Two vulnerabilities have been identified in Fedora, which could be exploited by local attackers to bypass security restrictions or disclose sensitive information. These issues are caused by errors in Bournal, which could allow malicious users to overwrite arbitrary files via symlink attacks or gain knowledge of a ccrypt key.

Affected Products

Fedora 13
Fedora 12
Fedora 11

Solution

Upgrade the affected package (bournal) :
http://docs.fedoraproject.org/yum/

References

http://www.vupen.com/english/advisories/2010/0570
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036697.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036701.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036764.html
https://bugzilla.redhat.com/show_bug.cgi?id=568440

Credits

Vulnerabilities reported by Secunia.

Changelog

2010-03-10 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.