The following Fedora EPEL 7 Security updates need testing:
Age URL
632
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087
dokuwiki-0-0.24.20140929c.el7
394
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f
mcollective-2.8.4-1.el7
113
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-23fa04bf1c
redis-3.2.3-1.el7
96
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-e8f4ff76b3
chicken-4.11.0-3.el7
39
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-ee3cc4d1b6
compat-guile18-1.8.8-14.el7
10
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-103c5b0f17
drupal7-7.52-1.el7
10
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-c7640e3ff5
teeworlds-0.6.4-2.el7
7
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-05f68ac70b
p7zip-16.02-2.el7
2
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-a0a16db403
dpkg-1.17.27-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-0e9b9b02bb
phpMyAdmin-4.4.15.9-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-89c47c50a3
mingw-gdk-pixbuf-2.30.8-2.el7 mingw-qt5-qtimageformats-5.6.0-2.el7
mingw-jasper-1.900.28-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-bd288eeb9f
php-php-gettext-1.0.12-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-7059e6dc35
roundcubemail-1.1.7-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
RBTools-0.7.7-1.el7
brightnessctl-0.1.1_p2-2.el7
golang-github-knieriem-markdown-0-1.git325ec6c.el7
kompose-0.1.2-0.1.git92ea047.el7
libqtxdg-qt4-1.2.0-11.el7
lout-3.40-5.el7
lrzip-0.616-5.el7
mimedefang-2.79-1.el7
mingw-gdk-pixbuf-2.30.8-2.el7
mingw-jasper-1.900.28-1.el7
mingw-qt5-qtimageformats-5.6.0-2.el7
pam_mapi-0.3.0-1.el7
perl-Image-ExifTool-10.36-1.el7
perl-Module-Extract-Use-1.04-2.el7
php-cs-fixer-1.13.0-1.el7
php-deepend-Mockery-0.9.6-1.el7
php-http-interop-http-middleware-0.2.0-1.el7
php-php-gettext-1.0.12-1.el7
php-phpiredis-1.0.0-2.el7
php-phpmd-PHP-PMD-2.5.0-1.el7
phpMyAdmin-4.4.15.9-1.el7
python3-ply-3.9-1.el7
python3-sqlalchemy-1.1.3-1.el7
python3-urllib3-1.19.1-2.el7
roundcubemail-1.1.7-1.el7
screengrab-1.2.1-1.el7
zarafa-7.1.14-3.el7
Details about builds:
================================================================================
RBTools-0.7.7-1.el7 (FEDORA-EPEL-2016-b6dc8cb568)
Tools for use with ReviewBoard
--------------------------------------------------------------------------------
Update Information:
https://www.reviewboard.org/docs/releasenotes/rbtools/0.7.7/
--------------------------------------------------------------------------------
================================================================================
brightnessctl-0.1.1_p2-2.el7 (FEDORA-EPEL-2016-c463ab64a5)
Read and control device brightness
--------------------------------------------------------------------------------
Update Information:
new software :)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1398929 - Review Request: brightnessctl - Read and control device brightness
https://bugzilla.redhat.com/show_bug.cgi?id=1398929
--------------------------------------------------------------------------------
================================================================================
golang-github-knieriem-markdown-0-1.git325ec6c.el7 (FEDORA-EPEL-2016-fc4294ee35)
A translation of peg-markdown into Go
--------------------------------------------------------------------------------
Update Information:
A translation of peg-markdown into Go
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1396636 - Review Request: golang-github-knieriem-markdown - A translation of
peg-markdown into Go
https://bugzilla.redhat.com/show_bug.cgi?id=1396636
--------------------------------------------------------------------------------
================================================================================
kompose-0.1.2-0.1.git92ea047.el7 (FEDORA-EPEL-2016-5985421e72)
Tool to move from `docker-compose` to Kubernetes
--------------------------------------------------------------------------------
Update Information:
Update to kompose version 0.1.2
--------------------------------------------------------------------------------
================================================================================
libqtxdg-qt4-1.2.0-11.el7 (FEDORA-EPEL-2016-6e90a39e8a)
QtXdg, a Qt4 implementation of XDG standards
--------------------------------------------------------------------------------
Update Information:
Rebuilt for
https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
lout-3.40-5.el7 (FEDORA-EPEL-2016-fd06a2045b)
A document formatting system
--------------------------------------------------------------------------------
Update Information:
Unification of SPEC file and rebuild in all supported branches.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1201246 - Upgrade to 3.40
https://bugzilla.redhat.com/show_bug.cgi?id=1201246
--------------------------------------------------------------------------------
================================================================================
lrzip-0.616-5.el7 (FEDORA-EPEL-2016-b9b141bd3b)
Compression program optimized for large files
--------------------------------------------------------------------------------
Update Information:
lrzip 0.616 =========== * Making things more homogeneous in checks, some
space removed * Simplifying and refactoring logic, alignment edits, empty
semantic rewire * Target directories must always exist and -f should not
create them * Deferring output directory after -f check has taken place *
Preserve extraction semantics without resorting to tar stripping * Making sure
last forward slash is removed from input path * Removing pointless forced
overwrite point check lrzip 0.615 =========== * Adjusting -O flag
semantics, options help update * Making -O flag operative for lrztar,
whitespace path fix, lrzuntar fix, other minor * Further tighten up ram
restrictions with stdin/stdout to prevent running out of memory with all the
buffers involved * Massive files fail with -U due to trying to allocate the
whole lot in ram while doing checksums. Do it piecemeal to avoid the problem.
Patch and debugging courtesy of Adam Tk���� * We have to run through the clear
buffer function even for empty buffers or corrupt archives with empty match
streams * MD5 code uses little endian so remove arbitrary SWAP macro and
explicitly use htole32 * Rewrite the magic if we receive lzma properties and
have not yet written them yet during stdout operation * Set the control lzma
properties only once * Add a control lock mutex for protecting certain control
variables * Fix stdin fake mremap creating null bytes on osx, patch courtesy
of John Boyle * Cache frequently used indirectly referenced variables in the
sliding mmap code * Micro-optimise sliding_get_sb_range * A fix for a bug
where large files containing the same non-zero bytes which requires a sliding
window, courtesy of Serge Belyshev * Put vchar should take a 64 bit integer
and is used from more than one call site so uninline it * Microoptimise in
hash_search * Inline rzip functions used from only one caller * Check for
successful calloc of hash table only after performing it * stdin_eof is just a
bool * hash_bits can only be up to 64 so use a char type * Check endianness
of build with autotools to enable md5 support on more platforms
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1154614 - Please update lrzip to 0.616 (current 0.614 fails to compress large
files with -U)
https://bugzilla.redhat.com/show_bug.cgi?id=1154614
--------------------------------------------------------------------------------
================================================================================
mimedefang-2.79-1.el7 (FEDORA-EPEL-2016-b61124cf9e)
E-Mail filtering framework using Sendmail's Milter interface
--------------------------------------------------------------------------------
Update Information:
MIMEDefang 2.79 =============== * Add the --data-dump option to scripts
/mimedefang-util * Improve Postfix compatibility by trying to get QueueID
after first RCPT command, and if not found, at the EOH milter phase * Make
mimedefang-multiplexor exit with a successful return code upon receipt of
SIGTERM * Use 64-bit variables where supported for some statstics counters
that could overflow with only 32-bit variables, yielding incorrect statistics
* Fix configure.in to correctly detect that an embedded Perl interpreter can be
destroyed/recreated on systems that need the -pthread GCC flag
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1380052 - mimedefang-2.79 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1380052
--------------------------------------------------------------------------------
================================================================================
mingw-gdk-pixbuf-2.30.8-2.el7 (FEDORA-EPEL-2016-89c47c50a3)
MinGW Windows GDK Pixbuf library
--------------------------------------------------------------------------------
Update Information:
Many security fixes for jasper.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1393887 - CVE-2016-9262 mingw-jasper: jasper: Multiple overflow
vulnerabilities leading to use after free [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1393887
[ 2 ] Bug #1396989 - CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390
CVE-2016-9391 CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9395 CVE-2016-9396
CVE-2016-9397 CVE-2016-9398 CVE-2016-9399 mingw-jasper: various flaws [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1396989
--------------------------------------------------------------------------------
================================================================================
mingw-jasper-1.900.28-1.el7 (FEDORA-EPEL-2016-89c47c50a3)
MinGW Windows Jasper library
--------------------------------------------------------------------------------
Update Information:
Many security fixes for jasper.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1393887 - CVE-2016-9262 mingw-jasper: jasper: Multiple overflow
vulnerabilities leading to use after free [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1393887
[ 2 ] Bug #1396989 - CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390
CVE-2016-9391 CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9395 CVE-2016-9396
CVE-2016-9397 CVE-2016-9398 CVE-2016-9399 mingw-jasper: various flaws [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1396989
--------------------------------------------------------------------------------
================================================================================
mingw-qt5-qtimageformats-5.6.0-2.el7 (FEDORA-EPEL-2016-89c47c50a3)
Qt5 for Windows - QtImageFormats component
--------------------------------------------------------------------------------
Update Information:
Many security fixes for jasper.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1393887 - CVE-2016-9262 mingw-jasper: jasper: Multiple overflow
vulnerabilities leading to use after free [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1393887
[ 2 ] Bug #1396989 - CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390
CVE-2016-9391 CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9395 CVE-2016-9396
CVE-2016-9397 CVE-2016-9398 CVE-2016-9399 mingw-jasper: various flaws [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1396989
--------------------------------------------------------------------------------
================================================================================
pam_mapi-0.3.0-1.el7 (FEDORA-EPEL-2016-63c9ac0082)
PAM module for authentication via MAPI against a Zarafa server
--------------------------------------------------------------------------------
Update Information:
Update to pam_mapi 0.3.0
--------------------------------------------------------------------------------
================================================================================
perl-Image-ExifTool-10.36-1.el7 (FEDORA-EPEL-2016-e98e0f5b6d)
Utility for reading and writing image meta info
--------------------------------------------------------------------------------
Update Information:
Update to 10.36, latest stable release.
--------------------------------------------------------------------------------
================================================================================
perl-Module-Extract-Use-1.04-2.el7 (FEDORA-EPEL-2016-08051f4718)
Pull out the modules a module explicitly uses
--------------------------------------------------------------------------------
Update Information:
This is the first Fedora/EPEL release of perl-Module-Extract-Use.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1398690 - Review Request: perl-Module-Extract-Use - Pull out the modules a
module explicitly uses
https://bugzilla.redhat.com/show_bug.cgi?id=1398690
--------------------------------------------------------------------------------
================================================================================
php-cs-fixer-1.13.0-1.el7 (FEDORA-EPEL-2016-0f90e4d0d8)
A tool to automatically fix PHP code style
--------------------------------------------------------------------------------
Update Information:
The PHP Coding Standards Fixer tool fixes most issues in your code when you want
to follow the PHP coding standards as defined in the PSR-1 and PSR-2 documents
and many more. If you are already using a linter to identify coding standards
problems in your code, you know that fixing them by hand is tedious, especially
on large projects. This tool does not only detect them, but also fixes them for
you.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1391951 - Review Request: php-cs-fixer - A tool to automatically fix PHP code
style
https://bugzilla.redhat.com/show_bug.cgi?id=1391951
--------------------------------------------------------------------------------
================================================================================
php-deepend-Mockery-0.9.6-1.el7 (FEDORA-EPEL-2016-af436484c4)
Mockery is a simple but flexible PHP mock object framework
--------------------------------------------------------------------------------
Update Information:
Last upstream version. Sadly, upstream project does not provide a useful
[
changelog](https://github.com/padraic/mockery/issues/644).
--------------------------------------------------------------------------------
================================================================================
php-http-interop-http-middleware-0.2.0-1.el7 (FEDORA-EPEL-2016-a8b5fe22e8)
Common interface for HTTP middleware
--------------------------------------------------------------------------------
Update Information:
PSR-15 interfaces for HTTP middleware.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1393934 - Review Request: php-http-interop-http-middleware - Common interface
for HTTP middleware
https://bugzilla.redhat.com/show_bug.cgi?id=1393934
--------------------------------------------------------------------------------
================================================================================
php-php-gettext-1.0.12-1.el7 (FEDORA-EPEL-2016-bd288eeb9f)
Gettext emulation in PHP
--------------------------------------------------------------------------------
Update Information:
php-gettext 1.0.12 ================== * Security fix for potential code
injection bug (LP#1515334) * Do not assume mbstring functions are always
there, pass text through if they aren't (LP#734494)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1367462 - php-php-gettext: Arbitrary code execution in select_string,
ngettext and npgettext count parameter
https://bugzilla.redhat.com/show_bug.cgi?id=1367462
--------------------------------------------------------------------------------
================================================================================
php-phpiredis-1.0.0-2.el7 (FEDORA-EPEL-2016-3daa2edd8e)
Client extension for Redis
--------------------------------------------------------------------------------
Update Information:
Phpiredis is an extension for PHP 5.x and 7.x based on hiredis that provides a
simple and efficient client for Redis and a fast incremental parser / serializer
for the RESP protocol.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1398799 - Review Request: php-phpiredis - Client extension for Redis
https://bugzilla.redhat.com/show_bug.cgi?id=1398799
--------------------------------------------------------------------------------
================================================================================
php-phpmd-PHP-PMD-2.5.0-1.el7 (FEDORA-EPEL-2016-3f198db5ac)
PHPMD - PHP Mess Detector
--------------------------------------------------------------------------------
Update Information:
**Version 2.5.0** Features * Implemented #365: Remove the leading blank
line from the TextRenderer * Implemented #380: add --ignore-exit-violations
CLI flag to allow exit code 0 event if violation is found (will allow
successfull build for CI) * Implemented: Bump PHP dependency to 5.3.9
Bugfixes * Fixed #386: English language fixes * Fixed #395: Fix typo in
rulesets/cleancode * Fixed: Fix copy & paste error * Fixed #411: Unexpected
token: list * Fixed #389: Unexpected token: EMPTY ---- **Version 2.4.4**
* Fixed #347: Fixed UnexpectedTokenException on null coalesce operator.
--------------------------------------------------------------------------------
================================================================================
phpMyAdmin-4.4.15.9-1.el7 (FEDORA-EPEL-2016-0e9b9b02bb)
Handle the administration of MySQL over the World Wide Web
--------------------------------------------------------------------------------
Update Information:
phpMyAdmin 4.4.15.9 (2016-11-25) ================================ This release
includes many security fixes of various levels of severity. For full information
on the vulnerabilities fixed and mitigation factors for users who are unable to
upgrade, refer to the ChangeLog file included with this release and the security
announcements at
https://www.phpmyadmin.net/security/
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1399197 - CVE-2016-4412 phpMyAdmin: Multiple vulnerabilities fixed in
4.0.10.18, 4.4.15.9 and 4.6.5 versions
https://bugzilla.redhat.com/show_bug.cgi?id=1399197
--------------------------------------------------------------------------------
================================================================================
python3-ply-3.9-1.el7 (FEDORA-EPEL-2016-1a54effc5e)
Python Lex-Yacc
--------------------------------------------------------------------------------
Update Information:
PLY is a straightforward lex/yacc implementation. Here is a list of its
essential features: * It is implemented entirely in Python. * It uses LR-
parsing which is reasonably efficient and well suited for larger grammars. *
PLY provides most of the standard lex/yacc features including support for
empty productions, precedence rules, error recovery, and support for ambiguous
grammars. * PLY is straightforward to use and provides very extensive error
checking. * PLY doesn't try to do anything more or less than provide the basic
lex/yacc functionality. In other words, it's not a large parsing framework or
a component of some larger system. functionality. In other words, it's not
a large parsing framework or a component of some larger system.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1384249 - Review Request: python3-ply - Python Lex-Yacc
https://bugzilla.redhat.com/show_bug.cgi?id=1384249
--------------------------------------------------------------------------------
================================================================================
python3-sqlalchemy-1.1.3-1.el7 (FEDORA-EPEL-2016-10a96f676a)
Modular and flexible ORM library for python
--------------------------------------------------------------------------------
Update Information:
SQLAlchemy is an Object Relational Mappper (ORM) that provides a flexible, high-
level interface to SQL databases. Database and domain concepts are decoupled,
allowing both sides maximum flexibility and power. SQLAlchemy provides a
powerful mapping layer that can work as automatically or as manually as you
choose, determining relationships based on foreign keys or letting you define
the join conditions explicitly, to bridge the gap between database and domain.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1384130 - Review Request: python3-sqlalchemy - Modular and flexible ORM
library for python
https://bugzilla.redhat.com/show_bug.cgi?id=1384130
--------------------------------------------------------------------------------
================================================================================
python3-urllib3-1.19.1-2.el7 (FEDORA-EPEL-2016-0d498d0bdc)
Python 3 HTTP library with thread-safe connection pooling and file post
--------------------------------------------------------------------------------
Update Information:
Python 3 HTTP module with connection pooling and file POST abilities.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1376940 - Review Request: python3-urllib3 - Python 3 HTTP library with
thread-safe connection pooling and file post
https://bugzilla.redhat.com/show_bug.cgi?id=1376940
--------------------------------------------------------------------------------
================================================================================
roundcubemail-1.1.7-1.el7 (FEDORA-EPEL-2016-7059e6dc35)
Round Cube Webmail is a browser-based multilingual IMAP client
--------------------------------------------------------------------------------
Update Information:
**Version 1.1.7** - Fix vulnerability in handling of mail()'s 5th argument
--------------------------------------------------------------------------------
================================================================================
screengrab-1.2.1-1.el7 (FEDORA-EPEL-2016-517f51e170)
Screen grabber
--------------------------------------------------------------------------------
Update Information:
Version bump
--------------------------------------------------------------------------------
================================================================================
zarafa-7.1.14-3.el7 (FEDORA-EPEL-2016-a1cec9b87a)
Open Source Edition of the Zarafa Collaboration Platform
--------------------------------------------------------------------------------
Update Information:
- Added upstream patch to fix broken group expansion (ZCP-12148)
--------------------------------------------------------------------------------