Fedora 29 Update: nfoview-1.27-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-18140702e1
2019-08-30 00:49:12.870632
--------------------------------------------------------------------------------
Name : nfoview
Product : Fedora 29
Version : 1.27
Release : 1.fc29
URL : http://otsaloma.github.io/nfoview/
Summary : A viewer for NFO files
Description :
NFO Viewer is a simple viewer for NFO files, which are "ASCII" art in
the CP437 codepage. The advantages of using NFO Viewer instead of a
text editor are preset font and encoding settings, automatic window
size and clickable hyperlinks.
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release 1.27 (rhbz#1742648)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 19 2019 Fabian Affolter <mail(a)fabian-affolter.ch> - 1.27-1
- Update to latest upstream release 1.27 (rhbz#1742648)
* Mon Aug 19 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.26.1-3
- Rebuilt for Python 3.8
* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.26.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sat Jun 8 2019 Fabian Affolter <mail(a)fabian-affolter.ch> - 1.26.1-3
- Update to latest upstream release 1.26.1 (rhbz#1718557)
* Sat May 25 2019 Fabian Affolter <mail(a)fabian-affolter.ch> - 1.26-3
- Update specfile
* Fri Feb 1 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.26-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Jan 22 2019 Fabian Affolter <mail(a)fabian-affolter.ch> - 1.26-1
- Update to new upstream version 1.26
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742648 - nfoview-1.27 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742648
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-18140702e1' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: gpxsee-7.12-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-a7636f8fa0
2019-08-30 00:49:12.870589
--------------------------------------------------------------------------------
Name : gpxsee
Product : Fedora 29
Version : 7.12
Release : 1.fc29
URL : http://www.gpxsee.org/
Summary : GPS log file viewer and analyzer
Description :
GPS log file viewer and analyzer with support for
GPX, TCX, KML, FIT, IGC and NMEA files.
--------------------------------------------------------------------------------
Update Information:
**Version 7.12** - Added support for SeeYou CUP files - Added support for
Geographic 2D projection in vector maps - Fixed lat/lon reference parsing in big
endian EXIF entries **Version 7.11** - Improved IMG maps loading performance
and memory footprint - Improved road shields layout on IMG maps
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 19 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.12-1
- Update to version 7.12
resolves: #1742109
* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 7.10-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Jul 8 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.10-1
- Update to version 7.10
resolves: #1727700
* Tue Jun 18 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.9-1
- Update to version 7.9
resolves: #1720866
* Sun Jun 2 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.8-1
- Update to version 7.8
resolves: #1715247
* Thu May 23 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.7-1
- Update to version 7.7
resolves: #1711584
* Wed May 15 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.6-1
- Update to version 7.6
resolves: #1709052
* Tue Mar 19 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.5-1
- Update to version 7.5
resolves: #1689598
* Tue Mar 12 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.4-1
- Update to version 7.4
resolves: #1687195
* Tue Feb 19 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.3-1
- Update to version 7.3
resolves: #1678584
* Fri Feb 1 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 7.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Jan 29 2019 Nikola Forr�� <nforro(a)redhat.com> - 7.2-1
- Update to version 7.2
resolves: #1670181
* Thu Dec 20 2018 Nikola Forr�� <nforro(a)redhat.com> - 7.0-2
- Use upstream appdata.xml and fix license
* Wed Dec 19 2018 Nikola Forr�� <nforro(a)redhat.com> - 7.0-1
- Update to version 7.0
* Wed Nov 14 2018 Nikola Forr�� <nforro(a)redhat.com> - 6.3-1
- Update to version 6.3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742109 - gpxsee-7.12 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742109
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-a7636f8fa0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: pysvn-1.9.10-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-f64d88e076
2019-08-30 00:49:12.870535
--------------------------------------------------------------------------------
Name : pysvn
Product : Fedora 29
Version : 1.9.10
Release : 1.fc29
URL : https://pysvn.sourceforge.io/
Summary : Pythonic style bindings for Subversion
Description :
Pythonic style bindings for Subversion
--------------------------------------------------------------------------------
Update Information:
Update to 1.9.10 and build against PyCXX 7.1.3
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 19 2019 Barry Scott <barry(a)barrys-emacs.org> - 1.9.10-1
- Update to 1.9.10 and build against PyCXX 7.1.3
- Fix memory leak for python3 strings from PyCXX
* Mon Aug 19 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.9.9-3
- Rebuilt for Python 3.8
* Fri Jul 26 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.9.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Mar 4 2019 Barry Scott <barry(a)barrys-emacs.org> - 1.9.9-1
- Update to 1.9.9 and build against PyCXX 7.1.2
- remove setup options that are the default
* Sat Feb 2 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.9.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-f64d88e076' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: xxhash-0.7.1-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-d42508798b
2019-08-30 00:49:12.870507
--------------------------------------------------------------------------------
Name : xxhash
Product : Fedora 29
Version : 0.7.1
Release : 1.fc29
URL : http://www.xxhash.com/
Summary : Extremely fast hash algorithm
Description :
xxHash is an Extremely fast Hash algorithm, running at RAM speed
limits. It successfully completes the SMHasher test suite which
evaluates collision, dispersion and randomness qualities of hash
functions. Code is highly portable, and hashes are identical on all
platforms (little / big endian).
--------------------------------------------------------------------------------
Update Information:
xxhash 0.7.1.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Aug 17 2019 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.7.1-1
- Update to version 0.7.1
* Sat Jul 27 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Mar 18 2019 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.7.0-1
- Update to version 0.7.0
* Sun Feb 3 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742760 - xxhash-0.7.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742760
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-d42508798b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: libstatgrab-0.92-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-1ebe386df3
2019-08-30 00:49:12.870495
--------------------------------------------------------------------------------
Name : libstatgrab
Product : Fedora 29
Version : 0.92
Release : 1.fc29
URL : http://www.i-scream.org/libstatgrab
Summary : A library that provides cross platform access to statistics of the system
Description :
Libstatgrab is a library that provides cross platform access to statistics
about the system on which it's running. It's written in C and presents a
selection of useful interfaces which can be used to access key system
statistics. The current list of statistics includes CPU usage, memory
utilisation, disk usage, process counts, network traffic, disk I/O, and more.
The current list of supported and tested platforms includes FreeBSD, Linux,
NetBSD, OpenBSD, Solaris, DragonFly BSD, HP-UX and AIX.
--------------------------------------------------------------------------------
Update Information:
This release mostly includes bugfixes and is API and ABI compatible with 0.91.
* Fix various file descriptor leaks. * On Linux, read process thread name
from comm where available (fixes FreeScale ARM BSP). * Add more process stat
information on MacOS/Darwin. * Fix build on Alpine Linux and NetBSD 8. *
Fix build on FreeBSD 12 without COMPAT_FREEBSD11. * Improve collection of
data for non-standard Solaris interfaces. * Improve detection of interface
link status on Solaris. * Various configure and build fixes. * Ensure
modern log4cplus is used correctly.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 18 2019 Tim Orling <ticotimo(a)gmail.com> - 1:0.92-1
- Update to 0.92 (rhbz 1742062)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742062 - libstatgrab-0.92 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742062
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-1ebe386df3' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: golang-github-dlclark-regexp2-1.2.0-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-69e501bfb9
2019-08-30 00:49:12.870482
--------------------------------------------------------------------------------
Name : golang-github-dlclark-regexp2
Product : Fedora 29
Version : 1.2.0
Release : 1.fc29
URL : https://github.com/dlclark/regexp2
Summary : A regex engine for Go based on the .NET engine
Description :
A regex engine for Go based on the .NET engine
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 18 2019 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> - 1.2.0-1
- Update to latest version
* Thu Jan 31 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1.6-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742157 - golang-github-dlclark-regexp2-1.2.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742157
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-69e501bfb9' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: flrig-1.3.48-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-18d5cee92b
2019-08-30 00:49:12.870452
--------------------------------------------------------------------------------
Name : flrig
Product : Fedora 29
Version : 1.3.48
Release : 1.fc29
URL : http://www.w1hkj.com/
Summary : Transceiver control program
Description :
Flrig is a transceiver control program designed to be used either stand alone or
as an adjunct to fldigi. The supported transceivers all have some degree of
CAT. The flrig user interface changes to accommodate the degree of CAT support
available for the transceiver in use.
--------------------------------------------------------------------------------
Update Information:
Version 1.3.48 * Maintenance release IC 746/756 transceiver does not
support get split FT857D/897D Correct missing ptt control FT450D
smeter scale split on VFO-B
--------------------------------------------------------------------------------
ChangeLog:
* Sun Aug 18 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.48-1
- Update to 1.3.48.
* Tue Aug 6 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.47-1
- Update to 1.3.47.
* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.3.46-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Wed Jul 24 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.46-1
- Update to 1.3.46.
* Wed Jun 5 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.45-1
- Update to 1.3.45.
* Tue May 7 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.44-1
- Update to 1.3.44.
* Sun Apr 14 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.43-1
- Update to 1.3.43.
* Sat Feb 2 2019 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.42-1
- Update to 1.3.42.
* Thu Jan 31 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.3.41-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Dec 4 2018 Richard Shaw <hobbes1069(a)gmail.com> - 1.3.41-1
- Update to 1.3.41.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1742927 - flrig-1.3.48 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1742927
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-18d5cee92b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
Fedora 29 Update: perl-Getopt-Long-2.51-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-3aa8db1522
2019-08-30 00:49:12.870438
--------------------------------------------------------------------------------
Name : perl-Getopt-Long
Product : Fedora 29
Version : 2.51
Release : 1.fc29
URL : https://metacpan.org/release/Getopt-Long
Summary : Extended processing of command line options
Description :
The Getopt::Long module implements an extended getopt function called
GetOptions(). It parses the command line from @ARGV, recognizing and removing
specified options and their possible values. It adheres to the POSIX syntax
for command line options, with GNU extensions. In general, this means that
options have long names instead of single letters, and are introduced with
a double dash "--". Support for bundling of command line options, as was the
case with the more traditional single-letter approach, is provided but not
enabled by default.
--------------------------------------------------------------------------------
Update Information:
This release fixes incremental option processing, handling "--" with
pass_through option, and warnings when getting options adter calling VERSION()
method. It also corrects documentation regarding callback objects and <>
operator.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Aug 13 2019 Petr Pisar <ppisar(a)redhat.com> - 1:2.51-1
- 2.51 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1740546 - Upgrade perl-Getopt-Long to 2.51
https://bugzilla.redhat.com/show_bug.cgi?id=1740546
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-3aa8db1522' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
[SECURITY] Fedora 29 Update: kde-settings-29.1-1.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-39d23c7a94
2019-08-30 00:49:12.870421
--------------------------------------------------------------------------------
Name : kde-settings
Product : Fedora 29
Version : 29.1
Release : 1.fc29
URL : https://github.com/FedoraKDE/kde-settings
Summary : Config files for kde
Description :
Config files for kde.
--------------------------------------------------------------------------------
Update Information:
This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in
the compatibility library `kdelibs` 4 used by legacy applications (not yet
ported to KDE Frameworks 5). The included `kde-settings` update removes obsolete
settings that conflict with the security fix and are no longer needed (see below
for details). The full list of fixes in the `kdelibs` 4 build: * fixes
**CVE-2019-14744 (#1740138, #1740140)** ��� `kconfig`: malicious `.desktop` files
(and others) would execute code. KConfig had a well-meaning feature that allowed
configuration files to execute arbitrary shell commands. Unfortunately, this
could be abused by untrusted `.desktop` files to execute arbitrary code as the
target user, without the user even running the `.desktop` file. Therefore, this
update removes that ill-fated feature. (Patch from upstream: `kf5-kconfig` fix
by David Faure, `kdelibs` 4 backport by Kai Uwe Broulik.) * fixes **#917848** ���
removes support for the `gamin` file watching service which is unmaintained and
buggy and can lead to application lockups. KDirWatch now relies exclusively on
`inotify` (directly). (Packaging fix by Rex Dieter.) * fixes **#1730770** ���
removes an unused dependency on the obsolete `xf86misc` library. (Packaging fix
by Kevin Kofler.) The fixes in the `kde-settings` build remove settings that
were calling `xdg-user-dir`, because the above CVE-2019-14744 fix drops support
for running shell commands from configuration files from KConfig and because the
settings are all no longer needed (because they either only reproduce default
behavior or were commented out): * `/usr/share/kde-settings/kde-
profile/default/share/config/kdeglobals`, `/usr/share/kde-settings/kde-
profile/minimal/share/config/kdeglobals`: Remove the `[Paths]` section. The
`Desktop` and `Documents` directories that were set there are already detected
by default by `kdelibs` 4 (it has native support for xdg-user-dirs and does not
need the external `xdg-user-dir` command invocation), and now also by `kdelibs3
>= 3.5.10-101` (which has native xdg-user-dirs support backported). The `Trash`
setting was already commented out. * `/usr/share/kde-settings/kde-
profile/default/xdg/baloofilerc`: Delete the commented-out `folders` setting
that attempts to call `xdg-user-dir`.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 12 2019 Kevin Kofler <Kevin(a)tigcc.ticalc.org> 29.1-1
- Remove settings that call xdg-user-dir (no longer supported by KConfig)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1740138 - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
https://bugzilla.redhat.com/show_bug.cgi?id=1740138
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-39d23c7a94' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months
[SECURITY] Fedora 29 Update: kdelibs-4.14.38-15.fc29
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-39d23c7a94
2019-08-30 00:49:12.870421
--------------------------------------------------------------------------------
Name : kdelibs
Product : Fedora 29
Version : 4.14.38
Release : 15.fc29
URL : http://www.kde.org/
Summary : KDE Libraries
Description :
Libraries for KDE 4.
--------------------------------------------------------------------------------
Update Information:
This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in
the compatibility library `kdelibs` 4 used by legacy applications (not yet
ported to KDE Frameworks 5). The included `kde-settings` update removes obsolete
settings that conflict with the security fix and are no longer needed (see below
for details). The full list of fixes in the `kdelibs` 4 build: * fixes
**CVE-2019-14744 (#1740138, #1740140)** ��� `kconfig`: malicious `.desktop` files
(and others) would execute code. KConfig had a well-meaning feature that allowed
configuration files to execute arbitrary shell commands. Unfortunately, this
could be abused by untrusted `.desktop` files to execute arbitrary code as the
target user, without the user even running the `.desktop` file. Therefore, this
update removes that ill-fated feature. (Patch from upstream: `kf5-kconfig` fix
by David Faure, `kdelibs` 4 backport by Kai Uwe Broulik.) * fixes **#917848** ���
removes support for the `gamin` file watching service which is unmaintained and
buggy and can lead to application lockups. KDirWatch now relies exclusively on
`inotify` (directly). (Packaging fix by Rex Dieter.) * fixes **#1730770** ���
removes an unused dependency on the obsolete `xf86misc` library. (Packaging fix
by Kevin Kofler.) The fixes in the `kde-settings` build remove settings that
were calling `xdg-user-dir`, because the above CVE-2019-14744 fix drops support
for running shell commands from configuration files from KConfig and because the
settings are all no longer needed (because they either only reproduce default
behavior or were commented out): * `/usr/share/kde-settings/kde-
profile/default/share/config/kdeglobals`, `/usr/share/kde-settings/kde-
profile/minimal/share/config/kdeglobals`: Remove the `[Paths]` section. The
`Desktop` and `Documents` directories that were set there are already detected
by default by `kdelibs` 4 (it has native support for xdg-user-dirs and does not
need the external `xdg-user-dir` command invocation), and now also by `kdelibs3
>= 3.5.10-101` (which has native xdg-user-dirs support backported). The `Trash`
setting was already commented out. * `/usr/share/kde-settings/kde-
profile/default/xdg/baloofilerc`: Delete the commented-out `folders` setting
that attempts to call `xdg-user-dir`.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 12 2019 Kevin Kofler <Kevin(a)tigcc.ticalc.org> - 6:4.14.38-15
- apply upstream fix for CVE-2019-14744 (KConfig shell code execution, #1740140)
* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 6:4.14.38-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Wed Jul 17 2019 Kevin Kofler <Kevin(a)tigcc.ticalc.org> - 6:4.14.38-13
- drop obsolete xf86misc dependency (#1730770)
* Thu May 16 2019 Rex Dieter <rdieter(a)fedoraproject.org> - 6:4.14.38-12
- drop gamin support, too buggy (#917848)
* Thu Apr 11 2019 Richard Shaw <hobbes1069(a)gmail.com> - 6:4.14.38-11
- Rebuild for OpenEXR 2.3.0.
* Fri Feb 1 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 6:4.14.38-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1740138 - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
https://bugzilla.redhat.com/show_bug.cgi?id=1740138
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-39d23c7a94' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 9 months