#29681 – Множественные уязвимости: CVE-2011-1098, CVE-2011-1154, CVE-2011-1155

Bug 29681 - Множественные уязвимости: CVE-2011-1098, CVE-2011-1154, CVE-2011-1155

Summary: Множественные уязвимости: CVE-2011-1098, CVE-2011-1154, CVE-2011-1155

Status:	CLOSED FIXED

Alias:	None

Product:	Sisyphus
Classification:	Development
Component:	logrotate (show other bugs)
Version:	unstable
Hardware:	all Linux

Importance:	P3 critical
Assignee:	Alexey Gladkov
QA Contact:	qa-sisyphus

URL:	http://svn.fedorahosted.org/svn/logro...
Keywords:	relnote, security

Depends on:
Blocks:

Reported:	2014-01-03 12:37 MSK by Evgenii Terechkov
Modified:	2015-12-13 04:54 MSK (History)
CC List:	4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description

Evgenii Terechkov 2014-01-03 12:37:53 MSK

В свежей версии немало фиксов. Особенно тревожно видеть, что в текущей сизифной версии не закрыто это:

	- fixed CVE-2011-1098: race condition by creation of new files
	- fixed possible shell injection when using "shred" directive (CVE-2011-1154)
	- fixed escaping of file names within 'write state' action (CVE-2011-1155)

Comment 1

Andrey Cherepanov 2014-03-26 16:27:44 MSK

ping

Comment 2

Andrey Cherepanov 2014-03-27 13:33:21 MSK

Вряд ли это может послужить причиной сборки новой версии.

Comment 3

Michael Shigorin 2014-11-30 22:02:22 MSK

А старой?

Comment 4

Evgenii Terechkov 2014-12-01 10:02:55 MSK

[+1]

Comment 5

Repository Robot 2015-12-13 04:54:08 MSK

logrotate-3.9.1-alt1 -> sisyphus:

* Sun Dec 13 2015 Dmitry V. Levin <ldv@altlinux> 3.9.1-alt1
- Updated to 3.9.1 (closes: #12593, #29681, #31616).