Bug 15888

Summary:	testdisk new security issues fixed upstream in 7.0
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	geiger.david68210, mageia, sysadmin-bugs
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/643700/
Whiteboard:	has_procedure advisory mga4-32-ok mga4-64-ok
Source RPM:	testdisk-6.14-2.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2015-05-08 19:15:52 CEST

Fedora has issued an advisory on April 26:
https://lists.fedoraproject.org/pipermail/package-announce/2015-May/157216.html

The issues are fixed upstream in 7.0:
http://www.cgsecurity.org/wiki/TestDisk_7.0_Release

Mageia 4 and Mageia 5 are affected.

Reproducible: 

Steps to Reproduce:

David Walser 2015-05-08 19:15:57 CEST

Whiteboard: (none) => MGA5TOO, MGA4TOO

Comment 1 David GEIGER 2015-05-11 17:50:30 CEST

Note that testdisk-7.0 need now qt4-devel as a buildrequires for building qphotorec stuff like fedora's package.

This is not the case now in our svn.

CC: (none) => geiger.david68210

Comment 2 David Walser 2015-05-11 19:35:25 CEST

The version we currently have doesn't have qphotorec as far as I can tell, so this is not a regression.  We can add this feature in Cauldron after branching.

Version: Cauldron => 4
Whiteboard: MGA5TOO, MGA4TOO => (none)

Comment 3 David Walser 2015-05-11 19:47:20 CEST

Updated packages uploaded for Mageia 4 and Cauldron.  Thanks Nicolas!

Advisory:
========================

Updated testdisk packages fix security vulnerabilities:

The testdisk package has been updated to version 7.0, fixing several security
issues and a couple of bugs.  See the upstream announcement for more details.

References:
http://www.cgsecurity.org/wiki/TestDisk_7.0_Release
https://lists.fedoraproject.org/pipermail/package-announce/2015-May/157216.html
========================

Updated packages in core/updates_testing:
========================
testdisk-7.0-1.mga4
photorec-7.0-1.mga4

from testdisk-7.0-1.mga4.src.rpm

CC: (none) => mageia
Assignee: mageia => qa-bugs

Comment 4 claire robinson 2015-05-12 17:37:46 CEST

Testing complete mga4 64

Both need to be run as root.

Used testdisk to analyse the disk partitions. Didn't make any changes.
Used photorec to scan free space and save recovered items in /root/tmp/

Whiteboard: (none) => has_procedure mga4-64-ok

Comment 5 claire robinson 2015-05-12 18:40:37 CEST

Testing complete mga4 32, as comment 4.

Comment 6 claire robinson 2015-05-12 18:43:11 CEST

Validating. Advisory uploaded.

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure mga4-64-ok => has_procedure advisory mga4-32-ok mga4-64-ok
CC: (none) => sysadmin-bugs

Comment 7 Mageia Robot 2015-05-12 21:38:36 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0217.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED