The following Fedora EPEL 5 Security updates need testing:
Age URL
1051
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3....
505
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11893/libguestfs...
269
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1626/puppet-2.7....
123
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3784/mantis-1.2....
119
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-3849/sblim-sfcb-...
28
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-0695/drupal7-pat...
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-1001/drupal7-ent...
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-1098/librsync-1....
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-1121/dokuwiki-0-...
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-1044/putty-0.63-...
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-1029/phpMyAdmin4...
The following builds have been pushed to Fedora EPEL 5 updates-testing
HepMC-2.06.09-9.el5
R-qtl-1.36.6-1.el5
dokuwiki-0-0.24.20140929c.el5
drupal7-features-2.4-1.el5
drupal7-token-1.6-1.el5
duplicity-0.6.21-2.el5
fedpkg-minimal-1.0.0-3.el5
fts-3.2.32-1.el5
gfal2-2.8.4-1.el5
globus-ftp-client-8.20-1.el5
lhapdf-5.9.1-9.el5
librsync-1.0.0-1.el5
munin-2.0.25-2.el5
opendkim-2.10.1-2.el5
opendmarc-1.3.1-3.el5
pcp-3.10.3-1.el5
phpMyAdmin4-4.0.10.9-1.el5
putty-0.63-4.el5
rdiff-backup-1.0.5-3.el5
root-5.34.26-1.el5
srm-ifce-1.22.2-1.el5
udt-4.11-4.el5
userspace-rcu-0.7.7-1.el5
Details about builds:
================================================================================
HepMC-2.06.09-9.el5 (FEDORA-EPEL-2015-1032)
C++ Event Record for Monte Carlo Generators
--------------------------------------------------------------------------------
Update Information:
Avoid hexfloat notation (gcc 5), Use greater allowed epsilon for test (fixes i686 build).
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 6 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 2.06.09-9
- Increase epsilon - for i686 Fedora 22+ tests
* Fri Mar 6 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 2.06.09-8
- Do not trigger hexfloat output with gcc 5
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.06.09-7
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Fri Jun 6 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.06.09-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Aug 8 2013 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 2.06.09-5
- Use _pkgdocdir
* Fri Aug 2 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.06.09-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
R-qtl-1.36.6-1.el5 (FEDORA-EPEL-2015-1131)
Tools for analyzing QTL experiments
--------------------------------------------------------------------------------
Update Information:
Version 1.36, 2015-03-05
Major changes:
* None.
Minor changes:
* Added a function flip.order() for flipping the order of markers on selected
chromosomes.
* Added scanonevar.meanperm and scanonevar.varperm (from Robert Corty) for permutation
tests with scanonevar().
* Revised plotPheno (aka plot.pheno) so that one can control the x-axis label and title
(also, in a histogram, the breaks).
* plotPXG: if infer=FALSE and there are no fully-informative genotypes (e.g., in a 4-way
cross), give a more informative error.
* geno.image: allow control of x- and y-axis labels; allow suppression of axes.
* Removed some warnings about missing end-of-line characters, in read.cross with MapQTL
format.
* Fixed a bug in scanonevar; was failing with an error about coercing class "A"
to a data.frame
* Dropped the name summary.scantwo.old(); still available as summaryScantwoOld().
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 6 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 1.36.6-1
- Update to 1.36.6
--------------------------------------------------------------------------------
================================================================================
dokuwiki-0-0.24.20140929c.el5 (FEDORA-EPEL-2015-1121)
Standards compliant simple to use wiki
--------------------------------------------------------------------------------
Update Information:
This update fixes CVE-2015-2172
* There's a security hole in the ACL plugins remote API component. The plugin failes
to check for superuser permissions before executing ACL addition or deletion. This means
everybody with permissions to call the XMLRPC API also has permissions to set up their own
ACL rules and thus circumventing any existing rules.
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 - XSS via SFW file upload
* CVE-2012-6662 - jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 - XSS via SFW file upload
* CVE-2012-6662 - jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 - XSS via SFW file upload
* CVE-2012-6662 - jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
Update to the 2014-09-29b release which contains various fixes, notably:
Security:
* CVE-2014-9253 - XSS via SFW file upload
* CVE-2012-6662 - jquery-ui XSS vulnerability
Bugfixes:
* dokuwiki requires php-xml (RHBZ#1061477)
* wrong SELinux file context for writable files/directories (RHBZ#1064524)
* drop httpd requirement (RHBZ#1164396)
This update adds dokuwiki package to EPEL7
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 3 2015 Adam Tkac <vonsch(a)gmail.com> - 0.0.24.20140929c
- update to the latest upstream (CVE-2015-2172)
* Fri Dec 26 2014 Adam Tkac <vonsch(a)gmail.com> - 0.0.23.20140929b
- update to the latest upstream
- drop requirement of httpd (#1164396)
- fix SELinux file contexts (#1064524)
- require php-xml (#1061477)
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0-0.22.20131208
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1197822 - CVE-2015-2172 dokuwiki: privilege escalation in RPC API
https://bugzilla.redhat.com/show_bug.cgi?id=1197822
--------------------------------------------------------------------------------
================================================================================
drupal7-features-2.4-1.el5 (FEDORA-EPEL-2015-1119)
Provides feature management for Drupal
--------------------------------------------------------------------------------
Update Information:
Update to upstream 2.4 release for bug fixes
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 5 2015 Jared Smith <jsmith(a)fedoraproject.org> - 2.4-1
- Update to upstream 2.4 release for bug fixes
- Upstream changelog for this release:
https://www.drupal.org/node/2446159
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1199065 - drupal7-features-2.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1199065
--------------------------------------------------------------------------------
================================================================================
drupal7-token-1.6-1.el5 (FEDORA-EPEL-2015-1144)
Provides a user interface for the Token API and some missing core tokens
--------------------------------------------------------------------------------
Update Information:
Fixes bugs in the Token module. For complete details, refer to:
https://www.drupal.org/node/2443407
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 2 2015 Paul W. Frields <stickster(a)gmail.com> - 1.6-1
- New upstream version.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1197526 - drupal7-token-1.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1197526
--------------------------------------------------------------------------------
================================================================================
duplicity-0.6.21-2.el5 (FEDORA-EPEL-2015-1098)
Encrypted bandwidth-efficient backup using rsync algorithm
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong"
check sum to match blocks. However, MD4 is not cryptographically strong. It's possible
that an attacker who can control the contents of one part of a file could use it to
control other regions of the file, if it's transferred using librsync/rdiff. For
example this might occur in a database, mailbox, or VM image containing some
attacker-controlled data. To mitigate this issue, signatures will by default be computed
with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic
number when given these signature files. Backward compatibility can be obtained using the
new `rdiff sig --hash=md4` option or through specifying the "signature magic" in
the API, but this should not be used when either the old or new file contain untrusted
data. Deltas generated from those signatures will also use BLAKE2 during generation, but
produce output that can be read by old versions. See
https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net>
for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to
https://github.com/librsync/librsync/
*
Travis-CI.org integration test at
https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew
where it is called `glibtoolize`.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 7 2015 Robert Scheck <robert(a)fedoraproject.org> - 0.6.21-2
- Rebuild for librsync 1.0.0 (#1126712)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
================================================================================
fedpkg-minimal-1.0.0-3.el5 (FEDORA-EPEL-2015-1099)
Script to allow fedpkg fetch to work
--------------------------------------------------------------------------------
Update Information:
fedpkg replacement for use in Fedora buildsystem buildroots
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1189611 - Review Request: fedpkg-minimal - Script to allow fedpkg fetch to
work
https://bugzilla.redhat.com/show_bug.cgi?id=1189611
--------------------------------------------------------------------------------
================================================================================
fts-3.2.32-1.el5 (FEDORA-EPEL-2015-1058)
File Transfer Service V3
--------------------------------------------------------------------------------
Update Information:
fts 3.2.32 release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 5 2015 Alejandro Alvarez Ayllon <aalvarez(a)cern.ch> - 3.2.32-1
- Update for new upstream release
--------------------------------------------------------------------------------
================================================================================
gfal2-2.8.4-1.el5 (FEDORA-EPEL-2015-1053)
Grid file access library 2.0
--------------------------------------------------------------------------------
Update Information:
Update for release of gfal2 2.8.4
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 2 2015 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 2.8.4-1
- Upgraded to upstream release 2.8.4
--------------------------------------------------------------------------------
================================================================================
globus-ftp-client-8.20-1.el5 (FEDORA-EPEL-2015-1071)
Globus Toolkit - GridFTP Client Library
--------------------------------------------------------------------------------
Update Information:
Improved fix for GGUS 109089/109576 (from upstream git)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 6 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 8.20-1
- GT6 update (upstream's release of previous fix)
* Thu Mar 5 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 8.19-2
- Improved fix for GGUS 109089/109576 (from upstream git)
--------------------------------------------------------------------------------
================================================================================
lhapdf-5.9.1-9.el5 (FEDORA-EPEL-2015-1048)
Les Houches Accord PDF Interface
--------------------------------------------------------------------------------
Update Information:
Fix to example code.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 7 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.9.1-9
- Fix lhacontrol common block in example
* Sun Oct 12 2014 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.9.1-8
- Re-enable octave for EPEL 7
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
5.9.1-7
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
5.9.1-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Tue Jun 3 2014 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.9.1-5
- Disable octave for EPEL 7 - not yet available
--------------------------------------------------------------------------------
================================================================================
librsync-1.0.0-1.el5 (FEDORA-EPEL-2015-1098)
Rsync libraries
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong"
check sum to match blocks. However, MD4 is not cryptographically strong. It's possible
that an attacker who can control the contents of one part of a file could use it to
control other regions of the file, if it's transferred using librsync/rdiff. For
example this might occur in a database, mailbox, or VM image containing some
attacker-controlled data. To mitigate this issue, signatures will by default be computed
with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic
number when given these signature files. Backward compatibility can be obtained using the
new `rdiff sig --hash=md4` option or through specifying the "signature magic" in
the API, but this should not be used when either the old or new file contain untrusted
data. Deltas generated from those signatures will also use BLAKE2 during generation, but
produce output that can be read by old versions. See
https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net>
for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to
https://github.com/librsync/librsync/
*
Travis-CI.org integration test at
https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew
where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
================================================================================
munin-2.0.25-2.el5 (FEDORA-EPEL-2015-1042)
Network-wide graphing framework (grapher/gatherer)
--------------------------------------------------------------------------------
Update Information:
Merge 2.1 paches back to 2.0
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 7 2015 "D. Johnson" <fenris02(a)fedoraproject.org> - 2.0.25-2
- Merge 2.1 paches back to 2.0
- BZ# 1149949 - munin-async init script to override defaults (PR-274 backport)
- BZ# 1049262 - munin ntp_ plugin uses perl features from perl 5.10.0 but can only use
perl 5.8.8
- BZ# 1140015 - Munin mysql plugin fails to parse MariaDB status
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1149949 - munin-async init script to override defaults
https://bugzilla.redhat.com/show_bug.cgi?id=1149949
[ 2 ] Bug #1049262 - munin ntp_ plugin uses perl features from perl 5.10.0 but can only
use perl 5.8.8
https://bugzilla.redhat.com/show_bug.cgi?id=1049262
[ 3 ] Bug #1140015 - Munin mysql plugin fails to parse MariaDB status
https://bugzilla.redhat.com/show_bug.cgi?id=1140015
--------------------------------------------------------------------------------
================================================================================
opendkim-2.10.1-2.el5 (FEDORA-EPEL-2015-1138)
A DomainKeys Identified Mail (DKIM) milter to sign and/or verify mail
--------------------------------------------------------------------------------
Update Information:
Updating to 2.10.1 source (bug #1178373) and adding IPv6 localhost (::1) to default
TrustedHosts file (bug #1049204).
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug
fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys
on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 3 2015 Steve Jenkins <steve(a)stevejenkins.com> - 2.10.1-2
- Added IPv6 ::1 support to TrustedHosts (RH Bugzilla #1049204)
* Tue Mar 3 2015 Steve Jenkins <steve(a)stevejenkins.com> - 2.10.1-1
- Updated to use newer upstream 2.10.1 source code
* Tue Dec 9 2014 Steve Jenkins <steve(a)stevejenkins.com> - 2.10.0-1
- Updated to use newer upstream 2.10.0 source code
- Removed unbound compile option due to orphaned upstream dependency
- Removed AUTOCREATE_DKIM_KEYS option
- Added README.fedora with basic key generation and config instructions
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.9.2-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Mon Aug 4 2014 Steve Jenkins <steve(a)stevejenkins.com> - 2.9.2-2
- Change file ownerships/permissions to fix
https://bugzilla.redhat.com/show_bug.cgi?id=891292
- Default keys no longer created on startup. Privileged user must run
opendkim-default-keygen or create manually (after install)
* Wed Jul 30 2014 Steve Jenkins <steve(a)stevejenkins.com> - 2.9.2-1
- Updated to use newer upstream 2.9.2 source code
- Fixed invalid date in changelog
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.9.0-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #973541 - opendkim-2.9.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=973541
[ 2 ] Bug #1178373 - opendkim-2.10.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1178373
[ 3 ] Bug #1049204 - TrustedHosts is missing IPv6 ::1
https://bugzilla.redhat.com/show_bug.cgi?id=1049204
[ 4 ] Bug #891292 - SELinux is preventing /usr/sbin/opendkim from using the dac_override
capability
https://bugzilla.redhat.com/show_bug.cgi?id=891292
--------------------------------------------------------------------------------
================================================================================
opendmarc-1.3.1-3.el5 (FEDORA-EPEL-2015-1109)
A Domain-based Message Authentication, Reporting & Conformance (DMARC) milter and
library
--------------------------------------------------------------------------------
Update Information:
* Fri Mar 06 2015 Steve Jenkins <steve(a)stevejenkins.com> 1.3.1-3
- Added libbsd and libbsd-devel build requirement to fix libstrl issue
- initial packaged version of OpenDMARC for Fedora-based systems
- initial packaged version of OpenDMARC for Fedora-based systems
- initial packaged version of OpenDMARC for Fedora-based systems
- initial packaged version of OpenDMARC for Fedora-based systems
- initial packaged version of OpenDMARC for Fedora-based systems
- initial packaged version of OpenDMARC for Fedora-based systems
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #905304 - Review Request: OpenDMARC - Domain-based Message Authentication,
Reporting & Conformance (DMARC) milter and library
https://bugzilla.redhat.com/show_bug.cgi?id=905304
--------------------------------------------------------------------------------
================================================================================
pcp-3.10.3-1.el5 (FEDORA-EPEL-2015-1113)
System-level performance monitoring and performance management
--------------------------------------------------------------------------------
Update Information:
Update to latest PCP sources, New sub-package for pcp-import-ganglia2pcp, Python3 support
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 2 2015 Dave Brolley <brolley(a)redhat.com> - 3.10.3-1
- Update to latest PCP sources.
- New sub-package for pcp-import-ganglia2pcp.
- Python3 support, enabled by default in f22 onward (BZ 1194324)
* Mon Feb 23 2015 Slavek Kabrda <bkabrda(a)redhat.com> - 3.10.2-3
- Only use Python 3 in Fedora >= 23, more info at
https://bugzilla.redhat.com/show_bug.cgi?id=1194324#c4
* Mon Feb 23 2015 Nathan Scott <nathans(a)redhat.com> - 3.10.2-2
- Initial changes to support python3 as default (BZ 1194324)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1169226 - pmwebd fails to build on el5 since converting to C++
https://bugzilla.redhat.com/show_bug.cgi?id=1169226
[ 2 ] Bug #1194324 - Please switch pcp to Python 3
https://bugzilla.redhat.com/show_bug.cgi?id=1194324
--------------------------------------------------------------------------------
================================================================================
phpMyAdmin4-4.0.10.9-1.el5 (FEDORA-EPEL-2015-1029)
Handle the administration of MySQL over the World Wide Web
--------------------------------------------------------------------------------
Update Information:
phpMyAdmin 4.0.10.9 (2015-03-04)
================================
- [security] Risk of BREACH attack, see PMASA-2015-1
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 4 2015 Robert Scheck <robert(a)fedoraproject.org> 4.0.10.9-1
- Upgrade to 4.0.10.9
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1198794 - CVE-2015-2206 phpMyAdmin: Risk of BREACH attack due to reflected
parameter (PMASA-2015-1)
https://bugzilla.redhat.com/show_bug.cgi?id=1198794
--------------------------------------------------------------------------------
================================================================================
putty-0.63-4.el5 (FEDORA-EPEL-2015-1044)
SSH, Telnet and Rlogin client
--------------------------------------------------------------------------------
Update Information:
Fixed an issue when private keys weren't scrub from memory after use.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 3 2015 Jaroslav Škarvada <jskarvad(a)redhat.com> - 0.63-4
- Scrub private keys from memory after use
Resolves: CVE-2015-2157
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1198192 - CVE-2015-2157 putty: failure to scrub private keys from memory
after use
https://bugzilla.redhat.com/show_bug.cgi?id=1198192
--------------------------------------------------------------------------------
================================================================================
rdiff-backup-1.0.5-3.el5 (FEDORA-EPEL-2015-1098)
Convenient and transparent local/remote incremental mirror/backup
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong"
check sum to match blocks. However, MD4 is not cryptographically strong. It's possible
that an attacker who can control the contents of one part of a file could use it to
control other regions of the file, if it's transferred using librsync/rdiff. For
example this might occur in a database, mailbox, or VM image containing some
attacker-controlled data. To mitigate this issue, signatures will by default be computed
with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic
number when given these signature files. Backward compatibility can be obtained using the
new `rdiff sig --hash=md4` option or through specifying the "signature magic" in
the API, but this should not be used when either the old or new file contain untrusted
data. Deltas generated from those signatures will also use BLAKE2 during generation, but
produce output that can be read by old versions. See
https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net>
for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to
https://github.com/librsync/librsync/
*
Travis-CI.org integration test at
https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew
where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
================================================================================
root-5.34.26-1.el5 (FEDORA-EPEL-2015-1169)
Numerical data analysis framework
--------------------------------------------------------------------------------
Update Information:
root 5.34.26
https://root.cern.ch/drupal/content/patch-release-53426
--------------------------------------------------------------------------------
ChangeLog:
* Tue Feb 24 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.34.26-1
- Update to 5.34.26
- Drop patch root-xrdversion.patch
* Thu Jan 29 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.34.24-3
- Rebuild with fixed cairo (bz 1183242)
* Sat Jan 17 2015 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 5.34.24-2
- Rebuild for
https://fedoraproject.org/wiki/Changes/Ruby_2.2
--------------------------------------------------------------------------------
================================================================================
srm-ifce-1.22.2-1.el5 (FEDORA-EPEL-2015-1041)
SRM client side library
--------------------------------------------------------------------------------
Update Information:
Release of srm-ifce 1.22.2
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 2 2015 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 1.22.2-1
- Release srm-ifce 1.22.2
* Mon Jan 26 2015 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 1.22.1-2
- Rebuilt for gsoap 2.8.21
--------------------------------------------------------------------------------
================================================================================
udt-4.11-4.el5 (FEDORA-EPEL-2015-1153)
UDP based Data Transfer Protocol
--------------------------------------------------------------------------------
Update Information:
Fix sed substitutions in case of slashes in rpm macros
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 7 2015 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 4.11-4
- Fix sed substitutions in case of slashes in rpm macros
* Mon Aug 18 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
4.11-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
userspace-rcu-0.7.7-1.el5 (FEDORA-EPEL-2015-1134)
RCU (read-copy-update) implementation in user space
--------------------------------------------------------------------------------
Update Information:
Add userspace-rcu to EL5, porting from the EL6 build.
--------------------------------------------------------------------------------