[SECURITY] Fedora 24 Update: xen-4.6.5-7.fc24
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2017-b3bdaf58bc
2017-07-01 21:00:30.997417
--------------------------------------------------------------------------------
Name : xen
Product : Fedora 24
Version : 4.6.5
Release : 7.fc24
URL : http://xen.org/
Summary : Xen is a virtual machine monitor
Description :
This package contains the XenD daemon and xm command line
tools, needed to manage virtual machines running under the
Xen hypervisor
--------------------------------------------------------------------------------
Update Information:
xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216]
page transfer may allow PV guest to elevate privilege [XSA-217] Races in the
grant table unmap code [XSA-218] x86: insufficient reference counts during
shadow emulation [XSA-219] x86: PKRU and BND* leakage between vCPU-s [XSA-220]
stale P2M mappings due to insufficient error checking [XSA-222] ARM guest
disabling interrupt may crash Xen [XSA-223] grant table operations mishandle
reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs
[XSA-225] NULL pointer deref in event channel poll [XSA-221] (#1463231)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1458870 - xsa216 xen: blkif responses leak backend stack data (XSA-216)
https://bugzilla.redhat.com/show_bug.cgi?id=1458870
[ 2 ] Bug #1458871 - xsa217 xen: page transfer may allow PV guest to elevate privilege (XSA-217)
https://bugzilla.redhat.com/show_bug.cgi?id=1458871
[ 3 ] Bug #1458872 - xsa218 xen: Races in the grant table unmap code (XSA-218)
https://bugzilla.redhat.com/show_bug.cgi?id=1458872
[ 4 ] Bug #1458873 - xsa219 xen: x86: insufficient reference counts during shadow emulation (XSA-219)
https://bugzilla.redhat.com/show_bug.cgi?id=1458873
[ 5 ] Bug #1458874 - xsa220 xen: x86: PKRU and BND* leakage between vCPU-s (XSA-220)
https://bugzilla.redhat.com/show_bug.cgi?id=1458874
[ 6 ] Bug #1458876 - xsa222 xen: stale P2M mappings due to insufficient error checking (XSA-222)
https://bugzilla.redhat.com/show_bug.cgi?id=1458876
[ 7 ] Bug #1458877 - xsa223 xen: ARM guest disabling interrupt may crash Xen (XSA-223)
https://bugzilla.redhat.com/show_bug.cgi?id=1458877
[ 8 ] Bug #1458878 - xsa224 xen: grant table operations mishandle reference counts (XSA-224)
https://bugzilla.redhat.com/show_bug.cgi?id=1458878
[ 9 ] Bug #1459515 - xsa225 xen: arm: vgic: Out-of-bound access when sending SGIs (XSA-225)
https://bugzilla.redhat.com/show_bug.cgi?id=1459515
[ 10 ] Bug #1458875 - xsa221 xen: NULL pointer deref in event channel poll (XSA-221)
https://bugzilla.redhat.com/show_bug.cgi?id=1458875
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade xen' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years, 9 months
Fedora 24 Update: mozilla-https-everywhere-5.2.19-1.fc24
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2017-3b53a573d0
2017-07-01 21:00:30.997352
--------------------------------------------------------------------------------
Name : mozilla-https-everywhere
Product : Fedora 24
Version : 5.2.19
Release : 1.fc24
URL : https://eff.org/https-everywhere
Summary : HTTPS/HSTS enforcement extension for Mozilla Firefox and SeaMonkey
Description :
HTTPS Everywhere is a Firefox extension produced as a collaboration between
The Tor Project and the Electronic Frontier Foundation. It encrypts your
communications with a number of major websites.
Many sites on the web offer some limited support for encryption over HTTPS,
but make it difficult to use. For instance, they may default to unencrypted
HTTP, or fill encrypted pages with links that go back to the unencrypted site.
The HTTPS Everywhere extension fixes these problems by rewriting all requests
to these sites to HTTPS.
--------------------------------------------------------------------------------
Update Information:
Someone at my workplace decided the best place to put a switch was dangling off
the back of a desk. Bad idea, people.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1463450 - mozilla-https-everywhere-5.2.19 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1463450
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade mozilla-https-everywhere' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years, 9 months
Fedora 24 Update: sugar-speak-54-1.fc24
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2017-ef95755ffc
2017-07-01 21:00:30.997286
--------------------------------------------------------------------------------
Name : sugar-speak
Product : Fedora 24
Version : 54
Release : 1.fc24
URL : http://wiki.laptop.org/go/Speak
Summary : Speak for Sugar
Description :
Speak is a talking face for the XO laptop. Anything you type will be spoken
aloud using the XO's speech synthesizer, espeak. You can adjust the accent,
rate and pitch of the voice as well as the shape of the eyes and mouth. This
is a great way to experiment with the speech synthesizer, learn to type or
just have fun making a funny face for your XO.
--------------------------------------------------------------------------------
Update Information:
Release version 54
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade sugar-speak' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years, 9 months
Fedora 24 Update: meson-0.41.1-1.fc24
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2017-74af926adb
2017-07-01 21:00:30.996914
--------------------------------------------------------------------------------
Name : meson
Product : Fedora 24
Version : 0.41.1
Release : 1.fc24
URL : http://mesonbuild.com/
Summary : High productivity build system
Description :
Meson is a build system designed to optimize programmer
productivity. It aims to do this by providing simple, out-of-the-box
support for modern software development tools and practices, such as
unit tests, coverage reports, Valgrind, CCache and the like.
--------------------------------------------------------------------------------
Update Information:
# New features ## Dependency Handler for LLVM Native support for linking
against LLVM using the `dependency` function. ## vcs_tag keyword fallback is is
now optional The `fallback` keyword in `vcs_tag` is now optional. If not given,
its value defaults to the return value of `meson.project_version()`. ## Better
quoting of special characters in ninja command invocations The ninja backend
now quotes special characters that may be interpreted by ninja itself, providing
better interoperability with custom commands. This support may not be perfect;
please report any issues found with special characters to the issue tracker. ##
Pkgconfig support for custom variables The Pkgconfig module object can add
arbitrary variables to the generated .pc file with the new `variables` keyword:
pkg.generate(libraries : libs, subdirs : h,
version : '1.0', name : 'libsimple', filebase
: 'simple', description : 'A simple demo library.',
variables : ['datadir=${prefix}/data']) ## A target for creating tarballs
Creating distribution tarballs is simple: ninja dist This will create a
`.tar.xz` archive of the source code including submodules without any revision
control information. This command also verifies that the resulting archive can
be built, tested and installed. This is roughly equivalent to the distcheck
target in other build systems. Currently this only works for projects using Git
and only with the Ninja backend. ## Support for passing arguments to Rust
compiler Targets for building rust now take a `rust_args` keyword. ## Code
coverage export for tests Code coverage can be generated for tests by passing
the `--cov` argument to the `run_tests.py` test runner. Note, since multiple
processes are used, coverage must be combined before producing a report
(`coverage3 combine`). ## Reproducible builds All known issues have been fixed
and Meson can now build reproducible Debian packages out of the box. $$
Extended template substitution in configure_file The output argument of
`configure_file()` is parsed for `@BASENAME@` and @PLAINNAME@` substitutions.
## Cross-config property for overriding whether an exe wrapper is needed The
new `needs_exe_wrapper` property allows overriding auto-detection for cases
where `build_machine` appears to be compatible with `host_machine`, but actually
isn't. For example when: - `build_machine` is macOS and `host_machine` is the
iOS Simulator - the `build_machine's libc is glibc but the `host_machine` libc
is uClibc - code relies on kernel features not available on the `build_machine`
## Support for capturing stdout of a command in configure_file
`configure_file()` now supports a new keyword - `capture`. When this argument is
set to true, Meson captures `stdout` of the `command` and writes it to the
target file specified as output.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1461420 - meson-0.41.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1461420
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade meson' at the command line.
For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years, 9 months