The following Fedora EPEL 6 Security updates need testing:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5620/bugzilla-3.4.1... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5944/python-tornado... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6012/asterisk-1.8.1... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5955/socat-1.7.2.1-... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2011-4701/supybot-gribbl... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5974/drupal7-7.14-2... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5960/moodle-2.1.6-1... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5965/python-virtual...
The following builds have been pushed to Fedora EPEL 6 updates-testing
Pound-2.6-2.el6 asterisk-1.8.12.2-1.el6 darkserver-0.5.4-1.el6 drupal7-date_ical-1.1-1.el6 fedmsg-0.1.5-1.el6 gfalFS-1.0.0-0.3.20120503010snap.el6 guacd-0.6.0-6.el6 irclog2html-2.10.0-4.el6 libguac-0.6.0-6.el6 libguac-client-vnc-0.6.0-4.el6 mod_auth_token-1.0.5-2.el6 moksha-0.8.0-4.el6 python-tw2-jit-2.0.3-4.el6 python-txws-0.7-5.el6 python-txzmq-0.5.0-2.el6 shellinabox-2.14-4.el6 zanata-python-client-1.3.6-1.el6
Details about builds:
================================================================================ Pound-2.6-2.el6 (FEDORA-EPEL-2012-6001) Reverse proxy and load balancer -------------------------------------------------------------------------------- Update Information:
rebuild with new gperftools. fixes https://bugzilla.redhat.com/show_bug.cgi?id=795501 -------------------------------------------------------------------------------- ChangeLog:
* Wed May 30 2012 Manuel Wolfshant < wolfy@fedoraproject.org> 2.6-2 - Rebuild with new gperftools -------------------------------------------------------------------------------- References:
[ 1 ] Bug #795501 - Pound package has broken dependencies https://bugzilla.redhat.com/show_bug.cgi?id=795501 --------------------------------------------------------------------------------
================================================================================ asterisk-1.8.12.2-1.el6 (FEDORA-EPEL-2012-6012) The Open Source PBX -------------------------------------------------------------------------------- Update Information:
The Asterisk Development Team has announced the release of Asterisk 1.8.12.2. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 1.8.12.2 resolves an issue reported by the community and would have not been possible without your participation. Thank you!
The following is the issue resolved in this release:
* --- Resolve crash in subscribing for MWI notifications (Closes issue ASTERISK-19827. Reported by B. R)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.12.2
The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are released as versions 1.8.11-cert2, 1.8.12.1, and 10.4.1.
These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases
The release of Asterisk 1.8.11-cert2, 1.8.12.1, and 10.4.1 resolve the following two issues:
* A remotely exploitable crash vulnerability exists in the IAX2 channel driver if an established call is placed on hold without a suggested music class. Asterisk will attempt to use an invalid pointer to the music on hold class name, potentially causing a crash.
* A remotely exploitable crash vulnerability was found in the Skinny (SCCP) Channel driver. When an SCCP client closes its connection to the server, a pointer in a structure is set to NULL. If the client was not in the on-hook state at the time the connection was closed, this pointer is later dereferenced. This allows remote authenticated connections the ability to cause a crash in the server, denying services to legitimate users.
These issues and their resolution are described in the security advisories.
For more information about the details of these vulnerabilities, please read security advisories AST-2012-007 and AST-2012-008, which were released at the same time as this announcement.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Chan... http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.... http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.4...
The security advisories are available at:
* http://downloads.asterisk.org/pub/security/AST-2012-007.pdf * http://downloads.asterisk.org/pub/security/AST-2012-008.pdf
-------------------------------------------------------------------------------- ChangeLog:
* Wed May 30 2012 Jeffrey Ollie jeff@ocjtech.us - 1.8.12.2-1 - The Asterisk Development Team has announced the release of Asterisk 1.8.12.2. - This release is available for immediate download at - http://downloads.asterisk.org/pub/telephony/asterisk - - The release of Asterisk 1.8.12.2 resolves an issue reported by the - community and would have not been possible without your participation. - Thank you! - - The following is the issue resolved in this release: - - * --- Resolve crash in subscribing for MWI notifications - (Closes issue ASTERISK-19827. Reported by B. R) - - For a full list of changes in this release, please see the ChangeLog: - - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.12.2 * Wed May 30 2012 Jeffrey Ollie jeff@ocjtech.us - 1.8.12.1-1: - The Asterisk Development Team has announced security releases for Certified - Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are - released as versions 1.8.11-cert2, 1.8.12.1, and 10.4.1. - - These releases are available for immediate download at - http://downloads.asterisk.org/pub/telephony/asterisk/releases - - The release of Asterisk 1.8.11-cert2, 1.8.12.1, and 10.4.1 resolve the following - two issues: - - * A remotely exploitable crash vulnerability exists in the IAX2 channel - driver if an established call is placed on hold without a suggested music - class. Asterisk will attempt to use an invalid pointer to the music - on hold class name, potentially causing a crash. - - * A remotely exploitable crash vulnerability was found in the Skinny (SCCP) - Channel driver. When an SCCP client closes its connection to the server, - a pointer in a structure is set to NULL. If the client was not in the - on-hook state at the time the connection was closed, this pointer is later - dereferenced. This allows remote authenticated connections the ability to - cause a crash in the server, denying services to legitimate users. - - These issues and their resolution are described in the security advisories. - - For more information about the details of these vulnerabilities, please read - security advisories AST-2012-007 and AST-2012-008, which were released at the - same time as this announcement. - - For a full list of changes in the current releases, please see the ChangeLogs: - - http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/Chan... - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.... - http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.4... - - The security advisories are available at: - - * http://downloads.asterisk.org/pub/security/AST-2012-007.pdf - * http://downloads.asterisk.org/pub/security/AST-2012-008.pdf * Thu May 3 2012 Jeffrey Ollie jeff@ocjtech.us - 1.8.12.0-1: - The Asterisk Development Team has announced the release of Asterisk 1.8.12.0. - This release is available for immediate download at - http://downloads.asterisk.org/pub/telephony/asterisk - - The release of Asterisk 1.8.12.0 resolves several issues reported by the - community and would have not been possible without your participation. - Thank you! - - The following are the issues resolved in this release: - - * --- Prevent chanspy from binding to zombie channels - (Closes issue ASTERISK-19493. Reported by lvl) - - * --- Fix Dial m and r options and forked calls generating warnings - for voice frames. - (Closes issue ASTERISK-16901. Reported by Chris Gentle) - - * --- Remove ISDN hold restriction for non-bridged calls. - (Closes issue ASTERISK-19388. Reported by Birger Harzenetter) - - * --- Fix copying of CDR(accountcode) to local channels. - (Closes issue ASTERISK-19384. Reported by jamicque) - - * --- Ensure Asterisk acknowledges ACKs to 4xx on Replaces errors - (Closes issue ASTERISK-19303. Reported by Jon Tsiros) - - * --- Eliminate double close of file descriptor in manager.c - (Closes issue ASTERISK-18453. Reported by Jaco Kroon) - - For a full list of changes in this release, please see the ChangeLog: - - http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.12.0 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #826474 - CVE-2012-2947 asterisk: Remote crash in IAX2 channel driver (AST-2012-007) https://bugzilla.redhat.com/show_bug.cgi?id=826474 --------------------------------------------------------------------------------
================================================================================ darkserver-0.5.4-1.el6 (FEDORA-EPEL-2012-6006) GNU build-id service -------------------------------------------------------------------------------- Update Information:
This is a bugfix release, only the koji-plugin code is actually updated. -------------------------------------------------------------------------------- ChangeLog:
* Wed May 2 2012 Kushal Das kushal@fedoraproject.org - 0.5.4-1 - Updated the source to 0.5.4, for bz#817625 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #817625 - darkserver adds significant time to builds with large debuginfo packages https://bugzilla.redhat.com/show_bug.cgi?id=817625 --------------------------------------------------------------------------------
================================================================================ drupal7-date_ical-1.1-1.el6 (FEDORA-EPEL-2012-6005) Allows creation of an iCal feed in Views -------------------------------------------------------------------------------- Update Information:
Allows creation of an iCal feed in Views. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #825644 - Review Request: drupal7-date_ical - Allows creation of an iCal feed in Views https://bugzilla.redhat.com/show_bug.cgi?id=825644 --------------------------------------------------------------------------------
================================================================================ fedmsg-0.1.5-1.el6 (FEDORA-EPEL-2012-6017) Tools for Fedora Infrastructure real-time messaging -------------------------------------------------------------------------------- Update Information:
Support for multiple nodes-per-service. New package - tools for fedora infrastructure message bus. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #818297 - Review Request: fedmsg - Tools for Fedora Infrastructure real-time messaging https://bugzilla.redhat.com/show_bug.cgi?id=818297 --------------------------------------------------------------------------------
================================================================================ gfalFS-1.0.0-0.3.20120503010snap.el6 (FEDORA-EPEL-2012-6018) Filesystem client based on GFAL 2.0 -------------------------------------------------------------------------------- Update Information:
initial import of gfalFS --------------------------------------------------------------------------------
================================================================================ guacd-0.6.0-6.el6 (FEDORA-EPEL-2012-5999) Proxy daemon for Guacamole -------------------------------------------------------------------------------- Update Information:
Guacamole proxy daemon --------------------------------------------------------------------------------
================================================================================ irclog2html-2.10.0-4.el6 (FEDORA-EPEL-2012-6000) Script to convert IRC logs to HTML and other formats -------------------------------------------------------------------------------- Update Information:
* Mon May 28 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-4 - Missing build added (#821438) * Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-3 - BR updated
* Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-2 - Install section fixed * Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-3 - BR updated
* Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-2 - Install section fixed * Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-3 - BR updated
* Mon May 14 2012 Fabian Affolter mail@fabian-affolter.ch - 2.10.0-2 - Install section fixed -------------------------------------------------------------------------------- References:
[ 1 ] Bug #821438 - irclog2html 2.10.0 is completely non-functional https://bugzilla.redhat.com/show_bug.cgi?id=821438 --------------------------------------------------------------------------------
================================================================================ libguac-0.6.0-6.el6 (FEDORA-EPEL-2012-6015) The common library used by all C components of Guacamole -------------------------------------------------------------------------------- Update Information:
Guacamole base library --------------------------------------------------------------------------------
================================================================================ libguac-client-vnc-0.6.0-4.el6 (FEDORA-EPEL-2012-6009) VNC support for guacd -------------------------------------------------------------------------------- Update Information:
Guacamole VNC library --------------------------------------------------------------------------------
================================================================================ mod_auth_token-1.0.5-2.el6 (FEDORA-EPEL-2012-6010) Token based URI access module for Apache -------------------------------------------------------------------------------- Update Information:
mod_auth_token allow you to generate URIS for a determined time window, you can also limit them by IP. This is very useful to handle file downloads, generated URIS can't be hot-linked (after it expires), also it allows you to protect very large files that can't be piped trough a script languages due to memory limitation. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #633240 - Review Request: mod_auth_token - token based URI access for apache https://bugzilla.redhat.com/show_bug.cgi?id=633240 --------------------------------------------------------------------------------
================================================================================ moksha-0.8.0-4.el6 (FEDORA-EPEL-2012-6011) A platform for creating real-time web applications -------------------------------------------------------------------------------- Update Information:
Remove setuptools requirement of orbited Latest update with no-turbogears -------------------------------------------------------------------------------- References:
[ 1 ] Bug #818293 - moksha-0.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=818293 --------------------------------------------------------------------------------
================================================================================ python-tw2-jit-2.0.3-4.el6 (FEDORA-EPEL-2012-6019) Javascript Infovis Toolkit (JIT) for ToscaWidgets2 -------------------------------------------------------------------------------- Update Information:
Require sqlalchemy-0.7 if on epel. Initial packaging. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #818293 - moksha-0.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=818293 [ 2 ] Bug #812030 - Review Request: python-tw2-jit - Javascript Infovis Toolkit (JIT) for ToscaWidgets2 https://bugzilla.redhat.com/show_bug.cgi?id=812030 --------------------------------------------------------------------------------
================================================================================ python-txws-0.7-5.el6 (FEDORA-EPEL-2012-6014) Twisted WebSockets wrapper -------------------------------------------------------------------------------- Update Information:
Resolving conflicts between branches. -------------------------------------------------------------------------------- ChangeLog:
* Tue May 29 2012 Ralph Bean rbean@redhat.com 0.7-5 - Resolve merge conflict between rawhide and el6. * Mon May 21 2012 Luke Macken lmacken@redhat.com 0.7-4 - Remove the Twisted dependency from the setup.py, since the RHEL package does not contain the necessary egg-info metadata. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #818293 - moksha-0.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=818293 --------------------------------------------------------------------------------
================================================================================ python-txzmq-0.5.0-2.el6 (FEDORA-EPEL-2012-6003) Twisted bindings for ZeroMQ -------------------------------------------------------------------------------- Update Information:
Patch out setuptools dep on Twisted for epel Latest version Initial packaging of txzmq. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #818293 - moksha-0.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=818293 [ 2 ] Bug #810382 - Review Request: python-txzmq - Twisted bindings for ZeroMQ https://bugzilla.redhat.com/show_bug.cgi?id=810382 --------------------------------------------------------------------------------
================================================================================ shellinabox-2.14-4.el6 (FEDORA-EPEL-2012-6013) Web based AJAX terminal emulator -------------------------------------------------------------------------------- Update Information:
Web based AJAX terminal emulator --------------------------------------------------------------------------------
================================================================================ zanata-python-client-1.3.6-1.el6 (FEDORA-EPEL-2012-6008) Python Client for Zanata Server -------------------------------------------------------------------------------- Update Information:
- Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Add option --disable-ssl-cert to python client- - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Refactoring code and remove duplicate code -------------------------------------------------------------------------------- ChangeLog:
* Mon May 28 2012 James Ni jni@redhat.com - 1.3.6-1 - Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Add option --disable-ssl-cert to python client - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Refactoring code and remove duplicate code -------------------------------------------------------------------------------- References:
[ 1 ] Bug #814593 - "TypeError: 'unicode' object does not support item assignment" when pulling translation from server https://bugzilla.redhat.com/show_bug.cgi?id=814593 [ 2 ] Bug #820046 - Python client generates empty msgctxt "" when pushing https://bugzilla.redhat.com/show_bug.cgi?id=820046 [ 3 ] Bug #795643 - Python client pushes extracted comments instead of translator comments https://bugzilla.redhat.com/show_bug.cgi?id=795643 --------------------------------------------------------------------------------
epel-devel@lists.fedoraproject.org