The following Fedora EPEL 7 Security updates need testing: Age URL 412 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d condor-8.6.11-1.el7 187 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-d2c1368294 cinnamon-3.6.7-5.el7 153 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80 python-gnupg-0.4.4-1.el7 151 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b bubblewrap-0.3.3-2.el7 88 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-12067fc897 dosbox-0.74.3-2.el7 13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-330b323bb6 golang-1.13-1.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-209b03a8a4 cryptopp-5.6.5-1.el7 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-7410520bec blis-0.6.0-4.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-81572ab529 chromium-77.0.3865.90-2.el7 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-1c8bc2bf57 mosquitto-1.6.7-1.el7 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-600b4ad49c yara-3.10.0-3.el7 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-8b6b5df244 mbedtls-2.7.12-1.el7

The following builds have been pushed to Fedora EPEL 7 updates-testing

exim-4.92.3-1.el7 php-horde-Horde-Imap-Client-2.30.0-1.el7 php-horde-Horde-Text-Diff-2.2.1-1.el7 prosody-0.11.3-1.el7 relval-2.4.6-1.el7 rust-1.38.0-2.el7

Details about builds:

================================================================================ exim-4.92.3-1.el7 (FEDORA-EPEL-2019-2bdd0ea9d4) The exim mail transfer agent -------------------------------------------------------------------------------- Update Information:

This is an update fixing CVE-2019-16928. -------------------------------------------------------------------------------- ChangeLog:

* Mon Sep 30 2019 Jaroslav ��karvada jskarvad@redhat.com - 4.92.3-1 - New version Resolves: rhbz#1756656 Resolves: CVE-2019-16928 -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1756930 - CVE-2019-16928 exim: remotely triggerable buffer overflow in string_vformat() https://bugzilla.redhat.com/show_bug.cgi?id=1756930 --------------------------------------------------------------------------------

================================================================================ php-horde-Horde-Imap-Client-2.30.0-1.el7 (FEDORA-EPEL-2019-5433fecd92) Horde IMAP abstraction interface -------------------------------------------------------------------------------- Update Information:

**Horde_Imap_Client 2.30.0** * [mjr] Support returning entire thread list (Ticket #14943, mariusz.goch@spacja.com). ---- **Horde_Imap_Client 2.29.18** * [mjr] Fix LIST-STATUS parsing when using wildcards (Bug #14937, mariusz.goch). -------------------------------------------------------------------------------- ChangeLog:

* Mon Sep 30 2019 Remi Collet remi@remirepo.net - 2.30.0-1 - update to 2.30.0 * Mon Sep 16 2019 Remi Collet remi@remirepo.net - 2.29.18-1 - update to 2.29.18 --------------------------------------------------------------------------------

================================================================================ php-horde-Horde-Text-Diff-2.2.1-1.el7 (FEDORA-EPEL-2019-a8cf95e811) Engine for performing and rendering text diffs -------------------------------------------------------------------------------- Update Information:

**Horde_Text_Diff 2.2.1** * [mjr] Fix incorrect class name (PR #2, FGIKCM). -------------------------------------------------------------------------------- ChangeLog:

* Mon Sep 30 2019 Remi Collet remi@remirepo.net - 2.2.1-1 - update to 2.2.1 - use range dependencies --------------------------------------------------------------------------------

================================================================================ prosody-0.11.3-1.el7 (FEDORA-EPEL-2019-19e661f90c) Flexible communications server for Jabber/XMPP -------------------------------------------------------------------------------- Update Information:

Prosody 0.11.3 ============== Important note for those upgrading ================================== Previous releases did not automatically expire messages from group chat (MUC) archives, so if `mod_muc_mam` was loaded and enabled for a MUC, archives would grow indefinitely. This is not what most deployments want, therefore automatic expiry is now implemented and enabled with a default 7 day retention. You can configure this with the muc_log_expires_after configuration option, which can be set to `"never"` to restore the old behaviour and preserve any existing logs older than 7 days. Fixes and improvements ====================== * MUC: Advertise XEP-0410 support * mod_muc_mam: Import cleanup mechanism from mod_mam (fixes #672: mod_muc_mam: Archive expiry) * mod_bosh: Handle missing wait attribute (fixes #1288: BOSH: Traceback on missing ���wait��� attribute) * mod_storage_sql: Handle SQLite DELETE with LIMIT being optional (fixes #1359: Sqlite3 archive_store:delete error in prepared statement) * mod_c2s: Fixed #1313: attempt to call a field ���data��� (a nil value)) * net.server_epoll: Restore wantread flag after pause (fixes #1354: server_epoll: Race in chunked reads) * util.encodings: Allow unassigned code points in ICU mode to match libidn behavior (fixes #1348: Different treatment of unassigned code points between libidn and ICU ) * util.ip: Add missing netmask for 192.168/16 range (fixes #1343) * util.hashes: Use HMAC function provided by OpenSSL (fixes #1345: util.hashes: HMAC-SHA-512 implementation broken) * net.dns: Close resolv.conf handle when done (fixes #1342) * mod_websocket: Clone stanza before mutating (fixes #1398: mod_websocket leaks explicit xmlns attr) * mod_announce: Check for admin on current virtualhost instead of global (fixes #1365: ���host admins��� should be able to use mod_announce as well as ���global admins���) (thanks yc) * mod_blocklist: Trigger resend of presence when unblocking a contact (fixes #1380: Prosody does not send presence when unblocking (XEP-0191)) * mod_vcard_legacy: Multiple improvements (fixes #1289: mod_vcard_legacy upgrade experience): * mod_vcard_legacy: Don���t overwrite existing PEP data * mod_vcard_legacy: Handle partial migration * mod_vcard_legacy: Allow disabling vcard conversion * mod_vcard_legacy: Adapt node defaults to number of avatars * mod_muc_mam: Strip the stanza ���to��� attribute (fixes #1259: [muc_mam] forwarded stanza has a ���to��� attribute while spec says it MUST NOT) * util.pubsub: Validate node configuration on node creation (fixes #1328: Pubsub: Node configuration not validated on node creation) * mod_pep/mod_pubsub: Simplify configuration for storage of node data (fixes #1320) * MUC: Fix delay@from to be room JID (fixes #1416: MUC: Wrong delay@from on historic messages) * mod_mam/mod_muc_mam: Cache last date that archive owner has messages to reduce writes (fixes #1368: Archive cleanup doubles number of storage access) * mod_mam: Perform message expiry based on building an index by date (backport of 39ee70fbb009 from trunk) Minor changes ============= * net.server_epoll: Backport timer optimization from trunk (see #1388) * mod_storage_memory: Replace query function with one based on storage_internal (fixes #1322: mod_storage_memory does not support ���key��� querys) * net.server_epoll: Rename handshake_timeout to ssl_handshake_timeout (fixes #1319: net.server_epoll uses handshake_timeout instead of ssl_handshake_timeout like server_event) * mod_storage_memory: Generate ID using standard util (fixes #1326: mod_storage_memory.lua: attempt to concatenate a nil value) * MUC: Add error message to error bounces when not joined to room * mod_websocket: Log an error if cross_domain_websocket = true is set in a VirtualHost section * mod_presence: Revert empty ���to��� attribute of presence before presence/initial event (fixes #1296: mod_motd does not send MOTD set in configuration on Prosody versions 10.x or 11.x) * mod_pubsub: Support requests for multiple items (fixes #1305: pubsub: MUST allow multiple items to be specified) * net.server_epoll: Use send_timeout for write timout like other implementations (fixes #1316: net.server_epoll uses write_timeout where other implementations use send_timeout) * util.sql: Ignore if tables and indices already exist on creation (fixes #1064: SQL table creation query fails when tables already exist) * net.server_epoll: Skip delayed continuation read on paused connections * net.server_epoll: Handle LuaSec wantread/wantwrite conditions before callbacks (fixes #1333: net.server_epoll handling of ���wantread��� condition unintentionally resumes paused connection) * mod_storage_memory: Implement :user iteration API * util.serialization: Cache default serialization instance (fixes #1389: util.serialization: Creates new serializer instance on each call) * `prosodyctl about` improvements: * Report version of LuaDBI installed * Report configured network backend * util.random: Handle unlikely read errors from `/dev/urandom` (see #1313) * configure: Handle lua being found in `/bin` (workaround for #1353) -------------------------------------------------------------------------------- ChangeLog:

* Mon Sep 30 2019 Robert Scheck robert@fedoraproject.org 0.11.3-1 - Upgrade to 0.11.3 (#1756953) * Fri Jul 26 2019 Fedora Release Engineering releng@fedoraproject.org - 0.11.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sat Feb 2 2019 Fedora Release Engineering releng@fedoraproject.org - 0.11.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1756953 - prosody-0.11.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1756953 --------------------------------------------------------------------------------

================================================================================ relval-2.4.6-1.el7 (FEDORA-EPEL-2019-ecf27b5362) Tool for interacting with Fedora QA wiki pages -------------------------------------------------------------------------------- Update Information:

This update enhances the `size-check` subcommand to be capable of filing bug reports for oversize images, and also updates the set of image sizes checked and the target sizes. It also tweaks the use of wikitcms to avoid deprecation warnings with mwclient 0.10.0 and later. -------------------------------------------------------------------------------- ChangeLog:

* Mon Sep 30 2019 Adam Williamson awilliam@redhat.com - 2.4.6-1 - New release 2.4.6: limit bug alias length, update Cinnamon max size * Thu Sep 19 2019 Adam Williamson awilliam@redhat.com - 2.4.5-1 - New release 2.4.5: correct python-bugzilla requirement * Thu Sep 19 2019 Adam Williamson awilliam@redhat.com - 2.4.4-1 - New release 2.4.4: size-check can now file bugs for oversize images * Thu Sep 12 2019 Adam Williamson awilliam@redhat.com - 2.4.3-1 - New release 2.4.3: avoid deprecation warnings with mwclient 0.10.0+ --------------------------------------------------------------------------------

================================================================================ rust-1.38.0-2.el7 (FEDORA-EPEL-2019-a9134dc0d2) The Rust Programming Language -------------------------------------------------------------------------------- Update Information:

Update to Rust 1.38.0: - Pipelined compilation - Linting some incorrect uses of `mem::{uninitialized, zeroed}` - `#[deprecated]` macros - `std::any::type_name` - Library changes See the [blog post](https://blog.rust- lang.org/2019/09/26/Rust-1.38.0.html) and [release notes](https://github.com/rust- lang/rust/blob/master/RELEASES.md#version-1380-2019-09-26) for more details. -------------------------------------------------------------------------------- ChangeLog:

* Fri Sep 27 2019 Josh Stone jistone@redhat.com - 1.38.0-2 - Filter the libraries included in rust-std (rhbz1756487) * Thu Sep 26 2019 Josh Stone jistone@redhat.com - 1.38.0-1 - Update to 1.38.0. --------------------------------------------------------------------------------