[SECURITY] Fedora 21 Update: wordpress-4.3.1-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-15982
2015-09-25 07:40:56.700563
--------------------------------------------------------------------------------
Name : wordpress
Product : Fedora 21
Version : 4.3.1
Release : 1.fc21
URL : http://www.wordpress.org
Summary : Blog tool and publishing platform
Description :
Wordpress is an online publishing / weblog package that makes it very easy,
almost trivial, to get information out to people on the web.
Important information in /usr/share/doc/wordpress/README.fedora
--------------------------------------------------------------------------------
Update Information:
**WordPress 4.3.1 Security and Maintenance Release** [Upstream
announcement](https://wordpress.org/news/2015/09/wordpress-4-3-1/): WordPress
4.3.1 is now available. This is a security release for all previous versions and
we strongly encourage you to update your sites immediately. This release
addresses three issues, including two cross-site scripting vulnerabilities and a
potential privilege escalation. * WordPress versions 4.3 and earlier are
vulnerable to a cross-site scripting vulnerability when processing shortcode
tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point. *
A separate cross-site scripting vulnerability was found in the user list table.
Reported by Ben Bidner of the WordPress security team. * Finally, in certain
cases, users without proper permissions could publish private posts and make
them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check
Point. WordPress 4.3.1 also fixes twenty-six bugs. For more information, see
the [release notes](https://codex.wordpress.org/Version_4.3.1) or consult the
[list of changes](https://core.trac.wordpress.org/log/branches/4.3/?rev=34199&st
op_rev=33647).
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1263657 - CVE-2015-5714 CVE-2015-5715 wordpress: XSS and permission issue fixed in wordpress 4.3.1
https://bugzilla.redhat.com/show_bug.cgi?id=1263657
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update wordpress' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
[SECURITY] Fedora 21 Update: php-ZendFramework2-2.4.8-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-16032
2015-09-25 07:40:56.700523
--------------------------------------------------------------------------------
Name : php-ZendFramework2
Product : Fedora 21
Version : 2.4.8
Release : 1.fc21
URL : http://framework.zend.com
Summary : Zend Framework 2
Description :
Zend Framework 2 is an open source framework for developing web applications
and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code
and utilizes most of the new features of PHP 5.3, namely namespaces, late
static binding, lambda functions and closures.
Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework
with over 15 million downloads.
Note: This meta package installs all base Zend Framework component packages
(Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db,
Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n,
InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager,
Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar,
Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text,
Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and
Cache-memcached packages.
--------------------------------------------------------------------------------
Update Information:
**Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem
storage adapter of Zend\Cache was creating directories with a liberal umask that
could lead to local arbitrary code execution and/or local privilege escalation.
This release contains a patch that ensures the directories are created using
permissions of 0775 and files using 0664 (essentially umask 0002). **Bug
fixed** from upstream [Changelog](http://framework.zend.com/changelog/2.4.8) *
validate against DateTimeImmutable instead of DateTimeInterface * treat 0.0 as
non-empty, restoring pre-2.4 behavior * deprecate "magic" logic for auto-
attaching NonEmpty validators in favor of explicit attachment * ensure fallback
values work as per pre-2.4 behavior * update the InputFilterInterface::add()
docblock to match implementations * Fix how missing optoinal fields are
validated to match pre 2.4.0 behavior * deprecate AllowEmpty and ContinueIfEmpty
annotations, per zend-inputfilter#26 * fix typos in aria attribute names of
AbstractHelper * fixes the ContentType header to properly handle encoded
parameter values * fixes the Sender header to allow mailbox addresses without
TLDs * fixes parsing of messages that contain an initial blank line before
headers * fixes the SetCookie header to allow multiline values (as they are
always encoded * fixes DefaultRenderingStrategy errors due to controllers
returning non-view model results
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php-ZendFramework2' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 21 Update: mom-0.5.1-1.fc21
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-16145
2015-09-25 07:40:56.700417
--------------------------------------------------------------------------------
Name : mom
Product : Fedora 21
Version : 0.5.1
Release : 1.fc21
URL : http://www.ovirt.org
Summary : Dynamically manage system resources on virtualization hosts
Description :
MOM is a policy-driven tool that can be used to manage overcommitment on KVM
hosts. Using libvirt, MOM keeps track of active virtual machines on a host. At
a regular collection interval, data is gathered about the host and guests. Data
can come from multiple sources (eg. the /proc interface, libvirt API calls, a
client program connected to a guest, etc). Once collected, the data is
organized for use by the policy evaluation engine. When started, MOM accepts a
user-supplied overcommitment policy. This policy is regularly evaluated using
the latest collected data. In response to certain conditions, the policy may
trigger reconfiguration of the system’s overcommitment mechanisms. Currently
MOM supports control of memory ballooning and KSM but the architecture is
designed to accommodate new mechanisms such as cgroups.
--------------------------------------------------------------------------------
Update Information:
Balloon data collection does not crash when no balloon info is present for a VM.
Please restart MOM after upgrading.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mom' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: evolution-rspam-0.6.0-11.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-67db62a5e3
2015-09-25 07:42:11.533817
--------------------------------------------------------------------------------
Name : evolution-rspam
Product : Fedora 22
Version : 0.6.0
Release : 11.fc22
URL : http://gnome.eu.org/evo/index.php/Report_as_Spam
Summary : Evolution Plugin for reporting spam
Description :
Rspam Evolution Plugin enables Evolution Mail client to report email messages
as spam to checksum-based and statistical filtering networks.
It supports Razor network, DCC, SpamCop and Pyzor.
This plugins requires a pretty new version of evolution to build.
See README for more information about required programs.
--------------------------------------------------------------------------------
Update Information:
Fixes the bug #1254256 where the evolution-rspam unrefs an ESource twice,
effectively causing use-after-free later in the code.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1254256 - [abrt] ESource double unref
https://bugzilla.redhat.com/show_bug.cgi?id=1254256
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update evolution-rspam' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: eyesight-0.1.4-1.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-14016
2015-09-25 07:42:11.533667
--------------------------------------------------------------------------------
Name : eyesight
Product : Fedora 22
Version : 0.1.4
Release : 1.fc22
URL : http://hawaiios.org/projects/eyesight
Summary : Hawaii desktop image viewer
Description :
Image viewer for the Hawaii desktop.
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update eyesight' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: findbugs-contrib-6.2.3-1.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-14232
2015-09-25 07:42:11.533572
--------------------------------------------------------------------------------
Name : findbugs-contrib
Product : Fedora 22
Version : 6.2.3
Release : 1.fc22
URL : http://fb-contrib.sourceforge.net/
Summary : Extra findbugs detectors
Description :
This is an extra detector plugin to be used with the static bug finder
FindBugs. See the documentation for descriptions of the detectors.
--------------------------------------------------------------------------------
Update Information:
- Update to 6.2.3 - Put sample classes into JAR file - findbugs-contrib-javadoc
no longer depends on findbugs-contrib
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1249789 - findbugs-contrib-6.2.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1249789
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update findbugs-contrib' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: pyparted-3.10.7-1.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-14450
2015-09-25 07:42:11.533456
--------------------------------------------------------------------------------
Name : pyparted
Product : Fedora 22
Version : 3.10.7
Release : 1.fc22
URL : https://github.com/dcantrell/pyparted
Summary : Python module for GNU parted
Description :
Python module for the parted library. It is used for manipulating
partition tables.
--------------------------------------------------------------------------------
Update Information:
pyparted-3.10.7-1.fc22 - Use sys.exit instead of os._exit with pocketlint.
(clumens) - Use addCleanup instead of tearDown for removing temp-device.
(clumens) - Add a new makefile target that does everything needed for jenkins.
(clumens) - Merge pull request #13 from atodorov/fix_imports (david.l.cantrell)
- Merge pull request #14 from vpodzime/master (david.l.cantrell) - Do not
support and use hashing on pyparted's objects (#1229186) (vpodzime) - Fix pylint
errors (atodorov) - Merge pull request #12 from atodorov/remove_hardcoded_paths
(david.l.cantrell) - Merge pull request #8 from atodorov/tests_ped_filesystem
(david.l.cantrell) - Merge pull request #10 from atodorov/tests_ped_partition
(david.l.cantrell) - Merge pull request #6 from atodorov/add_coverage
(david.l.cantrell) - Remove hard-coded paths. You should have all tools in PATH
when working on pyparted. (atodorov) - run the test suite under python-
coverage and report the results (atodorov) - add test coverage for
_ped.Partition (atodorov) - Merge pull request #9 from
atodorov/tests_dont_skip_if_root (david.l.cantrell) - Merge pull request #11
from atodorov/fix_api_docs (david.l.cantrell) - update pydoc descriptions based
on actual behavior (atodorov) - don't skip DeviceGetNextTestCase if running as
root (atodorov) - add test cases for _ped.FileSystem (atodorov) - Merge pull
request #7 from atodorov/tests_readme (david.l.cantrell) - Remove old BUGS file.
(david.l.cantrell) - add simple test documentation (atodorov) - Merge pull
request #5 from vpodzime/master (david.l.cantrell) - Beware of Python 3's
version of the map() built-in function (vpodzime) - Remove the MANIFEST file
when doing 'make release' (dcantrell) - Remove fedorahosted steps from the
RELEASE file. (dcantrell) - Update documentation and Makefile for github.
(dcantrell) - Stop using type() to do comparisons. (clumens) - Merge pull
request #4 from vpodzime/master-python3 (david.l.cantrell) - Don't blindly
expect that everything is hashable (vpodzime) - Replace filter() call with list
comprehension (vpodzime) - Fix an incorrect reference to "type". (clumens) -
Merge pull request #3 from clumens/master (clumens) - Only run pylint against a
python3 build of pyparted. (clumens) - Fix the fdisk example up to pass pylint.
(clumens) - Catch exact exceptions in a couple places. (clumens) - Ignore some
pylint warnings. (clumens) - Don't use string formatting in calls to
log.whatever. (clumens) - Fix a couple unused variable warnings. (clumens) -
Define things in the setUp methods, not in runTest. (clumens) - Don't redefine
reserved or already used function names. (clumens) - Fix import errors turned up
by pylint. (clumens) - Convert to using pocketlint to run pylint. (clumens) -
Don't run "git clean -fdx" in the "make clean" target. (clumens) - Add extension
whitelist for _ped to pylint call (bcl) - Merge pull request #2 from
jflorian/master (david.l.cantrell) - New - example to create a single bootable
partition (john_florian) - Remember to pass the arguments to the exception
handler. (clumens) - Put new _ped constants and functions into the parted
module. (clumens) - PyInt_FromLong doesn't exist in python3, so always use
PyLong_FromLong. (clumens) - Add new functions to extend exception handling.
(clumens) - Add function for resetting partition's number. (vpodzime) - Fix
localeC imports in a handful of src/parted/*.py files. (dcantrell) - Disable
false positive E0611 errors on src/parted/__init__.py (dcantrell) -
ped_unit_get_size() returns a long long, not just a long. (dcantrell) - Adjust
test cases to deal with run-time support. (dcantrell) - Only import partition
types that exist. (dcantrell) - Note x.y.z version number. (dcantrell) - Remove
.travis.yml and tox.ini (dcantrell) - Skip 'aix' diskType in FreshDiskTestCase
(dcantrell) - Handle running the test suite on armv7l hosts. (dcantrell) - Fix
getPartitionByPath for disks that are just plain files. (dlehman) - ext2 may be
smaller than the end of the device (#1095904) (bcl) - support ppc64le in
pyparted (hamzy) - Fix up the PYTHONPATH for "make check" and "make test".
(clumens) - Remove geom tests that don't fail (bcl) - Add btrfs and ext4 for
filesystem type test (bcl) - Revert "Add support for hfs_esp flag" (bcl) - Teach
pyparted that aarch64 support GPT partitions. (dcantrell) - And disable the
length one, too. (clumens) - Disable one test case that fails on ppc64, for the
moment. (clumens) - Update pylint options for the latest version of that
program. (clumens) - Fix 'make bumpver' to handle multiple decimal points.
(dcantrell) - Add support for hfs_esp flag (dcantrell) - Add support for esp
flag (dcantrell) - Add support for irst flag (dcantrell) - Add support for
msftdata flag (dcantrell) - Don't assume tools will be in the user's $PATH.
(clumens) - Fix a lot of problems pylint caught. (clumens) - Move from pychecker
to pylint. (clumens) - Have pychecker ignore some fale positives on missing
class attrs. (clumens) - setattr doesn't return any value. (clumens) - Fix up
pychecker errors reported by Jenkins. (dcantrell) - Subject: [PATCH] pyparted:
export ped_disk_new functionality (rnsastry) - Correct boilerplate
modifications. (dcantrell) - Tests also require the parted binary. (g2p.code) -
Work around Travis's broken defaults. (g2p.code)
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update pyparted' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: parted-3.2-10.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-14533
2015-09-25 07:42:11.533353
--------------------------------------------------------------------------------
Name : parted
Product : Fedora 22
Version : 3.2
Release : 10.fc22
URL : http://www.gnu.org/software/parted
Summary : The GNU disk partition manipulation program
Description :
The GNU Parted program allows you to create, destroy, resize, move,
and copy hard disk partitions. Parted can be used for creating space
for new operating systems, reorganizing disk usage, and copying data
to new hard disks.
--------------------------------------------------------------------------------
Update Information:
parted-3.2-10.fc22 - tests: Fix patch 0012 test for extended partition length
- UI: Avoid memory leaks - libparted: Fix memory leaks.patch - libparted: Fix
possible memory leaks.patch - libparted: Stop converting . in-sys-path-to / -
libparted: Use read-only when probing devices on linux - tests: Use
wait_for_dev_to_ functions
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update parted' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: rabbitmq-server-3.5.4-3.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-15009
2015-09-25 07:42:11.533244
--------------------------------------------------------------------------------
Name : rabbitmq-server
Product : Fedora 22
Version : 3.5.4
Release : 3.fc22
URL : http://www.rabbitmq.com/
Summary : The RabbitMQ server
Description :
RabbitMQ is an implementation of AMQP, the emerging standard for high
performance enterprise messaging. The RabbitMQ server is a robust and
scalable implementation of an AMQP broker.
--------------------------------------------------------------------------------
Update Information:
Fix service restart on package upgrade (RHBZ#1259564)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1259564 - rabbitmq-server stops (instead of restart) during update to rabbitmq-server-3.3.5-5.el7.noarch
https://bugzilla.redhat.com/show_bug.cgi?id=1259564
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update rabbitmq-server' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months
Fedora 22 Update: php-pecl-jsonc-1.3.9-1.fc22
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-15249
2015-09-25 07:42:11.533133
--------------------------------------------------------------------------------
Name : php-pecl-jsonc
Product : Fedora 22
Version : 1.3.9
Release : 1.fc22
URL : http://pecl.php.net/package/jsonc
Summary : Support for JSON serialization
Description :
The php-pecl-jsonc module will add support for JSON (JavaScript Object Notation)
serialization to PHP.
This is a dropin alternative to standard PHP JSON extension which
use the json-c library parser.
--------------------------------------------------------------------------------
Update Information:
Upstream changelog: **Version 1.3.9**: - fix 70499 segfault after json_decode
**Version 1.3.8**: * using system libjson-c is no more supported * fix BIGINT
behavior * fix #12 allow float starting with a dot * fix #23 single quote in
property name * fix #9 invalid UTF-8 characters
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php-pecl-jsonc' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
8 years, 7 months