this flaw to escalate their privileges.

CVE-2014-0066

It was found that the chkpass extension of PostgreSQL did not check the return value of the crypt() function. An authenticated database user could possibly use this flaw to crash PostgreSQL via a null pointer dereference.

Security Fix

CVE-2013-4282

A stack-based buffer overflow flaw was found in the way the reds_handle_ticket() function in the spice-server library handled decryption of ticket data provided by the client. A remote user able to initiate a SPICE connection to an application acting as a SPICE server could use this flaw to crash the application.

Bug Fix

BZ#996553

Due to insufficient logs produced by the kernel download code, non-root users were not informed about lacking the necessary root privileges to download kernel debug symbols. To fix this bug, a log message which explains that root privileges are required to execute the findkerneldebugs and getkerneldebug commands has been added. In addition, the help for these two commands has been expanded to indicate that root privileges are required. Now, the non-root user has a better indication of which commands require root permissions.

Enhancement

BZ#995103

Issues such as low disk space or connectivity problems can interrupt the downloading of kernel debug symbols from Red Hat Network. Nevertheless, the user was not informed properly about the cause of this failure. With this update, error messages explaining why the kernel debug symbols failed to download are returned.

Bug Fixes

BZ#853083

When a cluster configuration file was invalid, an attempt to run the "clustat" command failed with a segmentation fault. This bug has been fixed with this update and "clustat" no longer crashes in the described scenario.

BZ#997546

Previously, the cluster services file system failed over from one node to another if the /tmp/ directory filled up. A patch has been provided to fix this bug and cluster services no longer fail over.

BZ#1016784

Recent changes in the lvm_by_lv script introduced a bug that caused all Logical Volume Management (LVM) status checks to fail. Consequently, when using high availability LVM (HA-LVM) with tagging made by LV, multiple warning and error messages were emitted while attempting to start a configured LVM resource. The LVM resource subsequently failed to start with a "vg/lv should not be active" error message. With this update, lvm_by_lv has been modified to remove white spaces from lvm commands that determine the resource owner. LVM status checks now succeed as expected and LVM resources are started properly.

BZ#1020279

Due to a syntax error in the underlying source code, the "find" command failed to find files whose names ended with the ".img" suffix. This update applies a patch to fix this bug and the command now works as expected.

BZ#1022723

If the "listener_name" attribute was omitted for the oracledb.sh resource agent script, the oracledb resources failed to start. With this update, oracledb.sh has been modified to operate correctly when no "listener_name" is given, and thus now starts as expected.

BZ#1035023

In certain environments, the hard-coded sleep time used in the agent process before trying to connect to the postmaster process was not long enough. As a consequence, the postgres-8 service terminated unexpectedly. With this update, the postgres-8.sh script has been modified to allow users to configure the sleep time according to their needs.

BZ#1035034

Under certain conditions, the postgres-8 service did not shut down gracefully and left the PID file populated. Consequently, the service failed to start after the reboot. The underlying source code has been modified and postgres-8 now works as expected.

BZ#1047989

Previously, the oralistener resource agent failed to stop when the listener process was no longer running. This update provides a patch to fix this bug and oralistener works correctly in the described scenario.

Enhancement

BZ#924694

This update adds the possibility to specify the "timeout" parameter for the Xen virtual machines when using the "xm" command.

Bug Fixes

BZ#1093157

Red Hat Network Client Tools did not count the CPU socket information on certain systems properly. With this update, rhn-client-tools parse the /proc/cpuinfo file correctly and thus provide the correct CPU socket information for all systems.

BZ#751294

The error logging module did not correctly determine sub-classes of YUM errors, causing such errors to throw a traceback rather than being correctly logged or reported on the command line. This update ensures that all errors are logged and reported properly by correcting the error inheritance structure.

BZ#919432

The rhn-client-tools sub-package did not correctly mark itself as conflicting with old versions of the rhn-virtualization-host package, which allowed the rhn-client-tools to be installed on the system with such an old package. As a consequence, the rhn-profile-sync utility returned an "exceptions.TypeError: refresh() takes no arguments (1 given)" traceback when it was run. With this update, the conflicting package versions are correctly marked in the rhn-client-tools spec file, which prevents installations of incompatible packages.

Security Fixes

CVE-2013-0213

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.

CVE-2013-0214

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user.

CVE-2013-4124

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory.

Bug Fix

BZ#1132425

Dropbox is a directory with permission 0733. Previously, when the user was trying to store a file in a dropbox directory, the file could not be created. As a consequence, an ACCESS_DENIED error was returned. The permissions to such a directory are now correctly processed by the smbd daemon, and the user can save files to a dropbox directory again.

Security Fixes

CVE-2013-4408

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges.

CVE-2013-4475

A flaw was found in the way Samba performed ACL checks on alternate file and directory data streams. An attacker able to access a CIFS share with alternate stream support enabled could access alternate data streams regardless of the underlying file or directory ACL permissions.

Security Fixes

CVE-2013-4496

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.

CVE-2012-6150

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service.

Bug Fixes

BZ#1109436

Due to incorrect Security Identifier (SID) mappings for Access Control List (ACL) files, generating a user access token previously sometimes failed. With this update, the conversion of SID values for ACL files has been amended and user access tokens are created as expected.

BZ#981369

Prior to this update, an incorrect return value check caused the fallback from TCP/IP to a named pipe to fail. As a consequence, it was not possible to create a Local Security Authority (LSA) query for user and group information. This update fixes the check of the above return value, allowing the fallback to a named pipe to occur. As a result, LSA querying over a named pipe now works as expected.

BZ#1033773

Prior to this update, the search string of the function encoding the Lightweight Directory Access Protocol (LDAP) binary, ldb_binary_encode(), detected the used character set incorrectly. As a consequence, Samba generated invalid search strings. This update fixes the encoding of the local string, and Samba now generates valid LDAP search strings.

BZ#1081002

Previously, Samba always wrote a negative cache entry for the user map. As a consequence, user name mapping did not function consistently. With this update, Samba only writes a negative cache entry if the mapping fails, and user name mapping now works correctly.

BZ#996656

When the smbd server daemon executed spooling for a print action, it previously did not include the job ID in the generated spool-file path. As a consequence, the spool check could not validate the spool-file's existence, and the printing thus failed. With this update, smbd includes the job ID in the spool-file path and parsing the file name succeeds. As a result, printing via Samba now works as expected.

Enhancements

BZ#1037273

A timeout option has been added to the smbclient command-line tool. This allows users to customize the timeout value for Samba file operations by using the "smbclient --help | grep timeout" command.

BZ#1101922

It is now possible to set a different OS version for the Spool Subsystem (spoolss) configuration. This allows users to work around situations where printing drivers do not interact with the printing server because they detect that the version of the printing server is too old.

Bug Fixes

BZ#921485

Previously, if the /etc/fstab file entry used symbolic link, UUID, or LABEL for identifying a device or a file system, these file systems or devices were reported to be disabled although they were mounted. A patch has been applied to fix this bug, and file systems and devices are now correctly reported as mounted.

BZ#959892

Previously, the wbemcli CIM Client did not accept full stop (.) as a password character on the command line. With the updated source code, the user is no longer limited in the use of full stops because passwords containing this character are now accepted.

BZ#971056

While enumerating the Linux_Processor class instances on systems with dynamic CPU frequencies, the MaxClockSpeed property was determined incorrectly. It showed the same value as the CurrentClockSpeed property, which is supposed to be lower. The underlying source code has been modified, and the value of MaxClockSpeed now correctly shows the real maximum processor clock speed.

BZ#974075

Prior to this update, the sblim-cmpi-base provider was scanning wrong fields of the /proc/[pid]/stat file. Consequently, the values for UserModeTime and KernelModeTime properties in CIM class Linux_UnixProcess were incorrectly calculated. With this update, correct fields are read, and UserModeTime and KernelModeTime are calculated correctly.

Bug Fixes

BZ#1040859

In previous versions of scl-utils, the working directory was changed during package build time, which caused complications to package maintainers. These complications ranged from mild inconveniences to build failures if the code in the spec file worked with the working directory. This bug has been fixed, and the working directory no longer changes during build time.

BZ#1040860

When building the SCL "noarch" meta packages on a 64-bit machine, the build failed with an error message. To fix this bug, the "%ifarch" conditionals have been changed, and affected packages are now built correctly.

Enhancements

BZ#1040861

This update introduces a new way to call the "scl enable" command. The scl utility now supports the double dash (--) as a separator between collections and the command; using the separator makes calling the "scl enable" command more convenient.

BZ#1040858

Previously, it was impossible to specify runtime dependencies between collections. For example, if one collection depended on another, the user had to enable both of them manually. With this update, a collection can enable another collection implicitly during startup.

Bug Fixes

BZ#959217

Due to missing rules in the SELinux policy, the sssd_t domain could not connect to port 464. With this update, the appropriate rules have been added to the policy and sssd_t now connects to that port as expected.

BZ#984453

Previously, SELinux prevented the fence_xvm agent from fencing nodes even if the fenced_can_network_connect Boolean was enabled. The SELinux policy has been modified to fix this bug and SELinux no longer blocks fence_xvm in the described scenario.

BZ#997710

Due to missing rules in the SELinux policy, SELinux did not allow the dovecot_deliver_t process to send the SIGNULL signal. With this update, the SELinux rules have been modified accordingly and SELinux no longer prevents dovecot_deliver_t from sending SIGNULL.

BZ#1005589

Previously, SELinux prevented the iptables_t process from using the inotify utility to monitor file system activity. This update adds appropriate SELinux rules and iptables_t can use inotify as expected.

BZ#1008472

When SELinux was in enforcing mode, the glibc library was unable to update the /etc/localtime file. The SELinux policy has been modified to fix this bug and glibc can now update the file as expected.

BZ#1053050

Due to missing SELinux rules, the automount utility could not read symbolic links, which caused the AVC denial messages to return. With this update, the SELinux policy has been modified and SELinux no longer prevents automount from reading symbolic links.

BZ#1078357

Previously, the restorecon command failed to restore the SELinux context on a file located in a symbolically linked directory. The underlying source code has been modified to fix this bug and restorecon now works correctly in the described scenario.

BZ#1083491

Previously, the smbd daemon service was unable to connect to the nmbd service using a Unix stream socket, which caused AVC messages to be logged in the /var/log/audit/audit.log file. To fix this bug, a set of new rules has been added to the SELinux policy to allow smbd to connect to nmbd.

BZ#1089006

An attempt to start a clustered service with the postgres-8 resource script failed due to a bug in the SELinux policy. With this update, the policy has been modified and the service now starts as expected.

BZ#1096891

Due to missing rules in the SELinux policy, the radiusd daemon was unable to write to the /tmp/ directory. Consequently, when radiusd was integrated with the Kerberos network authentication system, an attempt to authenticate a user failed. This update applies a new SELinux policy module so that radiusd works correctly in the described scenario.

BZ#1098031

The zarafa-indexer package has been replaced with the zarafa-search package. Previously, the zarafa-search utility was not labeled with the same SELinux context as the zarafa-indexer utility. With this update, the appropriate SELinux policy rules have been modified and zarafa-search now runs in the zarafa_indexer_t domain as expected.

Bug Fix

BZ#985475

Due to the previously added support for the split groups, the newgrp command searched all groups on the system for a given GID. This behavior could cause high network traffic on systems pulling user and group information from a Lightweight Directory Access Protocol (LDAP) server. The underlying source code has been modified, so that this exhaustive search is not performed if the user is a member of a group whose name is specified with newgrp.

Bug Fixes

BZ#833406

Previously, the sosreport utility did not include the output of the "brctl show" command for all systems. Consequently, information on bridged network configurations was only available in the report tarball on systems using Xen for virtualization. With this update, the networking module collects the output of "brctl show" as well as "brctl showstp" commands for each configured bridge, and thus bridged network configuration information is now available in the report tarball for all hosts.

BZ#980177

Previous versions of the sosreport utility used the legacy ifconfig command to detect network interfaces, but ifconfig did not support interfaces named via biosdevname. As a consequence, no information on biosdevname interfaces was present in the report tarball. With this update, the sosreport networking plug-in now uses the "ip" command to detect interfaces of all types, and full information on biosdevname interfaces is now included.

BZ#1029017

Previously, the sosreport utility collected the krb5.keytab file from Kerberos installations. Although encrypted, this file can contain sensitive key material. With this update, sosreport collects a summary of krb5.keytab using the klist command but does not collect the krb5.keytab file itself. As a result, krb5.keytab data is still available but no sensitive information is included in the report tarball.

BZ#1086736

Previously, the sosreport "ds" plug-in collected all directory server logs by default. Depending on the log configuration, this could lead to very large report sizes. With this update, sosreport collects by default only the current version of the directory server logs regarding to "access", "errors" and "audit", and rotated logs are not collected by default. In addition, the plug-in now supports an "all_logs" option that can be used to request the old behavior. As a result, the default report size for directory server hosts is now smaller and more consistent unless full log data is explicitly requested.

BZ#1107751

Prior to this update, the sosreport utility could include password material in the grub.conf and fstab files collected by the boot loader and file system plug-ins if present on the collection system. Consequently, passwords, either plain text or hashed, could be included in the report tarball. With this bug fix update, password and other secrets are now removed during collection, and passwords from the fstab or grub.conf files can no longer appear in the report tarball.

Bug Fix

BZ#1000205

Prior to this update, when a dynamic Domain Name System (DNS) update operation timed out, it unintentionally freed specific data related to the update. Consequently, a child_handler() call attempted to access this data, which caused the sssd_be process to terminate unexpectedly with a segmentation fault. With this update, child_handler() is destroyed when a dynamic DNS update times out and sssd_be thus no longer crashes in the described scenario.

Security Fix

CVE-2014-0114

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.

Bug Fixes

BZ#1086316

This update adds support for repository overrides to the Subscription Manager. Repositories are now written with server-side overrides taken into account. This feature gives more control in managed environments.

BZ#1088372

This update adds the "Quantity Needed" field in the output of the "subscription-manager list --available" command. The value in this field is the suggested quantity of subscription instances needed to achieve compliance. Note that the maximum suggested quantity is the number of subscriptions available for the user, even if more are required for compliance. This feature prevents the Subscription Manager from using "1" as a default quantity and also ensures better parity with the GUI tool.

BZ#1086290

This update adds the "Subscription Type" field in the output of the "subscription-manager list --available" command. This field displays the subscription type, for example "Instance Based", and also supports new types on old clients.

BZ#1039653

This update adds the rhsm-debug tool to the subscription-manager packages to improve debugging of subscription-related problems.

Security Fixes

CVE-2014-0032

A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash.

CVE-2013-1968

A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file.

CVE-2013-2112

A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service.

Security Fix

CVE-2014-0106

A flaw was found in the way sudo handled its blacklist of environment variables. When the "env_reset" option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges.

Bug Fixes

BZ#804890, BZ#885571

Previously, the sysstat packages did not support dynamically attributed major device numbers. Consequently, devices with these numbers were not listed in sar reports under their real names. With this update, support for dynamically attributed major device numbers has been added to sysstat. As a result, all devices now appear with their correct names in sar reports.

BZ#837238

Previously, the "sar -dp" command did not translate device-mapper device names. As a consequence, block devices under device-mapper were listed as "nodev" instead of their proper names. The underlying source has been modified to fix this bug and the devices are now displayed with the proper names as expected.

Bug Fixes

BZ#445958

Previously, the system-config-network service failed to recognize the Monitor mode configuration of a WIFI device and as a consequence, the service terminated unexpectedly with a traceback. This update provides a patch to fix this bug and system-config-network no longer crashes in the described scenario.

BZ#452446

In certain cases, when the user dismissed a dialog immediately when it popped up, the system-config-network service could terminate unexpectedly. The service has been modified to verify properly if the dialog has been dismissed already, thus it no longer fails in such a case.

BZ#452776

Previously, the system-config-network-cmd --import command did not correctly handle bonding interfaces. Consequently, when using this command to import a setting generated with the system-config-network-cmd --export command, the configuration for bonding interfaces was lost. This bug has been fixed and system-config-network-cmd --import now works as expected.

BZ#474515

Due to a bug in the GUI handling, the system-config-network service occasionally terminated unexpectedly when displaying the interfaces. The underlying source code has been modified to fix this bug and system-config-network no longer fails in the described scenario.

BZ#514534

When creating several device aliases for the same interfaces, the system-config-network service did not store the correct device name in the configuration file. As a consequence, the interface was started with an incorrect interface name. With this update, system-config-network now correctly stores the device aliases and interfaces are named properly.

BZ#516496

Previously, the system-config-network service did not handle correctly those entries in the /etc/hosts/ directory that were specified only with an IP address and with no host name. Consequently, system-config-network failed. This bug has been fixed and system-config-network now works properly in the described scenario.

BZ#545286

When interface aliases were not specified using numbers only, the system-config-network service terminated unexpectedly. This update applies a patch that modifies system-config-network to warn the user when the interface aliases are not specified using numbers only.

BZ#656529, BZ#805806, BZ#919656, BZ#950988

Early versions of the Python programming language do not switch to the UTF-8 format correctly. This behavior led to a failure of the system-config-network service when some UTF-8 character were presented in configuration files. With this update, system-config-network now resets the Python internals to properly handle UTF-8 so that system-config-network no longer crashes in the described scenario.

BZ#679000

Previously, when changing host names with the system-config-network service, the service did not remove the old host name from the /etc/hosts/ directory and did not add the new host name. This update applies a patch to fix this bug so that /etc/hosts now contains the updated host name as expected.

BZ#765727

Certain system-config-network user interface elements were not marked as translatable and therefore they were not translated. This bug has been fixed and all user elements are now correctly translated to the language set by the user if a translation exits for it.

BZ#791335

The text user interface version of the system-config-network service, system-config-network-tui, did not store the network configuration correctly after the system was cleaned with the sys-unconfig command. As a consequence, no network configuration was stored in the /etc/sysconfig/network-scripts/ directory. With this update, even if no previous configuration exists, system-config-network-tui stores the configuration in that directory as expected. As a result, a network configured with system-config-network-tui works after executing sys-unconfig.

BZ#825767

Previously, the dbus-python package was missing from the system-config-network-tui dependency list. Consequently, when the system-config-network-tui package was installed on a system with a minimal installation of Red Hat Enterprise Linux, the system-config-network-tui utility failed to start. The missing dependency has been added to the dependency list of system-config-network-tui, thus the utility works as expected in the described scenario.

BZ#955310

Due to a typo in the underlying source code, the system-config-network service was unable to configure anything else than Ethernet devices, which led to the service terminate unexpectedly on any other hardware devices. With this update, the typo has been fixed and system-config-network no longer crashes in such a case.

Security Fix

CVE-2014-1533, CVE-2014-1538, CVE-2014-1541

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

Security Fixes

CVE-2014-1477, CVE-2014-1482, CVE-2014-1486

Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2014-1487

A flaw was found in the way Thunderbird handled error messages related to web workers. An attacker could use this flaw to bypass the same-origin policy, which could lead to cross-site scripting (XSS) attacks, or could potentially be used to gather authentication tokens and other data from third-party websites.

CVE-2014-1479

A flaw was found in the implementation of System Only Wrappers (SOW). An attacker could use this flaw to crash Thunderbird. When combined with other vulnerabilities, this flaw could have additional security implications.

CVE-2014-1481

It was found that the Thunderbird JavaScript engine incorrectly handled window objects. A remote attacker could use this flaw to bypass certain security checks and possibly execute arbitrary code.

Security Fixes

CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602

Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2013-5595

It was found that the Thunderbird JavaScript engine incorrectly allocated memory for certain functions. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2013-5604

A flaw was found in the way Thunderbird handled certain Extensible Stylesheet Language Transformations (XSLT) files. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird.

Security Fixes

CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2014-1497, CVE-2014-1508, CVE-2014-1505

Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash.

CVE-2014-1509

A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

Security Fixes

CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2014-1532

A use-after-free flaw was found in the way Thunderbird resolved hosts in certain circumstances. An attacker could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2014-1523

An out-of-bounds read flaw was found in the way Thunderbird decoded JPEG images. Loading an email or a web page containing a specially crafted JPEG image could cause Thunderbird to crash.

CVE-2014-1530

A flaw was found in the way Thunderbird handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks.

Security Fixes

CVE-2013-5609, CVE-2013-5616, CVE-2013-5618, CVE-2013-6671, CVE-2013-5613

Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird.

CVE-2013-5612

A flaw was found in the way Thunderbird rendered web content with missing character encoding information. An attacker could use this flaw to possibly bypass same-origin inheritance and perform cross site-scripting (XSS) attacks.

CVE-2013-5614

It was found that certain malicious web content could bypass restrictions applied by sandboxed iframes. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird.

Enhancement

BZ#1065930, BZ#1065928, BZ#1065926

The Turkish government decided to delay the start of daylight saving time (DST) in Turkey this year. DST will begin at 3 a.m. on Monday, March 31 instead of 3 a.m. on Sunday, March 30. The respective tzdata rules have been updated to reflect this change.