RHEL 7 : tcmu-runner (RHSA-2017:3277)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3277 advisory. The tcmu-runner packages provide a service that handles the complexity of the LIO kernel target's userspace passthrough interface TCMU. It...

Moderate: Red Hat Security Advisory: tcmu-runner security update

An update for tcmu-runner is now available for Red Hat Gluster Storage 3.3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

tcmu-runner: glfs handler allows local DoS via crafted CheckConfig strings

A flaw was found in the implementation of CheckConfig method in handlerglfs.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could send a specially crafted string to CheckConfig method resulting in various kinds of segmentation fault...

[SECURITY] Fedora 27 Update: systemd-234-9.fc27

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

[SECURITY] Fedora 26 Update: systemd-233-7.fc26

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...

CVE-2017-5084

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

Information disclosure

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2017-5084

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2017-5084

Removed by vendor...

SUSE SLES12 Security Update : tcmu-runner (SUSE-SU-2017:2601-1)

This update for tcmu-runner fixes the following issues: Security issues fixed : - CVE-2017-1000198: The glfs handler allowed local DoS via crafted CheckConfig strings bsc1049485 - CVE-2017-1000199: The qcow handler leaked information via the CheckConfig D-Bus method bsc1049491 Note that Tenable...

Tails 3.2 - Live System to Preserve Your Privacy and Anonymity

Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly. It is a complete operating system designed to be used fr...

CVE-2014-8156

The D-Bus security policy files in /etc/dbus-1/system.d/.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged git master on 2015-01-19,...

Code injection

The D-Bus security policy files in /etc/dbus-1/system.d/.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged git master on 2015-01-19,...

CVE-2014-8156

The D-Bus security policy files in /etc/dbus-1/system.d/.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged git master on 2015-01-19,...

CVE-2014-8156

Removed by vendor...

CVE-2014-8156

CVE-2014-8156 affects D-Bus system service policy handling in fso-gsmd, fso-frameworkd, fso-usaged and related up-stream modules (cornucopia.git, framework.git) on Debian/Ubuntu. The vulnerability stems from improper filtering of D-Bus message paths in /etc/dbus-1/system.d/*.conf, enabling a loca...

CVE-2017-1000200

A NULL pointer dereference flaw was found in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call the UnregisterHandler method with the name of a handler loaded internally in tcmu-runner via dlopen to trigger DoS...

CVE-2017-1000201

A NULL pointer dereference flaw was found in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call UnregisterHandler method with non-existing tcmu handler as paramater to trigger DoS...

[SECURITY] Fedora 25 Update: python-dbusmock-0.11.1-6.fc25

With this program/Python library you can easily create mock objects on D-Bus. This is useful for writing tests for software which talks to D-Bus services such as upower, systemd, ConsoleKit, gnome-session or others, and it is hard or impossible without root privileges to set the state of the real...

Security update for tcmu-runner (important)

This update for tcmu-runner fixes the following issues: - qcow handler opens up an information leak via the CheckConfig D-Bus method bsc1049491 - glfs handler allows local DoS via crafted CheckConfig strings bsc1049485 - UnregisterHandler dbus method in tcmu-runner daemon for non-existing handler...