Fedora EPEL 6 Update: rubygem-thin-1.2.8-4.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3403
2011-05-25 15:24:39
--------------------------------------------------------------------------------
Name : rubygem-thin
Product : Fedora EPEL 6
Version : 1.2.8
Release : 4.el6
URL : http://code.macournoyer.com/thin/
Summary : A thin and fast web server
Description :
Thin is a Ruby web server that glues together three of the best Ruby
libraries in web history.
The Mongrel parser, the root of Mongrel speed and security,
Event Machine, a network I/O library with extremely high scalability and
Rack, a minimal interface between webservers and Ruby frameworks.
--------------------------------------------------------------------------------
Update Information:
Fix loading of thin_parser
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update rubygem-thin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
[SECURITY] Fedora EPEL 5 Update: cacti-0.8.7g-1.el5.1
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3423
2011-05-27 14:57:35
--------------------------------------------------------------------------------
Name : cacti
Product : Fedora EPEL 5
Version : 0.8.7g
Release : 1.el5.1
URL : http://www.cacti.net/
Summary : An rrd based graphing tool
Description :
Cacti is a complete frontend to RRDTool. It stores all of the
necessary information to create graphs and populate them with
data in a MySQL database. The frontend is completely PHP
driven. Along with being able to maintain graphs, data
sources, and round robin archives in a database, Cacti also
handles the data gathering. There is SNMP support for those
used to creating traffic graphs with MRTG.
--------------------------------------------------------------------------------
Update Information:
Update EL5 to 0.8.7g. Release notes available at http://cacti.net/release_notes_0_8_7g.php
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #690581 - Security fixes in Cacti v0.8.7g for EPEL4/5
https://bugzilla.redhat.com/show_bug.cgi?id=690581
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update cacti' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
[SECURITY] Fedora EPEL 5 Update: unbound-1.4.4-3.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3415
2011-05-26 15:39:31
--------------------------------------------------------------------------------
Name : unbound
Product : Fedora EPEL 5
Version : 1.4.4
Release : 3.el5
URL : http://www.nlnetlabs.nl/unbound/
Summary : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.
The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.
Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.
--------------------------------------------------------------------------------
Update Information:
Denial of Service fix: CVE-2011-1922.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update unbound' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
Fedora EPEL 6 Update: ATpy-0.9.5.1-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3382
2011-05-25 15:23:50
--------------------------------------------------------------------------------
Name : ATpy
Product : Fedora EPEL 6
Version : 0.9.5.1
Release : 1.el6
URL : http://atpy.github.com/
Summary : Astronomical Tables in Python
Description :
ATpy is a high-level Python package providing a way to manipulate tables of
astronomical data in a uniform way. It provides built-in support for NumPy
recarrays and common astronomical file/database formats (FITS, VO, HDF5,
and ASCII tables) with a very simple API.
--------------------------------------------------------------------------------
Update Information:
Astronomical Tables in Python.
ATpy is a high-level Python package providing a way to manipulate tables of astronomical data in a uniform way. It provides built-in support for NumPy recarrays and common astronomical file/database formats (FITS, VO, HDF5, and ASCII tables) with a very simple API.
New upstream release. Fixes crash if vo package is not present
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update ATpy' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
Fedora EPEL 5 Update: rubygem-thin-1.2.8-2.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3385
2011-05-25 15:23:57
--------------------------------------------------------------------------------
Name : rubygem-thin
Product : Fedora EPEL 5
Version : 1.2.8
Release : 2.el5
URL : http://code.macournoyer.com/thin/
Summary : A thin and fast web server
Description :
Thin is a Ruby web server that glues together three of the best Ruby
libraries in web history.
The Mongrel parser, the root of Mongrel speed and security,
Event Machine, a network I/O library with extremely high scalability and
Rack, a minimal interface between webservers and Ruby frameworks.
--------------------------------------------------------------------------------
Update Information:
Fix loading of thin_parser
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update rubygem-thin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
Fedora EPEL 6 Update: autoconf-archive-2011.04.12-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3414
2011-05-26 15:39:28
--------------------------------------------------------------------------------
Name : autoconf-archive
Product : Fedora EPEL 6
Version : 2011.04.12
Release : 1.el6
URL : http://www.gnu.org/software/autoconf-archive/
Summary : The Autoconf Macro Archive
Description :
The GNU Autoconf Archive is a collection of more than 450 macros for
GNU Autoconf that have been contributed as free software by friendly
supporters of the cause from all over the Internet.
--------------------------------------------------------------------------------
Update Information:
The GNU Autoconf Archive is a collection of more than 450 macros for GNU Autoconf that have been contributed as free software by friendly supporters of the cause from all over the Internet.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #663925 - Review Request: autoconf-archive - The Autoconf Macro Archive
https://bugzilla.redhat.com/show_bug.cgi?id=663925
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update autoconf-archive' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
[SECURITY] Fedora EPEL 6 Update: unbound-1.4.4-3.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3420
2011-05-26 15:39:41
--------------------------------------------------------------------------------
Name : unbound
Product : Fedora EPEL 6
Version : 1.4.4
Release : 3.el6
URL : http://www.nlnetlabs.nl/unbound/
Summary : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.
The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.
Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.
--------------------------------------------------------------------------------
Update Information:
Denial of Service fix: CVE-2011-1922.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update unbound' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
Fedora EPEL 5 Update: drupal6-features-1.0-3.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3364
2011-05-20 17:36:59
--------------------------------------------------------------------------------
Name : drupal6-features
Product : Fedora EPEL 5
Version : 1.0
Release : 3.el5
URL : http://drupal.org/project/features
Summary : Provides feature management for Drupal
Description :
The features module enables the capture
and management of features in Drupal.
A feature is a collection of Drupal entities
which taken together satisfy a certain use-case.
Features provides a UI and API for taking different site building components
from modules with exportables and
bundling them together in a single feature module.
A feature module is like any other Drupal module except
that it declares its components (e.g. views, contexts, CCK fields, etc.)
in its .info file so that it can be checked,
updated, or reverted programmatically.
--------------------------------------------------------------------------------
Update Information:
The features module enables the capture and management of
features in Drupal. A feature is a collection of Drupal entities which taken together satisfy a certain use-case.
The features module enables the capture and management of features in Drupal. A feature is a collection of Drupal entities which taken together satisfy a certain use-case.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #705375 - README.txt should appear in module directory for use in-module
https://bugzilla.redhat.com/show_bug.cgi?id=705375
[ 2 ] Bug #698590 - Review Request: drupal6-features - Provides feature management for Drupal
https://bugzilla.redhat.com/show_bug.cgi?id=698590
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update drupal6-features' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
Fedora EPEL 5 Update: perlbrew-0.22-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3429
2011-05-27 14:57:49
--------------------------------------------------------------------------------
Name : perlbrew
Product : Fedora EPEL 5
Version : 0.22
Release : 1.el5
URL : http://search.cpan.org/dist/App-perlbrew/
Summary : Manage perl installations in your $HOME
Description :
perlbrew is a program to automate the building and installation of perl in
the users HOME. At the moment, it installs everything to ~/perl5/perlbrew,
and requires you to tweak your PATH by including a bashrc/cshrc file it
provides. You then can benefit from not having to run 'sudo' commands to
install cpan modules because those are installed inside your HOME too. It's
almost like an isolated perl environments.
--------------------------------------------------------------------------------
Update Information:
This update includes numerous bugfixes and enhancements.
0.22:
* Fix ccache support on Linux with bash
* `install` command no longer clobbers existing installations
* New commands: uninstall, alias, self-upgrade
* See more detail in http://perlbrew.pl/Release-0.22.html
0.21:
* Let version numbers alone mean installation names. For example, 5.12.3 means perl-5.12.3
* Fixed `perlbrew install <URL>` that might install to a wrong path
* Fixed the --as option
* Improve `perlbrew list` command output
* Improve `perlbrew install` command. Now it takes a local .tar.gz filename
* See more detail in http://perlbrew.pl/Release-0.21.html
0.20:
* stop when user specified an invalid perl version that cannot be found on cpan
* specialized version installation: perlbrew install perl-blead / <URL>
* fix `perlbrew install /path/to/git/src/dir`
* See more detail in http://www.perlbrew.pl/Release-0.20.html
0.19:
* Auto run 'perlbrew init' after an install (or upgrade)
* Symlink dev versions of executables. For example,'perl5.13.11' to 'perl', 'prove5.13.11' to 'prove'
* Automatically apply patches necessary to make older perls build again on modern platforms with the help of Devel::PatchPerl.
* A command `perlbrew available` to list recently available perls to build
0.18:
* Fixed an issue when bash set `noclobber` option, which breaks the creation of ~/.perlbrew/init.
* A simple `perlbrew clean` command to clean build dir
* Delegate `-j` arg value to `make test_harness`
* $HOME is replaced with "~" in many messages
0.17:
* Fix `perlbrew use` to work even if we are switched to a specific version
* Fix `perlbrew env` to use current version, sets PERLBREW_PERL and proper PATH
* Feature: `perlbrew use` shows current version in use
* Feature: `perlbrew switch /path/to/special/perl name-of-special-perl` names for adhoc perl's
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update perlbrew' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years
[SECURITY] Fedora EPEL 5 Update: drupal7-7.2-1.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2011-3418
2011-05-26 15:39:37
--------------------------------------------------------------------------------
Name : drupal7
Product : Fedora EPEL 5
Version : 7.2
Release : 1.el5
URL : http://www.drupal.org
Summary : An open-source content-management platform
Description :
Equipped with a powerful blend of features, Drupal is a Content Management
System written in PHP that can support a variety of websites ranging from
personal weblogs to large community-driven websites. Drupal is highly
configurable, skinnable, and secure.
--------------------------------------------------------------------------------
Update Information:
* Advisory ID: DRUPAL-SA-CORE-2011-001
* Project: Drupal core [1]
* Version: 6.x, 7.x
* Date: 2011-May-25
* Security risk: Critical [2]
* Exploitable from: Remote
* Vulnerability: Access bypass, Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
Multiple vulnerabilities and weaknesses were discovered in Drupal.
.... Reflected cross site scripting vulnerability in error handler
A reflected cross site scripting vulnerability was discovered in Drupal's
error handler. Drupal displays PHP errors in the messages area, and a
specially crafted URL can cause malicious scripts to be injected into the
message. The issue can be mitigated by disabling on-screen error display at
admin/settings/error-reporting. This is the recommended setting for
production sites.
This issue affects Drupal 6.x only.
.... Cross site scripting vulnerability in Color module
When using re-colorable themes, color inputs are not sanitized. Malicious
color values can be used to insert arbitrary CSS and script code. Successful
exploitation requires the "Administer themes" permission.
This issue affects Drupal 6.x and 7.x.
.... Access bypass in File module
When using private files in combination with a node access module, the File
module allows unrestricted access to private files.
This issue affects Drupal 7.x only.
-------- VERSIONS AFFECTED
---------------------------------------------------
* Drupal 7.x before version 7.1.
* Drupal 6.x before version 6.21.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you are running Drupal 7.x then upgrade to Drupal 7.1 [3] or 7.2 [4].
* If you are running Drupal 6.x then upgrade to Drupal 6.21 [5] or 6.22. [6]
The Security Team has released both a pure security update without other bug
fixes and a security update combined with other bug fixes and improvements.
You can choose to either only include the security update for an immediate
fix (which might require less quality assurance and testing) or more fixes
and improvements alongside the security fixes by choosing between Drupal 7.1
[7] and Drupal 7.2 [8] or Drupal 6.21 [9] and Drupal 6.22 [10].
See the release announcement [11] for more information.
See also the Drupal core [12] project page.
-------- REPORTED BY
---------------------------------------------------------
* The reflected cross site scripting vulnerability was reported by Heine
Deelstra [13] (*).
* The Color module cross site scripting vulnerability was reported by Kasper
Lindgaard, Secunia Research.
* The File access bypass was reported by Hubert Lecorche, and Peter Bex
[14].
-------- FIXED BY
------------------------------------------------------------
* The reflected cross site scripting vulnerability was fixed by Alan
Smithee.
* The Color module cross site scripting vulnerability was fixed by Stéphane
Corlosquet [15] (*), Heine Deelstra [16] (*), and Peter Wolanin [17] (*).
* The File access bypass was fixed by Heine Deelstra [18] (*).
(*) Member of the Drupal security team.
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [19].
Learn more about the Drupal Security team and their policies [20], writing
secure code for Drupal [21], and securing your site [22].
[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/1168910
[4] http://drupal.org/node/1168946
[5] http://drupal.org/node/1168908
[6] http://drupal.org/node/1168950
[7] http://drupal.org/node/1168910
[8] http://drupal.org/node/1168946
[9] http://drupal.org/node/1168908
[10] http://drupal.org/node/1168950
[11] http://drupal.org/drupal-7.2
[12] http://drupal.org/project/drupal
[13] http://drupal.org/user/17943
[14] https://drupal.org/user/309898
[15] http://drupal.org/user/52142
[16] http://drupal.org/user/17943
[17] http://drupal.org/user/49851
[18] http://drupal.org/user/17943
[19] http://drupal.org/contact
[20] http://drupal.org/security-team
[21] http://drupal.org/writing-secure-code
[22] http://drupal.org/security/secure-configuration
_______________________________________________
Security-news mailing list
Security-news(a)drupal.org
http://lists.drupal.org/mailman/listinfo/security-news
Require php 5.3.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #704319 - drupal7 should require php53 instead of php (including php sub-packages)
https://bugzilla.redhat.com/show_bug.cgi?id=704319
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update drupal7' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years