The following Fedora EPEL 9 Security updates need testing:
Age URL
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-7bc0a1d338
chromium-123.0.6312.105-1.el9
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-cda1e4035b
cjson-1.7.17-1.el9
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-7c7a65fa6c
wordpress-6.5.2-1.el9
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-6ebc36e81d
perl-Clipboard-0.29-1.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
baresip-3.11.0-1.el9
forge-srpm-macros-0.3.1-1.el9
latexmk-4.85-1.el9
libre-3.11.0-1.el9
lutris-0.5.17-1.el9
python-django3-3.2.25-1.el9
tor-0.4.8.11-1.el9
Details about builds:
================================================================================
baresip-3.11.0-1.el9 (FEDORA-EPEL-2024-ddb5e78473)
Modular SIP user-agent with audio and video support
--------------------------------------------------------------------------------
Update Information:
Baresip v3.11.0 (2024-04-09)
account: read catchall flag from accounts file
vp8/encode: optimizations and target_bitrate fix
vp8,vp9: fix deprecated decode codec init
aureceiver: fix mtx_unlock on discard
release v3.10.1
message: return 403 instead of 488
netroam/cmake: add optional netlink detection
ci/sanitizers: add mmap rnd_bits workaround
account: set inreq_allowed=yes as default
account: use correct format %zu for printing outbound
stream: fix empty rtcp_stats for rtx.ssrc reception reports
stream: avoid sanitizer warnings for strm->tx
avcodec: remove re_h264 extra header
play: err handling and ensure eof
stream: add stream_jbuf_stats()
sndfile: write correct sample rate to WAV header
tls: add session resumption setter
avcodec: use util function to decode H.264 STAP-A
mixausrc: fix ausrc resampling
ci/build: remove obsolete for loop
libre v3.11.0 (2024-04-09)
ci/clang-analyze: bump clang version and fix status-bugs
main: Flush list of deleted fhs on fd_poll errors
main: Use slist for fhs delete list
http/server: fix wrong sizeof in verify_msg
ci/sanitizers: add mmap rnd_bits workaround
rtcp: add printing of TWCC packet
include: add re_h264.h to re.h
sdp: add sdp media lattr apply function the same way as for rattr
av1: improve packetizer
test: minor H.264 improvements
tls: add session resumption setter
thread/posix: optimize handler and fix gcc arm32 warning
h264: fix for Annex-B bitstreams with 4-byte startcode
ci/arch: add armv7 check
main,httpauth: fix different from the declaration
httpauth: fix doxygen comment
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 11 2024 Robert Scheck <robert(a)fedoraproject.org> 3.11.0-1
- Upgrade to 3.11.0 (#2274242)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2274242 - baresip-3.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2274242
[ 2 ] Bug #2274320 - libre-3.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2274320
--------------------------------------------------------------------------------
================================================================================
forge-srpm-macros-0.3.1-1.el9 (FEDORA-EPEL-2024-94dfe347ea)
Macros to simplify packaging of forge-hosted projects
--------------------------------------------------------------------------------
Update Information:
Bugfix release
https://git.sr.ht/~gotmax23/forge-srpm-macros/tree/main/item/NEWS.md
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 10 2024 Maxwell G <maxwell(a)gtmx.me> - 0.3.1-1
- Update to 0.3.1.
--------------------------------------------------------------------------------
================================================================================
latexmk-4.85-1.el9 (FEDORA-EPEL-2024-cfb5ea1dbf)
A make-like utility for LaTeX files
--------------------------------------------------------------------------------
Update Information:
Changes in version 4.85:
Correct bug that if $out_dir and $out2_dir referred to the same directory, but
latexmk didn't detect that, then the subroutine copy reported an error, and
latexmk treated that incorrectly as a fatal error.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 11 2024 Jerry James <loganjerry(a)gmail.com> - 4.85-1
- Version 4.85
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2274269 - latexmk-485 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2274269
[ 2 ] Bug #2274458 - latexmk 4.84 compiles only if pdf not exists
https://bugzilla.redhat.com/show_bug.cgi?id=2274458
--------------------------------------------------------------------------------
================================================================================
libre-3.11.0-1.el9 (FEDORA-EPEL-2024-ddb5e78473)
Generic library for real-time communications
--------------------------------------------------------------------------------
Update Information:
Baresip v3.11.0 (2024-04-09)
account: read catchall flag from accounts file
vp8/encode: optimizations and target_bitrate fix
vp8,vp9: fix deprecated decode codec init
aureceiver: fix mtx_unlock on discard
release v3.10.1
message: return 403 instead of 488
netroam/cmake: add optional netlink detection
ci/sanitizers: add mmap rnd_bits workaround
account: set inreq_allowed=yes as default
account: use correct format %zu for printing outbound
stream: fix empty rtcp_stats for rtx.ssrc reception reports
stream: avoid sanitizer warnings for strm->tx
avcodec: remove re_h264 extra header
play: err handling and ensure eof
stream: add stream_jbuf_stats()
sndfile: write correct sample rate to WAV header
tls: add session resumption setter
avcodec: use util function to decode H.264 STAP-A
mixausrc: fix ausrc resampling
ci/build: remove obsolete for loop
libre v3.11.0 (2024-04-09)
ci/clang-analyze: bump clang version and fix status-bugs
main: Flush list of deleted fhs on fd_poll errors
main: Use slist for fhs delete list
http/server: fix wrong sizeof in verify_msg
ci/sanitizers: add mmap rnd_bits workaround
rtcp: add printing of TWCC packet
include: add re_h264.h to re.h
sdp: add sdp media lattr apply function the same way as for rattr
av1: improve packetizer
test: minor H.264 improvements
tls: add session resumption setter
thread/posix: optimize handler and fix gcc arm32 warning
h264: fix for Annex-B bitstreams with 4-byte startcode
ci/arch: add armv7 check
main,httpauth: fix different from the declaration
httpauth: fix doxygen comment
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 11 2024 Robert Scheck <robert(a)fedoraproject.org> 3.11.0-1
- Upgrade to 3.11.0 (#2274320)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2274242 - baresip-3.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2274242
[ 2 ] Bug #2274320 - libre-3.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2274320
--------------------------------------------------------------------------------
================================================================================
lutris-0.5.17-1.el9 (FEDORA-EPEL-2024-db5ebc3343)
Install and play any video game easily
--------------------------------------------------------------------------------
Update Information:
0.5.17
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 11 2024 Steve Cossette <farchord(a)gmail.com> - 0.5.17-1
- 0.5.17
--------------------------------------------------------------------------------
================================================================================
python-django3-3.2.25-1.el9 (FEDORA-EPEL-2024-76d6941f10)
A high-level Python Web framework
--------------------------------------------------------------------------------
Update Information:
Security fixes for
CVE-2024-27351 Potential regular expression DOS in
django.utils.text.Truncator.words()
CVE-2023-41164 Potential DOS vulnerability in django.utils.encoding.uri_to_iri()
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 10 2024 Michel Lind <salimma(a)fedoraproject.org> - 3.2.25-1
- Update to 3.2.25
- Mark as deprecated due to EOL
- Update list of bundled dependencies
- Declare licenses of bundled dependencies
- Add virtual Provides and Conflicts to allow swapping Django stacks
- Drop unneeded patches
* Wed Apr 10 2024 Miro Hron��ok <miro(a)hroncok.cz> - 3.2.20-4
- No longer own the /usr/share/bash-completion directory
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2237869 - CVE-2023-41164 python-django3: python-django: Potential denial of
service vulnerability in ``django.utils.encoding.uri_to_iri()`` [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2237869
[ 2 ] Bug #2267653 - CVE-2024-27351 python-django3: python-django: Potential regular
expression denial-of-service in django.utils.text.Truncator.words() [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2267653
--------------------------------------------------------------------------------
================================================================================
tor-0.4.8.11-1.el9 (FEDORA-EPEL-2024-ff368e1990)
Anonymizing overlay network for TCP
--------------------------------------------------------------------------------
Update Information:
update to latest upstream release
https://forum.torproject.org/t/stable-
release-0-4-8-11/12265
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 11 2024 Marcel H��rry <mh+fedora(a)scrit.ch> - 0.4.8.11-1
- update to latest upstream release
https://forum.torproject.org/t/stable-release-0-4-8-11/12265
- bz#2211726
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2211726 - tor-0.4.9.0-alpha-dev is available
https://bugzilla.redhat.com/show_bug.cgi?id=2211726
--------------------------------------------------------------------------------