Uočeno je više sigurnosnih propusta u radu programskog paketa Gjs, distribuiranog s operacijskim sustavom Fedora 15. Udaljenom napadaču propusti omogućuju izmjenu i čitanje osjetljivih podataka, neovlašteni pristup sustavu, proizvoljno izvršavanje programskog koda, umetanje skriptnog i HTML koda i DoS napad.

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-8627
2011-06-24 02:47:06
--------------------------------------------------------------------------------

Name        : gjs
Product     : Fedora 15
Version     : 0.7.14
Release     : 6.fc15
URL         : http://live.gnome.org/Gjs/
Summary     : Javascript Bindings for GNOME
Description :
Gjs allows using GNOME libraries from Javascript. It's based on the
Spidermonkey Javascript engine from Mozilla and the GObject introspection
framework.

--------------------------------------------------------------------------------
Update Information:

Update to new upstream Firefox version 5.0, fixing multiple security issues
detailed in the upstream advisories:

* http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox5

See upstream release notes for more information about this new version:

* http://www.mozilla.com/en-US/firefox/5.0/releasenotes/

This update ALSO contains a change to the GNOME 3 shell's gjs library, to make
it use the standalone js package, to reduce risk of regression.

It also includes all packages depending on gecko-libs rebuilt against the new
version of Firefox / XULRunner.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Jun 23 2011 Colin Walters <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 0.7.14-6
- BR cairo-devel, previously gecko pulled it in I guess
- Rerun autotools
- Include autogen.sh since it's missing from gjs tarball
* Wed Jun 22 2011 Colin Walters <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 0.7.14-5
- Backport patch to compile/run against js 1.8.5
- Drop dependency on gecko, add one on standalone js
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #676437 - Build gjs against the standalone SpiderMonkey package
'js', not XULRunner's copy
        https://bugzilla.redhat.com/show_bug.cgi?id=676437
  [ 2 ] Bug #715188 - Update to Firefox 5.0
        https://bugzilla.redhat.com/show_bug.cgi?id=715188
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update gjs' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce