The following Fedora EPEL 5 Security updates need testing: Age URL 608 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3.2.1... 123 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11276/ssmtp-2.61-21... 99 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11560/fail2ban-0.8.... 63 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11893/libguestfs-1.... 38 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-12091/bip-0.8.9-1.e... 28 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-12159/389-ds-base-1... 28 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-12169/gc-7.1-6.el5 13 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-12330/munin-2.0.19-... 2 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-12428/perl-Proc-Dae...

The following builds have been pushed to Fedora EPEL 5 updates-testing

NLopt-2.4.1-1.el5 dsniff-2.4-0.17.b1.el5 libnet-1.1.6-7.el5 proftpd-1.3.3g-4.el5 zabbix20-2.0.10-2.el5

Details about builds:

================================================================================ NLopt-2.4.1-1.el5 (FEDORA-EPEL-2013-12445) Open-Source library for nonlinear optimization -------------------------------------------------------------------------------- Update Information:

new upstream release: v2.4.1 -------------------------------------------------------------------------------- ChangeLog:

* Fri Dec 20 2013 Björn Esser bjoern.esser@gmail.com - 2.4.1-1 - new upstream release: v2.4.1 - adapted %{source0} to match %{name} - changed `%global lc_name` to `%define lc_name`, because of globbing problems - use `tr` instead of shell-builtin for `%define lc_name` - move `README.md` only if existing - create an empty Makefile on el5 instead of modifying top-level Makefile.am - do not autoreconf on el5 - append `-fpermissive` to C[XX]FLAGS on Fedora 19+ * Fri Dec 20 2013 Björn Esser bjoern.esser@gmail.com - 2.4-3.git20130903.35e6377 - made %clean-target conditional on el5 - restructured spec-file for quick switching between snapshot and release - moved package-specific macros to the corresponding subpackage --------------------------------------------------------------------------------

================================================================================ dsniff-2.4-0.17.b1.el5 (FEDORA-EPEL-2013-12442) Tools for network auditing and penetration testing -------------------------------------------------------------------------------- Update Information:

- Corrected patch which touches tabular data stream protocol handler - Added a patch to add both communication partners in arpspoof - Added patch to allow multiple targets to be imitated simultaniously - Added patch to allow the selection of source hw address in arpspoof - Added a patch which fixes and modernizes the POP decoder - Fixed segmentation faults related to libnet_name2addr4() (#1009879) - Added a patch to fix bit-shift in pntohl() macro (#714958, #850496) - Avoid xdrs being used without being initialised (#715042, #850494) -------------------------------------------------------------------------------- ChangeLog:

* Fri Dec 20 2013 Robert Scheck robert@fedoraproject.org 2.4-0.17.b1 - Corrected patch which touches tabular data stream protocol handler - Added a patch to add both communication partners in arpspoof - Added patch to allow multiple targets to be imitated simultaniously - Added patch to allow the selection of source hw address in arpspoof - Added a patch which fixes and modernizes the POP decoder - Fixed segmentation faults related to libnet_name2addr4() (#1009879) - Added a patch to fix bit-shift in pntohl() macro (#714958, #850496) - Avoid xdrs being used without being initialised (#715042, #850494) * Sat Aug 3 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 2.4-0.16.b1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Wed Feb 13 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 2.4-0.15.b1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1009879 - [abrt] dsniff-2.4-0.14.b1.fc18: ___vsnprintf_chk: Process /usr/sbin/arpspoof was killed by signal 11 (SIGSEGV) https://bugzilla.redhat.com/show_bug.cgi?id=1009879 [ 2 ] Bug #714958 - [PATCH] incorrect bit-shift in pntohl() macro https://bugzilla.redhat.com/show_bug.cgi?id=714958 [ 3 ] Bug #850496 - [PATCH] incorrect bit-shift in pntohl() macro https://bugzilla.redhat.com/show_bug.cgi?id=850496 [ 4 ] Bug #715042 - dsniff segfaults when decoding RPC packets on x86_64 https://bugzilla.redhat.com/show_bug.cgi?id=715042 [ 5 ] Bug #850494 - dsniff segfaults when decoding RPC packets on x86_64 https://bugzilla.redhat.com/show_bug.cgi?id=850494 --------------------------------------------------------------------------------

================================================================================ libnet-1.1.6-7.el5 (FEDORA-EPEL-2013-12450) C library for portable packet creation and injection -------------------------------------------------------------------------------- Update Information:

- Upgrade to 1.1.6 - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7 - Tight run-time dependencies between sub-packages via %{?_isa} -------------------------------------------------------------------------------- ChangeLog:

* Fri Dec 20 2013 Robert Scheck robert@fedoraproject.org 1.1.6-7 - Run autoreconf to recognize aarch64 (#925813) - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7 - Tight run-time dependencies between sub-packages via %{?_isa} * Sat Aug 3 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 1.1.6-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Thu Feb 14 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 1.1.6-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Thu Jul 19 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 1.1.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Mon Apr 2 2012 Jon Ciesla limburgher@gmail.com - 1.1.6-3 - Removed redundant leading slashes. * Mon Apr 2 2012 Jon Ciesla limburgher@gmail.com - 1.1.6-2 - Move from lib to libdir. * Fri Mar 30 2012 Jon Ciesla limburgher@gmail.com - 1.1.6-1 - Upgrade to 1.1.6, BZ 808394. * Fri Jan 13 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 1.1.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Tue Feb 8 2011 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 1.1.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild --------------------------------------------------------------------------------

================================================================================ proftpd-1.3.3g-4.el5 (FEDORA-EPEL-2013-12443) Flexible, stable and highly-configurable FTP server -------------------------------------------------------------------------------- Update Information:

This update adds 3072-bit, 7680-bit and 8192-bit Diffie-Hellman group parameters, needed for support of some ciphers such as aes-256-ctr. -------------------------------------------------------------------------------- ChangeLog:

* Fri Dec 20 2013 Paul Howarth paul@city-fan.org 1.3.3g-4 - Fix support for 8192-bit DH parameters (#1044586) - Add 3072-bit and 7680-bit DH parameters (upstream bug 4002) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1044586 - proftpd does not ship 8192 bit dh parameter https://bugzilla.redhat.com/show_bug.cgi?id=1044586 --------------------------------------------------------------------------------

================================================================================ zabbix20-2.0.10-2.el5 (FEDORA-EPEL-2013-12454) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information:

New upstream release 2.0.10

http://www.zabbix.com/rn2.0.10.php

Note that CVE-2013-6824 was already fixed in 2.0.9-2!

This release includes new init scripts that allow to run multiple instances. Please take a look at the included README file for detailed instructions. -------------------------------------------------------------------------------- ChangeLog:

* Sun Dec 15 2013 Volker Fröhlich volker27@gmx.at - 2.0.10-2 - The start function of the proxy init script had a typo causing failure - Improved the section on running multiple instances in the README * Fri Dec 13 2013 Volker Fröhlich volker27@gmx.at - 2.0.10-1 - New upstream release - Drop obsolete patch ZBX-7479 - Improve init scripts to not kill other instances (BZ#1018293) - General overhaul of init scripts and documentation in README - Harmonize scriptlet if-clause style -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1018293 - init.d script kills also any subsequent agents that were started https://bugzilla.redhat.com/show_bug.cgi?id=1018293 --------------------------------------------------------------------------------