[SECURITY] Fedora EPEL 5 Update: cherokee-1.2.101-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4749
2011-10-24 14:37:41
--------------------------------------------------------------------------------
Name : cherokee
Product : Fedora EPEL 5
Version : 1.2.101
Release : 1.el5
URL : http://www.cherokee-project.com/
Summary : Flexible and Fast Webserver
Description :
Cherokee is a very fast, flexible and easy to configure Web Server. It supports
the widespread technologies nowadays: FastCGI, SCGI, PHP, CGI, TLS and SSL
encrypted connections, Virtual hosts, Authentication, on the fly encoding,
Apache compatible log files, and much more.
--------------------------------------------------------------------------------
Update Information:
Latest 1.2.x upstream release
Resolves bz 746532 - put some deps back: GeoIP-devel openldap-devel
Latest 1.2.x upstream release
.spec corrections for optional build for systemd
Resolves bz 710474
Resolves bz 713307
Resolves bz 680691
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #746532 - Cherokee 1.2.100 RPMs built without LDAP, GeoIP support
https://bugzilla.redhat.com/show_bug.cgi?id=746532
[ 2 ] Bug #710474 - cherokee: A weakness in Cherokee’s administrative interface random administrator password generation [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=710474
[ 3 ] Bug #713307 - CVE-2011-2190 CVE-2011-2191 cherokee: multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=713307
[ 4 ] Bug #680691 - cherokee uses libssl from openssl >1.0, when opensssl <1.0 is current in repository
https://bugzilla.redhat.com/show_bug.cgi?id=680691
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update cherokee' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
[SECURITY] Fedora EPEL 4 Update: phpldapadmin-0.9.8.5-1.el4
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4759
2011-10-27 18:32:21
--------------------------------------------------------------------------------
Name : phpldapadmin
Product : Fedora EPEL 4
Version : 0.9.8.5
Release : 1.el4
URL : http://phpldapadmin.sourceforge.net
Summary : Web-based tool for managing LDAP servers
Description :
PhpLDAPadmin is a web-based LDAP client.
It provides easy, anywhere-accessible, multi-language administration
for your LDAP server. Its hierarchical tree-viewer and advanced search
functionality make it intuitive to browse and administer your LDAP directory.
Since it is a web application, this LDAP browser works on many platforms,
making your LDAP server easily manageable from any location.
PhpLDAPadmin is the perfect LDAP browser for the LDAP professional
and novice alike. Its user base consists mostly of LDAP administration
professionals.
Edit /etc/phpldapadmin/config.php to change default (localhost) LDAP server
location and other things. Edit /etc/httpd/conf.d/phpldapadmin.conf to allow
access by remote web-clients.
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2011-4074 and CVE-2011-4075 (XSS and code injection vulnerabilities in versions <= 1.2.1.1)
Update to version 0.9.8.5
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #748537 - CVE-2011-4074 CVE-2011-4075 phpldapadmin: XSS and code injection vulnerabilities in <= 1.2.1.1
https://bugzilla.redhat.com/show_bug.cgi?id=748537
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update phpldapadmin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
[SECURITY] Fedora EPEL 4 Update: proftpd-1.3.3g-1.el4
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4945
2011-11-10 19:04:20
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora EPEL 4
Version : 1.3.3g
Release : 1.el4
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update, to the current (and final) release for the 1.3.3 maintenance branch, includes a pair of security fixes:
* Enable OpenSSL countermeasure against SSLv3/TLSv1 BEAST attacks (upstream bug 3704); to disable this countermeasure, which may cause interoperability issues with some clients, use the NoEmptyFragments TLSOption
* Response pool use-after-free memory corruption error (upstream bug 3711, #752812, ZDI-CAN-1420), in which a remote attacker could provide a specially-crafted request (resulting in a need for the server to handle an exceptional condition), leading to memory corruption and potentially arbitrary code execution, with the privileges of the user running the proftpd server
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #752812 - CVE-2011-4130 proftpd: Response pool use-after-free flaw (ZDI-CAN-1420)
https://bugzilla.redhat.com/show_bug.cgi?id=752812
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
[SECURITY] Fedora EPEL 5 Update: net6-1.3.14-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4869
2011-11-03 16:53:57
--------------------------------------------------------------------------------
Name : net6
Product : Fedora EPEL 5
Version : 1.3.14
Release : 1.el5
URL : http://releases.0x539.de/net6/
Summary : A TCP protocol abstraction for library C++
Description :
net6 is a library which eases the development of network-based applications
as it provides a TCP protocol abstraction for C++. It is portable to both
the Windows and Unix-like platforms.
--------------------------------------------------------------------------------
Update Information:
http://permalink.gmane.org/gmane.network.obby.announce/50
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #750631 - CVE-2011-4093 net6: integer overflow may lead to connection hijacking
https://bugzilla.redhat.com/show_bug.cgi?id=750631
[ 2 ] Bug #750632 - CVE-2011-4091 net6: user information exposure flaw
https://bugzilla.redhat.com/show_bug.cgi?id=750632
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update net6' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
[SECURITY] Fedora EPEL 4 Update: cherokee-1.2.101-1.el4
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4733
2011-10-24 14:36:42
--------------------------------------------------------------------------------
Name : cherokee
Product : Fedora EPEL 4
Version : 1.2.101
Release : 1.el4
URL : http://www.cherokee-project.com/
Summary : Flexible and Fast Webserver
Description :
Cherokee is a very fast, flexible and easy to configure Web Server. It supports
the widespread technologies nowadays: FastCGI, SCGI, PHP, CGI, TLS and SSL
encrypted connections, Virtual hosts, Authentication, on the fly encoding,
Apache compatible log files, and much more.
--------------------------------------------------------------------------------
Update Information:
Latest 1.2.x upstream release
Resolves bz 746532 - put some deps back: GeoIP-devel openldap-devel
Latest 1.2.x upstream release
.spec corrections for optional build for systemd
Resolves bz 710474
Resolves bz 713307
Resolves bz 680691
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #746532 - Cherokee 1.2.100 RPMs built without LDAP, GeoIP support
https://bugzilla.redhat.com/show_bug.cgi?id=746532
[ 2 ] Bug #710474 - cherokee: A weakness in Cherokee’s administrative interface random administrator password generation [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=710474
[ 3 ] Bug #713307 - CVE-2011-2190 CVE-2011-2191 cherokee: multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=713307
[ 4 ] Bug #680691 - cherokee uses libssl from openssl >1.0, when opensssl <1.0 is current in repository
https://bugzilla.redhat.com/show_bug.cgi?id=680691
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update cherokee' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
Fedora EPEL 6 Update: softhsm-1.3.0-3.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4837
2011-11-01 23:35:07
--------------------------------------------------------------------------------
Name : softhsm
Product : Fedora EPEL 6
Version : 1.3.0
Release : 3.el6
URL : http://www.opendnssec.org/
Summary : Software version of a PKCS#11 Hardware Security Module
Description :
OpenDNSSEC is providing a software implementation of a generic
cryptographic device with a PKCS#11 interface, the SoftHSM. SoftHSM is
designed to meet the requirements of OpenDNSSEC, but can also work together
with other cryptographic products because of the PKCS#11 interface.
--------------------------------------------------------------------------------
Update Information:
Initial package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #711895 - Review Request: softhsm - Software version of a PKCS#11 Hardware Security Module
https://bugzilla.redhat.com/show_bug.cgi?id=711895
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update softhsm' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
Fedora EPEL 6 Update: perl-Catalyst-Runtime-5.80033-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4858
2011-11-02 15:47:35
--------------------------------------------------------------------------------
Name : perl-Catalyst-Runtime
Product : Fedora EPEL 6
Version : 5.80033
Release : 1.el6
URL : http://search.cpan.org/dist/Catalyst-Runtime/
Summary : Catalyst Framework Runtime
Description :
This is the primary class for the Catalyst-Runtime distribution. It provides
the core of any runtime Catalyst instance.
--------------------------------------------------------------------------------
Update Information:
This update fixes numerous bugs. See the upstream [changelog](http://cpansearch.perl.org/src/BOBTFISH/Catalyst-Runtime-5.800... for full details.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update perl-Catalyst-Runtime' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
Fedora EPEL 5 Update: viewvc-1.1.12-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4880
2011-11-04 19:45:20
--------------------------------------------------------------------------------
Name : viewvc
Product : Fedora EPEL 5
Version : 1.1.12
Release : 1.el5
URL : http://www.viewvc.org/
Summary : Browser interface for CVS and SVN version control repositories
Description :
ViewVC is a browser interface for CVS and Subversion version control
repositories. It generates templatized HTML to present navigable directory,
revision, and change log listings. It can display specific versions of files
as well as diffs between those versions. Basically, ViewVC provides the bulk
of the report-like functionality you expect out of your version control tool,
but much more prettily than the average textual command-line program output.
--------------------------------------------------------------------------------
Update Information:
Version 1.1.12 (released 03-Nov-2011)
- fix path display in patch and certain diff views (issue #485)
- fix broken cvsdb glob searching (issue 486)
- allow svn revision specifiers to have leading r's (issue #441, #448)
- allow environmental override of configuration location (issue #494)
- fix exception HTML-escaping non-string data under WSGI (issue #454)
- add links to root logs from roots view (issue #470)
- use Pygments lexer-guessing functionality (issue #495)
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update viewvc' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
Fedora EPEL 6 Update: python-greenlet-0.3.1-6.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4822
2011-11-01 23:34:33
--------------------------------------------------------------------------------
Name : python-greenlet
Product : Fedora EPEL 6
Version : 0.3.1
Release : 6.el6
URL : http://pypi.python.org/pypi/greenlet
Summary : Lightweight in-process concurrent programming
Description :
The greenlet package is a spin-off of Stackless, a version of CPython
that supports micro-threads called "tasklets". Tasklets run
pseudo-concurrently (typically in a single or a few OS-level threads)
and are synchronized with data exchanges on "channels".
--------------------------------------------------------------------------------
Update Information:
This avoids segfaults on i686
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #746771 - openstack-nova components fail with segfault with error 4 and 6 in libc-2.14.90.so
https://bugzilla.redhat.com/show_bug.cgi?id=746771
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-greenlet' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months
Fedora EPEL 6 Update: python-vobject-0.8.1c-5.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-4860
2011-11-02 15:47:52
--------------------------------------------------------------------------------
Name : python-vobject
Product : Fedora EPEL 6
Version : 0.8.1c
Release : 5.el6
URL : http://vobject.skyhouseconsulting.com/
Summary : A python library for manipulating vCard and vCalendar files
Description :
VObject is intended to be a full featured python library for parsing and
generating vCard and vCalendar files.
--------------------------------------------------------------------------------
Update Information:
Add python-setuptools as Requires
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #662845 - python-vobject depends on python-setuptools
https://bugzilla.redhat.com/show_bug.cgi?id=662845
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-vobject' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 6 months