The following Fedora 25 Security updates need testing: Age URL 325 https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25 224 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e python-XStatic-jquery-ui-1.12.0.1-4.fc25 163 https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f nodejs-brace-expansion-1.1.7-1.fc25 117 https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c memcached-1.4.39-1.fc25 114 https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4 docker-distribution-2.6.2-1.git48294d9.fc25 35 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 29 https://bodhi.fedoraproject.org/updates/FEDORA-2017-7089c6e789 suricata-3.2.4-1.fc25 21 https://bodhi.fedoraproject.org/updates/FEDORA-2017-51f49ebbce apr-1.6.3-1.fc25 21 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f563b201ba apr-util-1.5.4-4.fc25 21 https://bodhi.fedoraproject.org/updates/FEDORA-2017-45ed341e61 httpd-2.4.29-1.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5ad4107cc fedpkg-1.30-4.fc25 rpkg-1.51-2.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-c7514691cb perl-Net-Ping-External-0.15-11.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-0188f21212 postgresql-9.5.10-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-481e4f6f8c ldns-1.6.17-22.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e5bbb657c5 chromium-62.0.3202.89-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1a9068594d python-copr-1.84-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-8016cc0bd0 backintime-1.1.24-1.fc25 3 https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd openssl-1.0.2m-1.fc25 3 https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e webkitgtk4-2.18.3-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f58bbbbdb0 konversation-1.7.4-1.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781 kernel-4.13.13-100.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-8575fbfe90 varnish-5.0.0-5.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f1535b86fa lucene4-4.10.4-11.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-580f91f6b0 qt5-qtwebengine-5.9.2-2.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5bcfedf10 mrbs-1.7.0-1.fc25
The following Fedora 25 Critical Path updates have yet to be approved: Age URL 167 https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25 47 https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fc5429e7e iproute-4.12.0-1.fc25 35 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 16 https://bodhi.fedoraproject.org/updates/FEDORA-2017-b89e9f62d8 bind99-9.9.10-3.P3.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-dbf347055a hwdata-0.306-1.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e64b02d1b1 pcre2-10.23-10.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-65b10e63d5 pungi-4.1.20-1.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ec5efbcfc6 pcre-8.41-3.fc25 10 https://bodhi.fedoraproject.org/updates/FEDORA-2017-560cebc111 menu-cache-1.1.0-1.fc25 10 https://bodhi.fedoraproject.org/updates/FEDORA-2017-a7f307017b python-lxml-4.1.1-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e82231f2c7 libglvnd-1.0.0-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 3 https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e webkitgtk4-2.18.3-1.fc25 3 https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd openssl-1.0.2m-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-15b7f781f0 nss-3.34.0-1.0.fc25 nss-softokn-3.34.0-1.0.fc25 nss-util-3.34.0-1.0.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781 kernel-4.13.13-100.fc25 1 https://bodhi.fedoraproject.org/updates/FEDORA-2017-dc8c38e976 man-db-2.7.5-6.fc25
The following builds have been pushed to Fedora 25 updates-testing
fedfind-3.8.2-1.fc25 ignuit-2.24.3-1.fc25 module-build-service-1.5.0-1.fc25 mrbs-1.7.0-1.fc25 python-mwclient-0.8.6-1.fc25 python-pytest-httpbin-0.3.0-1.fc25 python-wikitcms-2.2.1-1.fc25 python-xapp-1.0.1-7.fc25 qt5-qtwebengine-5.9.2-2.fc25 redis-4.0.2-2.fc25 relval-2.2.0-1.fc25 slick-greeter-1.1.1-1.fc25
Details about builds:
================================================================================ fedfind-3.8.2-1.fc25 (FEDORA-2017-a113080467) Fedora compose and image finder -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. fedfind 3.8.1 returns to using the pkgdb `collections` API end point for `get_current_release`, as it is now being manually updated until PDC is ready to replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for modular composes, and `get_package_nvras` with Python 3 (it previously raised an exception for all composes in Python 3, and modular composes in Python 2). python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora wikis are being converted to use only OpenID Connect authentication, with standard mediawiki authentication disabled. --------------------------------------------------------------------------------
================================================================================ ignuit-2.24.3-1.fc25 (FEDORA-2017-8773729fd1) Memorization aid based on the Leitner flashcard system -------------------------------------------------------------------------------- Update Information:
Update to new upstream version 2.24.3 (rhbz#1514436) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1514436 - ignuit-2.24.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1514436 --------------------------------------------------------------------------------
================================================================================ module-build-service-1.5.0-1.fc25 (FEDORA-2017-c700241c98) The Module Build Service for Modularity -------------------------------------------------------------------------------- Update Information:
Changes: * Fix an issue where the latest ref for a branch wasn't being used * Fixes the issue where builds stay in the "build" state even though they've had a component fail * Set the timeout on Koji sessions to 10 minutes (this will help during outages) * Transition stale failed builds to the "garbage" state and untag their components (after 180 days of inactivity) * Add a "short" query parameter to show less detail on the "module-builds" API ---- Changes: * Change the MBS builders into setuptools plugins so now you can now create your own builder plugin * Updated some documentation * mbs-build local now builds only from yaml files (this bypasses the need for SCM) * Only complete the module build when all components are tagged and a KojiRepoRegen message is received * Don't trigger init handler when importing a local build and mark the build as done after import * Validate component git refs when a commit is explicitly stated in the modulemd before starting the module build * Set Access-Control- Allow-Origin to "*" on GET API routes * Fix duplicate module build state traces * Make the module build log name configurable --------------------------------------------------------------------------------
================================================================================ mrbs-1.7.0-1.fc25 (FEDORA-2017-b5bcfedf10) Meeting Room Booking System -------------------------------------------------------------------------------- Update Information:
Changes since MRBS 1.6.1: - Fixed a number of security issues in MRBS that were disclosed to the project by SySS GmbH, including XSS, CSRF protection and session fixation. - Improved behaviour of browser caching in MRBS. - Improved localisation, especially the use of colons in labels. - Added new config variable $weekdays to define weekdays and weekends, allowing for the possibility that weekdays are not the same as working days. - MRBS now restricts form actions which modify data/pass passwords to only accept POSTs. - Added the ability to have different period names in each area. - Add SAML auth and session schemes, thanks to J��rn ��ne. - Updated to jQuery 3.2.1 and jQueryUI 1.12.1, which includes XSS fixes. - Plus a few other bug fixes/improvements. - Dropped support for Internet Explorer 9 and lower. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1514285 - mrbs-1.7.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1514285 --------------------------------------------------------------------------------
================================================================================ python-mwclient-0.8.6-1.fc25 (FEDORA-2017-b79de50946) Mwclient is a client to the MediaWiki API -------------------------------------------------------------------------------- Update Information:
This update provides the latest upstream release of mwclient, with various enhancements and bug fixes, notably for Semantic Mediawiki support. Please see the [upstream release notes](https://github.com/mwclient/mwclient/releases) for more details. I don't believe any of the changes should break compatibility in any way. Note that the previous "0.8.4" builds of mwclient were in fact still 0.8.3 due to an error on my part, so this update includes the changes from 0.8.4 as well as 0.8.5 and 0.8.6. --------------------------------------------------------------------------------
================================================================================ python-pytest-httpbin-0.3.0-1.fc25 (FEDORA-2017-0c80a9f880) Fixture providing local instance of httpbin test service -------------------------------------------------------------------------------- Update Information:
This update provides a new release of pytest-httpbin. It adds some new features, including one requested by @hroncok. It should not have any backward compatibility issues. For Fedora 27, the update also includes a new build of python-httpbin. The python-pytest-httpbin test suite belatedly discovered that `python-httpbin-0.6.2-1` had several setuptools dependency issues. Those are resolved in this build. --------------------------------------------------------------------------------
================================================================================ python-wikitcms-2.2.1-1.fc25 (FEDORA-2017-a113080467) Fedora QA wiki test management Python library -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. fedfind 3.8.1 returns to using the pkgdb `collections` API end point for `get_current_release`, as it is now being manually updated until PDC is ready to replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for modular composes, and `get_package_nvras` with Python 3 (it previously raised an exception for all composes in Python 3, and modular composes in Python 2). python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora wikis are being converted to use only OpenID Connect authentication, with standard mediawiki authentication disabled. --------------------------------------------------------------------------------
================================================================================ python-xapp-1.0.1-7.fc25 (FEDORA-2017-2f8aa9a9a1) Python bindings for xapps -------------------------------------------------------------------------------- Update Information:
* Use unified macros for Python3 --------------------------------------------------------------------------------
================================================================================ qt5-qtwebengine-5.9.2-2.fc25 (FEDORA-2017-580f91f6b0) Qt5 - QtWebEngine components -------------------------------------------------------------------------------- Update Information:
An update of QtWebEngine to the security and bugfix release 5.9.2, including: Chromium Snapshot: * Security fixes from Chromium up to version 61.0.3163.79 Including: CVE-2017-5092, CVE-2017-5093, CVE-2017-5095, CVE-2017-5097, CVE-2017-5099, CVE-2017-5102, CVE-2017-5103, CVE-2017-5107, CVE-2017-5112, CVE-2017-5114, CVE-2017-5117 and CVE-2017-5118 * Fixed Skia to to render text correctly with FreeType 2.8.1 * [QTBUG-50389] Fixed assert on some flash content QtWebEngine: * [QTBUG-57505] Handle --force-webrtc-ip-handling-policy on command-line * [QTBUG-58306] Fixed handling of menu key * [QTBUG-60790] Fixed dragging images to desktop * [QTBUG-61354] Set referrer on download requests * [QTBUG-61429] Fixed cancelling IME composition * [QTBUG-61506] Stop searching when navigating away * [QTBUG-61910] Fixed an issue where system proxy settings were not picked up correctly * [QTBUG-62112] Fixed upside-down rendering in software rendering mode * [QTBUG-62112] Fixed rendering of content with preserve-3d in CSS * [QTBUG-62311] Fixed hang when exiting with open combobox * [QTBUG-62808] Handle --explicitly-allowed-ports on command-line * [QTBUG-62898] Fixed accessing webchannels from document-creation user-scripts after navigation. * [QTBUG-62942] Fixed committing IME composition on touch events QWebEngineView: * [QTBUG-61621] Fixed propagation of unhandled key press events WebEngineView: * The callback version of printToPdf is now called with a proper bytearray result instead of a PDF data in a javascript string. Platform Specific Changes: * [QTBUG-61528, QTBUG-62673] Fixed various multilib build configurations * [QTBUG-61846] Fixed host builds on Arm and MIPS --------------------------------------------------------------------------------
================================================================================ redis-4.0.2-2.fc25 (FEDORA-2017-343c274808) A persistent key-value database -------------------------------------------------------------------------------- Update Information:
Update to Redis 4.0.2 upstream release. ---- Upstream 3.2.11 bug-fix-only release -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1172841 - Service start returns success even when service fails to start https://bugzilla.redhat.com/show_bug.cgi?id=1172841 [ 2 ] Bug #788500 - redis bundles jemalloc and hiredis and lua https://bugzilla.redhat.com/show_bug.cgi?id=788500 --------------------------------------------------------------------------------
================================================================================ relval-2.2.0-1.fc25 (FEDORA-2017-a113080467) Tool for interacting with Fedora QA wiki pages -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. fedfind 3.8.1 returns to using the pkgdb `collections` API end point for `get_current_release`, as it is now being manually updated until PDC is ready to replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for modular composes, and `get_package_nvras` with Python 3 (it previously raised an exception for all composes in Python 3, and modular composes in Python 2). python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora wikis are being converted to use only OpenID Connect authentication, with standard mediawiki authentication disabled. --------------------------------------------------------------------------------
================================================================================ slick-greeter-1.1.1-1.fc25 (FEDORA-2017-e7101fe4b3) A slick-looking LightDM greeter -------------------------------------------------------------------------------- Update Information:
* New upstream release -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1514464 - slick-greeter-1.1.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1514464 --------------------------------------------------------------------------------