Fedora Legacy Test Update Notification: gnome-vfs

[Marc Deslauriers]

---------------------------------------------------------------------
Fedora Test Update Notification
FEDORA-2004-1944
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=1944
2004-11-30
---------------------------------------------------------------------
 
Name        : gnome-vfs
Version 7.3 : 1.0.5-4.1.legacy
Version 9   : 1.0.5-13.1.legacy and 2.2.2-4.1.legacy
Summary     : The GNOME virtual file-system libraries.
Description :
GNOME VFS is the GNOME virtual file system. It is the foundation of
the Nautilus file manager. It provides a modular architecture and
ships with several modules that implement support for file systems,
http, ftp, and others. It provides a URI-based API, backend
supporting asynchronous file operations, a MIME type manipulation
library, and other features.
 
---------------------------------------------------------------------
Update Information:
 
Updated GNOME VFS packages that remove potential extfs-related
vulnerabilities are now available.

GNOME VFS is the GNOME virtual file system. It provides a modular
architecture and ships with several modules that implement support for
file systems, HTTP, FTP, and others. The extfs backends make it possible
to implement file systems for GNOME VFS using scripts.

Flaws have been found in several of the GNOME VFS extfs backend scripts.
Red Hat Linux ships with vulnerable scripts, but they are not used by
default. An attacker who is able to influence a user to open a
specially-crafted URI using gnome-vfs could perform actions as that
user. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0494 to this issue.

Users of Red Hat Linux should upgrade to these updated packages, which
remove these unused scripts.

---------------------------------------------------------------------
Changelog:
 
7.3:
* Tue Nov 30 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
1.0.5-4.1.legacy
- Added automake autoconf253 intltool libtool db1-devel openssl-devel
  gtk-doc and gettext BuildRequires

* Mon Aug 30 2004 Dave Botsch <dwb7 at ccmr.cornell.edu>
- added legacy to version
- Drop extfs from package due to security: CAN-2004-0494
 
9 gnome-vfs:
* Mon Nov 29 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
1.0.5-13.1.legacy
- Added automake14, gettext, intltool, libtool, openssl-devel
  and gtk-doc BuildRequires

* Fri Aug 13 2004 Jon Peatfield <J.S.Peatfield at damtp.cam.ac.uk>
- Drop unused extfs from the package due to security issues using
  patch from Michal Jaegermann <michal at harddata.com>

9 gnome-vfs2:
* Mon Nov 29 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.2.2-4.1.legacy
- Added automake14, libtool, gettext, scrollkeeper, docbook-utils,
  fam-devel, openssl-devel and docbook-style-xsl BuildRequires

* Fri Aug 13 2004 Jon Peatfield <J.S.Peatfield at damtp.cam.ac.uk>
- remove extfs based on change in RHEL 3AS

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/redhat/
 
1b2e233aa6ae55ae23a6789fb13c5b6448a2a949
7.3/updates-testing/i386/gnome-vfs-1.0.5-4.1.legacy.i386.rpm
7a651d8d5ddfc1838664551c97f0326a385f80d1
7.3/updates-testing/i386/gnome-vfs-devel-1.0.5-4.1.legacy.i386.rpm
95d81f3f9744e57c41b80057fd9c1d210cb3f772
7.3/updates-testing/SRPMS/gnome-vfs-1.0.5-4.1.legacy.src.rpm
0c4d06767ec7ffefbcdb77b66f8845502204d5da
9/updates-testing/i386/gnome-vfs-1.0.5-13.1.legacy.i386.rpm
8f5c82ba289b2e7b51079af4867ddddaf66006d4
9/updates-testing/i386/gnome-vfs2-2.2.2-4.1.legacy.i386.rpm
65650947bcc05f583b0833ad429e8204e7533fa2
9/updates-testing/i386/gnome-vfs2-devel-2.2.2-4.1.legacy.i386.rpm
e702fbcd55b20e6208fe460eb83035173e25a1c4
9/updates-testing/i386/gnome-vfs-devel-1.0.5-13.1.legacy.i386.rpm
5a6db00010fefa6117f5b417262279c7d2645a6a
9/updates-testing/SRPMS/gnome-vfs-1.0.5-13.1.legacy.src.rpm
b48bb8e86f9300f2a0b6da398bf3004cba2c19c3
9/updates-testing/SRPMS/gnome-vfs2-2.2.2-4.1.legacy.src.rpm

Please note that this update is also available via yum and apt through
the updates-testing channel.  Many people find this an easier
way to apply updates.
---------------------------------------------------------------------

Please test these new packages and add comments to Bugzilla.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-legacy-list/attachments/20041130/78459fb0/attachment.sig>