[SECURITY] Fedora 19 Update: openjpeg-1.5.1-13.fc19
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17053
2014-12-16 21:10:52
--------------------------------------------------------------------------------
Name : openjpeg
Product : Fedora 19
Version : 1.5.1
Release : 13.fc19
URL : http://code.google.com/p/openjpeg/
Summary : JPEG 2000 command line tools
Description :
OpenJPEG is an open-source JPEG 2000 codec written in C. It has been
developed in order to promote the use of JPEG 2000, the new still-image
compression standard from the Joint Photographic Experts Group (JPEG).
--------------------------------------------------------------------------------
Update Information:
Better fix for CVE-2013-6045, that doesn't cause regressions. Backporting from f20/f21.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 8 2014 Jaromir Capik <jcapik(a)redhat.com> - 1.5.1-13
- Reworked fix for CVE-2013-6045 (#1093379)
- Offset check (1.5.2 -> 1.5.1 backport)
* Thu Sep 4 2014 Petr Hracek <phracek(a)redhat.com> - 1.5.1-12
- OpenJPEG does not provide some binaries (#1138141)
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.5.1-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.5.1-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Apr 17 2014 Jaromir Capik <jcapik(a)redhat.com> - 1.5.1-9
- Minor spec file changes according to the latest guidelines
- Fixing source URL
* Sat Jan 11 2014 Rex Dieter <rdieter(a)fedoraproject.org> 1.5.1-8
- revert CVE-2013-6045 patch due to regression (#1047494)
* Tue Jan 7 2014 Rex Dieter <rdieter(a)fedoraproject.org> 1.5.1-7
- plethora of security updates (#1038409)
- CVE-2013-6052 (#1036491)
- CVE-2013-6053 (#1036493)
- CVE-2013-6045 (#1036495)
- CVE-2013-1447 (#1037945)
- CVE-2013-6887 (#1037948)
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.5.1-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1038409 - CVE-2013-6887 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052 CVE-2013-6053 openjpeg: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1038409
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update openjpeg' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
Fedora 21 Update: golang-github-ghodss-yaml-0-0.2.git4fb5c72.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17604
2014-12-25 04:36:23
--------------------------------------------------------------------------------
Name : golang-github-ghodss-yaml
Product : Fedora 21
Version : 0
Release : 0.2.git4fb5c72.fc21
URL : https://github.com/ghodss/yaml
Summary : A better way to marshal and unmarshal YAML in Golang
Description :
A better way to marshal and unmarshal YAML in Golang
--------------------------------------------------------------------------------
Update Information:
Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1172603 - Review Request: golang-github-ghodss-yaml - A better way to marshal and unmarshal YAML in Golang
https://bugzilla.redhat.com/show_bug.cgi?id=1172603
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update golang-github-ghodss-yaml' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
Fedora 19 Update: perl-IPC-Run-0.93-1.fc19
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-16934
2014-12-13 08:39:19
--------------------------------------------------------------------------------
Name : perl-IPC-Run
Product : Fedora 19
Version : 0.93
Release : 1.fc19
URL : http://search.cpan.org/dist/IPC-Run/
Summary : Perl module for interacting with child processes
Description :
IPC::Run allows you run and interact with child processes using files,
pipes, and pseudo-ttys. Both system()-style and scripted usages are
supported and may be mixed. Likewise, functional and OO API styles are
both supported and may be mixed.
Various redirection operators reminiscent of those seen on common Unix
and DOS command lines are provided.
--------------------------------------------------------------------------------
Update Information:
This release fixes handling paths with spaces and internal tests.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 11 2014 Petr Pisar <ppisar(a)redhat.com> - 0.93-1
- 0.93 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1173061 - perl-IPC-Run-0.93 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1173061
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update perl-IPC-Run' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
Fedora 20 Update: nodejs-end-of-stream-1.1.0-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17589
2014-12-25 04:35:48
--------------------------------------------------------------------------------
Name : nodejs-end-of-stream
Product : Fedora 20
Version : 1.1.0
Release : 1.fc20
URL : https://github.com/mafintosh/end-of-stream
Summary : Call a callback when a readable/writable/duplex stream has completed or failed
Description :
Call a callback when a readable/writable/duplex stream has completed or failed.
--------------------------------------------------------------------------------
Update Information:
Initial packaging
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1176809 - Review Request: nodejs-end-of-stream - Call a callback when a readable/writable/duplex stream has completed or failed
https://bugzilla.redhat.com/show_bug.cgi?id=1176809
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update nodejs-end-of-stream' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
[SECURITY] Fedora 21 Update: mingw-binutils-2.25-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17586
2014-12-25 04:35:41
--------------------------------------------------------------------------------
Name : mingw-binutils
Product : Fedora 21
Version : 2.25
Release : 1.fc21
URL : http://www.gnu.org/software/binutils/
Summary : Cross-compiled version of binutils for Win32 and Win64 environments
Description :
Cross compiled binutils (utilities like 'strip', 'as', 'ld') which
understand Windows executables and DLLs.
--------------------------------------------------------------------------------
Update Information:
Fix various CVE's
--------------------------------------------------------------------------------
ChangeLog:
* Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 2.25-1
- Update to 2.25
* Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 2.24-5
- Fix CVE-2014-8501 (RHBZ #1162578 #1162583)
- Fix CVE-2014-8502 (RHBZ #1162602)
- Fix CVE-2014-8503 (RHBZ #1162612)
- Fix CVE-2014-8504 (RHBZ #1162626)
- Fix CVE-2014-8737 (RHBZ #1162660)
- Fix CVE-2014-8738 (RHBZ #1162673)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1162578 - CVE-2014-8501 mingw-binutils: binutils: out-of-bounds write when parsing specially crafted PE executable [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162578
[ 2 ] Bug #1162602 - CVE-2014-8502 mingw-binutils: binutils: heap overflow in objdump [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162602
[ 3 ] Bug #1162612 - CVE-2014-8503 mingw-binutils: binutils: stack overflow in objdump when parsing specially crafted ihex file [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162612
[ 4 ] Bug #1162626 - CVE-2014-8504 mingw-binutils: binutils: stack overflow in the SREC parser [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162626
[ 5 ] Bug #1162660 - mingw-binutils: binutils: directory traversal vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162660
[ 6 ] Bug #1162673 - mingw-binutils: binutils: out of bounds memory write [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162673
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mingw-binutils' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
[SECURITY] Fedora 21 Update: mingw-openssl-1.0.1j-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17576
2014-12-25 04:35:15
--------------------------------------------------------------------------------
Name : mingw-openssl
Product : Fedora 21
Version : 1.0.1j
Release : 1.fc21
URL : http://www.openssl.org/
Summary : MinGW port of the OpenSSL toolkit
Description :
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.
This package contains Windows (MinGW) libraries and development tools.
--------------------------------------------------------------------------------
Update Information:
* Synced with native openssl-1.0.1j-3.fc22\r\n* Add support for RFC 5649\r\n* Prevent compiler warning "Please include winsock2.h before windows.h" when using the OpenSSL headers\r\n* Fixes various CVE's
--------------------------------------------------------------------------------
ChangeLog:
* Mon Dec 22 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 1.0.1j-1
- Synced with native openssl-1.0.1j-3.fc22
- Add support for RFC 5649
- Prevent compiler warning "Please include winsock2.h before windows.h"
when using the OpenSSL headers
- Fixes various CVE's (RHBZ #1127889 #1127709 #1152851)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1152851 - CVE-2014-3566 mingw-openssl: openssl: Padding Oracle On Downgraded Legacy Encryption attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1152851
[ 2 ] Bug #1127705 - CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3511 CVE-2014-3510 CVE-2014-3508 CVE-2014-3509 mingw-openssl: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1127705
[ 3 ] Bug #1096234 - CVE-2014-0221 CVE-2014-0198 CVE-2014-0224 CVE-2014-0195 CVE-2010-5298 CVE-2014-3470 mingw-openssl: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1096234
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mingw-openssl' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
Fedora 20 Update: nodejs-browser-request-0.3.3-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17593
2014-12-25 04:35:59
--------------------------------------------------------------------------------
Name : nodejs-browser-request
Product : Fedora 20
Version : 0.3.3
Release : 1.fc20
URL : http://github.com/iriscouch/browser-request
Summary : Browser port of the Node.js 'request' package
Description :
Browser port of the Node.js 'request' package.
--------------------------------------------------------------------------------
Update Information:
Initial packaging
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1173387 - Review Request: nodejs-browser-request - Browser port of the Node.js 'request' package
https://bugzilla.redhat.com/show_bug.cgi?id=1173387
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update nodejs-browser-request' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
[SECURITY] Fedora 20 Update: mingw-curl-7.39.0-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17596
2014-12-25 04:36:05
--------------------------------------------------------------------------------
Name : mingw-curl
Product : Fedora 20
Version : 7.39.0
Release : 1.fc20
URL : http://curl.haxx.se/
Summary : MinGW Windows port of curl and libcurl
Description :
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS,
DICT, TELNET and TFTP servers, using any of the supported protocols.
cURL is designed to work without user interaction or any kind of
interactivity. cURL offers many useful capabilities, like proxy
support, user authentication, FTP upload, HTTP post, and file transfer
resume.
This is the MinGW cross-compiled Windows library.
--------------------------------------------------------------------------------
Update Information:
* Update to 7.39.0
--------------------------------------------------------------------------------
ChangeLog:
* Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 7.39.0-1
- Update to 7.39.0
- Fixes CVE-2014-3707 (RHBZ #1160724)
- Fixes CVE-2014-3620 CVE-2014-3613 (RHBZ #1140037)
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 7.37.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu May 29 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 7.37.0-1
- Update to 7.37.0
- Fixes CVE-2014-0138 and CVE-2014-0139 (RHBZ #1080880)
* Wed Nov 20 2013 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 7.33.0-1
- Update to 7.33.0
- Fixes CVE-2013-4545, RHBZ #1031429
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1140037 - CVE-2014-3620 CVE-2014-3613 mingw-curl: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1140037
[ 2 ] Bug #1160724 - CVE-2014-3707 mingw-curl: curl: incorrect handle duplication after COPYPOSTFIELDS [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1160724
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mingw-curl' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months
Fedora 21 Update: nodejs-dtree-0.0.7-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-17569
2014-12-25 04:34:59
--------------------------------------------------------------------------------
Name : nodejs-dtree
Product : Fedora 21
Version : 0.0.7
Release : 1.fc21
URL : https://github.com/RP-3/dtree
Summary : Command-line tool to view the dependency tree of any single js file
Description :
A simple command-line tool to display the dependency tree of
a single js file that requires external modules.
--------------------------------------------------------------------------------
Update Information:
Initial packaging
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1171750 - Review Request: nodejs-dtree - Command-line tool to view the dependency tree of any single js file
https://bugzilla.redhat.com/show_bug.cgi?id=1171750
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update nodejs-dtree' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 5 months