The following Fedora EPEL 4 Security updates need testing:
https://admin.fedoraproject.org/updates/xml-security-c-1.5.1-3.el4
The following builds have been pushed to Fedora EPEL 4 updates-testing
drbdlinks-1.19-2.el4
duplicity-0.6.14-1.el4
xml-security-c-1.5.1-3.el4
Details about builds:
================================================================================
drbdlinks-1.19-2.el4 (FEDORA-EPEL-2011-3871)
A program for managing links into a DRBD shared partition
--------------------------------------------------------------------------------
Update Information:
- Handle visible SELinux range label if mcstrans is not used
- Added configuration file for tmpfiles handling (#656578)
- Added logrotate configuration to ignore possible *.drbdlinks
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 17 2011 Robert Scheck <robert(a)fedoraproject.org> 1.19-2
- Handle visible SELinux range label if mcstrans is not used
- Added configuration file for tmpfiles handling (#656578)
- Added logrotate configuration to ignore possible *.drbdlinks
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #656578 - Please Update Spec File to use %ghost on files in /var/run and
/var/lock
https://bugzilla.redhat.com/show_bug.cgi?id=656578
--------------------------------------------------------------------------------
================================================================================
duplicity-0.6.14-1.el4 (FEDORA-EPEL-2011-3864)
Encrypted bandwidth-efficient backup using rsync algorithm
--------------------------------------------------------------------------------
Update Information:
New in v0.6.14 (2011/06/18)
----------------------------
Enhancements:
* Provide Ubuntu One integration
Bugs closed in this release:
* AttributeError: FileobjHooked instance has no attribute 'name'
* Restore fails with "Invalid data - SHA1 hash mismatch"
* Cygwin: Full Backup fails with "IOError: [Errno 13] Permission denied"
* --exclude-filelist-stdin and gpg error with/without PASSPHRASE
* Endless retype passphrase when typo
* "include-filelist-stdin" not implemented on version 0.6.11
* [PATCH] Local backend should always try renaming instead of copying
* cannot import name S3ResponseError
* Difference found: File X has permissions 666, expected 666
* collection-status asking for passphrase
* ncftpls file delete fails in ftpbackend.py
* create tomporary files with sftp
* duplicity sftp backend should ignore removing a file which is not there
* Webdav(s) url scheme lacks port support
* create tomporary files with sftp
* sftp backend cannot create new subdirs on new backup
* Timeout on sftp command 'ls -1'
* Duplicity ignores some FatalErrors
* Allow to pass different passwords for --sign-key and --encrypt-key
New in v0.6.13 (2011/04/02)
----------------------------
Enhancements added this release:
* New manual test to make Ctrl-C issues easier to replicate.
* Use python-virtualenv to make testing multiple Python versions easier.
* In boto backend check for existing bucket before trying to create.
Bugs closed in this release:
* Assertion error "time not moving forward at appropriate pace"
* silent data corruption with checkpoint/restore
* File "/usr/bin/duplicity", error after upgrade from 6.11 to 6.12
New in v0.6.12 (2011/03/08)
----------------------------
Enhancements added this release:
* ftps support using lftp (ftpsbackend)
Bugs closed in this release:
* Only full backups done on webdav
* Use log codes for common backend errors
* Inverted "Current directory" "Previous directory" in error
message
* OSError: [Errno 2] No such file or directory
* sslerror: The read operation timed out with cf
* boto backend uses Python 2.5 conditional
* symbolic link ownership not preserved
* Cygwin: TypeError: basis_file must be a (true) file ...
* Duplicity 0.6.11 aborts if RSYNC_RSH not set
* Backup fails silently when target is full (sftp, verbosity=4)
* Exception in log module
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 17 2011 Robert Scheck <robert(a)fedoraproject.org> 0.6.14-1
- Upgrade to 0.6.14 (#720589, #697222)
- Backported optparse 1.5a2 from RHEL 5 for RHEL 4 (#717133)
* Tue Feb 8 2011 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.6.11-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #720589 - duplicity 0.6.13 out
https://bugzilla.redhat.com/show_bug.cgi?id=720589
[ 2 ] Bug #697222 - Duplicity with rsync fails if RSYNC_RSH is not set
https://bugzilla.redhat.com/show_bug.cgi?id=697222
[ 3 ] Bug #717133 - Duplicity on EL4 (From epel) doesn't even work
https://bugzilla.redhat.com/show_bug.cgi?id=717133
--------------------------------------------------------------------------------
================================================================================
xml-security-c-1.5.1-3.el4 (FEDORA-EPEL-2011-3857)
C++ Implementation of W3C security standards for XML
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2011-2516: Apache Santuario XML Security for C++
contains buffer overflows signing or verifying with large keys.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #719698 - CVE-2011-2516 xml-security-c: Stack-based buffer overflows when
creating or verifying XML Signatures with RSA keys of sizes >= 8192 bits
https://bugzilla.redhat.com/show_bug.cgi?id=719698
--------------------------------------------------------------------------------