The following Fedora EPEL 7 Security updates need testing:
Age URL
394
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d
condor-8.6.11-1.el7
169
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-d2c1368294
cinnamon-3.6.7-5.el7
135
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80
python-gnupg-0.4.4-1.el7
133
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b
bubblewrap-0.3.3-2.el7
69
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-12067fc897
dosbox-0.74.3-2.el7
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-ca3444781e
perl-SOAP-Lite-1.10-2.el7
12
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-9bc2214140
nsd-4.2.2-1.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-9166ad1315
cobbler-2.8.5-0.1.el7
7
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-b4713b164c
chromium-76.0.3809.132-2.el7
7
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-2dd8fb899e
wordpress-5.1.2-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
bird-1.6.8-1.el7
bird2-2.0.6-1.el7
libebml-1.3.9-1.el7
libmatroska-1.5.2-1.el7
mkvtoolnix-37.0.0-1.el7
mozilla-noscript-11.0.3-3.el7
mozilla-ublock-origin-1.22.2-1.el7
seamonkey-2.49.5-2.el7
wabt-1.0.11-1.el7
youtube-dl-2019.09.12.1-1.el7
Details about builds:
================================================================================
bird-1.6.8-1.el7 (FEDORA-EPEL-2019-5fce3c9dd9)
BIRD Internet Routing Daemon
--------------------------------------------------------------------------------
Update Information:
BIRD 1.6.8 (2019-09-10) ======================= * Several important bugfixes
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 11 2019 Robert Scheck <robert(a)fedoraproject.org> - 1.6.8-1
- Upgrade to 1.6.8 (#1751031, #1751349)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1751031 - CVE-2019-16159 bird: incorrect logical expressionwhen checking the
validity of an input message leads to stack-based buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1751031
--------------------------------------------------------------------------------
================================================================================
bird2-2.0.6-1.el7 (FEDORA-EPEL-2019-3da69c71ad)
BIRD Internet Routing Daemon
--------------------------------------------------------------------------------
Update Information:
BIRD 2.0.6 (2019-09-10) ======================= * RAdv: Solicited unicast RAs
* BGP: Optional Adj-RIB-Out * BGP: Extended optional parameters length *
Filter: Sets and set expressions in path masks * Several important bugfixes
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 11 2019 Robert Scheck <robert(a)fedoraproject.org> - 2.0.6-1
- Upgrade to 2.0.6 (#1751031, #1751349)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1751031 - CVE-2019-16159 bird: incorrect logical expressionwhen checking the
validity of an input message leads to stack-based buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1751031
--------------------------------------------------------------------------------
================================================================================
libebml-1.3.9-1.el7 (FEDORA-EPEL-2019-c9e955fd21)
Extensible Binary Meta Language library
--------------------------------------------------------------------------------
Update Information:
Latest Matroska container stack (libebml, libmatroska, mkvtoolnix). Includes a
fix for CVE-2019-13615 in libebml.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 10 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 1.3.9-1
- update to 1.3.9 (#1688001)
* Fri Jun 7 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 1.3.7-1
- update to 1.3.7
- unbundle utf8cpp
- fix unowned %{_libdir}/cmake/ebml directory
* Mon Jul 23 2018 Dominik Mierzejewski <rpm(a)greysector.net> - 1.3.6-1
- update to 1.3.6 (#1570224)
- add BR: gcc for
https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot
- switch build system to cmake
- add missing dependencies to -devel subpackage
- use license and ldconfig_scriptlets macros
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1734735 - CVE-2019-13615 libebml: could be made to crash if it opened a
specially crafted file
https://bugzilla.redhat.com/show_bug.cgi?id=1734735
--------------------------------------------------------------------------------
================================================================================
libmatroska-1.5.2-1.el7 (FEDORA-EPEL-2019-c9e955fd21)
Open audio/video container format library
--------------------------------------------------------------------------------
Update Information:
Latest Matroska container stack (libebml, libmatroska, mkvtoolnix). Includes a
fix for CVE-2019-13615 in libebml.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 10 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 1.5.2-1
- update to 1.5.2 (#1688000)
- switch build system to cmake, add missing dependencies
- use ldconfig_scriptlets macro
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1734735 - CVE-2019-13615 libebml: could be made to crash if it opened a
specially crafted file
https://bugzilla.redhat.com/show_bug.cgi?id=1734735
--------------------------------------------------------------------------------
================================================================================
mkvtoolnix-37.0.0-1.el7 (FEDORA-EPEL-2019-c9e955fd21)
Matroska container manipulation utilities
--------------------------------------------------------------------------------
Update Information:
Latest Matroska container stack (libebml, libmatroska, mkvtoolnix). Includes a
fix for CVE-2019-13615 in libebml.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 10 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 37.0.0-1
- update to 37.0.0 (#1723039)
- requires libebml 1.3.7 and libmatroska 1.5.0
- switch to devtoolset-8
- enable appstream metadata validation (#1636955 fixed)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1734735 - CVE-2019-13615 libebml: could be made to crash if it opened a
specially crafted file
https://bugzilla.redhat.com/show_bug.cgi?id=1734735
--------------------------------------------------------------------------------
================================================================================
mozilla-noscript-11.0.3-3.el7 (FEDORA-EPEL-2019-1a34b82a87)
JavaScript white list extension for Mozilla Firefox
--------------------------------------------------------------------------------
Update Information:
Latest upstream release. Full [
changelog](https://noscript.net/changelog).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 12 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 11.0.3-3
- update to 11.0.3 (#1751683)
- add more bundled libraries
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1751683 - mozilla-noscript-11.0.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1751683
--------------------------------------------------------------------------------
================================================================================
mozilla-ublock-origin-1.22.2-1.el7 (FEDORA-EPEL-2019-f2e9b0ce82)
An efficient blocker for Firefox
--------------------------------------------------------------------------------
Update Information:
**New:** New procedural cosmetic/HTML filtering operator: `min-text-length(x)`,
where `x` is the minimal text length of the subject DOM element. It is
chainable. Example: example.de##^script:has-text(.charCodeAt):min-text-
length(14000) New keyboard shortcut available: "Relax blocking mode". Use it
to
lower the current blocking mode to a lower one. Currently the default behavior
is: + Allow JavaScript; or + Allow 3rd-party network requests Consequently, if
your default blocking profile is to disable JavaScript and 3rd-party network
requests, you will need to press twice to lower uBO's blocking mode to the
lowest blocking mode achievable through the keyboard command. The current web
page will be automatically reloaded each time the current blocking mode is
lowered. The shortcut will have no effect when the current blocking mode in
effect does not forbid JavaScript and 3rd-party requests. **Fixed** * url(...)
style injections in cosmetic filters * Parse search string as plaintext to avoid
doubling \ * Commit button gets stuck under specific circumstances *
Whitelisting behind-the-scene causes uBO to disregard the moz-extension-scheme
rule * Add link to open urls in a new tab * Coalesce common plain filters in a
bucket into a single trie * Temporary dynamic filters with 3p-script won't save
* Keyboard shortcut to change modes * Fix thrown exception in onHeadersReceived
listener * Prevent adding known invalid URL-based rules * Fix background color
of previewed image in logger * Finalize converting resources.txt into immutable
resources * Save only modified immediate hidden settings * Refactor management
of injectable resources * Strict-block only if match is anchored to end of
hostname * Minor code review re. context menu code * Add ability to suspend
network request handler at will * Fix some element picker-related issues * Fix
merging multiple URls in element picker * Replace exec with transpose in
procedural filters * Add test pages for procedural filters * Add new procedural
operator: :min-text-length(x) * Does not block large media fetched over Fetch
API * Last permanent rule is marked as changed when rules are added to the
bottom * Dashboard open from uBO popup triggers unsaved changes dialog *
Multiple "Advanced settings" opened * Redirection fails for filters having * in
the host part * Show requests blocked in the logger as a result of csp= option *
Element picker normalize style attrib * "#@#+js" entries are shown in the
logger
as yellow instead of green * no-scripting: behind-the-scene false sticks even
after restoring uBO from a config where it's not present * Revert button remains
active/clickable after clicking on Apply changes * "Block element" item should
have ellipsis (usability) * Nested !#if/!#endif directives not evaluated
properly * Hide predefined whitelist directives * Non-specific procedural
filters * HTML filter showing up as cosmetic filter in logger * No warning for
unsaved changes in dashboard * Logger: can't bring up filtering options for
popup entries where URL does not start with http[s] * Switching configuration
tabs [appears to stop] list updates * Cosmetic filter exceptions not displayed
in network request logger * Fix generichide not being evaluated for local
context * Discard whole filter with bad csp= content * Add a link to the remote
asset in asset viewer * Rearrange inner loop of static network filtering engine
* Fix "Close this window" not working on document-blocked page * Add support
for
all filter option * Set default delay for creating selfie to 3 minutes * Avoid
duplicated strings in filterOrigin w/ new approach * Revisit code to benefit
from ES6 syntax * Refactor runtime storage of specific cosmetic filters * Add
support for nth-ancestor operator in HTML filtering * Ensure "Ignore generic
cosmetic filters" sticks on Fennec * Fix regression affecting `*$csp=`-like
filters * Fix error when loading a non-cached non-local asset
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 11 2019 Dominik Mierzejewski <rpm(a)greysector.net> - 1.22.2-1
- update to 1.22.2 (#1713383)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1713383 - mozilla-ublock-origin-1.22.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1713383
--------------------------------------------------------------------------------
================================================================================
seamonkey-2.49.5-2.el7 (FEDORA-EPEL-2019-57cf200dc6)
Web browser, e-mail, news, IRC client, HTML editor
--------------------------------------------------------------------------------
Update Information:
Rebuild to properly handle external lightning extension. ---- Update to
2.49.5
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 9 2019 Dmitry Butskoy <Dmitry(a)Butskoy.name> 2.49.5-2
- rebuid to properly handle external lightning extension (#1750450)
* Sat Aug 24 2019 Dmitry Butskoy <Dmitry(a)Butskoy.name> 2.49.5-1
- update to 2.49.5
- add support for conditional build of inspector and irc
- re-enable webgl2 by default for EPEL7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1750450 - Lightning not working in SeaMonkey 2.49.5 due to
--disable-calendar
https://bugzilla.redhat.com/show_bug.cgi?id=1750450
--------------------------------------------------------------------------------
================================================================================
wabt-1.0.11-1.el7 (FEDORA-EPEL-2019-f81b600696)
The WebAssembly Binary Toolkit
--------------------------------------------------------------------------------
Update Information:
Latest upstream release with a number of bug fixes. Adds support for custom
annotations.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 12 2019 Dominik Mierzejewski <rpm(a)greysector.net> 1.0.11-1
- update to 1.0.11
- drop obsolete patches
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1708856 - wabt-1.0.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1708856
--------------------------------------------------------------------------------
================================================================================
youtube-dl-2019.09.12.1-1.el7 (FEDORA-EPEL-2019-a25429d6dd)
A small command-line program to download online videos
--------------------------------------------------------------------------------
Update Information:
Update to 2019.09.12.1 ---- Add Fish shell completion ---- Update to
2019.09.12
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 11 2019 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> - 2019.09.12.1-1
- Update to 2019.09.12.1
* Wed Sep 11 2019 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> - 2019.09.12-2
- Add Fish shell completion
* Wed Sep 11 2019 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> - 2019.09.12-1
- Update to 2019.09.12
* Mon Aug 19 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 2019.07.30-2
- Rebuilt for Python 3.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742440 - youtube-dl-2019.09.01 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742440
--------------------------------------------------------------------------------