gnome security update

CentOS Errata and Security Advisory CESA-2013:0131

The gnome-vfs2 packages provide the GNOME Virtual File System, which is the
foundation of the Nautilus file manager. neon is an HTTP and WebDAV client
library embedded in the gnome-vfs2 packages.

A denial of service flaw was found in the neon Extensible Markup Language
(XML) parser. Visiting a malicious DAV server with an application using
gnome-vfs2 (such as Nautilus) could possibly cause the application to
consume an excessive amount of CPU and memory. (CVE-2009-2473)

This update also fixes the following bugs:

• When extracted from the Uniform Resource Identifier (URI), gnome-vfs2
  returned escaped file paths. If a path, as stored in the URI,
  contained non-ASCII characters or ASCII characters which are parsed as
  something other than a file path (for example, spaces), the escaped path
  was inaccurate. Consequently, files with the described type of URI could
  not be processed. With this update, gnome-vfs2 properly unescapes paths
  that are required for a system call. As a result, these paths are parsed
  properly. (BZ#580855)

• In certain cases, the trash info file was populated by foreign
  entries, pointing to live data. Emptying the trash caused an accidental
  deletion of valuable data. With this update, a workaround has been applied
  in order to prevent the deletion. As a result, the accidental data loss is
  prevented, however further information is still gathered to fully fix this
  problem. (BZ#586015)

• Due to a wrong test checking for a destination file system, the Nautilus
  file manager failed to delete a symbolic link to a folder which was
  residing in another file system. With this update, a special test has been
  added. As a result, a symbolic link pointing to another file system can be
  trashed or deleted properly. (BZ#621394)

• Prior to this update, when directories without a read permission were
  marked for copy, the Nautilus file manager skipped these unreadable
  directories without notification. With this update, Nautilus displays an
  error message and properly informs the user about the aforementioned
  problem. (BZ#772307)

• Previously, gnome-vfs2 used the stat() function calls for every file on
  the MultiVersion File System (MVFS), used for example by IBM Rational
  ClearCase. This behavior significantly slowed down file operations. With
  this update, the unnecessary stat() operations have been limited. As a
  result, gnome-vfs2 user interfaces, such as Nautilus, are more responsive.
  (BZ#822817)

All gnome-vfs2 users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2013-January/081291.html
https://lists.centos.org/pipermail/centos-cr-announce/2013-January/026611.html

Affected packages:
gnome-vfs2
gnome-vfs2-devel
gnome-vfs2-smb

Upstream details at:
https://access.redhat.com/errata/RHSA-2013:0131