Fedora 13 Update: cvs-1.11.23-11.fc13
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0605
2011-01-20 19:26:01
--------------------------------------------------------------------------------
Name : cvs
Product : Fedora 13
Version : 1.11.23
Release : 11.fc13
URL : http://www.cvshome.org/
Summary : A version control system
Description :
CVS (Concurrent Versions System) is a version control system that can
record the history of your files (usually, but not always, source
code). CVS only stores the differences between versions, instead of
every version of every file you have ever created. CVS also keeps a log
of who, when, and why changes occurred.
CVS is very helpful for managing releases and controlling the
concurrent editing of source files among multiple authors. Instead of
providing version control for a collection of files in a single
directory, CVS provides version control for a hierarchical collection
of directories consisting of revision controlled files. These
directories and files can then be combined together to form a software
release.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 20 2011 Petr Pisar <ppisar(a)redhat.com> - 1.11.23-11
- Make cvs.csh valid CSH script (bug #671003)
* Thu Oct 21 2010 Petr Pisar <ppisar(a)redhat.com> - 1.11.23-10
- Fix CVE-2010-3846 (bug #645386)
* Tue Jan 12 2010 Jiri Moskovcak <jmoskovc(a)redhat.com> 1.11.23-9
- spec file fixes based on review
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #671003 - /etc/profile.d/cvs.csh uses non-tcsh syntax
https://bugzilla.redhat.com/show_bug.cgi?id=671003
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update cvs' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
[SECURITY] Fedora 14 Update: proftpd-1.3.3d-1.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0610
2011-01-20 19:26:13
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 14
Version : 1.3.3d
Release : 1.fc14
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This is an update to the current upstream maintenance release, which addresses a security issue that could affect users of the mod_sql module (not enabled by default).
* A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the mod_sql module was enabled. A remote, unauthenticated attacker could use this flaw to cause the proftpd daemon to crash or, potentially, to execute arbitrary code with the privileges of the user running 'proftpd' via a specially-crafted username, provided in the authentication dialog.
The update also fixes a CPU spike when handling .ftpaccess files, and handling of SFTP uploads when compression is used.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 19 2011 Paul Howarth <paul(a)city-fan.org> 1.3.3d-1
- Updated to 1.3.3d
- Fixed sql_prepare_where() buffer overflow (bug 3536, CVE-2010-4652)
- Fixed CPU spike when handling .ftpaccess files
- Fixed handling of SFTP uploads when compression is used
- Add Default-Stop LSB keyword in initscript (for runlevels 0, 1, and 6)
- Fix typos in config file and initscript
* Mon Nov 1 2010 Paul Howarth <paul(a)city-fan.org> 1.3.3c-1
- Update to 1.3.3c (#647965)
- Fixed Telnet IAC stack overflow vulnerability (CVE-2010-4221)
- Fixed directory traversal bug in mod_site_misc (CVE-2010-3867)
- Fixed SQLite authentications using "SQLAuthType Backend"
- New DSO module: mod_geoip
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #670170 - CVE-2010-4652 ProFTPD (mod_sql): Heap-based buffer overflow by processing certain usernames, when mod_sql module enabled
https://bugzilla.redhat.com/show_bug.cgi?id=670170
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 14 Update: rubygem-boxgrinder-build-ebs-delivery-plugin-0.0.4-1.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0553
2011-01-19 20:22:58
--------------------------------------------------------------------------------
Name : rubygem-boxgrinder-build-ebs-delivery-plugin
Product : Fedora 14
Version : 0.0.4
Release : 1.fc14
URL : http://www.jboss.org/boxgrinder
Summary : Elastic Block Storage Delivery Plugin
Description :
BoxGrinder Build Elastic Block Storage Delivery Plugin
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #664113 - Review Request: rubygem-boxgrinder-build-ebs-delivery-plugin - BoxGrinder plugin to deliver appliances as EBS AMIs
https://bugzilla.redhat.com/show_bug.cgi?id=664113
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update rubygem-boxgrinder-build-ebs-delivery-plugin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 14 Update: mrpt-0.9.4-0.1.20110110svn2383.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0331
2011-01-12 05:03:00
--------------------------------------------------------------------------------
Name : mrpt
Product : Fedora 14
Version : 0.9.4
Release : 0.1.20110110svn2383.fc14
URL : http://www.mrpt.org/
Summary : Libraries and programs for mobile robot SLAM and navigation
Description :
The Mobile Robot Programming Toolkit (MRPT) is an extensive, cross-platform,
and open source C++ library aimed to help robotics researchers to design and
implement algorithms in the fields of Simultaneous Localization and Mapping
(SLAM), computer vision, and motion planning (obstacle avoidance).
The libraries include classes for easily managing 3D(6D) geometry,
probability density functions (pdfs) over many predefined variables (points
and poses, landmarks, maps), Bayesian inference (Kalman filters, particle
filters), image processing, path planning and obstacle avoidance, 3D
visualization of all kind of maps (points, occupancy grids, landmarks,...),
etc.
Gathering, manipulating and inspecting very large robotic datasets (Rawlogs)
efficiently is another goal of MRPT, supported by several classes and
applications.
The MRPT is free software and is released under the GPL.
--------------------------------------------------------------------------------
Update Information:
Update from a new upstream version.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 10 2011 - Jose Luis Blanco <joseluisblancoc(a)gmail.com> 0.9.4-0.1.20110110svn2383
- New 0.9.4 svn snapshot, with more secure unit tests for autobuilders.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mrpt' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
[SECURITY] Fedora 13 Update: proftpd-1.3.3d-1.fc13
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0613
2011-01-20 19:26:18
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 13
Version : 1.3.3d
Release : 1.fc13
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This is an update to the current upstream maintenance release, which addresses a security issue that could affect users of the mod_sql module (not enabled by default).
* A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the mod_sql module was enabled. A remote, unauthenticated attacker could use this flaw to cause the proftpd daemon to crash or, potentially, to execute arbitrary code with the privileges of the user running 'proftpd' via a specially-crafted username, provided in the authentication dialog.
The update also fixes a CPU spike when handling .ftpaccess files, and handling of SFTP uploads when compression is used.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 19 2011 Paul Howarth <paul(a)city-fan.org> 1.3.3d-1
- Updated to 1.3.3d
- Fixed sql_prepare_where() buffer overflow (bug 3536, CVE-2010-4652)
- Fixed CPU spike when handling .ftpaccess files
- Fixed handling of SFTP uploads when compression is used
- Add Default-Stop LSB keyword in initscript (for runlevels 0, 1, and 6)
- Fix typos in config file and initscript
* Mon Nov 1 2010 Paul Howarth <paul(a)city-fan.org> 1.3.3c-1
- Update to 1.3.3c (#647965)
- Fixed Telnet IAC stack overflow vulnerability (CVE-2010-4221)
- Fixed directory traversal bug in mod_site_misc (CVE-2010-3867)
- Fixed SQLite authentications using "SQLAuthType Backend"
- New DSO module: mod_geoip
* Fri Sep 10 2010 Paul Howarth <paul(a)city-fan.org> 1.3.3b-1
- Update to 1.3.3b
- Fixed SFTP directory listing bug
- Avoid corrupting utmpx databases on FreeBSD
- Avoid null pointer dereferences during data transfers
- Fixed "AuthAliasOnly on" anonymous login
* Fri Jul 2 2010 Paul Howarth <paul(a)city-fan.org> 1.3.3a-1
- Update to 1.3.3a
- Added Japanese translation
- Many mod_sftp bugfixes
- Fixed SSL_shutdown() errors caused by OpenSSL 0.9.8m and later
- Fixed handling of utmp/utmpx format changes on FreeBSD
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #670170 - CVE-2010-4652 ProFTPD (mod_sql): Heap-based buffer overflow by processing certain usernames, when mod_sql module enabled
https://bugzilla.redhat.com/show_bug.cgi?id=670170
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 14 Update: cvs-1.11.23-12.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0599
2011-01-20 19:25:47
--------------------------------------------------------------------------------
Name : cvs
Product : Fedora 14
Version : 1.11.23
Release : 12.fc14
URL : http://www.cvshome.org/
Summary : A version control system
Description :
CVS (Concurrent Versions System) is a version control system that can
record the history of your files (usually, but not always, source
code). CVS only stores the differences between versions, instead of
every version of every file you have ever created. CVS also keeps a log
of who, when, and why changes occurred.
CVS is very helpful for managing releases and controlling the
concurrent editing of source files among multiple authors. Instead of
providing version control for a collection of files in a single
directory, CVS provides version control for a hierarchical collection
of directories consisting of revision controlled files. These
directories and files can then be combined together to form a software
release.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 20 2011 Petr Pisar <ppisar(a)redhat.com> - 1.11.23-12
- Make cvs.csh valid CSH script (bug #671003)
* Thu Oct 21 2010 Petr Pisar <ppisar(a)redhat.com> - 1.11.23-11
- Fix CVE-2010-3846 (bug #645386)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #671003 - /etc/profile.d/cvs.csh uses non-tcsh syntax
https://bugzilla.redhat.com/show_bug.cgi?id=671003
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update cvs' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 14 Update: bdii-5.1.13-1.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0059
2011-01-03 19:38:57
--------------------------------------------------------------------------------
Name : bdii
Product : Fedora 14
Version : 5.1.13
Release : 1.fc14
URL : https://twiki.cern.ch/twiki/bin/view/EGEE/BDII
Summary : The Berkeley Database Information Index (BDII)
Description :
The Berkeley Database Information Index (BDII) consists of a standard
LDAP database which is updated by an external process. The update process
obtains LDIF from a number of sources and merges them. It then compares
this to the contents of the database and creates an LDIF file of the
differences. This is then used to update the database.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jan 1 2011 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 5.1.13-1
- New upstream version 5.1.13
- Move restorecon from post sctiptlet to startup script in order to support
/var/run on tmpfs
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #656549 - Please Update Spec File to use %ghost on files in /var/run and /var/lock
https://bugzilla.redhat.com/show_bug.cgi?id=656549
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update bdii' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 13 Update: perl-IO-Socket-SSL-1.38-1.fc13
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0614
2011-01-20 19:26:20
--------------------------------------------------------------------------------
Name : perl-IO-Socket-SSL
Product : Fedora 13
Version : 1.38
Release : 1.fc13
URL : http://search.cpan.org/dist/IO-Socket-SSL/
Summary : Perl library for transparent SSL
Description :
This module is a true drop-in replacement for IO::Socket::INET that
uses SSL to encrypt data before it is transferred to a remote server
or client. IO::Socket::SSL supports all the extra features that one
needs to write a full-featured SSL client or server application:
multiple SSL contexts, cipher selection, certificate verification, and
SSL version selection. As an extra bonus, it works perfectly with
mod_perl.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream release, fixes CPAN RT#64864, where the wildcards_in_cn setting for the HTTP protocol was wrongly set in the previous version to "1" instead of "anywhere".
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 18 2011 Paul Howarth <paul(a)city-fan.org> - 1.38-1
- Update to 1.38
- fixed wildcards_in_cn setting for http, wrongly set in 1.34 to 1 instead of
anywhere (CPAN RT#64864)
* Fri Dec 10 2010 Paul Howarth <paul(a)city-fan.org> - 1.37-1
- Update to 1.37
- don't complain about invalid certificate locations if user explicitly set
SSL_ca_path and SSL_ca_file to undef: assume that user knows what they are
doing and will work around the problems themselves (CPAN RT#63741)
* Thu Dec 9 2010 Paul Howarth <paul(a)city-fan.org> - 1.36-1
- Update to 1.36
- update documentation for SSL_verify_callback based on CPAN RT#63743 and
CPAN RT#63740
* Mon Dec 6 2010 Paul Howarth <paul(a)city-fan.org> - 1.35-1
- Update to 1.35 (addresses CVE-2010-4334)
- if verify_mode is not VERIFY_NONE and the ca_file/ca_path cannot be
verified as valid, it will no longer fall back to VERIFY_NONE but throw an
error (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058)
* Tue Nov 2 2010 Paul Howarth <paul(a)city-fan.org> - 1.34-1
- Update to 1.34
- schema http for certificate verification changed to wildcards_in_cn=1
- if upgrading socket from inet to ssl fails due to handshake problems, the
socket gets downgraded back again but is still open (CPAN RT#61466)
- deprecate kill_socket: just use close()
* Sun May 2 2010 Marcela Maslanova <mmaslano(a)redhat.com> - 1.33-2
- Mass rebuild with perl-5.12.0
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update perl-IO-Socket-SSL' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 13 Update: rubygem-hashery-1.4.0-2.fc13
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0630
2011-01-20 19:26:48
--------------------------------------------------------------------------------
Name : rubygem-hashery
Product : Fedora 13
Version : 1.4.0
Release : 2.fc13
URL : http://rubyworks.github.com/hashery
Summary : Facets bread collection of Hash-like classes
Description :
The Hashery is a collection of Hash-like classes, spun-off from the original
Ruby Facets library. Included are the widely used OrderedHash, the related but
more featured Dictionary class, a number of open classes, similiar to the
standard OpenStruct and a few variations on the standard Hash.
--------------------------------------------------------------------------------
Update Information:
Updated to new upstream release: 1.4.0
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update rubygem-hashery' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months
Fedora 14 Update: perl-IO-Socket-SSL-1.38-1.fc14
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0612
2011-01-20 19:26:17
--------------------------------------------------------------------------------
Name : perl-IO-Socket-SSL
Product : Fedora 14
Version : 1.38
Release : 1.fc14
URL : http://search.cpan.org/dist/IO-Socket-SSL/
Summary : Perl library for transparent SSL
Description :
This module is a true drop-in replacement for IO::Socket::INET that
uses SSL to encrypt data before it is transferred to a remote server
or client. IO::Socket::SSL supports all the extra features that one
needs to write a full-featured SSL client or server application:
multiple SSL contexts, cipher selection, certificate verification, and
SSL version selection. As an extra bonus, it works perfectly with
mod_perl.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream release, fixes CPAN RT#64864, where the wildcards_in_cn setting for the HTTP protocol was wrongly set in the previous version to "1" instead of "anywhere".
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 18 2011 Paul Howarth <paul(a)city-fan.org> - 1.38-1
- Update to 1.38
- fixed wildcards_in_cn setting for http, wrongly set in 1.34 to 1 instead of
anywhere (CPAN RT#64864)
* Fri Dec 10 2010 Paul Howarth <paul(a)city-fan.org> - 1.37-1
- Update to 1.37
- don't complain about invalid certificate locations if user explicitly set
SSL_ca_path and SSL_ca_file to undef: assume that user knows what they are
doing and will work around the problems themselves (CPAN RT#63741)
* Thu Dec 9 2010 Paul Howarth <paul(a)city-fan.org> - 1.36-1
- Update to 1.36
- update documentation for SSL_verify_callback based on CPAN RT#63743 and
CPAN RT#63740
* Mon Dec 6 2010 Paul Howarth <paul(a)city-fan.org> - 1.35-1
- Update to 1.35 (addresses CVE-2010-4334)
- if verify_mode is not VERIFY_NONE and the ca_file/ca_path cannot be
verified as valid, it will no longer fall back to VERIFY_NONE but throw an
error (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058)
* Tue Nov 2 2010 Paul Howarth <paul(a)city-fan.org> - 1.34-1
- Update to 1.34
- schema http for certificate verification changed to wildcards_in_cn=1
- if upgrading socket from inet to ssl fails due to handshake problems, the
socket gets downgraded back again but is still open (CPAN RT#61466)
- deprecate kill_socket: just use close()
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update perl-IO-Socket-SSL' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
13 years, 3 months