Fedora alert FEDORA-2014-17384 (thermostat)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 21 Update: thermostat-1.0.6-1.fc21 | |
| Date: | Thu, 08 Jan 2015 07:01:52 +0000 | |
| Message-ID: | <20150108070215.DCD72608770E@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2014-17384 2014-12-21 05:22:05 -------------------------------------------------------------------------------- Name : thermostat Product : Fedora 21 Version : 1.0.6 Release : 1.fc21 URL : http://icedtea.classpath.org/thermostat/ Summary : A monitoring and serviceability tool for OpenJDK Description : Thermostat is a monitoring and instrumentation tool for the Hotspot JVM, with support for monitoring multiple JVM instances. The system is made up of two processes: an Agent, which collects data, and a Client which allows users to visualize this data. These components communicate via a MongoDB-based storage layer. A pluggable agent and gui framework allows for collection and visualization of performance data beyond that which is included out of the box. -------------------------------------------------------------------------------- Update Information: Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-8120) -------------------------------------------------------------------------------- ChangeLog: * Thu Dec 18 2014 Elliott Baron <ebaron@redhat.com> - 1.0.6-1 - Update to latest maintenance release. - Resolves: CVE-2014-8120 * Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.5 - Use /etc/alternatives/java_sdk_openjdk as jdk_base. * Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.4 - Remove obsolete requires on gnome-icon-theme. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1168977 - CVE-2014-8120 thermostat: local JMX URL disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1168977 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update thermostat' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...