The following Fedora EPEL 7 Security updates need testing:
Age URL
367
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087
dokuwiki-0-0.24.20140929c.el7
129
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f
mcollective-2.8.4-1.el7
12
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-6dc46a554e
libssh-0.6.5-2.el7
10
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-b23b791a7e
drupal7-7.43-1.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-1613bc2a80
php-htmLawed-1.1.21-1.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-07b9ae23da
qpid-cpp-0.34-6.el7
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-e79091a3b8
ReviewBoard-2.5.3-1.el7 python-djblets-0.9.2-1.el7
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-60ae263220
exim-4.84.2-1.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-8fd1e13dd2
python-django-1.6.11-5.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-0fc6ac67c6
websvn-2.3.3-12.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-bfdc2d9e96
php-pecl-http-2.5.6-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
check-mk-1.2.6p16-3.el7
cinnamon-2.8.7-1.el7
cinnamon-desktop-2.8.1-1.el7
cinnamon-settings-daemon-2.8.4-1.el7
cmake3-3.5.0-2.el7
fail2ban-0.9.4-2.el7
fasd-1.0.1-2.el7
freight-0.3.6-1.el7
lcgdm-dav-0.17.1-1.el7
libfabric-1.2.0-1.el7
libotr-4.1.1-1.el7
mosquitto-1.4.8-1.el7
muffin-2.8.5-1.el7
nemo-2.8.7-1.el7
pdc-client-0.9.0-2.el7
percona-xtrabackup-2.2.9-4.el7
php-extras-5.4.16-4.el7
php-pecl-http-2.5.6-1.el7
pmix-1.1.3-1.el7
python-nmrglue-0.5-3.el7
rubygem-benchmark-ips-2.5.0-1.el7
rubygem-stomp-1.3.5-1.el7
Details about builds:
================================================================================
check-mk-1.2.6p16-3.el7 (FEDORA-EPEL-2016-929b1703d0)
A new general purpose Nagios-plugin for retrieving data
--------------------------------------------------------------------------------
Update Information:
Make sure the /etc/nagios/auth.serials,htpasswd.users files are not overwritten
at package update.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1316086 - check-mk: use %config(noreplace) for /etc/nagios/htpasswd.users
https://bugzilla.redhat.com/show_bug.cgi?id=1316086
--------------------------------------------------------------------------------
================================================================================
cinnamon-2.8.7-1.el7 (FEDORA-EPEL-2016-f3d75fbe8d)
Window management and application launching for GNOME
--------------------------------------------------------------------------------
Update Information:
release update
--------------------------------------------------------------------------------
================================================================================
cinnamon-desktop-2.8.1-1.el7 (FEDORA-EPEL-2016-f3d75fbe8d)
Shared code among cinnamon-session, nemo, etc
--------------------------------------------------------------------------------
Update Information:
release update
--------------------------------------------------------------------------------
================================================================================
cinnamon-settings-daemon-2.8.4-1.el7 (FEDORA-EPEL-2016-f3d75fbe8d)
The daemon sharing settings from CINNAMON to GTK+/KDE applications
--------------------------------------------------------------------------------
Update Information:
release update
--------------------------------------------------------------------------------
================================================================================
cmake3-3.5.0-2.el7 (FEDORA-EPEL-2016-1b4a2161de)
Cross-platform make system
--------------------------------------------------------------------------------
Update Information:
initial epel-release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1315193 - Review Request (EPEL): cmake3 - Cross-platform make system
https://bugzilla.redhat.com/show_bug.cgi?id=1315193
--------------------------------------------------------------------------------
================================================================================
fail2ban-0.9.4-2.el7 (FEDORA-EPEL-2016-e8c048b38b)
Daemon to ban hosts that cause multiple authentication errors
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.4: Fixes: roundcube-auth jail typo for logpath
Fix dnsToIp resolver for fqdn with large list of IPs (gh-1164) filter.d
/apache-badbots.conf Updated useragent string regex adding escape
for + filter.d/mysqld-auth.conf Updated "Access denied ..."
regex for MySQL 5.6 and later (gh-1211, gh-1332) filter.d/sshd.conf
Updated "Auth fail" regex for OpenSSH 5.9 and later Treat failed and
killed execution of commands identically (only different log messages), which
addresses different behavior on different exit codes of dash and bash (gh-1155)
Fix jail.conf.5 man's section (gh-1226) Fixed default banaction for
allports jails like pam-generic, recidive, etc with new default variable
banaction_allports (gh-1216) Fixed fail2ban-regex stops working on
invalid (wrong encoded) character for python version < 3.x (gh-1248) Use
postfix_log logpath for postfix-rbl jail filters.d/postfix.conf - add
'Sender address rejected: Domain not found' failregex use fail2ban_agent
as user-agent in actions badips, blocklist_de, etc (gh-1271) Fix
ignoring the sender option by action_mw, action_mwl and action_c_mwl
Changed filter.d/asterisk regex for "Call from ..." (few vulnerable now)
Removed compression and rotation count from logrotate (inherit them from the
global logrotate config) New Features: New interpolation feature
for definition config readers - <known/parameter> (means last known init
definition of filters or actions with name parameter). This interpolation makes
possible to extend a parameters of stock filter or action directly in jail
inside jail.local file, without creating a separately filter.d/*.local file. As
extension to interpolation %(known/parameter)s, that does not works for filter
and action init parameters New actions: nftables-multiport
and nftables-allports - filtering using nftables framework. Note: it requires a
pre-existing chain for the filtering rule. New filters:
openhab - domotic software authentication failure with the rest api and web
interface (gh-1223) nginx-limit-req - ban hosts, that were failed
through nginx by limit request processing rate (ngx_http_limit_req_module)
murmur - ban hosts that repeatedly attempt to connect to murmur/mumble-server
with an invalid server password or certificate. haproxy-http-auth -
filter to match failed HTTP Authentications against a HAProxy server New
jails: murmur - bans TCP and UDP from the bad host on the default
murmur port. sshd filter got new failregex to match "maximum
authentication attempts exceeded" (introduced in openssh 6.8) Added
filter for Mac OS screen sharing (VNC) daemon Enhancements: Do not
rotate empty log files Added new date pattern with year after day (e.g.
Sun Jan 23 2005 21:59:59)
http://bugs.debian.org/798923 Added openSUSE
path configuration (Thanks Johannes Weberhofer) Allow to split ignoreip
entries by ',' as well as by ' ' (gh-1197) Added a timeout (3 sec)
to
urlopen within badips.py action (Thanks M. Maraun) Added check against
atacker's Googlebot PTR fake records (Thanks Pablo Rodriguez Fernandez)
Enhance filter against atacker's Googlebot PTR fake records (gh-1226)
Nginx log paths extended (prefixed with "*" wildcard) (gh-1237) Added
filter for openhab domotic software authentication failure with the rest api and
web interface (gh-1223) Add *_backend options for services to allow
distros to set the default backend per service, set default to systemd for
Fedora as appropriate Performance improvements while monitoring large
number of files (gh-1265). Use associative array (dict) for monitored log files
to speed up lookup operations. Thanks @kshetragia Specified that
fail2ban is PartOf iptables.service firewalld.service in .service file -- would
reload fail2ban if those services are restarted Provides new default
fail2ban_version and interpolation variable fail2ban_agent in jail.conf
Enhance filter 'postfix' to ban incoming SMTP client with no fqdn hostname, and
to support multiple instances of postfix having varying suffix (gh-1331) (Thanks
Tom Hendrikx) files/gentoo-initd to use start-stop-daemon to robustify
restarting the service
--------------------------------------------------------------------------------
================================================================================
fasd-1.0.1-2.el7 (FEDORA-EPEL-2016-1e28b4c3d4)
A command-line productivity booster
--------------------------------------------------------------------------------
Update Information:
Fasd (pronounced similar to "fast") is a command-line productivity booster.
Fasd
offers quick access to files and directories for POSIX shells. It is inspired by
tools like autojump, z and v. Fasd keeps track of files and directories you have
accessed, so that you can quickly reference them in the command line.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1316175 - Review Request: fasd - A command-line productivity booster
https://bugzilla.redhat.com/show_bug.cgi?id=1316175
--------------------------------------------------------------------------------
================================================================================
freight-0.3.6-1.el7 (FEDORA-EPEL-2016-e4ac5782f8)
A modern take on the Debian archive
--------------------------------------------------------------------------------
Update Information:
Switched upstream to freight-team releases. ### New features - support multiple
GPG keys for signing Release file - add `Date`/`Valid-Util` release Packages
fields for apt 1.1 compatibility - support `.orig.xz` and `.debian.tar.xz`
source files - French documentation linked in README - add `freight-clear-cache`
man page - add Fedora/EPEL package installation instructions - add a test suite
and Travis CI integration ### Changes - change project URLs and references to
`freight-team` - freight-add temporary directories now have a `freight.` prefix
- Makefile directory creation improved ### Bug fixes - fix SHA field labels in
release file for apt 1.1 compatibility - fix misleading freight-add message when
`VARLIB` is not writeable ([#48](https://github.com/rcrowley/freight/issues/48))
- fix apt errors with empty values in package control fields
([#53](https://github.com/rcrowley/freight/issues/53)) - raise error when config
file supplied via `-c` does not exist
([#54](https://github.com/rcrowley/freight/issues/54))
--------------------------------------------------------------------------------
================================================================================
lcgdm-dav-0.17.1-1.el7 (FEDORA-EPEL-2016-96e5e66655)
HTTP/DAV front end to the DPM/LFC services
--------------------------------------------------------------------------------
Update Information:
New upstream release 0.17.1
--------------------------------------------------------------------------------
================================================================================
libfabric-1.2.0-1.el7 (FEDORA-EPEL-2016-d9151b1a3d)
Open Fabric Interfaces
--------------------------------------------------------------------------------
Update Information:
v1.2.0, TBD ======================= ## General notes - Added GNI provider -
Added PSM2 provider ## GNI provider notes - Initial release ## PSM provider
notes - General bug fixes - Support auto progress mode - Support more threading
modes - Only set FI_CONTEXT mode if FI_TAGGED or FI_MSG is used - Support Intel
Omni-Path Fabric via the psm2-compat library ## PSM2 provider notes - Initial
addition ## Sockets provider notes - General bug fixes and code cleanup -
Update memory registration to support 32-bit builds and fix build warnings -
Initiate conn-msg on the same tx_ctx as the tx operation for scalable ep - Fix
av mask calculation for scalable ep - Mask out context-id during connection
lookup for scalable ep - Increase buffered receive limit - Ignore FI_INJECT flag
for atomic read operation - Return -FI_EINVAL instead of -FI_ENODATA for
fi_endpoint for invalid attributes - Set default tag format to FI_TAG_GENERIC -
Set src/dest iov len correctly for readv operations - Fix random crashes while
closing shared contexts - Fix an out of bound access when large multi-recv limit
is specified by user - Reset tag field in CQ entry for send completion - Do not
set prov_name in fabric_attr - Validate flags in CQ/Cntr bind operations -
Scalability enhancements - Increase mr_key size to 64 bit - Use red-black tree
for mr_key lookup ## usNIC provider notes - The usNIC provider does not yet
support asynchronous memory registration. Return -FI_EOPNOTSUPP if an event
queue is bound to a domain with FI_REG_MR. - Set fi_usnic_info::ui_version
correctly in calls to fi_usnic_ops_fabric::getinfo(). - Improve fi_cq_sread
performance. - Return -FI_EINVAL from av_open when given invalid paramters. -
Fix bug in fi_av_remove that could lead to a seg fault. - Implement
fi_av_insertsvc. - Report FI_PROTO_RUDP as protocol for EP_RDM. ## Verbs
provider notes - Add support for RDM EPs. Currently only FI_TAGGED capability
is supported. RDM and MSG EPs would be reported in seperate domains since they
don't share CQs. The RDM enpoint feature is currently experimental and no
guarantees are given with regard to its functionality. - Refactor the code
into several files to enable adding RDM support. - Consolidate send code paths
to improve maintainability. - Fix a bug in fi_getinfo where wild card address
was not used when service argument is given. - Fix fi_getinfo to always return
-FI_ENODATA in case of failure. - Add support for fi_eq_write. - Other misc bug
fixes. v1.1.1, TBD ======================= ## General notes ## PSM provider
notes - General bug fixes - Proper termination of the name server thread - Add
UUID and PSM epid to debug output - Add environment variable to control
psm_ep_close timeout - Code refactoring of AM-based messaging - Check more
fields of the hints passed to fi_getinfo - Generate error CQ entries for empty
result of recv with FI_SEEK flag - Correctly handle overlapped local buffers in
atomics - Handle duplicated addresses in fi_av_insert - Fix the return value of
fi_cq_readerr - Call AM progress function only when AM is used - Detect MPI runs
and turns off name server thread automatically ## Sockets provider notes -
General clean-up and restructuring - Add fallback mechanism for getting source
address - Fix fi_getinfo to use user provided capabilities from hints - Fix
hostname and port number and added checks in sock_av_insertsym - Add retry for
connection timeout - Release av resources in the error path - Remove separate
read/write CQ to be consistent with the man page - Increase default connection
map size and added environment variable to specify AV, CQ, EQ and connection
map size to run large scale tests - Fix FI_PEEK operation to be consistent with
the man page - Fix remote write event not to generate CQ event - Fix CSWAP
operation to return initial value - Use size_t for min_multi_recv and
buffered_len - Set address size correctly in fi_getname/fi_getpeer ## usNIC
provider notes - Fix EP_RDM reassembly issue for large messages - Return
correct number of read completions on error - Fix EP_RDM and EP_MSG data
corruption issue when packets are actually corrupted on the wire - Fix EP_RDM
and EP_MSG fi_tx_size_left/fi_rx_size_left functions ## Verbs provider notes -
Add more logging for errors - Bug fixes
--------------------------------------------------------------------------------
================================================================================
libotr-4.1.1-1.el7 (FEDORA-EPEL-2016-be7c90de69)
Off-The-Record Messaging library and toolkit
--------------------------------------------------------------------------------
Update Information:
Updated to 4.1.1 for CVE-2016-2851
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1315247
https://bugzilla.redhat.com/show_bug.cgi?id=1315247
--------------------------------------------------------------------------------
================================================================================
mosquitto-1.4.8-1.el7 (FEDORA-EPEL-2016-d881a05e37)
An Open Source MQTT v3.1/v3.1.1 Broker
--------------------------------------------------------------------------------
Update Information:
Update to new upstream version 1.4.8 ---- Update to new upstream version 1.4.7
--------------------------------------------------------------------------------
================================================================================
muffin-2.8.5-1.el7 (FEDORA-EPEL-2016-f3d75fbe8d)
Window and compositing manager based on Clutter
--------------------------------------------------------------------------------
Update Information:
release update
--------------------------------------------------------------------------------
================================================================================
nemo-2.8.7-1.el7 (FEDORA-EPEL-2016-f3d75fbe8d)
File manager for Cinnamon
--------------------------------------------------------------------------------
Update Information:
release update
--------------------------------------------------------------------------------
================================================================================
pdc-client-0.9.0-2.el7 (FEDORA-EPEL-2016-26a015168e)
Client library and console client for Product Definition Center
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream version
--------------------------------------------------------------------------------
================================================================================
percona-xtrabackup-2.2.9-4.el7 (FEDORA-EPEL-2016-8246f7bdba)
Online backup for InnoDB/XtraDB in MySQL, Percona Server and MariaDB
--------------------------------------------------------------------------------
Update Information:
Rebuild to add ppc64le arch
--------------------------------------------------------------------------------
================================================================================
php-extras-5.4.16-4.el7 (FEDORA-EPEL-2016-3a8b95f437)
Additional PHP modules from the standard PHP distribution
--------------------------------------------------------------------------------
Update Information:
Fix for pdo_dblib (#1266177)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1266177 - PHP bug 63638 "Cannot connect to SQL Server 2008 with PDO
dblib"
https://bugzilla.redhat.com/show_bug.cgi?id=1266177
--------------------------------------------------------------------------------
================================================================================
php-pecl-http-2.5.6-1.el7 (FEDORA-EPEL-2016-bfdc2d9e96)
Extended HTTP support
--------------------------------------------------------------------------------
Update Information:
**Version 2.5.6** * Fix php-bug php#71719: Buffer overflow in HTTP url parsing
functions (Mike, rc0r) * Fix gh-issue #28: Possible null pointer dereference in
php_http_url_mod() (rc0r) * Fix gh-issue #22: Fix PHP5 config.w32 (Jan Ehrhardt)
* Fix gh-issue #20: setSslOptions notice with curl 7.43 (Mike, Vitaliy Demidov)
--------------------------------------------------------------------------------
================================================================================
pmix-1.1.3-1.el7 (FEDORA-EPEL-2016-f75b3d7754)
Exascale version of PMI
--------------------------------------------------------------------------------
Update Information:
The Process Management Interface (PMI) has been used for quite some time as a
means of exchanging wireup information needed for interprocess communication.
Two versions (PMI-1 and PMI-2) have been released as part of the MPICH effort.
While PMI-2 demonstrates better scaling properties than its PMI-1 predecessor,
attaining rapid launch and wireup of the roughly 1M processes executing across
100k nodes expected for exascale operations remains challenging. PMI Exascale
(PMIx) represents an attempt to resolve these questions by providing an extended
version of the PMI standard specifically designed to support clusters up to and
including exascale sizes. The overall objective of the project is not to branch
the existing pseudo-standard definitions - in fact, PMIx fully supports both of
the existing PMI-1 and PMI-2 APIs - but rather to (a) augment and extend those
APIs to eliminate some current restrictions that impact scalability, and (b)
provide a reference implementation of the PMI-server that demonstrates the
desired level of scalability.
--------------------------------------------------------------------------------
================================================================================
python-nmrglue-0.5-3.el7 (FEDORA-EPEL-2016-8dd87b0c13)
Python module for processing NMR data
--------------------------------------------------------------------------------
Update Information:
Python module for processing NMR data
--------------------------------------------------------------------------------
================================================================================
rubygem-benchmark-ips-2.5.0-1.el7 (FEDORA-EPEL-2016-6c3d911900)
An iterations per second enhancement to Benchmark
--------------------------------------------------------------------------------
Update Information:
Updated to upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1305669 - Review Request: rubygem-benchmark-ips - An iterations per second
enhancement to Benchmark
https://bugzilla.redhat.com/show_bug.cgi?id=1305669
--------------------------------------------------------------------------------
================================================================================
rubygem-stomp-1.3.5-1.el7 (FEDORA-EPEL-2016-24eb073219)
Ruby client for the Stomp messaging protocol
--------------------------------------------------------------------------------
Update Information:
1.3.5 20160302 * Add AMQ specific durable topic example. * Output error to
stderr only in logger is undefined. * Move README changelog lower. * Handle
newline at start of receive buffer. * Use Timeout::timeout instead of deprecated
kernel version. * If socket open on reconnect, close it before new open. * On
misc_err, make error messages more readable. * Attempt to support both Rspec
2.14.1+ and 3.x.
--------------------------------------------------------------------------------