[SECURITY] Fedora 28 Update: xmlrpc-3.1.3-20.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-4ac4229aa8
2018-06-02 20:42:19.387810
--------------------------------------------------------------------------------
Name : xmlrpc
Product : Fedora 28
Version : 3.1.3
Release : 20.fc28
URL : http://ws.apache.org/xmlrpc/
Summary : Java XML-RPC implementation
Description :
Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol
that uses XML over HTTP to implement remote procedure calls.
Apache XML-RPC was previously known as Helma XML-RPC. If you have code
using the Helma library, all you should have to do is change the import
statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2016-5003, CVE-2016-5002
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 18 2018 Michael Simacek <msimacek(a)redhat.com> - 1:3.1.3-20
- Disallow deserialization of <ex:serializable> tags by default
- Resolves CVE-2016-5003
- Disallow loading of external DTD
- Resolves CVE-2016-5002
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
https://bugzilla.redhat.com/show_bug.cgi?id=1508123
[ 2 ] Bug #1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-4ac4229aa8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: acpica-tools-20180508-2.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-bc16c6f899
2018-06-02 20:42:19.387751
--------------------------------------------------------------------------------
Name : acpica-tools
Product : Fedora 28
Version : 20180508
Release : 2.fc28
URL : https://www.acpica.org/
Summary : ACPICA tools for the development and debug of ACPI tables
Description :
The ACPI Component Architecture (ACPICA) project provides an OS-independent
reference implementation of the Advanced Configuration and Power Interface
Specification (ACPI). ACPICA code contains those portions of ACPI meant to
be directly integrated into the host OS as a kernel-resident subsystem, and
a small set of tools to assist in developing and debugging ACPI tables.
This package contains only the user-space tools needed for ACPI table
development, not the kernel implementation of ACPI. The following commands
are installed:
-- iasl: compiles ASL (ACPI Source Language) into AML (ACPI Machine
Language), suitable for inclusion as a DSDT in system firmware.
It also can disassemble AML, for debugging purposes.
-- acpibin: performs basic operations on binary AML files (e.g.,
comparison, data extraction)
-- acpidump: write out the current contents of ACPI tables
-- acpiexec: simulate AML execution in order to debug method definitions
-- acpihelp: display help messages describing ASL keywords and op-codes
-- acpinames: display complete ACPI name space from input AML
-- acpisrc: manipulate the ACPICA source tree and format source files
for specific environments
-- acpixtract: extract binary ACPI tables from acpidump output (see
also the pmtools package)
This version of the tools is being released under GPLv2 license.
--------------------------------------------------------------------------------
Update Information:
Corrected a problem where the %pre/%post scriptlets had inverted logic when
testing to see if files were present, causing the scriptlets to execute when the
files were missing, instead of when they were present as they were supposed to
do. This in turn could cause installation or removal of the package to fail.
---- This release brings forward all the changes from upstream versions
20180313, to 20180427, to 20180508, plus minor improvements in the build
process. #### 8 May 2018. Summary of changes for version 20180508: 1) ACPICA
kernel-resident subsystem: Completed the new (recently deployed) package
resolution mechanism for the Load and LoadTable ASL/AML operators. This fixes a
regression that was introduced in version 20180209 that could result in an
AE_AML_INTERNAL exception during the loading of a dynamic ACPI/AML table (SSDT)
that contains package objects. 2) iASL Compiler/Disassembler and Tools:
AcpiDump and AcpiXtract: Implemented support for ACPI tables larger than 1 MB.
This change allows for table offsets within the acpidump file to be up to 8
characters. These changes are backwards compatible with existing acpidump files.
#### 27 April 2018. Summary of changes for version 20180427: 1) ACPICA
kernel-resident subsystem: Debugger: Added support for Package objects in the
"Test Objects" command. This command walks the entire namespace and evaluates
all named data objects (Integers, Strings, Buffers, and now Packages). Improved
error messages for the namespace root node. Originally, the root was referred to
by the confusing string "\___". This has been replaced by "Namespace Root" for
clarification. Fixed a potential infinite loop in the AcpiRsDumpByteList
function. Colin Ian King <colin.king(a)canonical.com>. 2) iASL
Compiler/Disassembler and Tools: iASL: Implemented support to detect and flag
illegal forward references. For compatibility with other ACPI implementations,
these references are now illegal at the root level of the DSDT or SSDTs. Forward
references have always been illegal within control methods. This change should
not affect existing ASL/AML code because of the fact that these references have
always been illegal in the other ACPI implementation. iASL: Added error
messages for the case where a table OEM ID and OEM TABLE ID strings are longer
than the ACPI-defined length. Previously, these strings were simply silently
truncated. iASL: Enhanced the -tc option (which creates an AML hex file in C,
suitable for import into a firmware project): * Create a unique name for the
table, to simplify use of multiple SSDTs. * Add a protection #ifdef in the
file, similar to a .h header file. * With assistance from Sami Mujawar,
sami.mujawar(a)arm.com and Evan Lloyd, evan.lloyd(a)arm.com AcpiExec: Added a new
option, -df, to disable the local fault handler. This is useful during
debugging, where it may be desired to drop into a debugger on a fault. #### 13
March 2018. Summary of changes for version 20180313: 1) ACPICA kernel-resident
subsystem: Implemented various improvements to the GPE support: * Dispatch
all active GPEs at initialization time so that no GPEs are lost. * Enable
runtime GPEs earlier. Some systems expect GPEs to be enabled before devices are
enumerated. * Don't unconditionally clear ACPI IRQs during suspend/resume, so
that IRQs are not lost. * Add parallel GPE handling to eliminate the
possibility of dispatching the same GPE twice. * Dispatch any pending GPEs
after enabling for the first time. AcpiGetObjectInfo - removed support for the
_STA method. This was causing problems on some platforms. Added a new _OSI
string, "Windows 2017.2". Cleaned up and simplified the module-level code
support. These changes are in preparation for the eventual removal of the legacy
MLC support (deferred execution), replaced by the new MLC architecture which
executes the MLC as a table is loaded (DSDT/SSDTs). Changed a compile-time
option to a runtime option. Changes the option to ignore ACPI table load-time
package resolution errors into a runtime option. Used only for platforms that
generate many AE_NOT_FOUND errors during boot.
AcpiGbl_IgnorePackageResolutionErrors. Fixed the ACPI_ERROR_NAMESPACE macro.
This change involves putting some ACPI_ERROR_NAMESPACE parameters inside macros.
By doing so, we avoid compilation errors from unused variables (seen with some
compilers). 2) iASL Compiler/Disassembler and Tools: ASLTS: parallelized
execution in order to achieve an (approximately) 2X performance increase.
ASLTS: Updated to use the iASL __LINE__ and __METHOD__ macros. Improves error
reporting.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 22 2018 Al Stone <ahs3(a)redhat.com> - 20180508-2
- %pre and %post scriptlets fail -- stupid thinko where I inadvertently
tested for alternatives not existing, vs existing
* Tue May 15 2018 Al Stone <ahs3(a)redhat.com> - 20180508-1
- Update to 20180508 source tree, including patch refeshes. Closes BZ#1544048
- acpidump/acpixtract no longer have alternatives, so remove the scriptlets
that maintain them and just install them directly; we do leave the pre-
and post- scriptlets to remove the alternatives for now. Closes BZ#1576970
- Typo: OPT_LDFLAGS, not OPT_LDLAGS in the build section. Closes BZ#1560542
* Mon May 14 2018 Al Stone <ahs3(a)redhat.com> - 20180427-1
- Update to 20180427 source tree, including patch refeshes. Closes BZ#1544048
* Mon May 14 2018 Al Stone <ahs3(a)redhat.com> - 20180313-1
- Update to 20180313 source tree, including patch refeshes. Closes BZ#1544048
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1576970 - /usr/bin/acpidump not owned by the package
https://bugzilla.redhat.com/show_bug.cgi?id=1576970
[ 2 ] Bug #1560542 - acpica-tools: Incomplete Fedora build flags injection
https://bugzilla.redhat.com/show_bug.cgi?id=1560542
[ 3 ] Bug #1544048 - acpica-tools-20180508 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1544048
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-bc16c6f899' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: webextension-token-signing-1.0.6-6.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-30dea36d23
2018-06-02 20:42:19.387542
--------------------------------------------------------------------------------
Name : webextension-token-signing
Product : Fedora 28
Version : 1.0.6
Release : 6.fc28
URL : https://github.com/open-eid/chrome-token-signing
Summary : Firefox extension for signing with your eID on the web
Description :
Firefox extension for signing with your eID on the web
--------------------------------------------------------------------------------
Update Information:
- Added install hint and native messaging host files for Chromium
--------------------------------------------------------------------------------
ChangeLog:
* Sat May 5 2018 Dmitri Smirnov <dmitri(a)smirnov.ee> - 1.0.6-6
- Added install hint and native messaging host files for Chromium
- Minor whitespace consistency changes in spec file
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-30dea36d23' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: bcal-1.9-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-01f42497be
2018-06-02 20:42:19.387522
--------------------------------------------------------------------------------
Name : bcal
Product : Fedora 28
Version : 1.9
Release : 1.fc28
URL : https://github.com/jarun/bcal
Summary : Storage conversion and expression calculator
Description :
bcal (Byte CALculator) is a command-line utility for storage conversions
and calculations. Storage, hardware and firmware developers work
with numerical calculations regularly e.g., storage unit conversions,
address calculations etc. If you are one and can't calculate the hex address
offset for (512 - 16) MiB immediately, or the value when the 43rd bit of
a 64-bit address is set, bcal is for you
--------------------------------------------------------------------------------
Update Information:
Release 1.9
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 21 2018 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> - 1.9-1
- Release 1.9
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-01f42497be' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: pdd-1.2-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-bb3265a941
2018-06-02 20:42:19.387500
--------------------------------------------------------------------------------
Name : pdd
Product : Fedora 28
Version : 1.2
Release : 1.fc28
URL : https://github.com/jarun/pdd
Summary : Tiny date, time diff calculator
Description :
There are times you want to check how old you are (in years, months, days) or
how long you need to wait for the next flash sale... pdd (python3 date diff)
is a small cmdline utility to calculate date and time difference. If no
program arguments are specified it shows the current date, time and timezone.
--------------------------------------------------------------------------------
Update Information:
Release 1.2
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-bb3265a941' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: wordpress-4.9.6-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-b51389a00a
2018-06-02 20:42:19.387478
--------------------------------------------------------------------------------
Name : wordpress
Product : Fedora 28
Version : 4.9.6
Release : 1.fc28
URL : http://www.wordpress.org
Summary : Blog tool and publishing platform
Description :
Wordpress is an online publishing / weblog package that makes it very easy,
almost trivial, to get information out to people on the web.
Important information in /usr/share/doc/wordpress/README.fedora
--------------------------------------------------------------------------------
Update Information:
Update to 4.9.6, Privacy and Maintenance Release See
https://wordpress.org/news/2018/05/wordpress-4-9-6-privacy-and-maintenance-
release/ for more information.
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 18 2018 Kevin Fenzi <kevin(a)scrye.com> - 4.9.6-1
- Update to 4.9.6. Fixes bug #1579584
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1579584 - wordpress-4.9.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1579584
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-b51389a00a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: python-priority-1.3.0-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-666563d2eb
2018-06-02 20:42:19.387448
--------------------------------------------------------------------------------
Name : python-priority
Product : Fedora 28
Version : 1.3.0
Release : 1.fc28
URL : http://python-hyper.org/priority/
Summary : A pure-Python implementation of the HTTP/2 priority tree
Description :
A HTTP/2 Priority Implementation Priority is a pure-Python
implementation of the priority logic for HTTP/2, set out in RFC 7540 Section
5.3 (Stream Priority)_. This logic allows for clients to express a preference
for how the server allocates its (limited) resources to the many outstanding
HTTP requests that may be running over a single HTTP/2 connection.
--------------------------------------------------------------------------------
Update Information:
Initial package.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1578107 - Review Request: python-priority - A pure-Python implementation of the HTTP/2 priority tree
https://bugzilla.redhat.com/show_bug.cgi?id=1578107
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-666563d2eb' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: python-towncrier-17.8.0-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-7db4f93052
2018-06-02 20:42:19.387426
--------------------------------------------------------------------------------
Name : python-towncrier
Product : Fedora 28
Version : 17.8.0
Release : 1.fc28
URL : https://github.com/hawkowl/towncrier
Summary : Building newsfiles for your project
Description :
Towncrier is a utility to produce useful, summarised news files for your
project. Rather than reading the Git history as some newer tools to produce it,
or having one single file which developers all write to, towncrier reads "news
fragments" which contain information useful to end users.
--------------------------------------------------------------------------------
Update Information:
Initial package.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1578108 - Review Request: python-towncrier - Building newsfiles for your project
https://bugzilla.redhat.com/show_bug.cgi?id=1578108
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-7db4f93052' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: python-constantly-15.1.0-1.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-767dd39f87
2018-06-02 20:42:19.387403
--------------------------------------------------------------------------------
Name : python-constantly
Product : Fedora 28
Version : 15.1.0
Release : 1.fc28
URL : https://github.com/twisted/constantly
Summary : Symbolic constants in Python
Description :
A library that provides symbolic constant support. It includes
collections and constants with text, numeric, and bit flag values. Originally
twisted.python.constants from the Twisted project.
--------------------------------------------------------------------------------
Update Information:
Initial package.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1578093 - Review Request: python-constantly - Symbolic constants in Python
https://bugzilla.redhat.com/show_bug.cgi?id=1578093
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-767dd39f87' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months
Fedora 28 Update: golang-github-jedisct1-xsecretbox-0-0.1.20180518git7a679c0.fc28
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-b997ba3241
2018-06-02 20:42:19.387373
--------------------------------------------------------------------------------
Name : golang-github-jedisct1-xsecretbox
Product : Fedora 28
Version : 0
Release : 0.1.20180518git7a679c0.fc28
URL : https://github.com/jedisct1/xsecretbox
Summary : Go implementation of crypto_secretbox_xchacha20poly1305
Description :
Go implementation of crypto_secretbox_xchacha20poly1305.
--------------------------------------------------------------------------------
Update Information:
First package for Fedora
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1573997 - Review Request: golang-github-jedisct1-xsecretbox - Go implementation of crypto_secretbox_xchacha20poly1305
https://bugzilla.redhat.com/show_bug.cgi?id=1573997
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-b997ba3241' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
5 years, 11 months