The following Fedora EPEL 5 Security updates need testing:
Age URL
491
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3....
386
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6608/Django-1.1....
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11174/libzrtpcpp...
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11165/cacti-0.8....
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11144/chrony-1.2...
5
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11276/ssmtp-2.61...
3
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11300/drupal7-th...
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11336/lighttpd-1...
The following builds have been pushed to Fedora EPEL 5 updates-testing
libburn-1.3.2-1.el5
libisoburn-1.3.2-1.el5
libisofs-1.3.2-1.el5
lighttpd-1.4.32-1.el5
mksh-48b-1.el5
Details about builds:
================================================================================
libburn-1.3.2-1.el5 (FEDORA-EPEL-2013-11335)
Library for reading, mastering and writing optical discs
--------------------------------------------------------------------------------
Update Information:
Changes towards previous version 1.3.0
======================================
libburn novelties
-----------------
* Bug fix: The signal handler aborted on SIGCONT, SIGTSTP, SIGTTIN, SIGTTOU
* New API call burn_make_input_sheet_v07t()
* API call burn_session_input_sheet_v07t(): read multiple blocks from same file
* New API calls burn_drive_extract_audio(), burn_drive_extract_audio_track()
* Optional "make doc" now demands doxygen 1.8.4
cdrskin novelties
-----------------
* Bug fix: cdrskin -msinfo on DVD and BD reported old session start = next writable
address. Regression introduced by version 1.2.8 (rev 4956). Also fixed in
libburn-1.3.0.pl01.
* New cdrskin option textfile_to_v07t=
* New cdrskin options cdtext_to_textfile= and cdtext_to_v07t=
* New cdrskin options extract_audio_to= , extract_tracks= , extract_basename= ,
--extract_dap
* New cdrskin option --pacifier_with_newline
* Improved granularity of SCSI log time measurement, now with timestamp
libisofs novelties
------------------
* Bug fix: iso_finish() left an invalid global pointer, which a subsequent call of
iso_init() would try to dereference.
* The sort weight of data files loaded from ISO image is now 2 exp 28 to 1 rather than 2
exp 31 - 1 to - 2 exp 31
libisoburn and xorriso novelties
--------------------------------
* Bug fix: -find -exec "sort_weight" did not mark the image as having pending
changes
* Bug fix: -backslash_codes "with_program_arguments" was interpreted too
late
* Bug fix: Missing or empty parameter with -dus was interpreted as "*" rather
than "."
* Bug fix: readline history was spammed by -msg_op parsing and pipe loops
* New -pacifier behavior code "interval="
* New -as mkisofs options --sort-weight-list and --sort-weight-patterns
* New -format mode "without_spare" (for BD-RE)
* New command -named_pipe_loop
* New command -sh_style_result
* New -msg_op opcodes "parse_silently" and "parse_bulk_silently"
* New command -application_use and new -as mkisofs option --application_use
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 25 2013 Robert Scheck <robert(a)fedoraproject.org> 1.3.2-1
- Update to upstream 1.3.2 (#994916)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #994921 - libisofs-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994921
[ 2 ] Bug #994916 - libburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994916
[ 3 ] Bug #994920 - libisoburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994920
--------------------------------------------------------------------------------
================================================================================
libisoburn-1.3.2-1.el5 (FEDORA-EPEL-2013-11335)
Library to enable creation and expansion of ISO-9660 filesystems
--------------------------------------------------------------------------------
Update Information:
Changes towards previous version 1.3.0
======================================
libburn novelties
-----------------
* Bug fix: The signal handler aborted on SIGCONT, SIGTSTP, SIGTTIN, SIGTTOU
* New API call burn_make_input_sheet_v07t()
* API call burn_session_input_sheet_v07t(): read multiple blocks from same file
* New API calls burn_drive_extract_audio(), burn_drive_extract_audio_track()
* Optional "make doc" now demands doxygen 1.8.4
cdrskin novelties
-----------------
* Bug fix: cdrskin -msinfo on DVD and BD reported old session start = next writable
address. Regression introduced by version 1.2.8 (rev 4956). Also fixed in
libburn-1.3.0.pl01.
* New cdrskin option textfile_to_v07t=
* New cdrskin options cdtext_to_textfile= and cdtext_to_v07t=
* New cdrskin options extract_audio_to= , extract_tracks= , extract_basename= ,
--extract_dap
* New cdrskin option --pacifier_with_newline
* Improved granularity of SCSI log time measurement, now with timestamp
libisofs novelties
------------------
* Bug fix: iso_finish() left an invalid global pointer, which a subsequent call of
iso_init() would try to dereference.
* The sort weight of data files loaded from ISO image is now 2 exp 28 to 1 rather than 2
exp 31 - 1 to - 2 exp 31
libisoburn and xorriso novelties
--------------------------------
* Bug fix: -find -exec "sort_weight" did not mark the image as having pending
changes
* Bug fix: -backslash_codes "with_program_arguments" was interpreted too
late
* Bug fix: Missing or empty parameter with -dus was interpreted as "*" rather
than "."
* Bug fix: readline history was spammed by -msg_op parsing and pipe loops
* New -pacifier behavior code "interval="
* New -as mkisofs options --sort-weight-list and --sort-weight-patterns
* New -format mode "without_spare" (for BD-RE)
* New command -named_pipe_loop
* New command -sh_style_result
* New -msg_op opcodes "parse_silently" and "parse_bulk_silently"
* New command -application_use and new -as mkisofs option --application_use
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 25 2013 Robert Scheck <robert(a)fedoraproject.org> 1.3.2-1
- Upgrade to 1.3.2 (#994920)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #994921 - libisofs-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994921
[ 2 ] Bug #994916 - libburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994916
[ 3 ] Bug #994920 - libisoburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994920
--------------------------------------------------------------------------------
================================================================================
libisofs-1.3.2-1.el5 (FEDORA-EPEL-2013-11335)
Library to create ISO 9660 disk images
--------------------------------------------------------------------------------
Update Information:
Changes towards previous version 1.3.0
======================================
libburn novelties
-----------------
* Bug fix: The signal handler aborted on SIGCONT, SIGTSTP, SIGTTIN, SIGTTOU
* New API call burn_make_input_sheet_v07t()
* API call burn_session_input_sheet_v07t(): read multiple blocks from same file
* New API calls burn_drive_extract_audio(), burn_drive_extract_audio_track()
* Optional "make doc" now demands doxygen 1.8.4
cdrskin novelties
-----------------
* Bug fix: cdrskin -msinfo on DVD and BD reported old session start = next writable
address. Regression introduced by version 1.2.8 (rev 4956). Also fixed in
libburn-1.3.0.pl01.
* New cdrskin option textfile_to_v07t=
* New cdrskin options cdtext_to_textfile= and cdtext_to_v07t=
* New cdrskin options extract_audio_to= , extract_tracks= , extract_basename= ,
--extract_dap
* New cdrskin option --pacifier_with_newline
* Improved granularity of SCSI log time measurement, now with timestamp
libisofs novelties
------------------
* Bug fix: iso_finish() left an invalid global pointer, which a subsequent call of
iso_init() would try to dereference.
* The sort weight of data files loaded from ISO image is now 2 exp 28 to 1 rather than 2
exp 31 - 1 to - 2 exp 31
libisoburn and xorriso novelties
--------------------------------
* Bug fix: -find -exec "sort_weight" did not mark the image as having pending
changes
* Bug fix: -backslash_codes "with_program_arguments" was interpreted too
late
* Bug fix: Missing or empty parameter with -dus was interpreted as "*" rather
than "."
* Bug fix: readline history was spammed by -msg_op parsing and pipe loops
* New -pacifier behavior code "interval="
* New -as mkisofs options --sort-weight-list and --sort-weight-patterns
* New -format mode "without_spare" (for BD-RE)
* New command -named_pipe_loop
* New command -sh_style_result
* New -msg_op opcodes "parse_silently" and "parse_bulk_silently"
* New command -application_use and new -as mkisofs option --application_use
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 25 2013 Robert Scheck <robert(a)fedoraproject.org> 1.3.2-1
- Upgrade to 1.3.2 (#994921)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #994921 - libisofs-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994921
[ 2 ] Bug #994916 - libburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994916
[ 3 ] Bug #994920 - libisoburn-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=994920
--------------------------------------------------------------------------------
================================================================================
lighttpd-1.4.32-1.el5 (FEDORA-EPEL-2013-11336)
Lightning fast webserver with light system requirements
--------------------------------------------------------------------------------
Update Information:
One important denial of service (in 1.4.31) fix: CVE-2012-5533.
A flaw was found in lighttpd version 1.4.31 that could be exploited by a remote user to
cause a denial of service condition in lighttpd. A client could send a malformed
Connection header to lighttpd (such as "Connection: TE,,Keep-Alive"), which
would cause lighttpd to enter an endless loop, detecting an empty token but not
incrementing the current string position, causing it to continually read ',' over
and over.
This flaw was introduced in 1.4.31 [1] when an "invalid read" bug was fixed
[2].
[1]
http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2830/d...
[2]
http://redmine.lighttpd.net/issues/2413
Acknowledgement:
Red Hat would like to thank Stefan Bühler for reporting this issue. Upstream acknowledges
Jesse Sipprell from McClatchy Interactive, Inc. as the original reporter.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 26 2013 Jon Ciesla <limburgher(a)gmail.com> - 1.4.32-1
- Update to 1.4.32, BZ 878915.
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.4.31-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.4.31-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.4.31-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #878915 - CVE-2012-5533 lighttpd: Denial of Service via malformed Connection
headers [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=878915
[ 2 ] Bug #878914 - CVE-2012-5533 lighttpd: Denial of Service via malformed Connection
headers [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=878914
--------------------------------------------------------------------------------
================================================================================
mksh-48b-1.el5 (FEDORA-EPEL-2013-11343)
MirBSD enhanced version of the Korn Shell
--------------------------------------------------------------------------------
Update Information:
R48b is a minor bugfix update:
* [tg] Fix display issue with multi-line prompts and SIGWINCH
R48 is a small but important bugfix update:
* [tg] dot.mkshrc: unbreak hd(1) function in UTF-8 mode
* [Jens Staal, tg] Improve buildability on Plan 9 and support kencc
* [tg] Clean up and improve build process and testsuite
* [Michael Langguth] Add multi-layer ICO file from mksh/Win32
* [tg, Steffen Daode Nurpmeso] Fix interactive shell exiting on ^C or syntax error when
the EXIT pseudo-signal trap was set (to anything)
* [tg, Daode] Display longer command excerpts in job control
* [tg] Rewrite Emacs mode display window sliding calculation code
* [tg] dot.mkshrc: “doch” now keeps standard input
* [tg] Reduce memory usage and improve comments and documentation
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 25 2013 Robert Scheck <robert(a)fedoraproject.org> 48b-1
- Upgrade to 48b
--------------------------------------------------------------------------------