Fedora EPEL 5 Update: drupal6-backup_migrate-2.4-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3156
2011-04-25 18:35:44
--------------------------------------------------------------------------------
Name : drupal6-backup_migrate
Product : Fedora EPEL 5
Version : 2.4
Release : 1.el5
URL : http://drupal.org/project/backup_migrate
Summary : Database backup, restore, and migrate module for Drupal 6
Description :
Backup and Migrate simplifies the task of backing up and restoring
your Drupal database or copying your database from one Drupal site to
another. It supports gzip, bzip and zip compression as well as
automatic scheduled backups.
With Backup and Migrate you can dump some or all of your database
tables to a file download or save to a file on the server, and to
restore from an uploaded or previously saved database dump. You can
chose which tables and what data to backup and cache data is excluded
by default.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update drupal6-backup_migrate' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 5 Update: openvpn-2.1.4-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3154
2011-04-25 18:35:39
--------------------------------------------------------------------------------
Name : openvpn
Product : Fedora EPEL 5
Version : 2.1.4
Release : 1.el5
URL : http://openvpn.net/
Summary : A full-featured SSL VPN solution
Description :
OpenVPN is a robust and highly flexible tunneling application that uses all
of the encryption, authentication, and certification features of the
OpenSSL library to securely tunnel IP networks over a single UDP or TCP
port. It can use the Marcus Franz Xaver Johannes Oberhumer's LZO library
for compression.
--------------------------------------------------------------------------------
Update Information:
This update includes the following upstream fixes and changes:
2010.11.09 -- Version 2.1.4
===========================
* Fix problem with special case route targets ('remote_host'): The init_route() function will leave &netlist untouched for get_special_addr() routes ("remote_host" being one of them). netlist is on stack, contains random garbage, and netlist.len will not be 0 - thus, random stack data is copied from netlist.data[] until the route_list is full. Thanks to Teodo MICU and Gert Doering for finding and fixing this issue.
2010.08.20 -- Version 2.1.3
===========================
* Windows build fixes: Attempt to fix issue where domake-win build system was not properly signing drivers and .exe files. This change is only affecting the Windows build scripts and not the OpenVPN code base.
2010.08.09 -- Version 2.1.2
===========================
* Windows security issue: Fixed potential local privilege escalation vulnerability in Windows service. The Windows service did not properly quote the executable filename passed to CreateService. A local attacker with write access to the root directory C:\ could create an executable that would be run with the same privilege level as the OpenVPN Windows service. However, since non-Administrative users normally lack write permission on C:\, this vulnerability is generally not exploitable except on older versions of Windows (such as Win2K) where the default permissions on C:\ would allow any user to create files there. Credit: Scott Laurie, MWR InfoSecurity
* Added Python-based based alternative build system for Windows using Visual Studio 2008 (in win directory).
* When aborting in a non-graceful way, try to execute do_close_tun in init.c prior to daemon exit to ensure that the tun/tap interface is closed and any added routes are deleted.
* Fixed an issue where AUTH_FAILED was not being properly delivered to the client when a bad password is given for mid-session reauth, causing the connection to fail without an error indication.
* Don't advance to the next connection profile on AUTH_FAILED errors.
* Fixed an issue in the Management Interface that could cause a process hang with 100% CPU utilization in --management-client mode if the management interface client disconnected at the point where credentials are queried.
* Fixed an issue where if reneg-sec was set to 0 on the client, so that the server-side value would take precedence, the auth_deferred_expire_window function would incorrectly return a window period of 0 seconds. In this case, the correct window period should be the handshake window period.
* Modified ">PASSWORD:Verification Failed" management interface notification to include a client reason string: ">PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']"
* Enable exponential backoff in reliability layer retransmits.
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after socket is created rather than waiting until after connect/listen.
* Management interface performance optimizations:
* Added env-filter MI command to perform filtering on env vars passed through as a part of --management-client-auth
* man_write will now try to aggregate output into larger blocks (up to 1024 bytes) for more efficient i/o
* Fixed minor issue in Windows TAP driver DEBUG builds where non-null-terminated unicode strings were being printed incorrectly.
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support was not being compiled in.
* Proxy improvements:
* Improved the ability of http-auth "auto" flag to dynamically detect the auth method required by the proxy.
* Added http-auth "auto-nct" flag to reject weak proxy auth methods.
* Added HTTP proxy digest authentication method.
* Removed extraneous openvpn_sleep calls from proxy.c.
* Implemented http-proxy-override and http-proxy-fallback directives to make it easier for OpenVPN client UIs to start a pre-existing client config file with proxy options, or to adaptively fall back to a proxy connection if a direct connection fails.
* Implemented a key/value auth channel from client to server.
* Fixed issue where bad creds provided by the management interface for HTTP Proxy Basic Authentication would go into an infinite retry-fail loop instead of requerying the management interface for new creds.
* Added support for MSVC debugging of openvpn.exe in settings.in: "# Build debugging version of openvpn.exe", "!define PRODUCT_OPENVPN_DEBUG"
* Implemented multi-address DNS expansion on the network field of route commands: When only a single IP address is desired from a multi-address DNS expansion, use the first address rather than a random selection.
* Added --register-dns option for Windows.
* Fixed some issues on Windows with --log, subprocess creation for command execution, and stdout/stderr redirection.
* Fixed an issue where application payload transmissions on the TLS control channel (such as AUTH_FAILED) that occur during or immediately after a TLS renegotiation might be dropped.
* Added warning about tls-remote option in man page.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update openvpn' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: openvpn-2.1.4-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3155
2011-04-25 18:35:42
--------------------------------------------------------------------------------
Name : openvpn
Product : Fedora EPEL 6
Version : 2.1.4
Release : 1.el6
URL : http://openvpn.net/
Summary : A full-featured SSL VPN solution
Description :
OpenVPN is a robust and highly flexible tunneling application that uses all
of the encryption, authentication, and certification features of the
OpenSSL library to securely tunnel IP networks over a single UDP or TCP
port. It can use the Marcus Franz Xaver Johannes Oberhumer's LZO library
for compression.
--------------------------------------------------------------------------------
Update Information:
This update includes the following upstream fixes and changes:
2010.11.09 -- Version 2.1.4
===========================
* Fix problem with special case route targets ('remote_host'): The init_route() function will leave &netlist untouched for get_special_addr() routes ("remote_host" being one of them). netlist is on stack, contains random garbage, and netlist.len will not be 0 - thus, random stack data is copied from netlist.data[] until the route_list is full. Thanks to Teodo MICU and Gert Doering for finding and fixing this issue.
2010.08.20 -- Version 2.1.3
===========================
* Windows build fixes: Attempt to fix issue where domake-win build system was not properly signing drivers and .exe files. This change is only affecting the Windows build scripts and not the OpenVPN code base.
2010.08.09 -- Version 2.1.2
===========================
* Windows security issue: Fixed potential local privilege escalation vulnerability in Windows service. The Windows service did not properly quote the executable filename passed to CreateService. A local attacker with write access to the root directory C:\ could create an executable that would be run with the same privilege level as the OpenVPN Windows service. However, since non-Administrative users normally lack write permission on C:\, this vulnerability is generally not exploitable except on older versions of Windows (such as Win2K) where the default permissions on C:\ would allow any user to create files there. Credit: Scott Laurie, MWR InfoSecurity
* Added Python-based based alternative build system for Windows using Visual Studio 2008 (in win directory).
* When aborting in a non-graceful way, try to execute do_close_tun in init.c prior to daemon exit to ensure that the tun/tap interface is closed and any added routes are deleted.
* Fixed an issue where AUTH_FAILED was not being properly delivered to the client when a bad password is given for mid-session reauth, causing the connection to fail without an error indication.
* Don't advance to the next connection profile on AUTH_FAILED errors.
* Fixed an issue in the Management Interface that could cause a process hang with 100% CPU utilization in --management-client mode if the management interface client disconnected at the point where credentials are queried.
* Fixed an issue where if reneg-sec was set to 0 on the client, so that the server-side value would take precedence, the auth_deferred_expire_window function would incorrectly return a window period of 0 seconds. In this case, the correct window period should be the handshake window period.
* Modified ">PASSWORD:Verification Failed" management interface notification to include a client reason string: ">PASSWORD:Verification Failed: 'AUTH_TYPE' ['REASON_STRING']"
* Enable exponential backoff in reliability layer retransmits.
* Set socket buffers (SO_SNDBUF and SO_RCVBUF) immediately after socket is created rather than waiting until after connect/listen.
* Management interface performance optimizations:
* Added env-filter MI command to perform filtering on env vars passed through as a part of --management-client-auth
* man_write will now try to aggregate output into larger blocks (up to 1024 bytes) for more efficient i/o
* Fixed minor issue in Windows TAP driver DEBUG builds where non-null-terminated unicode strings were being printed incorrectly.
* Fixed issue on Windows with MSVC compiler, where TCP_NODELAY support was not being compiled in.
* Proxy improvements:
* Improved the ability of http-auth "auto" flag to dynamically detect the auth method required by the proxy.
* Added http-auth "auto-nct" flag to reject weak proxy auth methods.
* Added HTTP proxy digest authentication method.
* Removed extraneous openvpn_sleep calls from proxy.c.
* Implemented http-proxy-override and http-proxy-fallback directives to make it easier for OpenVPN client UIs to start a pre-existing client config file with proxy options, or to adaptively fall back to a proxy connection if a direct connection fails.
* Implemented a key/value auth channel from client to server.
* Fixed issue where bad creds provided by the management interface for HTTP Proxy Basic Authentication would go into an infinite retry-fail loop instead of requerying the management interface for new creds.
* Added support for MSVC debugging of openvpn.exe in settings.in: "# Build debugging version of openvpn.exe", "!define PRODUCT_OPENVPN_DEBUG"
* Implemented multi-address DNS expansion on the network field of route commands: When only a single IP address is desired from a multi-address DNS expansion, use the first address rather than a random selection.
* Added --register-dns option for Windows.
* Fixed some issues on Windows with --log, subprocess creation for command execution, and stdout/stderr redirection.
* Fixed an issue where application payload transmissions on the TLS control channel (such as AUTH_FAILED) that occur during or immediately after a TLS renegotiation might be dropped.
* Added warning about tls-remote option in man page.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update openvpn' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: dvtm-0.5.2-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-2932
2011-03-30 17:04:09
--------------------------------------------------------------------------------
Name : dvtm
Product : Fedora EPEL 6
Version : 0.5.2
Release : 1.el6
URL : http://www.brain-dump.org/projects/dvtm/
Summary : Tiling window management for the console
Description :
dvtm brings the concept of tiling window management, popularized by
X11-window managers like dwm to the console. As a console window
manager it tries to make it easy to work with multiple console based
programs like vim, mutt, cmus or irssi.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update dvtm' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: eventlog-0.2.12-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3151
2011-04-24 21:20:07
--------------------------------------------------------------------------------
Name : eventlog
Product : Fedora EPEL 6
Version : 0.2.12
Release : 1.el6
URL : http://www.balabit.com/products/syslog-ng/
Summary : Syslog-ng v2 support library
Description :
The EventLog library aims to be a replacement of the simple syslog() API
provided on UNIX systems. The major difference between EventLog and syslog
is that EventLog tries to add structure to messages.
EventLog provides an interface to build, format and output an event record.
The exact format and output method can be customized by the administrator
via a configuration file.
This package is the runtime part of the library.
--------------------------------------------------------------------------------
Update Information:
Update to 0.2.12
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update eventlog' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
[SECURITY] Fedora EPEL 5 Update: chm2pdf-0.9.1-5.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3082
2011-04-15 17:09:31
--------------------------------------------------------------------------------
Name : chm2pdf
Product : Fedora EPEL 5
Version : 0.9.1
Release : 5.el5
URL : http://code.google.com/p/chm2pdf/
Summary : A tool to convert CHM files to PDF files
Description :
A simple Python script that converts CHM files into PDF files.
--------------------------------------------------------------------------------
Update Information:
This update fixes security bugs #474455 and #474457. The security issue is about unsafe use of fixed temporary directories by chm2pdf.
This update will break --dontextract option. The option will not be shown in the list of available options.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #474455 - CVE-2008-5298 chm2pdf insecure temporary file use
https://bugzilla.redhat.com/show_bug.cgi?id=474455
[ 2 ] Bug #474457 - CVE-2008-5299 chm2pdf insecure temporary file symlink flaw
https://bugzilla.redhat.com/show_bug.cgi?id=474457
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update chm2pdf' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: vttest-20100830-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-2994
2011-04-06 22:23:02
--------------------------------------------------------------------------------
Name : vttest
Product : Fedora EPEL 6
Version : 20100830
Release : 1.el6
URL : http://invisible-island.net/vttest/vttest.html
Summary : Test the compatibility of so-called "VT100-compatible" terminals
Description :
vttest is a program to test the compatibility (or to demonstrate the
non-compatibility) of so-called "VT100-compatible" terminals.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update vttest' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: python-demjson-1.6-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3136
2011-04-22 17:35:07
--------------------------------------------------------------------------------
Name : python-demjson
Product : Fedora EPEL 6
Version : 1.6
Release : 1.el6
URL : http://deron.meranda.us/python/demjson/
Summary : Python JSON module and lint checker
Description :
This module provides classes and functions for encoding or decoding
data represented in the language-neutral JSON format (which is often
used as a simpler substitute for XML in Ajax web applications). This
implementation tries to be as compliant to the JSON specification (RFC
4627) as possible, while still providing many optional extensions to
allow less restrictive JavaScript syntax. It includes complete
Unicode support, including UTF-32, BOM, and surrogate pair processing.
It can also support JavaScript's NaN and Infinity numeric types as
well as it's 'undefined' type.
It also includes a lint-like JSON syntax validator which tests JSON
text for strict compliance to the standard.
--------------------------------------------------------------------------------
Update Information:
Update to version 1.6, with these improvements and changes:
* Bug fix: The jsonlint tool failed to accept a JSON document from standard input (stdin). Also added a --version and --copyright option support to jsonlint.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-demjson' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 5 Update: clamav-unofficial-sigs-3.7.1-4.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3142
2011-04-23 18:08:29
--------------------------------------------------------------------------------
Name : clamav-unofficial-sigs
Product : Fedora EPEL 5
Version : 3.7.1
Release : 4.el5
URL : http://www.inetmsg.com/pub/
Summary : Scripts to download unoffical clamav signatures
Description :
This package contains scripts and configuration files
that provide the capability to download, test, and
update the 3rd-party signature databases provide by
Sanesecurity, SecuriteInfo, MalwarePatrol, OITC,
INetMsg and ScamNailer.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #683139 - bad packaging
https://bugzilla.redhat.com/show_bug.cgi?id=683139
[ 2 ] Bug #695356 - user clamupdate does not exist
https://bugzilla.redhat.com/show_bug.cgi?id=695356
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update clamav-unofficial-sigs' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months
Fedora EPEL 6 Update: clamav-unofficial-sigs-3.7.1-4.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3143
2011-04-23 18:08:31
--------------------------------------------------------------------------------
Name : clamav-unofficial-sigs
Product : Fedora EPEL 6
Version : 3.7.1
Release : 4.el6
URL : http://www.inetmsg.com/pub/
Summary : Scripts to download unoffical clamav signatures
Description :
This package contains scripts and configuration files
that provide the capability to download, test, and
update the 3rd-party signature databases provide by
Sanesecurity, SecuriteInfo, MalwarePatrol, OITC,
INetMsg and ScamNailer.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #683139 - bad packaging
https://bugzilla.redhat.com/show_bug.cgi?id=683139
[ 2 ] Bug #695356 - user clamupdate does not exist
https://bugzilla.redhat.com/show_bug.cgi?id=695356
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update clamav-unofficial-sigs' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
12 years, 12 months