In going through some of the security updates for EPEL 7, I've noticed a
few quirks, and I'm unsure of the cause/design.
Example -> https://apps.fedoraproject.org/packages/nginx
This does not show an EPEL7 build, even though there clearly is one (and
it's flagged for a security update
https://bugzilla.redhat.com/show_bug.cgi?id=1126892)
The same thing happened with thunderbird (
https://apps.fedoraproject.org/packages/thunderbird) as well. I'm going
to continue going through the EPEL7 security bugs, to see if this is
consistent behavior, or if the first two packages I saw were oddities.
Is there something that would cause them to not show up in appdb as
being part of epel7?
--
Jim Perrin
The CentOS Project | http://www.centos.org
twitter: @BitIntegrity | GPG Key: FA09AD77
The following packages are orphaned and will be retired when they
are orphaned for six weeks, unless someone adopts them. If you know for sure
that the package should be retired, please do so now with a proper reason:
https://fedoraproject.org/wiki/How_to_remove_a_package_at_end_of_life
Note: If you received this mail directly you (co)maintain one of the affected
packages or a package that depends on one. Please adopt the affected package or
retire your depending package to avoid broken dependencies, otherwise your
package will be retired when the affected package gets retired.
Package (co)maintainers Status Change
===========================================================================
cqrlog orphan, sparks 2014-10-14 (1 weeks
ago)
create-tx-configuration orphan, sparks 2014-10-14 (1 weeks
ago)
golang-github-gorilla- orphan, golang-sig, 2014-06-11 (19 weeks
context lsm5, mattdm, vbatts ago)
golang-github-gorilla- orphan, golang-sig, 2014-06-11 (19 weeks
mux lsm5, mattdm, vbatts ago)
golang-github-kr-pty orphan, golang-sig, 2014-06-11 (19 weeks
lsm5, mattdm ago)
golang-googlecode-net orphan, golang-sig, 2014-06-11 (19 weeks
jchaloup, lsm5, mattdm, ago)
vbatts
golang-googlecode- orphan, golang-sig, 2014-06-11 (19 weeks
sqlite lsm5, vbatts ago)
mikmod orphan, s4504kr, sdz 2014-05-14 (23 weeks
ago)
pkcs11-helper orphan 2014-08-03 (11 weeks
ago)
python-paver orphan, lmacken, toshio 2014-08-14 (10 weeks
ago)
The following packages require above mentioned packages:
Depending on: pkcs11-helper (2)
openvpn (maintained by: steve, huzaifas, limb)
openvpn-2.3.2-4.el7.src requires pkcs11-helper-devel = 1.10-1.el7
openvpn-2.3.2-4.el7.x86_64 requires libpkcs11-helper.so.1()(64bit)
NetworkManager-openvpn (maintained by: limb, huzaifas, pavlix)
NetworkManager-openvpn-0.9.8.2-4.el7.1.x86_64 requires openvpn = 2.3.2-4.el7
Affected (co)maintainers
golang-sig: golang-googlecode-net, golang-github-gorilla-context, golang-googlecode-sqlite, golang-github-kr-pty, golang-github-gorilla-mux
huzaifas: pkcs11-helper
jchaloup: golang-googlecode-net
limb: pkcs11-helper
lmacken: python-paver
lsm5: golang-googlecode-net, golang-github-gorilla-context, golang-googlecode-sqlite, golang-github-kr-pty, golang-github-gorilla-mux
mattdm: golang-googlecode-net, golang-github-gorilla-context, golang-github-kr-pty, golang-github-gorilla-mux
pavlix: pkcs11-helper
s4504kr: mikmod
sdz: mikmod
sparks: cqrlog, create-tx-configuration
steve: pkcs11-helper
toshio: python-paver
vbatts: golang-googlecode-net, golang-github-gorilla-context, golang-googlecode-sqlite, golang-github-gorilla-mux
Orphans (10): cqrlog create-tx-configuration
golang-github-gorilla-context golang-github-gorilla-mux
golang-github-kr-pty golang-googlecode-net
golang-googlecode-sqlite mikmod pkcs11-helper python-paver
Orphans (dependend on) (1): pkcs11-helper
Orphans for at least 6 weeks (dependend on) (1): pkcs11-helper
Orphans (not depended on) (9): cqrlog create-tx-configuration
golang-github-gorilla-context golang-github-gorilla-mux
golang-github-kr-pty golang-googlecode-net
golang-googlecode-sqlite mikmod python-paver
Orphans for at least 6 weeks (not dependend on) (7):
golang-github-gorilla-context golang-github-gorilla-mux
golang-github-kr-pty golang-googlecode-net
golang-googlecode-sqlite mikmod python-paver
Depending packages (2): NetworkManager-openvpn openvpn
Packages depending on packages orphaned for more than 6 weeks (2):
NetworkManager-openvpn openvpn
Not found in repo (1): cqrlog
--
The script creating this output is run and developed by Fedora
Release Engineering. Please report issues at its trac instance:
https://fedorahosted.org/rel-eng/
The sources of this script can be found at:
https://git.fedorahosted.org/cgit/releng/tree/scripts/find_unblocked_orphan…
The following Fedora EPEL 5 Security updates need testing:
Age URL
914 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3.2.…
368 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11893/libguestfs-1…
133 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1626/puppet-2.7.26…
29 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2669/check-mk-1.2.…
28 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2853/mediawiki119-…
13 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3206/phpMyAdmin4-4…
9 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3333/catdoc-0.94.2…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3455/drupal7-7.32-…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3549/rubygem-actio…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3554/rubygem-rails…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3570/tor-0.2.4.25-…
The following builds have been pushed to Fedora EPEL 5 updates-testing
nginx-0.8.55-5.el5
rubygem-actionmailer-2.3.18-1.el5
rubygem-activeresource-2.3.18-1.el5
rubygem-rails-2.3.18-1.el5
tor-0.2.4.25-1.el5
Details about builds:
================================================================================
nginx-0.8.55-5.el5 (FEDORA-EPEL-2014-3569)
Robust, small and high performance HTTP and reverse proxy server
--------------------------------------------------------------------------------
Update Information:
add vim files (#1142849)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Jamie Nguyen <jamielinux(a)fedoraproject.org> - 0.8.55-4
- add vim files (#1142849)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1142849 - [RFE] include nginx vim files
https://bugzilla.redhat.com/show_bug.cgi?id=1142849
--------------------------------------------------------------------------------
================================================================================
rubygem-actionmailer-2.3.18-1.el5 (FEDORA-EPEL-2014-3554)
Service layer for easy email delivery and testing
--------------------------------------------------------------------------------
Update Information:
This is part of the second part of the security rollup to 2.3.18 for EPEL5. These packages don't have security updates, but their dependencies of activerecord, activesupport and actionpack do.
--------------------------------------------------------------------------------
================================================================================
rubygem-activeresource-2.3.18-1.el5 (FEDORA-EPEL-2014-3554)
Active Record for web resources
--------------------------------------------------------------------------------
Update Information:
This is part of the second part of the security rollup to 2.3.18 for EPEL5. These packages don't have security updates, but their dependencies of activerecord, activesupport and actionpack do.
--------------------------------------------------------------------------------
================================================================================
rubygem-rails-2.3.18-1.el5 (FEDORA-EPEL-2014-3554)
Web-application framework
--------------------------------------------------------------------------------
Update Information:
This is part of the second part of the security rollup to 2.3.18 for EPEL5. These packages don't have security updates, but their dependencies of activerecord, activesupport and actionpack do.
--------------------------------------------------------------------------------
================================================================================
tor-0.2.4.25-1.el5 (FEDORA-EPEL-2014-3570)
Anonymizing overlay network for TCP (The onion router)
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Jamie Nguyen <jamielinux(a)fedoraproject.org> - 0.2.4.25-1
- update to upstream release 0.2.4.25
- reduce diff between el6 and el5
(amend URL, amend macros, some whitespace changes for legibility)
* Wed Feb 27 2013 Jamie Nguyen <jamielinux(a)fedoraproject.org> - 0.2.3.25-1
- rewrite package from scratch for simplicity and clarity
- stick closer with upstream defaults
- update to latest stable release
- add defaults-torrc
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1060758 - CVE-2012-2249 tor: denial of service via a renegotiation attempt
https://bugzilla.redhat.com/show_bug.cgi?id=1060758
[ 2 ] Bug #1055014 - CVE-2013-7295 tor: improper random number generation on certain Intel platforms with OpenSSL 1.x
https://bugzilla.redhat.com/show_bug.cgi?id=1055014
[ 3 ] Bug #1060768 - CVE-2012-2250 tor: denial of service via link protocol negotiation
https://bugzilla.redhat.com/show_bug.cgi?id=1060768
--------------------------------------------------------------------------------
After a very long period of neglect, (sorry), I worked on updating the
rails stack in EPEL5 to 2.3.18. This includes activesupport, activerecord
and actionpack thus far. Rails still to come.
Moving from 2.1.x to 2.3.x *should* be a clean upgrade, but I know in some
cases it's not, as some security fixes required minor behavioral changes.
I'd appreciate karma and feedback here if anybody is still using this old
stack on EPEL5.
https://admin.fedoraproject.org/updates/rubygem-actionpack-2.3.18-1.el5,rub…
The bugs and CVEs addressed are plentiful.
- Bug 1095122 - CVE-2014-0130
- Bug 1095125 - CVE-2014-0130
- Bug 677626 - CVE-2011-0446
- Bug 677629 - CVE-2011-0446, CVE-2011-0447
- Bug 677631 - CVE-2011-0447
- Bug 731435 - CVE-2011-2932
- Bug 731438 - CVE-2011-2930
- Bug 731450 - CVE-2011-2932
- Bug 731453 - CVE-2011-2930
- Bug 744706 - CVE-2010-3933
- Bug 831583 - CVE-2012-2695
- Bug 843924 - CVE-2012-3424
- Bug 847202 - CVE-2013-0156
- Bug 891468 - CVE-2012-5664
- Bug 905373 - CVE-2013-0333
- Bug 921329 - CVE-2013-1854
- Bug 924297 - CVE-2013-1855, CVE-2013-1857
- Bug 924318 - CVE-2013-1854
- Bug 948706 - CVE-2013-0276
The following Fedora EPEL 7 Security updates need testing:
Age URL
28 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2748/nodejs-0.10.3…
27 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2861/nodejs-qs-0.6…
27 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2870/nodejs-send-0…
12 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3236/python-oauth2…
11 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3283/php-ZendFrame…
8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3292/davfs2-1.4.7-…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3454/rubygem-httpc…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3432/drupal7-7.32-…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3328/zarafa-7.1.11…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3530/phpMyAdmin-4.…
The following builds have been pushed to Fedora EPEL 7 updates-testing
createrepo_c-0.7.0-1.el7
debootstrap-1.0.64-1.el7
fedora-review-0.5.2-1.el7
fldigi-3.22.01-1.el7
globus-gram-audit-4.3-2.el7
mate-themes-1.9.1-1.el7
mate-themes-extras-3.8.0-1.el7
nodejs-chainsaw-0.1.0-1.el7
ntfs-3g-2014.2.15-6.el7
phpMyAdmin-4.2.10.1-1.el7
python-django-pyscss-1.0.5-2.el7
python-pdfkit-0.4.1-5.el7
Details about builds:
================================================================================
createrepo_c-0.7.0-1.el7 (FEDORA-EPEL-2014-3536)
Creates a common metadata repository
--------------------------------------------------------------------------------
Update Information:
Update to 0.7.0
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 20 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.7.0-1
- deltarpms: Update module to work with current version of drpm
- mergerepo_c: Add --omit-baseurl option
- craterepo_c: Gen empty repo if empty pkglist is used
- Docs: Output python docs to separate directory
- Several small fixes
* Tue Aug 12 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.6.1-1
- updateinfo: Use Python datetime objects in python bindings
* Tue Aug 5 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.6.0-1
- Support for updateinfo.xml manipulation (including Python bindings)
* Fri Jul 18 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.5.0-1
- Experimental delta rpm (DRPM) support (Disabled in Fedora build).
* Thu Jun 26 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.4.1-1
- Initialize threads correctly on old versions of GLib2 (RhBug: 1108787)
- Do not print log domain (get rid off C_CREATEREPOLIB prefix in log messages)
- Implements support for --cachedir
- New option --retain-old-md-by-age
- Few small API changes
* Tue May 6 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.4.0-1
- Change default behavior of repodata files handling. (RhBug: 1094539)
See: https://github.com/Tojaj/createrepo_c/wiki/New-File-Handling
By default, createrepo leaves old groupfiles (comps files)
in the repodata/ directory during update.
Createrepo_c did the same thing but the version 0.4.0 changes this behaviour.
* Thu Apr 10 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.3.1-2
- Support for weak and rich dependecies
--------------------------------------------------------------------------------
================================================================================
debootstrap-1.0.64-1.el7 (FEDORA-EPEL-2014-3546)
Debian GNU/Linux bootstrapper
--------------------------------------------------------------------------------
Update Information:
new upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Jan Vcelak <jvcelak(a)fedoraproject.org> 1.0.64-1
- new upstream release:
+ Ubuntu vivid as a symlink to gutsy
+ move set -e out of shebang line (Debian: #762713)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1146866 - debootstrap-1.0.64 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1146866
--------------------------------------------------------------------------------
================================================================================
fedora-review-0.5.2-1.el7 (FEDORA-EPEL-2014-3537)
Review tool for fedora rpm packages
--------------------------------------------------------------------------------
Update Information:
fedora-review for EPEL7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1140900 - RFE: Please branch for EPEL7
https://bugzilla.redhat.com/show_bug.cgi?id=1140900
--------------------------------------------------------------------------------
================================================================================
fldigi-3.22.01-1.el7 (FEDORA-EPEL-2014-3550)
Digital modem program for Linux
--------------------------------------------------------------------------------
Update Information:
Version 3.22.01 * Maintenance release
RX single click
* restored Name / QTH clickable
Macro Buttons
* Increase width of alternate macro button(s)
* Add 2 row scheme, one above, one below text panel
Thumb drive
* update documentation on thumb drive installation
Power Squelch
* Correct initial state of power squelch
Documentation update
* Added missing documentation on use of Smeter / Power-meter
display on main dialog.
* Added new xmlrpc TxID commands
TxID control via xmlrpc
* Added xmlrpc commands
- Main.get_txid
- Main.set_txid
- Main.toggle_txid
Analysis modem
* Fix seg fault in rx_process
XMLRPC Character measurement issues with 8PSK modems
* Update xmlprc Main_get_char_timing() routine. Problem still persist in
other areas of FLDIGI ie Macro CPS, other xmlrpc commands.
Gray-mapped 8PSK and soft-decision
* Upgraded 8psk to Gray mapped constellation
* Implemented Soft-Decision decoder based on Gray constellation
* Even when the received phase is distorted by +- 1 phase-position:
- One of the bits is still known with 100% certianty.
- Only up to 1 bit can be in error.
* Increased gain for noisy/weak/HF channels
View/Hide Smeter
* Add view/hide Smeter / Power meter
- configuration saved in progdefaults, requires
"save config" to keep setting between executions.
* Reduce minimum width of main dialog to 750 pixels
CW matched filter
* Fix to inoperative matched filter
flarq update
* flarq changes to bring up to date with the 3.21 maintenance
branch
* version 4.3.5
For changes to fldigi see:
http://www.w1hkj.com/downloads/fldigi/fldigi_changes.txt
For changes to flrig see:
http://www.w1hkj.com/downloads/flrig/changes.txt
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155105 - fldigi-3.22.01 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1155105
--------------------------------------------------------------------------------
================================================================================
globus-gram-audit-4.3-2.el7 (FEDORA-EPEL-2014-3542)
Globus Toolkit - GRAM Jobmanager Auditing
--------------------------------------------------------------------------------
Update Information:
Remove unexpanded configure macro.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Oct 19 2014 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 4.3-2
- Remove unexpanded configure macro
--------------------------------------------------------------------------------
================================================================================
mate-themes-1.9.1-1.el7 (FEDORA-EPEL-2014-3547)
MATE Desktop themes
--------------------------------------------------------------------------------
Update Information:
- update to 1.9.1 release optimized for GTK3-3.8
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Wolfgang Ulbrich <chat-to-me(a)raveit.de> - 1.9.1-1
- update to 1.9.1 release for GTK3-3.8
- fix contrasthigh icon theme name
- remove all themes which doesn't support GTK3
* Fri Oct 17 2014 Wolfgang Ulbrich <chat-to-me(a)raveit.de> - 3.8.0-1
- update to GTK3 3.8.0 release
- drop adwaita engine require
- drop old themes
- disable runtime require gtk-unico-engine for the moment, see rhbz (#1154061)
--------------------------------------------------------------------------------
================================================================================
mate-themes-extras-3.8.0-1.el7 (FEDORA-EPEL-2014-3406)
Extra gtk-2/3 themes for gtk based desktops
--------------------------------------------------------------------------------
Update Information:
- build for epel7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #998219 - Review Request: mate-themes-extras - GTK-2/3 themes for GTK based desktops
https://bugzilla.redhat.com/show_bug.cgi?id=998219
--------------------------------------------------------------------------------
================================================================================
nodejs-chainsaw-0.1.0-1.el7 (FEDORA-EPEL-2014-3531)
Build chainable fluent interfaces the easy way
--------------------------------------------------------------------------------
Update Information:
Initial packaging
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1142049 - Review Request: nodejs-chainsaw - Build chainable fluent interfaces the easy way
https://bugzilla.redhat.com/show_bug.cgi?id=1142049
--------------------------------------------------------------------------------
================================================================================
ntfs-3g-2014.2.15-6.el7 (FEDORA-EPEL-2014-3535)
Linux NTFS userspace driver
--------------------------------------------------------------------------------
Update Information:
Update to 2014.2.15 with fstrim fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2014.2.15-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Tue Aug 5 2014 Richard W.M. Jones <rjones(a)redhat.com> - 2:2014.2.15-5
- Add upstream patch to fix fstrim so it works on partitions as well
as whole disks.
* Thu Jul 31 2014 Richard W.M. Jones <rjones(a)redhat.com> - 2:2014.2.15-4
- Upstream patches which add fstrim support.
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2014.2.15-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Apr 24 2014 Tomáš Mráz <tmraz(a)redhat.com> - 2:2014.2.15-2
- Rebuild for new libgcrypt
* Wed Feb 26 2014 Tom Callaway <spot(a)fedoraproject.org> 2:2014.2.15-1
- update to 2014.2.15
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2013.1.13-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
phpMyAdmin-4.2.10.1-1.el7 (FEDORA-EPEL-2014-3530)
Handle the administration of MySQL over the World Wide Web
--------------------------------------------------------------------------------
Update Information:
phpMyAdmin 4.2.10.1 (2014-10-21)
================================
- [security] XSS in debug SQL output
- [security] XSS in monitor query analyzer
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Robert Scheck <robert(a)fedoraproject.org> 4.2.10.1-1
- Upgrade to 4.2.10.1 (#1155272, #1155362)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155362 - CVE-2014-8326 phpmyadmin: cross-site scripting (XSS) flaw fixed in versions 4.0.10.5, 4.1.14.6, and 4.2.10.1 (PMASA-2014-12)
https://bugzilla.redhat.com/show_bug.cgi?id=1155362
--------------------------------------------------------------------------------
================================================================================
python-django-pyscss-1.0.5-2.el7 (FEDORA-EPEL-2014-3540)
Makes it easier to use PySCSS in Django
--------------------------------------------------------------------------------
Update Information:
Initial build on EPEL7
--------------------------------------------------------------------------------
================================================================================
python-pdfkit-0.4.1-5.el7 (FEDORA-EPEL-2014-3538)
Wkhtmltopdf python wrapper
--------------------------------------------------------------------------------
Update Information:
New package for epel7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1145443 - Review Request: python-pdfkit - Python 2 wrapper for wkhtmltopdf utility to convert HTML to PDF
https://bugzilla.redhat.com/show_bug.cgi?id=1145443
--------------------------------------------------------------------------------
The following Fedora EPEL 6 Security updates need testing:
Age URL
913 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5620/bugzilla-3.4.…
132 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1616/puppet-2.7.26…
28 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2719/nodejs-0.10.3…
27 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2811/nodejs-qs-0.6…
27 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2821/nodejs-send-0…
12 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3202/python-oauth2…
12 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-2850/nginx-1.0.15-…
11 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3286/facter-1.6.18…
11 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3264/getmail-4.46.…
11 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3279/php-ZendFrame…
8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3297/catdoc-0.94.2…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3427/rubygem-httpc…
5 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3421/drupal7-7.32-…
3 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3434/pylint-1.3.1-…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3527/asterisk-1.8.…
0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3533/phpMyAdmin-4.…
The following builds have been pushed to Fedora EPEL 6 updates-testing
asterisk-1.8.31.1-1.el6
createrepo_c-0.7.0-1.el6
debootstrap-1.0.64-1.el6
globus-gram-audit-4.3-2.el6
gnucash-2.4.15-4.el6
hdf5-1.8.5.patch1-9.el6
ntfs-3g-2014.2.15-6.el6
paraview-3.8.1-3.el6
phpMyAdmin-4.0.10.5-1.el6
pyelftools-0.22-0.6.git20130619.a1d9681.el6
scalapack-2.0.2-5.el6.1
Details about builds:
================================================================================
asterisk-1.8.31.1-1.el6 (FEDORA-EPEL-2014-3527)
The Open Source PBX
--------------------------------------------------------------------------------
Update Information:
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.31.1-1:
The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available
security releases are released as versions 1.8.28-cert2, 11.6-cert7, 1.8.31.1,
11.13.1, 12.6.1, and 13.0.0-beta3.
These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases
The release of these versions resolves the following security vulnerability:
* AST-2014-011: Asterisk Susceptibility to POODLE Vulnerability
Asterisk is susceptible to the POODLE vulnerability in two ways:
1) The res_jabber and res_xmpp module both use SSLv3 exclusively for their
encrypted connections.
2) The core TLS handling in Asterisk, which is used by the chan_sip channel
driver, Asterisk Manager Interface (AMI), and Asterisk HTTP Server, by
default allow a TLS connection to fallback to SSLv3. This allows for a
MITM to potentially force a connection to fallback to SSLv3, exposing it
to the POODLE vulnerability.
These issues have been resolved in the versions released in conjunction with
this security advisory.
For more information about the details of this vulnerability, please read
security advisory AST-2014-011, which was released at the same time as this
announcement.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.…
The security advisory is available at:
* http://downloads.asterisk.org/pub/security/AST-2014-011.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.31.0-1:
The Asterisk Development Team has announced the release of Asterisk 1.8.31.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.31.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-24032 - Gentoo compilation emits warning:
"_FORTIFY_SOURCE" redefined (Reported by Kilburn)
* ASTERISK-24225 - Dial option z is broken (Reported by
dimitripietro)
* ASTERISK-24178 - [patch]fromdomainport used even if not set
(Reported by Elazar Broad)
* ASTERISK-24019 - When a Music On Hold stream starts it restarts
at beginning of file. (Reported by Jason Richards)
* ASTERISK-24211 - testsuite: Fix the dial_LS_options test
(Reported by Matt Jordan)
* ASTERISK-24249 - SIP debugs do not stop (Reported by Avinash
Mohod)
Improvements made in this release:
-----------------------------------
* ASTERISK-24171 - [patch] Provide a manpage for the aelparse
utility (Reported by Jeremy Lainé)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.31.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.30.0-1:
The Asterisk Development Team has announced the release of Asterisk 1.8.30.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.30.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-23911 - URIENCODE/URIDECODE: WARNING about passing an
empty string is a bit over zealous (Reported by Matt Jordan)
* ASTERISK-23814 - No call started after peer dialed (Reported by
Igor Goncharovsky)
* ASTERISK-24087 - [patch]chan_sip: sip_subscribe_mwi_destroy
should not call sip_destroy (Reported by Corey Farrell)
* ASTERISK-23818 - PBX_Lua: after asterisk startup module is
loaded, but dialplan not available (Reported by Dennis Guse)
* ASTERISK-18345 - [patch] sips connection dropped by asterisk
with a large INVITE (Reported by Stephane Chazelas)
* ASTERISK-23508 - Memory Corruption in
__ast_string_field_ptr_build_va (Reported by Arnd Schmitter)
Improvements made in this release:
-----------------------------------
* ASTERISK-21178 - Improve documentation for manager command
Getvar, Setvar (Reported by Rusty Newton)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.30.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.29.0-1:
The Asterisk Development Team has announced the release of Asterisk 1.8.29.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.29.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-22551 - Session timer : UAS (Asterisk) starts counting
at Invite, UAC starts counting at 200 OK. (Reported by i2045)
* ASTERISK-23582 - [patch]Inconsistent column length in *odbc
(Reported by Walter Doekes)
* ASTERISK-23803 - AMI action UpdateConfig EmptyCat clears all
categories but the requested one (Reported by zvision)
* ASTERISK-23035 - ConfBridge with name longer than max (32 chars)
results in several bridges with same conf_name (Reported by
Iñaki Cívico)
* ASTERISK-23683 - #includes - wildcard character in a path more
than one directory deep - results in no config parsing on module
reload (Reported by tootai)
* ASTERISK-23827 - autoservice thread doesn't exit at shutdown
(Reported by Corey Farrell)
* ASTERISK-23814 - No call started after peer dialed (Reported by
Igor Goncharovsky)
* ASTERISK-23673 - Security: DOS by consuming the number of
allowed HTTP connections. (Reported by Richard Mudgett)
* ASTERISK-23246 - DEBUG messages in sdp_crypto.c display despite
a DEBUG level of zero (Reported by Rusty Newton)
* ASTERISK-23766 - [patch] Specify timeout for database write in
SQLite (Reported by Igor Goncharovsky)
* ASTERISK-23818 - PBX_Lua: after asterisk startup module is
loaded, but dialplan not available (Reported by Dennis Guse)
* ASTERISK-23667 - features.conf.sample is unclear as to which
options can or cannot be set in the general section (Reported by
David Brillert)
* ASTERISK-23790 - [patch] - SIP From headers longer than 256
characters result in dropped call and 'No closing bracket'
warnings. (Reported by uniken1)
* ASTERISK-23908 - [patch]When using FEC error correction,
asterisk tries considers negative sequence numbers as missing
(Reported by Torrey Searle)
* ASTERISK-23921 - refcounter.py uses excessive ram for large refs
files (Reported by Corey Farrell)
* ASTERISK-23948 - REF_DEBUG fails to record ao2_ref against
objects that were already freed (Reported by Corey Farrell)
* ASTERISK-23984 - Infinite loop possible in ast_careful_fwrite()
(Reported by Steve Davies)
* ASTERISK-23897 - [patch]Change in SETUP ACK handling (checking
PI) in revision 413765 breaks working environments (Reported by
Pavel Troller)
Improvements made in this release:
-----------------------------------
* ASTERISK-23564 - [patch]TLS/SRTP status of channel not currently
available in a CLI command (Reported by Patrick Laimbock)
* ASTERISK-23492 - Add option to safe_asterisk to disable
backgrounding (Reported by Walter Doekes)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.29.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.2-1:
The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security
releases are released as versions 1.8.15-cert7, 11.6-cert4, 1.8.28.2, 11.10.2,
and 12.3.2.
These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases
These releases resolve security vulnerabilities that were previously fixed in
1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1. Unfortunately, the fix
for AST-2014-007 inadvertently introduced a regression in Asterisk's TCP and TLS
handling that prevented Asterisk from sending data over these transports. This
regression and the security vulnerabilities have been fixed in the versions
specified in this release announcement.
The security patches for AST-2014-007 have been updated with the fix for the
regression, and are available at http://downloads.asterisk.org/pub/security
Please note that the release of these versions resolves the following security
vulnerabilities:
* AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe
Framework
* AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
Shell Access
* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
Connections
* AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions
For more information about the details of these vulnerabilities, please read
security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008,
which were released with the previous versions that addressed these
vulnerabilities.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…
The security advisories are available at:
* http://downloads.asterisk.org/pub/security/AST-2014-005.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-007.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-008.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.1-1:
The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security
releases are released as versions 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1,
and 12.3.1.
These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases
The release of these versions resolves the following issue:
* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
Connections
Establishing a TCP or TLS connection to the configured HTTP or HTTPS port
respectively in http.conf and then not sending or completing a HTTP request
will tie up a HTTP session. By doing this repeatedly until the maximum number
of open HTTP sessions is reached, legitimate requests are blocked.
Additionally, the release of 11.6-cert3, 11.10.1, and 12.3.1 resolves the
following issue:
* AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
Shell Access
Manager users can execute arbitrary shell commands with the MixMonitor manager
action. Asterisk does not require system class authorization for a manager
user to use the MixMonitor action, so any manager user who is permitted to use
manager commands can potentially execute shell commands as the user executing
the Asterisk process.
Additionally, the release of 12.3.1 resolves the following issues:
* AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe
Framework
A remotely exploitable crash vulnerability exists in the PJSIP channel
driver's pub/sub framework. If an attempt is made to unsubscribe when not
currently subscribed and the endpoint's “sub_min_expiry” is set to zero,
Asterisk tries to create an expiration timer with zero seconds, which is not
allowed, so an assertion raised.
* AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions
When a SIP transaction timeout caused a subscription to be terminated, the
action taken by Asterisk was guaranteed to deadlock the thread on which SIP
requests are serviced. Note that this behavior could only happen on
established subscriptions, meaning that this could only be exploited if an
attacker bypassed authentication and successfully subscribed to a real
resource on the Asterisk server.
These issues and their resolutions are described in the security advisories.
For more information about the details of these vulnerabilities, please read
security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008,
which were released at the same time as this announcement.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…
The security advisories are available at:
* http://downloads.asterisk.org/pub/security/AST-2014-005.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-007.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-008.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.0-1:
The Asterisk Development Team has announced the release of Asterisk 1.8.28.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.28.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-23547 - [patch] app_queue removing callers from queue
when reloading (Reported by Italo Rossi)
* ASTERISK-22846 - testsuite: masquerade super test fails on all
branches (still) (Reported by Matt Jordan)
* ASTERISK-23546 - CB_ADD_LEN does not do what you'd think
(Reported by Walter Doekes)
* ASTERISK-23620 - Code path in app_stack fails to unlock list
(Reported by Bradley Watkins)
* ASTERISK-18331 - app_sms failure (Reported by David Woodhouse)
* ASTERISK-19465 - P-Asserted-Identity Privacy (Reported by
Krzysztof Chmielewski)
* ASTERISK-23707 - Realtime Contacts: Apparent mismatch between
PGSQL database state and Asterisk state (Reported by Mark
Michelson)
* ASTERISK-23665 - Wrong mime type for codec H263-1998 (h263+)
(Reported by Guillaume Maudoux)
* ASTERISK-22977 - chan_sip+CEL: missing ANSWER and PICKUP event
for INVITE/w/replaces pickup (Reported by Walter Doekes)
* ASTERISK-23709 - Regression in Dahdi/Analog/waitfordialtone
(Reported by Steve Davies)
* ASTERISK-23650 - Intermittent segfault in string functions
(Reported by Roel van Meer)
Improvements made in this release:
-----------------------------------
* ASTERISK-23754 - [patch] Use var/lib directory for log file
configured in asterisk.conf (Reported by Igor Goncharovsky)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.28.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.27.0-1:
The Asterisk Development Team has announced the release of Asterisk 1.8.27.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.27.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-22790 - check_modem_rate() may return incorrect rate
for V.27 (Reported by Paolo Compagnini)
* ASTERISK-23061 - [Patch] 'textsupport' setting not mentioned in
sip.conf.sample (Reported by Eugene)
* ASTERISK-23028 - [patch] Asterisk man pages contains unquoted
minus signs (Reported by Jeremy Lainé)
* ASTERISK-23046 - Custom CDR fields set during a GoSUB called
from app_queue are not inserted (Reported by Denis Pantsyrev)
* ASTERISK-23027 - [patch] Spelling typo "transfered" instead of
"transferred" (Reported by Jeremy Lainé)
* ASTERISK-23008 - Local channels loose CALLERID name when DAHDI
channel connects (Reported by Michael Cargile)
* ASTERISK-23100 - [patch] In chan_mgcp the ident in transmitted
request and request queue may differ - fix for locking (Reported
by adomjan)
* ASTERISK-22988 - [patch]T38 , SIP 488 after Rejecting image
media offer due to invalid or unsupported syntax (Reported by
adomjan)
* ASTERISK-22861 - [patch]Specifying a null time as parameter to
GotoIfTime or ExecIfTime causes segmentation fault (Reported by
Sebastian Murray-Roberts)
* ASTERISK-17837 - extconfig.conf - Maximum Include level (1)
exceeded (Reported by pz)
* ASTERISK-22662 - Documentation fix? - queues.conf says
persistentmembers defaults to yes, it appears to lie (Reported
by Rusty Newton)
* ASTERISK-23134 - [patch] res_rtp_asterisk port selection cannot
handle selinux port restrictions (Reported by Corey Farrell)
* ASTERISK-23220 - STACK_PEEK function with no arguments causes
crash/core dump (Reported by James Sharp)
* ASTERISK-19773 - Asterisk crash on issuing Asterisk-CLI 'reload'
command multiple times on cli_aliases (Reported by Joel Vandal)
* ASTERISK-22757 - segfault in res_clialiases.so on reload when
mapping "module reload" command (Reported by Gareth Blades)
* ASTERISK-17727 - [patch] TLS doesn't get all certificate chain
(Reported by LN)
* ASTERISK-23178 - devicestate.h: device state setting functions
are documented with the wrong return values (Reported by
Jonathan Rose)
* ASTERISK-23297 - Asterisk 12, pbx_config.so segfaults if
res_parking.so is not loaded, or if res_parking.conf has no
configuration (Reported by CJ Oster)
* ASTERISK-23069 - Custom CDR variable not recorded when set in
macro called from app_queue (Reported by Bryan Anderson)
* ASTERISK-19499 - ConfBridge MOH is not working for transferee
after attended transfer (Reported by Timo Teräs)
* ASTERISK-23261 - [patch]Output mixup in
${CHANNEL(rtpqos,audio,all)} (Reported by rsw686)
* ASTERISK-23260 - [patch]ForkCDR v option does not keep CDR
variables for subsequent records (Reported by zvision)
* ASTERISK-23141 - Asterisk crashes on Dial(), in
pbx_find_extension at pbx.c (Reported by Maxim)
* ASTERISK-23231 - Since 405693 If we have res_fax.conf file set
to minrate=2400, then res_fax refuse to load (Reported by David
Brillert)
* ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set
- probably introduced in 11.7.0 (Reported by OK)
* ASTERISK-23323 - [patch]chan_sip: missing p->owner checks in
handle_response_invite (Reported by Walter Doekes)
* ASTERISK-23382 - [patch]Build System: make -qp can corrupt
menuselect-tree and related files (Reported by Corey Farrell)
* ASTERISK-23406 - [patch]Fix typo in "sip show peer" (Reported by
ibercom)
* ASTERISK-23310 - bridged channel crashes in bridge_p2p_rtp_write
(Reported by Jeremy Lainé)
* ASTERISK-23104 - Specifying the SetVar AMI without a Channel
cause Asterisk to crash (Reported by Joel Vandal)
* ASTERISK-23383 - Wrong sense test on stat return code causes
unchanged config check to break with include files. (Reported by
David Woolley)
* ASTERISK-17523 - Qualify for static realtime peers does not work
(Reported by Maciej Krajewski)
* ASTERISK-21406 - [patch] chan_sip deadlock on monlock between
unload_module and do_monitor (Reported by Corey Farrell)
* ASTERISK-23373 - [patch]Security: Open FD exhaustion with
chan_sip Session-Timers (Reported by Corey Farrell)
* ASTERISK-23340 - Security Vulnerability: stack allocation of
cookie headers in loop allows for unauthenticated remote denial
of service attack (Reported by Matt Jordan)
* ASTERISK-23488 - Logic error in callerid checksum processing
(Reported by Russ Meyerriecks)
* ASTERISK-20841 - fromdomain not honored on outbound INVITE
request (Reported by Kelly Goedert)
* ASTERISK-22079 - Segfault: INTERNAL_OBJ (user_data=0x6374652f)
at astobj2.c:120 (Reported by Jamuel Starkey)
* ASTERISK-23509 - [patch]SayNumber for Polish language tries to
play empty files for numbers divisible by 100 (Reported by
zvision)
* ASTERISK-23391 - Audit dialplan function usage of channel
variable (Reported by Corey Farrell)
* ASTERISK-23548 - POST to ARI sometimes returns no body on
success (Reported by Scott Griepentrog)
Improvements made in this release:
-----------------------------------
* ASTERISK-22980 - [patch]Allow building cdr_radius and cel_radius
against libfreeradius-client (Reported by Jeremy Lainé)
* ASTERISK-22661 - Unable to exit ChanSpy if spied channel does
not have a call in progress (Reported by Chris Hillman)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.27.0
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.31.1-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available
- security releases are released as versions 1.8.28-cert2, 11.6-cert7, 1.8.31.1,
- 11.13.1, 12.6.1, and 13.0.0-beta3.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of these versions resolves the following security vulnerability:
-
- * AST-2014-011: Asterisk Susceptibility to POODLE Vulnerability
-
- Asterisk is susceptible to the POODLE vulnerability in two ways:
- 1) The res_jabber and res_xmpp module both use SSLv3 exclusively for their
- encrypted connections.
- 2) The core TLS handling in Asterisk, which is used by the chan_sip channel
- driver, Asterisk Manager Interface (AMI), and Asterisk HTTP Server, by
- default allow a TLS connection to fallback to SSLv3. This allows for a
- MITM to potentially force a connection to fallback to SSLv3, exposing it
- to the POODLE vulnerability.
-
- These issues have been resolved in the versions released in conjunction with
- this security advisory.
-
- For more information about the details of this vulnerability, please read
- security advisory AST-2014-011, which was released at the same time as this
- announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.…
-
- The security advisory is available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2014-011.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.31.0-1:
- The Asterisk Development Team has announced the release of Asterisk 1.8.31.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 1.8.31.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- Bugs fixed in this release:
- -----------------------------------
- * ASTERISK-24032 - Gentoo compilation emits warning:
- "_FORTIFY_SOURCE" redefined (Reported by Kilburn)
- * ASTERISK-24225 - Dial option z is broken (Reported by
- dimitripietro)
- * ASTERISK-24178 - [patch]fromdomainport used even if not set
- (Reported by Elazar Broad)
- * ASTERISK-24019 - When a Music On Hold stream starts it restarts
- at beginning of file. (Reported by Jason Richards)
- * ASTERISK-24211 - testsuite: Fix the dial_LS_options test
- (Reported by Matt Jordan)
- * ASTERISK-24249 - SIP debugs do not stop (Reported by Avinash
- Mohod)
-
- Improvements made in this release:
- -----------------------------------
- * ASTERISK-24171 - [patch] Provide a manpage for the aelparse
- utility (Reported by Jeremy Lainé)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.31.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.30.0-1:
- The Asterisk Development Team has announced the release of Asterisk 1.8.30.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 1.8.30.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- Bugs fixed in this release:
- -----------------------------------
- * ASTERISK-23911 - URIENCODE/URIDECODE: WARNING about passing an
- empty string is a bit over zealous (Reported by Matt Jordan)
- * ASTERISK-23814 - No call started after peer dialed (Reported by
- Igor Goncharovsky)
- * ASTERISK-24087 - [patch]chan_sip: sip_subscribe_mwi_destroy
- should not call sip_destroy (Reported by Corey Farrell)
- * ASTERISK-23818 - PBX_Lua: after asterisk startup module is
- loaded, but dialplan not available (Reported by Dennis Guse)
- * ASTERISK-18345 - [patch] sips connection dropped by asterisk
- with a large INVITE (Reported by Stephane Chazelas)
- * ASTERISK-23508 - Memory Corruption in
- __ast_string_field_ptr_build_va (Reported by Arnd Schmitter)
-
- Improvements made in this release:
- -----------------------------------
- * ASTERISK-21178 - Improve documentation for manager command
- Getvar, Setvar (Reported by Rusty Newton)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.30.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.29.0-1:
- The Asterisk Development Team has announced the release of Asterisk 1.8.29.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 1.8.29.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- Bugs fixed in this release:
- -----------------------------------
- * ASTERISK-22551 - Session timer : UAS (Asterisk) starts counting
- at Invite, UAC starts counting at 200 OK. (Reported by i2045)
- * ASTERISK-23582 - [patch]Inconsistent column length in *odbc
- (Reported by Walter Doekes)
- * ASTERISK-23803 - AMI action UpdateConfig EmptyCat clears all
- categories but the requested one (Reported by zvision)
- * ASTERISK-23035 - ConfBridge with name longer than max (32 chars)
- results in several bridges with same conf_name (Reported by
- Iñaki Cívico)
- * ASTERISK-23683 - #includes - wildcard character in a path more
- than one directory deep - results in no config parsing on module
- reload (Reported by tootai)
- * ASTERISK-23827 - autoservice thread doesn't exit at shutdown
- (Reported by Corey Farrell)
- * ASTERISK-23814 - No call started after peer dialed (Reported by
- Igor Goncharovsky)
- * ASTERISK-23673 - Security: DOS by consuming the number of
- allowed HTTP connections. (Reported by Richard Mudgett)
- * ASTERISK-23246 - DEBUG messages in sdp_crypto.c display despite
- a DEBUG level of zero (Reported by Rusty Newton)
- * ASTERISK-23766 - [patch] Specify timeout for database write in
- SQLite (Reported by Igor Goncharovsky)
- * ASTERISK-23818 - PBX_Lua: after asterisk startup module is
- loaded, but dialplan not available (Reported by Dennis Guse)
- * ASTERISK-23667 - features.conf.sample is unclear as to which
- options can or cannot be set in the general section (Reported by
- David Brillert)
- * ASTERISK-23790 - [patch] - SIP From headers longer than 256
- characters result in dropped call and 'No closing bracket'
- warnings. (Reported by uniken1)
- * ASTERISK-23908 - [patch]When using FEC error correction,
- asterisk tries considers negative sequence numbers as missing
- (Reported by Torrey Searle)
- * ASTERISK-23921 - refcounter.py uses excessive ram for large refs
- files (Reported by Corey Farrell)
- * ASTERISK-23948 - REF_DEBUG fails to record ao2_ref against
- objects that were already freed (Reported by Corey Farrell)
- * ASTERISK-23984 - Infinite loop possible in ast_careful_fwrite()
- (Reported by Steve Davies)
- * ASTERISK-23897 - [patch]Change in SETUP ACK handling (checking
- PI) in revision 413765 breaks working environments (Reported by
- Pavel Troller)
-
- Improvements made in this release:
- -----------------------------------
- * ASTERISK-23564 - [patch]TLS/SRTP status of channel not currently
- available in a CLI command (Reported by Patrick Laimbock)
- * ASTERISK-23492 - Add option to safe_asterisk to disable
- backgrounding (Reported by Walter Doekes)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.29.0
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.2-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security
- releases are released as versions 1.8.15-cert7, 11.6-cert4, 1.8.28.2, 11.10.2,
- and 12.3.2.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- These releases resolve security vulnerabilities that were previously fixed in
- 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1, and 12.3.1. Unfortunately, the fix
- for AST-2014-007 inadvertently introduced a regression in Asterisk's TCP and TLS
- handling that prevented Asterisk from sending data over these transports. This
- regression and the security vulnerabilities have been fixed in the versions
- specified in this release announcement.
-
- The security patches for AST-2014-007 have been updated with the fix for the
- regression, and are available at http://downloads.asterisk.org/pub/security
-
- Please note that the release of these versions resolves the following security
- vulnerabilities:
-
- * AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe
- Framework
-
- * AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
- Shell Access
-
- * AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
- Connections
-
- * AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008,
- which were released with the previous versions that addressed these
- vulnerabilities.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2014-005.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-008.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.1-1:
- The Asterisk Development Team has announced security releases for Certified
- Asterisk 1.8.15, 11.6, and Asterisk 1.8, 11, and 12. The available security
- releases are released as versions 1.8.15-cert6, 11.6-cert3, 1.8.28.1, 11.10.1,
- and 12.3.1.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of these versions resolves the following issue:
-
- * AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
- Connections
-
- Establishing a TCP or TLS connection to the configured HTTP or HTTPS port
- respectively in http.conf and then not sending or completing a HTTP request
- will tie up a HTTP session. By doing this repeatedly until the maximum number
- of open HTTP sessions is reached, legitimate requests are blocked.
-
- Additionally, the release of 11.6-cert3, 11.10.1, and 12.3.1 resolves the
- following issue:
-
- * AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
- Shell Access
-
- Manager users can execute arbitrary shell commands with the MixMonitor manager
- action. Asterisk does not require system class authorization for a manager
- user to use the MixMonitor action, so any manager user who is permitted to use
- manager commands can potentially execute shell commands as the user executing
- the Asterisk process.
-
- Additionally, the release of 12.3.1 resolves the following issues:
-
- * AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe
- Framework
-
- A remotely exploitable crash vulnerability exists in the PJSIP channel
- driver's pub/sub framework. If an attempt is made to unsubscribe when not
- currently subscribed and the endpoint's “sub_min_expiry” is set to zero,
- Asterisk tries to create an expiration timer with zero seconds, which is not
- allowed, so an assertion raised.
-
- * AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions
-
- When a SIP transaction timeout caused a subscription to be terminated, the
- action taken by Asterisk was guaranteed to deadlock the thread on which SIP
- requests are serviced. Note that this behavior could only happen on
- established subscriptions, meaning that this could only be exploited if an
- attacker bypassed authentication and successfully subscribed to a real
- resource on the Asterisk server.
-
- These issues and their resolutions are described in the security advisories.
-
- For more information about the details of these vulnerabilities, please read
- security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008,
- which were released at the same time as this announcement.
-
- For a full list of changes in the current releases, please see the ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8…
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Cha…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.…
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.…
-
- The security advisories are available at:
-
- * http://downloads.asterisk.org/pub/security/AST-2014-005.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-006.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-007.pdf
- * http://downloads.asterisk.org/pub/security/AST-2014-008.pdf
* Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.28.0-1:
- The Asterisk Development Team has announced the release of Asterisk 1.8.28.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 1.8.28.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- Bugs fixed in this release:
- -----------------------------------
- * ASTERISK-23547 - [patch] app_queue removing callers from queue
- when reloading (Reported by Italo Rossi)
- * ASTERISK-22846 - testsuite: masquerade super test fails on all
- branches (still) (Reported by Matt Jordan)
- * ASTERISK-23546 - CB_ADD_LEN does not do what you'd think
- (Reported by Walter Doekes)
- * ASTERISK-23620 - Code path in app_stack fails to unlock list
- (Reported by Bradley Watkins)
- * ASTERISK-18331 - app_sms failure (Reported by David Woodhouse)
- * ASTERISK-19465 - P-Asserted-Identity Privacy (Reported by
- Krzysztof Chmielewski)
- * ASTERISK-23707 - Realtime Contacts: Apparent mismatch between
- PGSQL database state and Asterisk state (Reported by Mark
- Michelson)
- * ASTERISK-23665 - Wrong mime type for codec H263-1998 (h263+)
- (Reported by Guillaume Maudoux)
- * ASTERISK-22977 - chan_sip+CEL: missing ANSWER and PICKUP event
- for INVITE/w/replaces pickup (Reported by Walter Doekes)
- * ASTERISK-23709 - Regression in Dahdi/Analog/waitfordialtone
- (Reported by Steve Davies)
- * ASTERISK-23650 - Intermittent segfault in string functions
- (Reported by Roel van Meer)
-
- Improvements made in this release:
- -----------------------------------
- * ASTERISK-23754 - [patch] Use var/lib directory for log file
- configured in asterisk.conf (Reported by Igor Goncharovsky)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.28.0
-
- * Tue Oct 21 2014 Jeffrey C. Ollie <jeff(a)ocjtech.us> - 1.8.27.0-1:
- The Asterisk Development Team has announced the release of Asterisk 1.8.27.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 1.8.27.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- Bugs fixed in this release:
- -----------------------------------
- * ASTERISK-22790 - check_modem_rate() may return incorrect rate
- for V.27 (Reported by Paolo Compagnini)
- * ASTERISK-23061 - [Patch] 'textsupport' setting not mentioned in
- sip.conf.sample (Reported by Eugene)
- * ASTERISK-23028 - [patch] Asterisk man pages contains unquoted
- minus signs (Reported by Jeremy Lainé)
- * ASTERISK-23046 - Custom CDR fields set during a GoSUB called
- from app_queue are not inserted (Reported by Denis Pantsyrev)
- * ASTERISK-23027 - [patch] Spelling typo "transfered" instead of
- "transferred" (Reported by Jeremy Lainé)
- * ASTERISK-23008 - Local channels loose CALLERID name when DAHDI
- channel connects (Reported by Michael Cargile)
- * ASTERISK-23100 - [patch] In chan_mgcp the ident in transmitted
- request and request queue may differ - fix for locking (Reported
- by adomjan)
- * ASTERISK-22988 - [patch]T38 , SIP 488 after Rejecting image
- media offer due to invalid or unsupported syntax (Reported by
- adomjan)
- * ASTERISK-22861 - [patch]Specifying a null time as parameter to
- GotoIfTime or ExecIfTime causes segmentation fault (Reported by
- Sebastian Murray-Roberts)
- * ASTERISK-17837 - extconfig.conf - Maximum Include level (1)
- exceeded (Reported by pz)
- * ASTERISK-22662 - Documentation fix? - queues.conf says
- persistentmembers defaults to yes, it appears to lie (Reported
- by Rusty Newton)
- * ASTERISK-23134 - [patch] res_rtp_asterisk port selection cannot
- handle selinux port restrictions (Reported by Corey Farrell)
- * ASTERISK-23220 - STACK_PEEK function with no arguments causes
- crash/core dump (Reported by James Sharp)
- * ASTERISK-19773 - Asterisk crash on issuing Asterisk-CLI 'reload'
- command multiple times on cli_aliases (Reported by Joel Vandal)
- * ASTERISK-22757 - segfault in res_clialiases.so on reload when
- mapping "module reload" command (Reported by Gareth Blades)
- * ASTERISK-17727 - [patch] TLS doesn't get all certificate chain
- (Reported by LN)
- * ASTERISK-23178 - devicestate.h: device state setting functions
- are documented with the wrong return values (Reported by
- Jonathan Rose)
- * ASTERISK-23297 - Asterisk 12, pbx_config.so segfaults if
- res_parking.so is not loaded, or if res_parking.conf has no
- configuration (Reported by CJ Oster)
- * ASTERISK-23069 - Custom CDR variable not recorded when set in
- macro called from app_queue (Reported by Bryan Anderson)
- * ASTERISK-19499 - ConfBridge MOH is not working for transferee
- after attended transfer (Reported by Timo Teräs)
- * ASTERISK-23261 - [patch]Output mixup in
- ${CHANNEL(rtpqos,audio,all)} (Reported by rsw686)
- * ASTERISK-23260 - [patch]ForkCDR v option does not keep CDR
- variables for subsequent records (Reported by zvision)
- * ASTERISK-23141 - Asterisk crashes on Dial(), in
- pbx_find_extension at pbx.c (Reported by Maxim)
- * ASTERISK-23231 - Since 405693 If we have res_fax.conf file set
- to minrate=2400, then res_fax refuse to load (Reported by David
- Brillert)
- * ASTERISK-23135 - Crash - segfault in ast_channel_hangupcause_set
- - probably introduced in 11.7.0 (Reported by OK)
- * ASTERISK-23323 - [patch]chan_sip: missing p->owner checks in
- handle_response_invite (Reported by Walter Doekes)
- * ASTERISK-23382 - [patch]Build System: make -qp can corrupt
- menuselect-tree and related files (Reported by Corey Farrell)
- * ASTERISK-23406 - [patch]Fix typo in "sip show peer" (Reported by
- ibercom)
- * ASTERISK-23310 - bridged channel crashes in bridge_p2p_rtp_write
- (Reported by Jeremy Lainé)
- * ASTERISK-23104 - Specifying the SetVar AMI without a Channel
- cause Asterisk to crash (Reported by Joel Vandal)
- * ASTERISK-23383 - Wrong sense test on stat return code causes
- unchanged config check to break with include files. (Reported by
- David Woolley)
- * ASTERISK-17523 - Qualify for static realtime peers does not work
- (Reported by Maciej Krajewski)
- * ASTERISK-21406 - [patch] chan_sip deadlock on monlock between
- unload_module and do_monitor (Reported by Corey Farrell)
- * ASTERISK-23373 - [patch]Security: Open FD exhaustion with
- chan_sip Session-Timers (Reported by Corey Farrell)
- * ASTERISK-23340 - Security Vulnerability: stack allocation of
- cookie headers in loop allows for unauthenticated remote denial
- of service attack (Reported by Matt Jordan)
- * ASTERISK-23488 - Logic error in callerid checksum processing
- (Reported by Russ Meyerriecks)
- * ASTERISK-20841 - fromdomain not honored on outbound INVITE
- request (Reported by Kelly Goedert)
- * ASTERISK-22079 - Segfault: INTERNAL_OBJ (user_data=0x6374652f)
- at astobj2.c:120 (Reported by Jamuel Starkey)
- * ASTERISK-23509 - [patch]SayNumber for Polish language tries to
- play empty files for numbers divisible by 100 (Reported by
- zvision)
- * ASTERISK-23391 - Audit dialplan function usage of channel
- variable (Reported by Corey Farrell)
- * ASTERISK-23548 - POST to ARI sometimes returns no body on
- success (Reported by Scott Griepentrog)
-
- Improvements made in this release:
- -----------------------------------
- * ASTERISK-22980 - [patch]Allow building cdr_radius and cel_radius
- against libfreeradius-client (Reported by Jeremy Lainé)
- * ASTERISK-22661 - Unable to exit ChanSpy if spied channel does
- not have a call in progress (Reported by Chris Hillman)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.27.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1154895 - asterisk vulnerable to CVE-2014-3566/POODLE (AST-2014-011)
https://bugzilla.redhat.com/show_bug.cgi?id=1154895
--------------------------------------------------------------------------------
================================================================================
createrepo_c-0.7.0-1.el6 (FEDORA-EPEL-2014-3528)
Creates a common metadata repository
--------------------------------------------------------------------------------
Update Information:
Update to 0.7.0
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 20 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.7.0-1
- deltarpms: Update module to work with current version of drpm
- mergerepo_c: Add --omit-baseurl option
- craterepo_c: Gen empty repo if empty pkglist is used
- Docs: Output python docs to separate directory
- Several small fixes
* Tue Aug 12 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.6.1-1
- updateinfo: Use Python datetime objects in python bindings
* Tue Aug 5 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.6.0-1
- Support for updateinfo.xml manipulation (including Python bindings)
* Fri Jul 18 2014 Tomas Mlcoch <tmlcoch at redhat.com> - 0.5.0-1
- Experimental delta rpm (DRPM) support (Disabled in Fedora build).
--------------------------------------------------------------------------------
================================================================================
debootstrap-1.0.64-1.el6 (FEDORA-EPEL-2014-3545)
Debian GNU/Linux bootstrapper
--------------------------------------------------------------------------------
Update Information:
new upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Jan Vcelak <jvcelak(a)fedoraproject.org> 1.0.64-1
- new upstream release:
+ Ubuntu vivid as a symlink to gutsy
+ move set -e out of shebang line (Debian: #762713)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1146866 - debootstrap-1.0.64 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1146866
--------------------------------------------------------------------------------
================================================================================
globus-gram-audit-4.3-2.el6 (FEDORA-EPEL-2014-3543)
Globus Toolkit - GRAM Jobmanager Auditing
--------------------------------------------------------------------------------
Update Information:
Remove unexpanded configure macro.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Oct 19 2014 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 4.3-2
- Remove unexpanded configure macro
--------------------------------------------------------------------------------
================================================================================
gnucash-2.4.15-4.el6 (FEDORA-EPEL-2014-3551)
Finance management application
--------------------------------------------------------------------------------
Update Information:
This update is just a rebuild for the WebKit ABI change in RHEL 6.6. If you're on RHEL 6.6 or later, install this update.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Bill Nottingha, <notting(a)splat.cc> - 2.4.15-4
- rebuild for webkitgtk bump (#1155078)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155078 - gnucash needs rebuild because of rhel 6.6 update
https://bugzilla.redhat.com/show_bug.cgi?id=1155078
--------------------------------------------------------------------------------
================================================================================
hdf5-1.8.5.patch1-9.el6 (FEDORA-EPEL-2014-3539)
A general purpose library and file format for storing scientific data
--------------------------------------------------------------------------------
Update Information:
Replace mpich2 with mpich for EL6.6
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Orion Poplawski <orion(a)cora.nwra.com> 1.8.5.patch1-9
- Add Obsoletes/Provides for mpich2 upgrade
* Tue Oct 21 2014 Orion Poplawski <orion(a)cora.nwra.com> 1.8.5.patch1-8
- Replace mpich2 with mpich for EL6.6 (bug #1155089)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155089 - hdf5-mpich2 broke on rhel 6.6 update
https://bugzilla.redhat.com/show_bug.cgi?id=1155089
--------------------------------------------------------------------------------
================================================================================
ntfs-3g-2014.2.15-6.el6 (FEDORA-EPEL-2014-3544)
Linux NTFS userspace driver
--------------------------------------------------------------------------------
Update Information:
Update to a modern ntfs-3g.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2014.2.15-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Tue Aug 5 2014 Richard W.M. Jones <rjones(a)redhat.com> - 2:2014.2.15-5
- Add upstream patch to fix fstrim so it works on partitions as well
as whole disks.
* Thu Jul 31 2014 Richard W.M. Jones <rjones(a)redhat.com> - 2:2014.2.15-4
- Upstream patches which add fstrim support.
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2014.2.15-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Apr 24 2014 Tomáš Mráz <tmraz(a)redhat.com> - 2:2014.2.15-2
- Rebuild for new libgcrypt
* Wed Feb 26 2014 Tom Callaway <spot(a)fedoraproject.org> 2:2014.2.15-1
- update to 2014.2.15
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2013.1.13-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Tue May 28 2013 Tom Callaway <spot(a)fedoraproject.org> - 2:2013.1.13-5
- fix bug preventing reads on compressed files on windows 8 partitions (bz967301)
* Mon May 6 2013 Tom Callaway <spot(a)fedoraproject.org> - 2:2013.1.13-4
- apply fixes from upstream for issue with 4K sector drives (bz951603)
and truncated check for Interix types on a 32-bit CPU (bz958681)
* Thu Feb 7 2013 Tom Callaway <spot(a)fedoraproject.org> - 2:2013.1.13-3
- drop redundant manpages from ntfsprogs subpackage
* Thu Jan 31 2013 Tom Callaway <spot(a)fedoraproject.org> - 2:2013.1.13-2
- drop hal files, since hal is very dead
* Tue Jan 22 2013 Richard W.M. Jones <rjones(a)redhat.com> - 2:2013.1.13-1
- New upstream version 2013.1.13 (RHBZ#902729).
- Drop ntfs-3g-junction-point-fix.patch (now upstream).
- Drop Windows 8 patches x 2 (both now upstream).
- Remove obsolete patches from Fedora git repository.
- Fix .gitignore file.
* Mon Oct 15 2012 Tom Callaway <spot(a)fedoraproject.org> - 2:2012.1.15-5
- Limit obsoletes to last ntfsprogs-* versions ( < 2.0.0-17 ) to
minimize yum churn (where it would obsolete itself on every upgrade)
BZ#863641
* Thu Oct 4 2012 Tom Callaway <spot(a)fedoraproject.org> - 2:2012.1.15-4
- add patches from upstream git to add a level of safety in the case where windows 8
leaves the NTFS filesystem in an unsafe state and Linux access could result in data loss.
Basically, with these patches, Linux will refuse to mount the ntfs partition. For the details
refer to: https://bugzilla.redhat.com/show_bug.cgi?id=859373
* Sun Aug 19 2012 Tom Callaway <spot(a)fedoraproject.org> - 2:2012.1.15-3
- apply upstream fix for junction points (bz849332)
* Fri Jul 20 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2012.1.15-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Fri Feb 10 2012 Tom Callaway <spot(a)fedoraproject.org> 2:2012.1.15-1
- update to 2012.1.15
* Wed Feb 1 2012 Kay Sievers <kay(a)redhat.com> 2:2011.10.9-3
- install everything in /usr
https://fedoraproject.org/wiki/Features/UsrMove
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2:2011.10.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
* Tue Oct 11 2011 Tom Callaway <spot(a)fedoraproject.org> - 2:2011.10.9-1
- 2011.10.9-RC
- patch ntfsck to return 0 instead of 1 on unsupported filesystem cases
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1043236 - Update ntfs-3g/ntfsprogs packages in EPEL
https://bugzilla.redhat.com/show_bug.cgi?id=1043236
--------------------------------------------------------------------------------
================================================================================
paraview-3.8.1-3.el6 (FEDORA-EPEL-2014-3548)
Parallel visualization application
--------------------------------------------------------------------------------
Update Information:
Replace mpich2 with mpich for EL6.6
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Orion Poplawski <orion(a)cora.nwra.com> - 3.8.1-3
- Replace mpich2 with mpich for EL6.6 (bug #1155092)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155092 - paraview-mpich2 broke on rhel 6.6 update
https://bugzilla.redhat.com/show_bug.cgi?id=1155092
--------------------------------------------------------------------------------
================================================================================
phpMyAdmin-4.0.10.5-1.el6 (FEDORA-EPEL-2014-3533)
Handle the administration of MySQL over the World Wide Web
--------------------------------------------------------------------------------
Update Information:
phpMyAdmin 4.0.10.5 (2014-10-21)
================================
- [security] XSS in debug SQL output
- [security] XSS in monitor query analyzer
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 22 2014 Robert Scheck <robert(a)fedoraproject.org> 4.0.10.5-1
- Upgrade to 4.0.10.5 (#1155362)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155362 - CVE-2014-8326 phpmyadmin: cross-site scripting (XSS) flaw fixed in versions 4.0.10.5, 4.1.14.6, and 4.2.10.1 (PMASA-2014-12)
https://bugzilla.redhat.com/show_bug.cgi?id=1155362
--------------------------------------------------------------------------------
================================================================================
pyelftools-0.22-0.6.git20130619.a1d9681.el6 (FEDORA-EPEL-2014-3541)
Pure-Python library for parsing and analyzing ELF files
--------------------------------------------------------------------------------
Update Information:
pyelftools for EL6
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1148217 - Please package pyelftools for EL6 and EPEL7
https://bugzilla.redhat.com/show_bug.cgi?id=1148217
--------------------------------------------------------------------------------
================================================================================
scalapack-2.0.2-5.el6.1 (FEDORA-EPEL-2014-3534)
A subset of LAPACK routines redesigned for heterogeneous computing
--------------------------------------------------------------------------------
Update Information:
Update scalapack to 2.0.2 (el6), rebuild against updated mpich in RHEL 6.6
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 21 2014 Tom Callaway <spot(a)fedoraproject.org> - 2.0.2-5.1
- fixup el6
* Thu Sep 4 2014 Thomas Spura <tomspur(a)fedoraproject.org> - 2.0.2-5
- rebuild for changed library inside openmpi (#1135728)
* Mon Aug 18 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2.0.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Tue Jul 1 2014 Tom Callaway <spot(a)fedoraproject.org> - 2.0.2-3
- explictly link to other dependent libs
* Sun Jun 8 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 2.0.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sat May 3 2014 Tom Callaway <spot(a)fedoraproject.org> - 2.0.2-1
- update to 2.0.2
- subpackage blacs
* Sun Aug 4 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.7.5-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Sat Jul 20 2013 Deji Akingunola <dakingun(a)gmail.com> - 1.7.5-19
- Rename mpich2 sub-packages to mpich and rebuild for mpich-3.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1155036 - blacs-mpich2 got obsolted by rhel 6.6 update
https://bugzilla.redhat.com/show_bug.cgi?id=1155036
[ 2 ] Bug #1155094 - scalapack-mpich2 broke on rhel 6.6
https://bugzilla.redhat.com/show_bug.cgi?id=1155094
--------------------------------------------------------------------------------