The following Fedora 38 Security updates need testing: Age URL 263 https://bodhi.fedoraproject.org/updates/FEDORA-2023-aaa2b3d20b containerd-1.6.23-1.fc38 109 https://bodhi.fedoraproject.org/updates/FEDORA-2024-4ef97ebbfc python-pillow-9.5.0-3.fc38 5 https://bodhi.fedoraproject.org/updates/FEDORA-2024-48123e7aae mingw-python-werkzeug-2.2.3-2.fc38 5 https://bodhi.fedoraproject.org/updates/FEDORA-2024-e0b30915ee buildah-1.35.4-1.fc38 1 https://bodhi.fedoraproject.org/updates/FEDORA-2024-6dd1f32f22 firefox-126.0-5.fc38
The following Fedora 38 Critical Path updates have yet to be approved: Age URL 13 https://bodhi.fedoraproject.org/updates/FEDORA-2024-99a50e0666 crun-1.15-1.fc38 13 https://bodhi.fedoraproject.org/updates/FEDORA-2024-076ddb0c6c java-17-openjdk-17.0.11.0.9-1.fc38 9 https://bodhi.fedoraproject.org/updates/FEDORA-2024-133484fa74 hwdata-0.382-1.fc38 9 https://bodhi.fedoraproject.org/updates/FEDORA-2024-fa6b29667c kobo-0.36.2-1.fc38 8 https://bodhi.fedoraproject.org/updates/FEDORA-2024-6dc419138b appstream-data-38-9.fc38 8 https://bodhi.fedoraproject.org/updates/FEDORA-2024-abaf3a05fa libsolv-0.7.29-1.fc38 7 https://bodhi.fedoraproject.org/updates/FEDORA-2024-8dfd149f10 plasma-discover-5.27.11-3.fc38 5 https://bodhi.fedoraproject.org/updates/FEDORA-2024-4a327d0aa1 osinfo-db-20240510-1.fc38 2 https://bodhi.fedoraproject.org/updates/FEDORA-2024-785c5a8995 passt-0^20240510.g7288448-1.fc38 2 https://bodhi.fedoraproject.org/updates/FEDORA-2024-1b136774c6 linux-firmware-20240513-1.fc38 1 https://bodhi.fedoraproject.org/updates/FEDORA-2024-6dd1f32f22 firefox-126.0-5.fc38
The following builds have been pushed to Fedora 38 updates-testing
bgpq4-1.15-1.fc38 cekit-4.12.0-1.fc38 chromium-125.0.6422.60-1.fc38 dotnet6.0-6.0.130-1.fc38 dotnet7.0-7.0.119-1.fc38 python-jinja2-3.1.4-1.fc38 skopeo-1.15.1-1.fc38 virtualbox-guest-additions-7.0.18-1.fc38
Details about builds:
================================================================================ bgpq4-1.15-1.fc38 (FEDORA-2024-08542449cd) Automate BGP filter generation based on routing database information -------------------------------------------------------------------------------- Update Information:
bgpq4 1.15 Apologies, debug code slipped into the last release bgpq4 1.14 Small performance gain: set TCP_NODELAY on the socket -------------------------------------------------------------------------------- ChangeLog:
* Wed May 15 2024 Robert Scheck robert@fedoraproject.org 1.15-1 - Upgrade to 1.15 * Wed May 15 2024 Robert Scheck robert@fedoraproject.org 1.14-1 - Upgrade to 1.14 --------------------------------------------------------------------------------
================================================================================ cekit-4.12.0-1.fc38 (FEDORA-2024-34314a100e) Container image creation tool -------------------------------------------------------------------------------- Update Information:
CEKit 4.12.0 release -------------------------------------------------------------------------------- ChangeLog:
* Thu May 16 2024 Nick Cross ncross@redhat.com - 4.12.0-1 - Release 4.12.0 --------------------------------------------------------------------------------
================================================================================ chromium-125.0.6422.60-1.fc38 (FEDORA-2024-3a548f46a8) A WebKit (Blink) powered web browser that Google doesn't want you to use -------------------------------------------------------------------------------- Update Information:
update to 125.0.6422.60 * High CVE-2024-4947: Type Confusion in V8 * High CVE-2024-4948: Use after free in Dawn * Medium CVE-2024-4949: Use after free in V8 * Low CVE-2024-4950: Inappropriate implementation in Downloads update to 124.0.6367.201 * High CVE-2024-4671: Use after free in Visuals update to 124.0.6367.155 High CVE-2024-4558: Use after free in ANGLE High CVE-2024-4559: Heap buffer overflow in WebAudio update to 124.0.6367.118 * High CVE-2024-4331: Use after free in Picture In Picture * High CVE-2024-4368: Use after free in Dawn update to 124.0.6367.91 -------------------------------------------------------------------------------- ChangeLog:
* Thu May 16 2024 Than Ngo than@redhat.com - 125.0.6422.60-1 - update to 125.0.6422.60 * High CVE-2024-4947: Type Confusion in V8 * High CVE-2024-4948: Use after free in Dawn * Medium CVE-2024-4949: Use after free in V8 * Low CVE-2024-4950: Inappropriate implementation in Downloads * Sun May 12 2024 Than Ngo than@redhat.com - 125.0.6422.41-1 - update to 125.0.6422.41 * Sat May 11 2024 Than Ngo than@redhat.com - 124.0.6367.201-2 - include headless_command_resources.pak for headless_shell * Fri May 10 2024 Than Ngo than@redhat.com - 124.0.6367.201-1 - update to 124.0.6367.201 * High CVE-2024-4671: Use after free in Visuals * Wed May 8 2024 Than Ngo than@redhat.com - 124.0.6367.155-1 - update to 124.0.6367.155 * High CVE-2024-4558: Use after free in ANGLE * High CVE-2024-4559: Heap buffer overflow in WebAudio * Sun May 5 2024 Than Ngo than@redhat.com - 124.0.6367.118-2 - fixed build errors on el8 - refreshed clean_ffmpeg.sh - added missing files for bundle ffmpeg * Wed May 1 2024 Than Ngo than@redhat.com - 124.0.6367.118-1 - update to 124.0.6367.118 * High CVE-2024-4331: Use after free in Picture In Picture * High CVE-2024-4368: Use after free in Dawn - use system highway * Sat Apr 27 2024 Than Ngo than@redhat.com - 124.0.6367.91-1 - update to 124.0.6367.91 - fixed bz#2277228 - chromium wrapper causes library issues (symbol lookup error) - use system dav1d -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2274695 - CVE-2023-49528 chromium: FFmpeg: Heap Buffer Overflow vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2274695 [ 2 ] Bug #2275841 - CVE-2024-31578 CVE-2024-31581 CVE-2024-31582 CVE-2024-31585 chromium: ffmpeg: multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2275841 [ 3 ] Bug #2276116 - CVE-2023-49501 CVE-2023-49502 CVE-2023-51791 CVE-2023-51792 CVE-2023-51793 chromium: ffmpeg: multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2276116 [ 4 ] Bug #2276123 - CVE-2023-51795 CVE-2023-51796 CVE-2023-51797 CVE-2023-51798 chromium: ffmpeg: multiple vulnerabilites [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2276123 [ 5 ] Bug #2276130 - CVE-2023-50007 CVE-2023-50008 CVE-2023-50009 CVE-2023-50010 chromium: ffmpeg: multiple vulnerabilitites [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2276130 [ 6 ] Bug #2277228 - chromium wrapper causes library issues (symbol lookup error) https://bugzilla.redhat.com/show_bug.cgi?id=2277228 [ 7 ] Bug #2278765 - CVE-2024-4331 chromium: chromium-browser: Use after free in Picture In Picture [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2278765 [ 8 ] Bug #2278766 - CVE-2024-4331 chromium: chromium-browser: Use after free in Picture In Picture [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2278766 [ 9 ] Bug #2278770 - CVE-2024-4368 chromium: chromium-browser: Use after free in Dawn [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2278770 [ 10 ] Bug #2278771 - CVE-2024-4368 chromium: chromium-browser: Use after free in Dawn [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2278771 [ 11 ] Bug #2279687 - CVE-2024-4559 chromium: chromium-browser: Heap buffer overflow in WebAudio [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2279687 [ 12 ] Bug #2279688 - CVE-2024-4559 chromium: chromium-browser: Heap buffer overflow in WebAudio [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2279688 [ 13 ] Bug #2279690 - CVE-2024-4558 chromium: chromium-browser: Use after free in ANGLE [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2279690 [ 14 ] Bug #2279691 - CVE-2024-4558 chromium: chromium-browser: Use after free in ANGLE [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2279691 [ 15 ] Bug #2280248 - CVE-2024-4671 chromium: chromium-browser: use after free in Visuals [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280248 [ 16 ] Bug #2280397 - CVE-2024-4761: Out of bounds write in V8. https://bugzilla.redhat.com/show_bug.cgi?id=2280397 [ 17 ] Bug #2280591 - CVE-2024-4761 chromium: chromium-browser: Out of bounds write in V8 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280591 [ 18 ] Bug #2280720 - High CVE-2024-4947: Type Confusion in V8 (and eight other CVEs patched in 125.0.6422.60) https://bugzilla.redhat.com/show_bug.cgi?id=2280720 --------------------------------------------------------------------------------
================================================================================ dotnet6.0-6.0.130-1.fc38 (FEDORA-2024-3c832e2f00) .NET Runtime and SDK -------------------------------------------------------------------------------- Update Information:
This is the May 2024 release of .NET 6. Release Notes: https://github.com/dotnet/core/blob/main/release- notes/6.0/6.0.30/6.0.30.md -------------------------------------------------------------------------------- ChangeLog:
* Tue May 14 2024 Omair Majid omajid@redhat.com - 6.0.130-1 - Update to .NET SDK 6.0.130 and Runtime 6.0.30 --------------------------------------------------------------------------------
================================================================================ dotnet7.0-7.0.119-1.fc38 (FEDORA-2024-bdd75e525c) .NET Runtime and SDK -------------------------------------------------------------------------------- Update Information:
This is the May 2024 security update for .NET 7. This is the last upstream release of .NET 7. After this update, .NET 7 reaches its End of Life (EOL). Full release notes: https://github.com/dotnet/core/blob/main/release- notes/7.0/7.0.19/7.0.19.md -------------------------------------------------------------------------------- ChangeLog:
* Tue May 14 2024 Omair Majid omajid@redhat.com - 7.0.119-1 - Update to .NET SDK 7.0.119 and Runtime 7.0.19 --------------------------------------------------------------------------------
================================================================================ python-jinja2-3.1.4-1.fc38 (FEDORA-2024-903edb056a) General purpose template engine -------------------------------------------------------------------------------- Update Information:
Update to 3.1.4 (rhbz#2279211,rhbz#2279491) -------------------------------------------------------------------------------- ChangeLog:
* Tue May 7 2024 Lum��r Balhar lbalhar@redhat.com - 3.1.4-1 - Update to 3.1.4 (rhbz#2279211,rhbz#2279491) * Fri Jan 26 2024 Fedora Release Engineering releng@fedoraproject.org - 3.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Mon Jan 22 2024 Fedora Release Engineering releng@fedoraproject.org - 3.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2279211 - python-jinja2-3.1.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2279211 [ 2 ] Bug #2279491 - TRIAGE CVE-2024-34064 python-jinja2: jinja2: accepts keys containing non-attribute characters [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2279491 --------------------------------------------------------------------------------
================================================================================ skopeo-1.15.1-1.fc38 (FEDORA-2024-ac7f95e81f) Inspect container images and repositories on registries -------------------------------------------------------------------------------- Update Information:
Automatic update for skopeo-1.15.1-1.fc38. Changelog for skopeo * Wed May 15 2024 Packit hello@packit.dev - 1:1.15.1-1 - Update to 1.15.1 upstream release -------------------------------------------------------------------------------- ChangeLog:
* Wed May 15 2024 Packit hello@packit.dev - 1:1.15.1-1 - Update to 1.15.1 upstream release --------------------------------------------------------------------------------
================================================================================ virtualbox-guest-additions-7.0.18-1.fc38 (FEDORA-2024-051fa17e43) VirtualBox Guest Additions -------------------------------------------------------------------------------- Update Information:
Update virtualbox-guest-additions to 7.0.18 (#2278895) -------------------------------------------------------------------------------- ChangeLog:
* Thu May 16 2024 S��rgio Basto sergio@serjux.com - 7.0.18-1 - Update virtualbox-guest-additions to 7.0.18 (#2278895) * Thu Apr 18 2024 S��rgio Basto sergio@serjux.com - 7.0.16-1 - Update virtualbox-guest-additions to 7.0.16 (#2275339) * Sat Jan 27 2024 Fedora Release Engineering releng@fedoraproject.org - 7.0.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2278895 - virtualbox-guest-additions-7.0.18 is available https://bugzilla.redhat.com/show_bug.cgi?id=2278895 --------------------------------------------------------------------------------
test-reports@lists.fedoraproject.org