Opened 2 years ago

Closed 2 years ago

#18652 closed enhancement (fixed)

tracker-miners3-3.6.1

Reported by: Bruce Dubbs Owned by: Douglas R. Reno
Priority: normal Milestone: 12.1
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New point version.

Change History (4)

comment:1 by Douglas R. Reno, 2 years ago

Owner: changed from blfs-book to Douglas R. Reno
Status: new → assigned

comment:2 by Douglas R. Reno, 2 years ago 

NEW in 3.6.1 - 2023-09-28
=========================
  * Avoid the special thread in tracker-extract-3, and extend
    the seccomp jail to the full process.

Translations: eo

comment:3 by Douglas R. Reno, 2 years ago

This release does fix a security vulnerability if the optional external dependency 'libcue' is installed:

​https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/

​https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277

If that package is installed, it's a one click remote code execution issue.

The original issue isn't in tracker-miners - however it does escape the seccomp sandbox that tracker-miners runs in, so we should expect a CVE for that soon. This version of tracker-miners fixes that sandbox escape.

Some of the tests fail now so I've put a comment in the book to that effect. Upstream is aware of those, but the package itself seems to function correctly

Last edited 2 years ago by Douglas R. Reno (previous) (diff)

comment:4 by Douglas R. Reno, 2 years ago

Resolution: → fixed
Status: assigned → closed

Fixed at 0614378114770bce746eac0c4c4203317173158a

Note: See TracTickets for help on using tickets.