The following Fedora EPEL 7 Security updates need testing:
Age URL
14
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-e56f478565
koji-1.15.1-1.el7
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-9f8e93d154
python-jwt-1.6.1-1.el7
11
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2c81054303
remctl-3.14-1.el7
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-7c41fcb3cc
nghttp2-1.31.1-1.el7
1
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f51587d6d2
composer-1.6.4-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-4d3c4577da
gsoap-2.8.16-10.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
ansible-2.5.1-1.el7
darktable-2.4.2-2.el7
distgen-1.1-1.el7
golang-github-oschwald-maxminddb-golang-1.3.0-1.el7
lua-socket-3.0-0.17.rc1.el7
perl-Qt-4.14.3-14.el7
roundcubemail-1.1.11-1.el7
xscreensaver-5.39-3.el7
Details about builds:
================================================================================
ansible-2.5.1-1.el7 (FEDORA-EPEL-2018-ad971a0926)
SSH-based configuration management, deployment, and task execution system
--------------------------------------------------------------------------------
Update Information:
Update to 2.5.1 with bugfixes. See
https://github.com/ansible/ansible/blob/stable-2.5/changelogs/CHANGELOG-v...
for full list of fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Kevin Fenzi <kevin(a)scrye.com> - 2.5.1-1
- Update to 2.5.1 with bugfixes. Fixes: #1569270 #1569153 #1566004 #1566001
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1563649 - Package ansible-doc-2.5.0-2.fc27.noarch.rpm too big
https://bugzilla.redhat.com/show_bug.cgi?id=1563649
[ 2 ] Bug #1566004 - ansible-vault edit asks to change the vault password
https://bugzilla.redhat.com/show_bug.cgi?id=1566004
[ 3 ] Bug #1569153 - Fact gathering fails if dmidecode is not present
https://bugzilla.redhat.com/show_bug.cgi?id=1569153
[ 4 ] Bug #1566001 - ansible-vault edit asks to change the vault password
https://bugzilla.redhat.com/show_bug.cgi?id=1566001
[ 5 ] Bug #1569270 - ansible-2.5.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1569270
--------------------------------------------------------------------------------
================================================================================
darktable-2.4.2-2.el7 (FEDORA-EPEL-2018-074d6d3893)
Utility to organize and develop raw images
--------------------------------------------------------------------------------
Update Information:
rebuild ---- 2.4.2 release ---- rebuild
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 19 2018 Germano Massullo <germano.massullo(a)gmail.com> - 2.4.2-2
- forced Requires: iso-codes for Fedora only
* Tue Apr 17 2018 Germano Massullo <germano.massullo(a)gmail.com> - 2.4.2-1
- 2.4.2 release
- enabled osm-gps-map-devel for EPEL7, because version 1.x reached that repository too
- added BuildRequires gcc and clang minimum version requirements
- added BuildRequires: zlib-devel
- replaced make %{?_smp_mflags} with %make_build
- replaced make install DESTDIR=%{buildroot} with %make_install
- added iso-codes library requirement
- added devtoolset for EPEL7 needs
- on Fedora: replaced bundled lua with Fedora lua
* Tue Apr 17 2018 Germano Massullo <germano.massullo(a)gmail.com> - 2.0.7-5
- rebuilt
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568388 - darktable nees rebuild for el7.5 update
https://bugzilla.redhat.com/show_bug.cgi?id=1568388
[ 2 ] Bug #1538211 - Use devtoolset-7 to bring darktable 2.4 into EPEL7
https://bugzilla.redhat.com/show_bug.cgi?id=1538211
--------------------------------------------------------------------------------
================================================================================
distgen-1.1-1.el7 (FEDORA-EPEL-2018-19784ebb46)
Templating system/generator for distributions
--------------------------------------------------------------------------------
Update Information:
new release v1.1, per packaged NEWS file
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 19 2018 Pavel Raiskup <praiskup(a)redhat.com> - 1.1-1
- sync with upstream spec file
* Wed Apr 18 2018 Slavek Kabrda <bkabrda(a)redhat.com> - 1.1-1
- update to 1.1
- update source url to conform with new PyPI urls format
* Wed Feb 7 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.20-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
golang-github-oschwald-maxminddb-golang-1.3.0-1.el7 (FEDORA-EPEL-2018-15291f5a9e)
MaxMind DB Reader for Go
--------------------------------------------------------------------------------
Update Information:
Initial build of golang-github-oschwald-maxminddb-golang for EPEL7.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568203 - golang-github-oschwald-maxminddb-golang: build for EPEL7
https://bugzilla.redhat.com/show_bug.cgi?id=1568203
--------------------------------------------------------------------------------
================================================================================
lua-socket-3.0-0.17.rc1.el7 (FEDORA-EPEL-2018-1f73443466)
Network support for the Lua language
--------------------------------------------------------------------------------
Update Information:
- Use standard Fedora linker flags (bug #1548713)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Apr 16 2018 Rafael dos Santos <rdossant(a)redhat.com> - 3.0-0.17.rc1
- Use standard Fedora linker flags (bug #1548713)
* Thu Feb 8 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.0-0.16.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.0-0.15.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.0-0.14.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Fri Feb 10 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.0-0.13.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Thu Feb 4 2016 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.0-0.12.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
3.0-0.11.rc1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548713 - lua-socket: Partial Fedora build flags injection
https://bugzilla.redhat.com/show_bug.cgi?id=1548713
--------------------------------------------------------------------------------
================================================================================
perl-Qt-4.14.3-14.el7 (FEDORA-EPEL-2018-3d19253897)
Perl bindings for Qt
--------------------------------------------------------------------------------
Update Information:
Build-require kde-filesystem (bug #1568834)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Petr Pisar <ppisar(a)redhat.com> - 4.14.3-14
- Build-require kde-filesystem (bug #1568834)
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.14.3-13
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Sat Jan 20 2018 Bj��rn Esser <besser82(a)fedoraproject.org> - 4.14.3-12
- Rebuilt for switch to libxcrypt
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.14.3-11
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Thu Jun 8 2017 Jitka Plesnikova <jplesnik(a)redhat.com> - 4.14.3-10
- Perl 5.26 rebuild
* Thu Jun 8 2017 Petr Pisar <ppisar(a)redhat.com> - 4.14.3-9
- Restore compatibilty with Perl 5.26.0 (bug #1459787)
* Mon Jun 5 2017 Jitka Plesnikova <jplesnik(a)redhat.com> - 4.14.3-8
- Perl 5.26 rebuild
* Mon Mar 13 2017 Petr Pisar <ppisar(a)redhat.com> - 4.14.3-7
- Work around Qt::TcpSocket::connetctToHost() IPv6 deficiency (KDE bug #377563)
* Sat Feb 11 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.14.3-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568834 - Missing BuildRequires: kde-filesystem in perl-Qt.spec
https://bugzilla.redhat.com/show_bug.cgi?id=1568834
--------------------------------------------------------------------------------
================================================================================
roundcubemail-1.1.11-1.el7 (FEDORA-EPEL-2018-26155198e1)
Round Cube Webmail is a browser-based multilingual IMAP client
--------------------------------------------------------------------------------
Update Information:
**Version 1.1.11** This is a security update to the stable version 1.1. It
fixes a recently reported vulnerability allowing IMAP command injection via a
GET parameters. More details about this are published under CVE-2018-9846. The
second fix is about a missed remote content blocking on HTML messages with
specially crafted image and style tags. We strongly recommend to update all
productive installations of Roundcube 1.1.x. Please do backup your data before
updating! CHANGELOG * Don't ignore (global) userlogins/sendmail logs in
per_user_logging mode * Fix security issue in remote content blocking on HTML
image and style tags (#6178) * Fix check_request() bypass in places using
get_uids() [CVE-2018-9846] (#6238) * Fix possible IMAP command injection
vulnerability [CVE-2018-9846] (#6229)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 19 2018 Remi Collet <remi(a)remirepo.net> - 1.1.11.1
- update to 1.1.11
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1566744 - CVE-2018-9846 roundcubemail: MX injection in archive.php
[epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1566744
--------------------------------------------------------------------------------
================================================================================
xscreensaver-5.39-3.el7 (FEDORA-EPEL-2018-3cbd661ad7)
X screen saver and locker
--------------------------------------------------------------------------------
Update Information:
Match the fedora 29 version (5.39) xscreensaver-autostart and xscreensaver-
autostart.desktop is removed.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Apr 16 2018 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.39-3
- crumbler: fix loop enclosure for calculating keys in split_chunk
* Sun Apr 15 2018 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.39-2
- crumbler: fix color overvalue when accessing colors array
* Sun Apr 15 2018 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.39-1
- Update to 5.39
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:5.38-2.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Tue Jan 30 2018 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.38-2
- esper: fix uninitialized variable
* Sat Jan 20 2018 Bj��rn Esser <besser82(a)fedoraproject.org> - 1:5.38-1.1
- Rebuilt for switch to libxcrypt
* Mon Dec 25 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.38-1
- Update to 5.38
* Tue Aug 15 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-6.1
- Actually apply Patch3704
* Mon Aug 7 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-6
- bsod: more stack-use-after-scope fix for utsname
* Wed Aug 2 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-5
- vigilance: fix which camera to pay attention on tick_camera
* Wed Aug 2 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-4
- bsod: fix some stack-use-after-scope issues
* Tue Aug 1 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-3
- store_saver_id: fix stack-use-after-scope
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:5.37-2.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Thu Jul 20 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-2
- Leave autostart stuff installed (at least useful for LXDE),
but not show them by default for all DE
(bug 1266521) for F-27+
* Fri Jul 7 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.37-1
- Update to 5.37
* Fri Feb 10 2017 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.36-4
- Kill gcc -Wall warnings
* Sat Oct 22 2016 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.36-3
- hexstrut: fix one-byte-ahead access for ccolor
* Sun Oct 16 2016 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.36-2
- splodesic: avoid using "depth" name not to make X internal collision
* Fri Oct 14 2016 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.36-1
- Update to 5.36
* Fri Jul 15 2016 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1:5.35-6
- decayscreen_reshape: return immediately when not ready
* Mon Jul 11 2016 Mamoru TASAKA <mtasaka(a)fedoraproject.org>
- Add debugging patch: XIO: print C backtrace on error
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1520012 - xscreensaver timebomb triggered
https://bugzilla.redhat.com/show_bug.cgi?id=1520012
--------------------------------------------------------------------------------