The following Fedora EPEL 7 Security updates need testing: Age URL 23 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-4a9fc09599 openjpeg2-2.3.1-10.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-ab8d229496 awstats-7.8-2.el7 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-a8b2c928f5 dia-0.97.3-16.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-143227c7ed sympa-6.2.60-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
adplug-2.3.3-1.el7 audacious-plugins-4.0.5-3.el7 python-chameleon-3.8.1-1.el7 xmakemol-5.16-10.el7
Details about builds:
================================================================================ adplug-2.3.3-1.el7 (FEDORA-EPEL-2021-5843fdc72c) Software library for AdLib (OPL2/3) emulation -------------------------------------------------------------------------------- Update Information:
AdPlug 2.3.3 ============ - New RAD player replacing the old one - Bug fixes: (huge thanks to Alexander Miller for these) - CVE-2019-14690 - buffer overflow in `.bmf` - CVE-2019-14691 - buffer overflow in `.dtm` - CVE-2019-14692 - buffer overflow in `.mkj` - CVE-2019-14732 - buffer overflow in `.a2m` - CVE-2019-14733 - buffer overflow in `.rad` - CVE-2019-14734 - buffer overflow in `.mtk` - CVE-2019-15151 - double free and OOB reads in `.u6m` - OOB reads in `.xad` - OOB reads in `.rix` AdPlug 2.3.2 ============ - Bug fixes: - FMOPL: Fix global variable pointer double-free (CVE-2018-17825) - HERAD: Fix compilation on GCC 4.2.1 - ADL: Calling `rewind()` before `update()` causes access violation - Move OPL reset/init code to `rewind()` for some players AdPlug 2.3.1 ============ - Fixed unconditional inclusion of "sys/io.h" on Linux - Autotools improvement - Non-recursive Automake, improved parallelizability - Compatibility fixes for FreeBSD's pmake and OpenBSD's make - Out-of-source building AdPlug 2.3 ========== - Bug fixes: - CMF: Fix uninitialised variable use (thanks binarymaster) - CMF: Handle invalid offsets without crashing - ROL: Prevent access beyond end of vector - MSC: Fix use of uninitialised variable - HSC: Handle out of range patterns more gracefully - MID: Fix out of range array read - LDS: Use the tempo stored inside the Loudness-File instead of simply returning 70Hz - RIX: Fix several replay bugs (thanks to Palxex) - RIX: Big-endian fix by Wei Mingzhi - XAD: Tempo fix - Various other out of bounds array fixes, timing fixes, etc. - New formats: - BMF: Easy AdLib 1.0 - CMF: SoundFX Macs Opera - GOT: God of Thunder - HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD) - MUS/IMS/MDI: AdLib Visual Composer ROL derivatives - SOP: sopepos' Note Player - VGM: Video Game Music - Allow compilation on platforms that don't support real OPL hardware access - Add support for compiling on Appveyor and publishing a NuGet package - Add Visual Studio 2015 projects - Add support for Travis CI builds - Add new CRC16 and CRC32 tests - Addition of WoodyOPL from DOSBox SVN (thanks to NY00123) - Addition of NukedOPL (thanks to loki666 and nukeykt) - Move from SourceForge to GitHub - DRO player refactored (thanks to Laurence Myers and William Yates) - Add (mono) OPL3 support to the surround/harmonic-effect OPL - Fix occasional random noise in right channel when using surround OPL and Satoh synth - Add display for ROL comment and instrument names - Improve support for different Westwood ADL format versions - Improve CMF transpose support (per-channel now) - Autotools build environment updated -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 5 2021 Robert Scheck robert@fedoraproject.org - 2.3.3-1 - Upgrade to 2.3.3 (#1743108, #1770224, #1770243, #1770257, * Fri Jul 31 2020 Fedora Release Engineering releng@fedoraproject.org - 2.2.1-13 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Mon Jul 27 2020 Fedora Release Engineering releng@fedoraproject.org - 2.2.1-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue Jan 28 2020 Fedora Release Engineering releng@fedoraproject.org - 2.2.1-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Wed Jul 24 2019 Fedora Release Engineering releng@fedoraproject.org - 2.2.1-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Wed Apr 24 2019 Bj��rn Esser besser82@fedoraproject.org - 2.2.1-9 - Remove hardcoded gzip suffix from GNU info pages * Thu Jan 31 2019 Fedora Release Engineering releng@fedoraproject.org - 2.2.1-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1743108 - CVE-2019-15151 adplug: double free in function Cu6mPlayer in u6m.h https://bugzilla.redhat.com/show_bug.cgi?id=1743108 [ 2 ] Bug #1770224 - CVE-2019-14692 adplug: heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770224 [ 3 ] Bug #1770243 - CVE-2019-14690 adplug: heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770243 [ 4 ] Bug #1770257 - CVE-2019-14691 adplug: heap-based buffer overflow in CdtmLoader::load() in dtm.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770257 [ 5 ] Bug #1778710 - CVE-2019-14734 adplug: multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778710 [ 6 ] Bug #1778716 - CVE-2019-14732 adplug: multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778716 [ 7 ] Bug #1778720 - CVE-2019-14733 adplug: multiple heap-based buffer overflows in CradLoader::load() in rad.cp https://bugzilla.redhat.com/show_bug.cgi?id=1778720 --------------------------------------------------------------------------------
================================================================================ audacious-plugins-4.0.5-3.el7 (FEDORA-EPEL-2021-5843fdc72c) Plugins for the Audacious audio player -------------------------------------------------------------------------------- Update Information:
AdPlug 2.3.3 ============ - New RAD player replacing the old one - Bug fixes: (huge thanks to Alexander Miller for these) - CVE-2019-14690 - buffer overflow in `.bmf` - CVE-2019-14691 - buffer overflow in `.dtm` - CVE-2019-14692 - buffer overflow in `.mkj` - CVE-2019-14732 - buffer overflow in `.a2m` - CVE-2019-14733 - buffer overflow in `.rad` - CVE-2019-14734 - buffer overflow in `.mtk` - CVE-2019-15151 - double free and OOB reads in `.u6m` - OOB reads in `.xad` - OOB reads in `.rix` AdPlug 2.3.2 ============ - Bug fixes: - FMOPL: Fix global variable pointer double-free (CVE-2018-17825) - HERAD: Fix compilation on GCC 4.2.1 - ADL: Calling `rewind()` before `update()` causes access violation - Move OPL reset/init code to `rewind()` for some players AdPlug 2.3.1 ============ - Fixed unconditional inclusion of "sys/io.h" on Linux - Autotools improvement - Non-recursive Automake, improved parallelizability - Compatibility fixes for FreeBSD's pmake and OpenBSD's make - Out-of-source building AdPlug 2.3 ========== - Bug fixes: - CMF: Fix uninitialised variable use (thanks binarymaster) - CMF: Handle invalid offsets without crashing - ROL: Prevent access beyond end of vector - MSC: Fix use of uninitialised variable - HSC: Handle out of range patterns more gracefully - MID: Fix out of range array read - LDS: Use the tempo stored inside the Loudness-File instead of simply returning 70Hz - RIX: Fix several replay bugs (thanks to Palxex) - RIX: Big-endian fix by Wei Mingzhi - XAD: Tempo fix - Various other out of bounds array fixes, timing fixes, etc. - New formats: - BMF: Easy AdLib 1.0 - CMF: SoundFX Macs Opera - GOT: God of Thunder - HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD) - MUS/IMS/MDI: AdLib Visual Composer ROL derivatives - SOP: sopepos' Note Player - VGM: Video Game Music - Allow compilation on platforms that don't support real OPL hardware access - Add support for compiling on Appveyor and publishing a NuGet package - Add Visual Studio 2015 projects - Add support for Travis CI builds - Add new CRC16 and CRC32 tests - Addition of WoodyOPL from DOSBox SVN (thanks to NY00123) - Addition of NukedOPL (thanks to loki666 and nukeykt) - Move from SourceForge to GitHub - DRO player refactored (thanks to Laurence Myers and William Yates) - Add (mono) OPL3 support to the surround/harmonic-effect OPL - Fix occasional random noise in right channel when using surround OPL and Satoh synth - Add display for ROL comment and instrument names - Improve support for different Westwood ADL format versions - Improve CMF transpose support (per-channel now) - Autotools build environment updated -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 5 2021 Robert Scheck robert@fedoraproject.org - 4.0.5-3 - Rebuilt for adplug 2.3.3 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1743108 - CVE-2019-15151 adplug: double free in function Cu6mPlayer in u6m.h https://bugzilla.redhat.com/show_bug.cgi?id=1743108 [ 2 ] Bug #1770224 - CVE-2019-14692 adplug: heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770224 [ 3 ] Bug #1770243 - CVE-2019-14690 adplug: heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770243 [ 4 ] Bug #1770257 - CVE-2019-14691 adplug: heap-based buffer overflow in CdtmLoader::load() in dtm.cpp leads to arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1770257 [ 5 ] Bug #1778710 - CVE-2019-14734 adplug: multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778710 [ 6 ] Bug #1778716 - CVE-2019-14732 adplug: multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1778716 [ 7 ] Bug #1778720 - CVE-2019-14733 adplug: multiple heap-based buffer overflows in CradLoader::load() in rad.cp https://bugzilla.redhat.com/show_bug.cgi?id=1778720 --------------------------------------------------------------------------------
================================================================================ python-chameleon-3.8.1-1.el7 (FEDORA-EPEL-2021-3dd9b1aa0c) XML-based template compiler -------------------------------------------------------------------------------- Update Information:
Update to 3.8.1. -------------------------------------------------------------------------------- ChangeLog:
* Sun Jan 10 2021 Kevin Fenzi kevin@scrye.com - 3.8.1-1 - Update to 3.8.1. - Build python3 packages for epel7. rhbz#1789317 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1789317 - Rfe: Package Chameleon for Python 3 https://bugzilla.redhat.com/show_bug.cgi?id=1789317 --------------------------------------------------------------------------------
================================================================================ xmakemol-5.16-10.el7 (FEDORA-EPEL-2021-8bf1e1cecb) Program for visualizing atomic and molecular systems -------------------------------------------------------------------------------- Update Information:
Fixes the bug "XtCreateWidget "canvas" requires non-NULL widget class" encountered on RHEL 7. -------------------------------------------------------------------------------- ChangeLog:
* Sun Jan 10 2021 Susi Lehtola jussilehtola@fedoraproject.org - 5.16-10 - Fix crash for NULL widget class (BZ #1914657). * Wed Jul 29 2020 Fedora Release Engineering releng@fedoraproject.org - 5.16-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Sat Feb 1 2020 Susi Lehtola jussilehtola@fedoraproject.org - 5.16-8 - Patch out multiple definition of bbox. * Fri Jan 31 2020 Fedora Release Engineering releng@fedoraproject.org - 5.16-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Tue Sep 17 2019 Gwyn Ciesla gwync@protonmail.com - 5.16-6 - Rebuilt for new freeglut * Sat Jul 27 2019 Fedora Release Engineering releng@fedoraproject.org - 5.16-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sun Feb 3 2019 Fedora Release Engineering releng@fedoraproject.org - 5.16-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1914657 - xmakemol crashes with error message about NULL widget class https://bugzilla.redhat.com/show_bug.cgi?id=1914657 --------------------------------------------------------------------------------
epel-devel@lists.fedoraproject.org