The following Fedora 32 Security updates need testing: Age URL 81 https://bodhi.fedoraproject.org/updates/FEDORA-2020-1f643c272c libntlm-1.6-1.fc32 5 https://bodhi.fedoraproject.org/updates/FEDORA-2021-d9faeff8eb chromium-87.0.4280.141-1.fc32 4 https://bodhi.fedoraproject.org/updates/FEDORA-2021-880aa7bd27 python-pillow-7.0.0-5.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-77a4202036 dotnet3.1-3.1.111-1.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-de45e7bb88 wavpack-5.4.0-1.fc32 1 https://bodhi.fedoraproject.org/updates/FEDORA-2021-02996612f6 php-pear-1.10.12-5.fc32 1 https://bodhi.fedoraproject.org/updates/FEDORA-2021-2e4c3d5a9d dnsmasq-2.83-1.fc32
The following Fedora 32 Critical Path updates have yet to be approved: Age URL 201 https://bodhi.fedoraproject.org/updates/FEDORA-2020-ebbe0f7b25 cpio-2.13-6.fc32 41 https://bodhi.fedoraproject.org/updates/FEDORA-2020-345d2fd2aa iproute-5.9.0-1.fc32 25 https://bodhi.fedoraproject.org/updates/FEDORA-2020-66d135ac1f python3-3.8.7-1.fc32 python3-docs-3.8.7-1.fc32 17 https://bodhi.fedoraproject.org/updates/FEDORA-2021-50c22ae8fd lua-socket-3.0-0.27.rc1.fc32 13 https://bodhi.fedoraproject.org/updates/FEDORA-2021-c737118abd perl-Socket-2.031-1.fc32 13 https://bodhi.fedoraproject.org/updates/FEDORA-2021-3a21976a89 libguestfs-1.44.0-1.fc32 12 https://bodhi.fedoraproject.org/updates/FEDORA-2021-2f77ff1189 nfs-utils-2.5.2-1.rc4.fc32 9 https://bodhi.fedoraproject.org/updates/FEDORA-2021-28c15ce0f9 fwupd-1.5.5-1.fc32 5 https://bodhi.fedoraproject.org/updates/FEDORA-2021-b5281bf395 gnome-shell-3.36.8-1.fc32 mutter-3.36.8-1.fc32 4 https://bodhi.fedoraproject.org/updates/FEDORA-2021-2c61d6444b firewalld-0.8.6-1.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-de45e7bb88 wavpack-5.4.0-1.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-04c779c2f9 gtk3-3.24.24-1.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-1caeb19526 gnome-desktop3-3.36.9-1.fc32 3 https://bodhi.fedoraproject.org/updates/FEDORA-2021-ed185a9589 gjs-1.64.5-1.fc32 2 https://bodhi.fedoraproject.org/updates/FEDORA-2021-fe0038f5a5 libical-3.0.9-1.fc32 1 https://bodhi.fedoraproject.org/updates/FEDORA-2021-2e4c3d5a9d dnsmasq-2.83-1.fc32 1 https://bodhi.fedoraproject.org/updates/FEDORA-2021-233f90324a gdisk-1.0.6-1.fc32 1 https://bodhi.fedoraproject.org/updates/FEDORA-2021-61011a635e rdma-core-33.0-1.fc32
The following builds have been pushed to Fedora 32 updates-testing
bpython-0.20.1-1.fc32 btrfs-progs-5.10-1.fc32 caribou-0.4.21-24.fc32 conmon-2.0.25-1.fc32 erlang-22.3.4.15-1.fc32 ipsilon-2.1.0-16.git20200618.c90a76b.fc32 jmtpfs-0.5-2.fc32 kernel-5.10.9-100.fc32 kernel-headers-5.10.9-100.fc32 kernel-tools-5.10.9-100.fc32 komikku-0.25.1-1.fc32 mozilla-noscript-11.1.9-1.fc32 mozilla-ublock-origin-1.32.4-1.fc32 nodejs-packaging-2021.01-2.fc32 php-horde-Horde-SessionHandler-2.3.0-1.fc32 python39-3.9.1-2.fc32 quilter-3.0.1-1.fc32 rubygem-gettext-3.3.7-1.fc32 rubygem-native-package-installer-1.1.1-1.fc32 unixcw-3.6.0-1.fc32
Details about builds:
================================================================================ bpython-0.20.1-1.fc32 (FEDORA-2021-d2e293f54c) Fancy curses interface to the Python interactive interpreter -------------------------------------------------------------------------------- Update Information:
Update to latest upstream release bpython 0.20.1. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Terje Rosten terje.rosten@ntnu.no - 0.20.1-1 - 0.20.1 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1896548 - bpython-0.20.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1896548 --------------------------------------------------------------------------------
================================================================================ btrfs-progs-5.10-1.fc32 (FEDORA-2021-002891b7f1) Userspace programs for btrfs -------------------------------------------------------------------------------- Update Information:
Changelog: * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if avaialble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to tolpevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Neal Gompa ngompa13@gmail.com - 5.10-1 - New upstream release * Fri Jan 15 2021 Igor Raits ignatenkobrain@fedoraproject.org - 5.10~rc1-1 - Update to 5.10-rc1 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1892166 - btrfsck segfaults on root 5 missing its root dir, recreating https://bugzilla.redhat.com/show_bug.cgi?id=1892166 [ 2 ] Bug #1917610 - btrfs-progs-5.10 is available https://bugzilla.redhat.com/show_bug.cgi?id=1917610 --------------------------------------------------------------------------------
================================================================================ caribou-0.4.21-24.fc32 (FEDORA-2021-a329375dd2) A simplified in-place on-screen keyboard -------------------------------------------------------------------------------- Update Information:
- Fix issue with X -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 13 2021 Leigh Scott leigh123linux@gmail.com - 0.4.21-24 - Fix last commit * Wed Jan 13 2021 Leigh Scott leigh123linux@gmail.com - 0.4.21-23 - Patch to fix crash * Mon Jul 27 2020 Fedora Release Engineering releng@fedoraproject.org - 0.4.21-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue May 26 2020 Miro Hron��ok mhroncok@redhat.com - 0.4.21-21 - Rebuilt for Python 3.9 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1918515 - [abrt] cinnamon-screensaver: __strlen_avx2(): cinnamon-screensaver-pam-helper killed by SIGSEGV https://bugzilla.redhat.com/show_bug.cgi?id=1918515 --------------------------------------------------------------------------------
================================================================================ conmon-2.0.25-1.fc32 (FEDORA-2021-b4f0f3b8dd) OCI container runtime monitor -------------------------------------------------------------------------------- Update Information:
Autobuilt v2.0.25 ---- Autobuilt v2.0.24 ---- Autobuilt v2.0.23 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 RH Container Bot rhcontainerbot@fedoraproject.org - 2:2.0.25-1 - autobuilt v2.0.25 * Thu Jan 14 2021 RH Container Bot rhcontainerbot@fedoraproject.org - 2:2.0.24-1 - autobuilt v2.0.24 * Thu Jan 14 2021 RH Container Bot rhcontainerbot@fedoraproject.org - 2:2.0.23-1 - autobuilt v2.0.23 --------------------------------------------------------------------------------
================================================================================ erlang-22.3.4.15-1.fc32 (FEDORA-2021-c0bac193c3) General-purpose programming language and runtime environment -------------------------------------------------------------------------------- Update Information:
Erlang ver. 22.3.4.15 ---- Erlang ver. 22.3.4.14 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Peter Lemenkov lemenkov@gmail.com - 22.3.4.15-1 - Ver. 22.3.4.15 * Wed Jan 13 2021 Peter Lemenkov lemenkov@gmail.com - 22.3.4.14-1 - Ver. 22.3.4.14 --------------------------------------------------------------------------------
================================================================================ ipsilon-2.1.0-16.git20200618.c90a76b.fc32 (FEDORA-2021-03c15b6217) An Identity Provider Server -------------------------------------------------------------------------------- Update Information:
Add missing dependency -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Nils Philippsen nils@redhat.com - 2.1.0-16.git20200618.c90a76b - Let saml2-base subpackage require openssl * Tue Jul 28 2020 Fedora Release Engineering releng@fedoraproject.org - 2.1.0-15.git20200618.c90a76b - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ jmtpfs-0.5-2.fc32 (FEDORA-2021-d73a1ada4e) FUSE and libmtp based filesystem for accessing MTP devices -------------------------------------------------------------------------------- Update Information:
- Added patch to avoid MtpErrorCantOpenDevice crash (#1871442) -------------------------------------------------------------------------------- ChangeLog:
* Thu Jan 7 2021 Robert Scheck robert@fedoraproject.org 0.5-2 - Added patch to avoid MtpErrorCantOpenDevice crash (#1871442) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1871442 - jmtpfs: crashes when started https://bugzilla.redhat.com/show_bug.cgi?id=1871442 --------------------------------------------------------------------------------
================================================================================ kernel-5.10.9-100.fc32 (FEDORA-2021-b7286258be) The Linux kernel -------------------------------------------------------------------------------- Update Information:
The 5.10.9 stable kernel update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Justin M. Forbes jforbes@fedoraproject.org - 5.10.9-100 - Linux v5.10.9 --------------------------------------------------------------------------------
================================================================================ kernel-headers-5.10.9-100.fc32 (FEDORA-2021-b7286258be) Header files for the Linux kernel for use by glibc -------------------------------------------------------------------------------- Update Information:
The 5.10.9 stable kernel update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Justin M. Forbes jforbes@fedoraproject.org - 5.10.9-100 - Linux v5.10.9 --------------------------------------------------------------------------------
================================================================================ kernel-tools-5.10.9-100.fc32 (FEDORA-2021-b7286258be) Assortment of tools for the Linux kernel -------------------------------------------------------------------------------- Update Information:
The 5.10.9 stable kernel update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Justin M. Forbes jforbes@fedoraproject.org - 5.10.9-100 - Linux v5.10.9 --------------------------------------------------------------------------------
================================================================================ komikku-0.25.1-1.fc32 (FEDORA-2021-0c2806077e) Online/offline manga reader for GNOME -------------------------------------------------------------------------------- Update Information:
Update to 0.25.1 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Artem Polishchuk ego.cordatus@gmail.com - 0.25.1-1 - build(update): 0.25.1 --------------------------------------------------------------------------------
================================================================================ mozilla-noscript-11.1.9-1.fc32 (FEDORA-2021-ab08c0b063) JavaScript white list extension for Mozilla Firefox -------------------------------------------------------------------------------- Update Information:
v 11.1.9 ============================================================ * Return null when webgl is not allowed (thanks Matthew Finkel for patch) * [XSS] Fixed memoization bug resulting in performance degradation on some payloads * [XSS] Include call stack in debugging log output * [XSS] Skip naps when InjectionChecker runs in its own worker * Shortcut for easier XSS filter testing * More lenient filter to add a new entry to per-site permissions * [L10n] Updated de * Replace script-embedded bitmap with css-embedded SVG as the placeholder logo * Updated TLDs * Remove source map reference causing console noise * Fix per-site permissions UI glitches when base domain is added to existing subdomain (thanks barbaz for reporting) v 11.1.8 ============================================================ * [XSS] Fix for old pre-screening optimization exploitable to bypass the filter in recent browsers - thanks Tsubasa FUJII (@reinforchu) for reporting * Replace DOM-based entity decoding with the he.js pure JS library * Updated copyright statement * Updated browser-polyfill.js * Removed obsolete fastclick.js dependency * [l10n] Updated de (thanks ib and Musonius) * Updated TLDs -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Dominik Mierzejewski rpm@greysector.net - 11.1.9-1 - update to 11.1.9 (#1914007) - polyfill was updated - fastclick is no longer included -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1914007 - mozilla-noscript-11.1.9 is available https://bugzilla.redhat.com/show_bug.cgi?id=1914007 --------------------------------------------------------------------------------
================================================================================ mozilla-ublock-origin-1.32.4-1.fc32 (FEDORA-2021-f3fecdad7b) An efficient blocker for Firefox -------------------------------------------------------------------------------- Update Information:
**New:** Ability to launch element picker into embedded frames, through a new "Block element in frame..." entry in the contextual menu. Support for match- case filter option, but only for regex-based static network filters. Ability to auto-complete (<kbd>Ctrl</kbd>-<kbd>Spacebar</kbd>) hostname values for origin- related options in static filter editor according to currently opened tabs. **Click-to-load** Support to replace embedded frames with a click-to-load widget. Examples of usage: ``` ||youtube.com/embed/$3p,frame,redirect=click2load.html ||scribd.com/embeds/$3p,frame,redirect=click2load.html ||player.vimeo.com/video/$3p,frame,redirect=click2load.html ``` Users of medium mode can experiment with a redirect rule to reveal embedded frames in a page: ``` *$3p,frame,redirect-rule=click2load.html ``` Or if you want to have click- to-load only for embedded widgets from specific origins being blocked (reminder: redirect-rule does not create a block filter): ``` ||youtube.com/embed/$3p,frame,redirect-rule=click2load.html ``` -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Dominik Mierzejewski rpm@greysector.net - 1.32.4-1 - update to 1.32.4 (#1918447) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1918447 - mozilla-ublock-origin-1.32.5b11 is available https://bugzilla.redhat.com/show_bug.cgi?id=1918447 --------------------------------------------------------------------------------
================================================================================ nodejs-packaging-2021.01-2.fc32 (FEDORA-2021-a6708a5ad2) RPM Macros and Utilities for Node.js Packaging -------------------------------------------------------------------------------- Update Information:
Updated Node.js packaging helpers corresponding to the latest [guidelines](https://docs.fedoraproject.org/en-US/packaging-guidelines/Node.js/) -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Stephen Gallagher sgallagh@redhat.com - 2021.01-2 - nodejs-packaging-bundler improvements to handle uncommon characters * Wed Jan 6 2021 Troy Dawson tdawson@redhat.com - 2021.01 - Add nodejs-packaging-bundler and update README.md * Fri Sep 18 2020 Stephen Gallagher sgallagh@redhat.com - 2020.09-1 - Move to dist-git as the upstream --------------------------------------------------------------------------------
================================================================================ php-horde-Horde-SessionHandler-2.3.0-1.fc32 (FEDORA-2021-a8156e5ad1) Horde Session Handler API -------------------------------------------------------------------------------- Update Information:
**Horde_SessionHandler 2.3.0** * [jan] Fix tests with PHP 7.2. * [jan] Fix compatibility with PHP 7.2 (PR #2). * [jan] Implement destroy() for builtin session handler. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Remi Collet remi@remirepo.net - 2.3.0-1 - update to 2.3.0 - add patch for test suite from https://github.com/horde/SessionHandler/pull/3 - use weak and range dependencies --------------------------------------------------------------------------------
================================================================================ python39-3.9.1-2.fc32 (FEDORA-2021-e3a5a74610) Version 3.9 of the Python interpreter -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2021-3177. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Miro Hron��ok mhroncok@redhat.com - 3.9.1-2 - Security fix for CVE-2021-3177 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1918168 - CVE-2021-3177 python: buffer overflow in PyCArg_repr in _ctypes/callproc.c may lead to RCE https://bugzilla.redhat.com/show_bug.cgi?id=1918168 --------------------------------------------------------------------------------
================================================================================ quilter-3.0.1-1.fc32 (FEDORA-2021-576f7facb4) Focus on your writing -------------------------------------------------------------------------------- Update Information:
Update to latest version -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Artem Polishchuk ego.cordatus@gmail.com - 3.0.1-1 - build(update): 3.0.1 --------------------------------------------------------------------------------
================================================================================ rubygem-gettext-3.3.7-1.fc32 (FEDORA-2021-1ea3481db8) RubyGem of Localization Library and Tools for Ruby -------------------------------------------------------------------------------- Update Information:
New version 3.3.7 is released. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Mamoru TASAKA mtasaka@fedoraproject.org - 3.3.7-1 - 3.3.7 - Remove irb dependency --------------------------------------------------------------------------------
================================================================================ rubygem-native-package-installer-1.1.1-1.fc32 (FEDORA-2021-b3cd7860d3) Native packages installation helper -------------------------------------------------------------------------------- Update Information:
New version 1.1.1 is released. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 20 2021 Mamoru TASAKA mtasaka@fedoraproject.org - 1.1.1-1 - 1.1.1 * Wed Jul 29 2020 Fedora Release Engineering releng@fedoraproject.org - 1.0.9-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ unixcw-3.6.0-1.fc32 (FEDORA-2021-ab95ec4f81) Shared library for Morse programs -------------------------------------------------------------------------------- Update Information:
Release of unixcw version 3.6.0. Changes since version 3.5.1: libcw: libcw no longer uses signals (and SIGALRM in particular) for any internal purpose. Internal communication between generator and queue has been re-implemented using other mechanism: pthread_cond_wait() and pthread_cond_broadcast(). In relation to the above, in order to avoid calling of pthread_cond_wait() and pthread_cond_broadcast() in signal handlers, the SIG_IGN and SIG_DFL values registered with cw_register_signal_handler() are completely ignored. It is strongly advised to avoid any libcw cleanup or calls to exit() in signal handlers (registered with either with cw_register_signal_handler() or with more direct methods). Enabling ALSA's configuration of HW period size. libcw's ALSA code now tries to configure HW period size to be smaller than in previous versions of code. Normally the period size could be in range of hundreds of frames, now it's possible to have the period size of tens, or low hundreds of frames. Decreased period size should lead to better behaviour of ALSA's writei() function: the function should now properly block during write of samples to ALSA handle in all circumstances. Correct blocking behaviour of writei() should lead to correct behaviour of libcw's internal keying mechanism, responsible e.g. for calling keying callbacks registered by programs using libcw (such as cwdaemon). Such callbacks will be now called at proper time intervals that match duration of enqueued dots/dashes/spaces. Initial report of incorrect behaviour, initial debugging, and confirmation of a fix come from Matthew M5EVT. Thanks Matthew! ALSA period size (in samples) used by applications (cw, cwcp, xcwcp) can be specified in command line through --alsa-period-size command line arg. Modifying PulseAudio parameters to decrease XRUNS and improve behaviour of callback registered by client code in library. Integrating these two commits from Matthew M5EVT https://github.com/m5evt/unixcw-3.5.1/commit/2d5491a461587ac4 686e2d1b897619c98be05c9e https://github.com/m5evt/unixcw-3.5.1/commit/c86785b595 a6d711aae915150df2ccb848ace05c The result is a better behaviour of PulseAudio sound sink, a bit similar to ALSA improvements mentioned above. Thanks again, Matthew! Behaviour of cw_lookup_phonetic() library function has been modified: the function now accepts NULL as a second argument (output buffer). Several items in libcw_debug.h are marked as deprecated. These items should be used only internally, during development of libcw, and should not be used by client code. They will be removed from the header in the future. Declaration of cw_debug_print_flags() has been removed from libcw_debug.h header. The function was not defined in the library, so no one could have used the function. Function cw_generator_set_tone_slope() from libcw.h is now marked as deprecated. The function was/is unusable because there is no way that client code can pass a cw_gen_t variable as first argument. Replacing some usages of double type with float type. There is very little (or maybe even nothing) in the library that would require precision or range of double. Adding new function: cw_generator_remove_last_character(). The function removes last character enqueued to generator, it can be called multiple times to remove a group of characters. The function can be used e.g. in reaction to Backspace character pressed in User Interface. This functionality was implemented by Zoltan Csahok and merged here: https://sourceforge.net/p/unixcw/code/merge-requests/1/, but it has been rewritten a bit: removing of character must be explicit, through the function call. The initial solution was affecting which characters are classified by libcw as valid and which aren't, and it may have broken some legacy code. Also using Backspace to remove a character is a User Interface concept, which in cwcp and xcwcp is handled explicitly by UI code, not implicitly by library code. Therefore I decided to rework the initial solution and add the new function to library. Modifications to receiver functions: cw_receive_character(), cw_receive_representation(), cw_start_receive_tone() and cw_end_receive_tone() are now actually setting errno to EINVAL (as described in documentation) when they detect that input timestamp (when the timestamp is non- NULL) is in some way invalid. cw_receive_buffer_dot() and cw_receive_buffer_dash() set additional value of errno (EINVAL) when they detect that input timestamp (when the timestamp is non-NULL) is in some way invalid. Please review information in man page about errno values set by these functions. cw_wait_for_tone_queue_critical() now sets errno to EINVAL and returns CW_FAILURE if function's argument is negative. There is a hard limit on length of name of sound device: 127 characters (+1 for terminating NUL). Fixing Debian bug #979113 (https://bugs.debian.org/979113). Library soname/version changed from 6.6.1 to 7.0.0. xcwcp: Program's command line option "--sound" has been changed to "--system", for consistency with similar option in other unixcw programs. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 19 2021 Richard Shaw hobbes1069@gmail.com - 3.6.0-1 - Update to 3.6.0. * Wed Jul 29 2020 Fedora Release Engineering releng@fedoraproject.org - 3.5.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1917162 - unixcw-3.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1917162 --------------------------------------------------------------------------------