The following Fedora EPEL 7 Security updates need testing:
Age URL
389
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087
dokuwiki-0-0.24.20140929c.el7
151
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f
mcollective-2.8.4-1.el7
18
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-785fc9a2ea
dropbear-2016.72-1.el7
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-961ab9f259
seamonkey-2.40-1.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-6f910ca40d
MUMPS-5.0.1-18.el7
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-9129aa0c6f
python-rsa-3.4.1-1.el7
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-41437a502e
libmaxminddb-1.2.0-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-8f8696393e
latex2rtf-2.3.10-1.el7
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-e710acc2b4
fuse-encfs-1.8.1-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
fuse-encfs-1.8.1-1.el7
krop-0.4.8-1.el7
latex2rtf-2.3.10-1.el7
libbson-1.3.5-1.el7
openscap-daemon-0.1.4-1.el7
php-composer-semver-1.4.0-1.el7
php-doctrine-doctrine-cache-bundle-1.3.0-1.el7
trustedqsl-2.2.1-1.el7
Details about builds:
================================================================================
fuse-encfs-1.8.1-1.el7 (FEDORA-EPEL-2016-e710acc2b4)
Encrypted pass-thru filesystem in userspace
--------------------------------------------------------------------------------
Update Information:
Update to 1.8.1.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1119122 - fuse-encfs is missing from EPEL 7
https://bugzilla.redhat.com/show_bug.cgi?id=1119122
[ 2 ] Bug #1097540 - fuse-encfs: multiple cryptography issues [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1097540
[ 3 ] Bug #906390 - Man page does not mention ENCFS6_CONFIG variable name.
https://bugzilla.redhat.com/show_bug.cgi?id=906390
[ 4 ] Bug #1307518 - fuse-encfs: FTBFS in rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1307518
[ 5 ] Bug #1234255 - New version available - 1.8.1
https://bugzilla.redhat.com/show_bug.cgi?id=1234255
--------------------------------------------------------------------------------
================================================================================
krop-0.4.8-1.el7 (FEDORA-EPEL-2016-f8be77734f)
Tool to crop PDF files with an eye towards eReaders
--------------------------------------------------------------------------------
Update Information:
initial package, version 0.4.8
--------------------------------------------------------------------------------
================================================================================
latex2rtf-2.3.10-1.el7 (FEDORA-EPEL-2016-8f8696393e)
LaTeX to RTF converter that handles equations, figures, and cross-references
--------------------------------------------------------------------------------
Update Information:
Update to 2.3.10 for CVE-2015-8106
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1282492 - CVE-2015-8106 latex2rtf: Format string vulnerability in
CmdKeywords
https://bugzilla.redhat.com/show_bug.cgi?id=1282492
--------------------------------------------------------------------------------
================================================================================
libbson-1.3.5-1.el7 (FEDORA-EPEL-2016-ee0053ba0c)
Building, parsing, and iterating BSON documents
--------------------------------------------------------------------------------
Update Information:
There are no changes in the code. We deliver this release only because of the
new version string.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1322634 - libbson-1.3.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1322634
--------------------------------------------------------------------------------
================================================================================
openscap-daemon-0.1.4-1.el7 (FEDORA-EPEL-2016-b1a9816d56)
Manages continuous SCAP scans of your infrastructure
--------------------------------------------------------------------------------
Update Information:
upgrade to the latest upstream release
--------------------------------------------------------------------------------
================================================================================
php-composer-semver-1.4.0-1.el7 (FEDORA-EPEL-2016-10800026f4)
Semver library that offers utilities, version constraint parsing and validation
--------------------------------------------------------------------------------
Update Information:
**Version 1.4.0** * Added: getters on MultiConstraint
--------------------------------------------------------------------------------
================================================================================
php-doctrine-doctrine-cache-bundle-1.3.0-1.el7 (FEDORA-EPEL-2016-2a482d28b1)
Symfony2 Bundle for Doctrine Cache
--------------------------------------------------------------------------------
Update Information:
### 1.3.0 * Added apcu driver * Added predis driver * Fixed mangling issue with
memcache driver * Reorganized documentation * Added persistent id to memcache
driver ### 1.2.2 * Made Symfony Security ACL an optional dependency ### 1.2.1
* Relaxed Symfony requirements allowing old installs ### 1.2.0 * Fixes
[#47](https://github.com/doctrine/DoctrineCacheBundle/pull/47)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1279828 - php-doctrine-doctrine-cache-bundle-1.3.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1279828
--------------------------------------------------------------------------------
================================================================================
trustedqsl-2.2.1-1.el7 (FEDORA-EPEL-2016-6e0cdac6d2)
TrustedQSL ham-radio applications
--------------------------------------------------------------------------------
Update Information:
TQSL changes Defects Corrected: When installing a .TQ6 file succeeded, TQSL
would delete any other certificate files for that callsign, under the assumption
that they were no longer needed. If an operator with a pending callsign
certificate request would then install a TQ6 file for their former callsign
certificate (one that was being renewed), the private key for the pending
renewal could be deleted. This would cause the subsequent TQ6 file to fail to
install. TQSL no longer deletes anything unless it can verfify on-line with LoTW
that the installed certificate is the current one. When uploading logs, TQSL
would always display the progress bar. This should not have been done when
signing via the command line when batch mode (-x or -q) was enabled. TQSL 2.2.1
no longer displays the progress bar for these operations. When using the
language selection dialog, TQSL could cause the main window to close and re-
appear on a different area of the screen. The window location is now preserved
when the language is changed. In addition, TQSL doesn't destroy and re-create
the main window when the language is not changed. Updating the LoTW
configuration file could fail if the user's home directory contained non-ASCII
characters (Windows only). TQSL now handles this properly for such users. TQSL
now ensures that the password prompt window appears on top of other windows when
a password is requested while signing a log. This will cause the main TQSL
window to appear along with the password prompt. No change will be seen if there
is no password set on the associated callsign certificate. TQSL would reject
Cabrillo "Light" mode QSOs (300 GHz) as having an invalid frequency. TQSL now
accepts these as valid. TQSL could misinterpret unrecognized ADIF MODE/SUBMODE
entries in an ADIF file by not using the user���s ADIF mode settings. TQSL now
will use the mode maps when a mode/submode is not recognized. There was a
defect on OSX that would cause an incorrect error message to be displayed when
an incorrect password was entered for a callsign certificate. TQSL now displays
an appropriate error message in this circumstance. Restoring an incorrect .TQ6
file when there was a pending callsign certificate request could cause the
pending request to be deleted. TQSL now rejects the invalid TQ6 file and takes
no other action. Major feature Additions: The callsign certificate properties
displays now include "Replaced" and "Expired" indicators. TQSL now
attempts to
cleanly close out the duplicates database when the window is closed while a
signing operation is underway. TQSL now allows an alternate layout for the user
interface that moves the status log to a separate tab. This is useful for users
with long lists of station locations or callsign certificates. The TQSL
duplicate QSO tracking was updated to allow reporting of station location
changes when the same QSO is signed from more than one station location. This
makes it less likely that an operator will mistakenly re-upload an already QSLd
contact with incorrect station location information. The TQSL ADIF editor was
updated to automatically select the appropriate band when a frequency is
entered.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1304113 - trustedqsl-2.2.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1304113
--------------------------------------------------------------------------------