Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.

- remove read permissions for other users on local sqlite     database as it may contain passwords (bnc#747833,     CVE-2012-0863)

  - don't add built-in CA certificates (bnc#660784)

This update fixes a number of startup problems of the mumble server murmur.

Additionally it contains a fix for CVE-2012-0863 (insecure world-readable permissions on database file) of the mumble client.
Rebuild for newer protobuf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a number of startup problems of the mumble server murmur.

Additionally it contains a fix for CVE-2012-0863 (insecure world-readable permissions on database file) of the mumble client.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Mumble, a VoIP client, does not properly manage permissions on its user-specific configuration files, allowing other local users on the system to access them.

ID	Name	Product	Family	Severity
74552	openSUSE Security Update : mumble (openSUSE-2012-127)	Nessus	SuSE Local Security Checks	low
59576	Fedora 15 : mumble-1.2.3-4.fc15.1 (2012-8960)	Nessus	Fedora Local Security Checks	low
59575	Fedora 16 : mumble-1.2.3-5.fc16.1 (2012-8956)	Nessus	Fedora Local Security Checks	low
59574	Fedora 17 : mumble-1.2.3-7.fc17.1 (2012-8903)	Nessus	Fedora Local Security Checks	low
58011	Debian DSA-2411-1 : mumble - information disclosure	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2012-0863

medium

Tenable Plugins

low

low

low

low

low