The following Fedora EPEL 5 Security updates need testing:
Age URL
848
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2014-3849
sblim-sfcb-1.3.8-2.el5
491
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-edbea40516
mcollective-2.8.4-1.el5
463
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-582c8075e6
thttpd-2.25b-24.el5
73
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-ce45574ab6
libbsd-0.8.3-2.el5
11
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-28a8a9acad
phpMyAdmin4-4.0.10.19-1.el5
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-0776d8318e
canl-c-2.1.8-1.el5
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-e531f99c94
drupal7-metatag-1.21-1.el5
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-33a8a8497b
drupal7-views-3.15-1.el5
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-1871d47e50
tcpreplay-4.1.2-3.el5
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-cfa4c77c94
wordpress-4.7.3-1.el5
The following builds have been pushed to Fedora EPEL 5 updates-testing
tcpreplay-4.1.2-3.el5
wordpress-4.7.3-1.el5
Details about builds:
================================================================================
tcpreplay-4.1.2-3.el5 (FEDORA-EPEL-2017-1871d47e50)
Replay captured network traffic
--------------------------------------------------------------------------------
Update Information:
Patch CVE-2017-6429. Tcpcapinfo utility of Tcpreplay has a buffer overflow
vulnerability associated with parsing a crafted pcap file. This occurs in the
src/tcpcapinfo.c file when capture has a packet that is too large to handle.
References:
http://seclists.org/bugtraq/2017/Mar/22 Upstream bug:
https://github.com/appneta/tcpreplay/issues/278
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1429521 - CVE-2017-6429 tcpreplay: Buffer overflow in Tcpcapinfo utility
[epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1429521
[ 2 ] Bug #1429522 - CVE-2017-6429 tcpreplay: Buffer overflow in Tcpcapinfo utility
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1429522
--------------------------------------------------------------------------------
================================================================================
wordpress-4.7.3-1.el5 (FEDORA-EPEL-2017-cfa4c77c94)
Blog tool and publishing platform
--------------------------------------------------------------------------------
Update Information:
**WordPress 4.7.3 is now available**. This is a security release for all
previous versions and we strongly encourage you to update your sites
immediately. WordPress versions 4.7.2 and earlier are affected by six security
issues: * Cross-site scripting (XSS) via media file metadata. Reported by
Chris Andr�� Dale, Yorick Koster, and Simon P. Briggs. * Control characters
can trick redirect URL validation. Reported by Daniel Chatfield. *
Unintended files can be deleted by administrators using the plugin deletion
functionality. Reported by xuliang. * Cross-site scripting (XSS) via video
URL in YouTube embeds. Reported by Marc Montpas. * Cross-site scripting
(XSS) via taxonomy term names. Reported by Delta. * Cross-site request
forgery (CSRF) in Press This leading to excessive use of server resources.
Reported by Sipke Mellema. Thank you to the reporters for practicing
responsible disclosure. In addition to the security issues above, WordPress
4.7.3 contains 39 maintenance fixes to the 4.7 release series. For more
information, see the [release
notes](https://codex.wordpress.org/Version_4.7.3)
or consult the [list of
changes](https://core.trac.wordpress.org/query?status=cl
osed&milestone=4.7.3&group=component&col=id&col=summary&col=component&col=status
&col=owner&col=type&col=priority&col=keywords&order=priority).
--------------------------------------------------------------------------------