Red Hat Product Errata RHSA-2018:0842 - Security Advisory

Issued:: 2018-04-10
Updated:: 2018-04-10

RHSA-2018:0842 - Security Advisory

Overview
Updated Packages

Synopsis

Low: xdg-user-dirs security and bug fix update

Type/Severity

Security Advisory: Low

Topic

An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories.

Security Fix(es):

xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux Server 7 x86_64
Red Hat Enterprise Linux Server - Extended Update Support 7.6 x86_64
Red Hat Enterprise Linux Workstation 7 x86_64
Red Hat Enterprise Linux Desktop 7 x86_64
Red Hat Enterprise Linux for IBM z Systems 7 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
Red Hat Enterprise Linux for Power, big endian 7 ppc64
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
Red Hat Enterprise Linux for Scientific Computing 7 x86_64
Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
Red Hat Enterprise Linux Server - AUS 7.6 x86_64
Red Hat Enterprise Linux for Power, little endian 7 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
Red Hat Enterprise Linux Server - TUS 7.6 x86_64
Red Hat Enterprise Linux for ARM 64 7 aarch64
Red Hat Enterprise Linux for Power 9 7 ppc64le
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64
Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

BZ - 1412762 - Xsession creation of XDG user directories does not honor system umask policy
BZ - 1455094 - CVE-2017-15131 xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy

CVEs

CVE-2017-15131

References

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux Server - Extended Update Support 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux Server - AUS 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux Workstation 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux Desktop 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
s390x
xdg-user-dirs-0.15-5.el7.s390x.rpm	SHA-256: b9cb00c05a151204c2e62424697758d9c5dcf32225130ac805ca5c0a1b09ab42
xdg-user-dirs-debuginfo-0.15-5.el7.s390x.rpm	SHA-256: c046e8a43c53bee7b4ad87b7d90135bee0153535d2cbf0468585ff59bec0aa99

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
s390x
xdg-user-dirs-0.15-5.el7.s390x.rpm	SHA-256: b9cb00c05a151204c2e62424697758d9c5dcf32225130ac805ca5c0a1b09ab42
xdg-user-dirs-debuginfo-0.15-5.el7.s390x.rpm	SHA-256: c046e8a43c53bee7b4ad87b7d90135bee0153535d2cbf0468585ff59bec0aa99

Red Hat Enterprise Linux for Power, big endian 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64
xdg-user-dirs-0.15-5.el7.ppc64.rpm	SHA-256: 8f5aa33b513015199cebad9238266d264b7a2b40097cce9c9117be2371a0cb06
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64.rpm	SHA-256: 810fb3048d4e314ebc18820e925e134031fd15b23c2ec710f4917cff6d9153fe

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64
xdg-user-dirs-0.15-5.el7.ppc64.rpm	SHA-256: 8f5aa33b513015199cebad9238266d264b7a2b40097cce9c9117be2371a0cb06
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64.rpm	SHA-256: 810fb3048d4e314ebc18820e925e134031fd15b23c2ec710f4917cff6d9153fe

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux EUS Compute Node 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux for Power, little endian 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64le
xdg-user-dirs-0.15-5.el7.ppc64le.rpm	SHA-256: 1c19fab6e8f880055f558b6e38150f4512f56145a30a67fb8df30884880db569
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64le.rpm	SHA-256: 54adb99c88c0fd3fa25d3b3312ed2a4c2a6a5928880cd8ffb74d984310d39cb2

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64le
xdg-user-dirs-0.15-5.el7.ppc64le.rpm	SHA-256: 1c19fab6e8f880055f558b6e38150f4512f56145a30a67fb8df30884880db569
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64le.rpm	SHA-256: 54adb99c88c0fd3fa25d3b3312ed2a4c2a6a5928880cd8ffb74d984310d39cb2

Red Hat Enterprise Linux Server - TUS 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux for ARM 64 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
aarch64
xdg-user-dirs-0.15-5.el7.aarch64.rpm	SHA-256: 5dade2d1455ad30c75439e3faea4f3a8d1d338183193ec9f1906dbe51b0cb0d0
xdg-user-dirs-debuginfo-0.15-5.el7.aarch64.rpm	SHA-256: 04dfeeae56f4f9c399cd568c222bcf68358d2156d88420432b73c7cdb3031311

Red Hat Enterprise Linux for Power 9 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64le
xdg-user-dirs-0.15-5.el7.ppc64le.rpm	SHA-256: 1c19fab6e8f880055f558b6e38150f4512f56145a30a67fb8df30884880db569
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64le.rpm	SHA-256: 54adb99c88c0fd3fa25d3b3312ed2a4c2a6a5928880cd8ffb74d984310d39cb2

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
ppc64le
xdg-user-dirs-0.15-5.el7.ppc64le.rpm	SHA-256: 1c19fab6e8f880055f558b6e38150f4512f56145a30a67fb8df30884880db569
xdg-user-dirs-debuginfo-0.15-5.el7.ppc64le.rpm	SHA-256: 54adb99c88c0fd3fa25d3b3312ed2a4c2a6a5928880cd8ffb74d984310d39cb2

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
x86_64
xdg-user-dirs-0.15-5.el7.x86_64.rpm	SHA-256: 4a90cd6bf1994098ef477c873684ef1bf12cd4b52dd43c9c53dd47e654725059
xdg-user-dirs-debuginfo-0.15-5.el7.x86_64.rpm	SHA-256: 94901707f00649bb5ab0af2c8bbfedd23b4a26d790df4a3ad96797ec23ca96d9

Red Hat Enterprise Linux for IBM System z (Structure A) 7

SRPM
xdg-user-dirs-0.15-5.el7.src.rpm	SHA-256: 790a6145fdfed17f0884ffdaadeb2a6f2e1e94f9a51c679bef173af862152ac1
s390x
xdg-user-dirs-0.15-5.el7.s390x.rpm	SHA-256: b9cb00c05a151204c2e62424697758d9c5dcf32225130ac805ca5c0a1b09ab42
xdg-user-dirs-debuginfo-0.15-5.el7.s390x.rpm	SHA-256: c046e8a43c53bee7b4ad87b7d90135bee0153535d2cbf0468585ff59bec0aa99

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.