The following Fedora 35 Security updates need testing:
Age URL
265
https://bodhi.fedoraproject.org/updates/FEDORA-2022-dfc6924a11
mysql-connector-java-8.0.28-1.fc35
36
https://bodhi.fedoraproject.org/updates/FEDORA-2022-58055cb1ef
nodejs-16.17.1-1.fc35
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-39688a779d curl-7.79.1-7.fc35
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec7de69ceb
java-latest-openjdk-19.0.1.0.10-2.rolling.fc35
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-f1aed93db8
ghc-cmark-gfm-0.2.5-1.fc35
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ebbac924d3 exim-4.96-5.fc35
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-7ad73a633f
dotnet6.0-6.0.110-2.fc35
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-99af00f60e xen-4.15.3-7.fc35
0
https://bodhi.fedoraproject.org/updates/FEDORA-2022-76b3530ac2
php-pear-CAS-1.6.0-1.fc35
The following Fedora 35 Critical Path updates have yet to be approved:
Age URL
84
https://bodhi.fedoraproject.org/updates/FEDORA-2022-bca7996d14
annobin-10.81-1.fc35
48
https://bodhi.fedoraproject.org/updates/FEDORA-2022-97f6c4fd2a
libblockdev-2.28-2.fc35
19
https://bodhi.fedoraproject.org/updates/FEDORA-2022-7c5789009a
python3-docs-3.10.8-1.fc35 python3.10-3.10.8-1.fc35
12
https://bodhi.fedoraproject.org/updates/FEDORA-2022-db6ecb3d6a
netcat-1.219-1.fc35
12
https://bodhi.fedoraproject.org/updates/FEDORA-2022-2f33bf498d rsync-3.2.7-1.fc35
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-84a4d61a33
mtools-4.0.42-1.fc35
9
https://bodhi.fedoraproject.org/updates/FEDORA-2022-8cc2a55191
libidn2-2.3.4-1.fc35
8
https://bodhi.fedoraproject.org/updates/FEDORA-2022-0e2736b340
webkit2gtk3-2.38.1-1.fc35
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-39688a779d curl-7.79.1-7.fc35
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-a044f89f66 koji-1.30.1-2.fc35
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-569e7560ec
python-rpm-macros-3.10-13.fc35
5
https://bodhi.fedoraproject.org/updates/FEDORA-2022-0535a53522
cmake-3.24.2-1.fc35
5
https://bodhi.fedoraproject.org/updates/FEDORA-2022-80b7db48db
rust-packaging-23-1.fc35 rust-srpm-macros-23-1.fc35
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec0c51fe25
tzdata-2022f-1.fc35
2
https://bodhi.fedoraproject.org/updates/FEDORA-2022-8b2695fc0e
hwdata-0.364-1.fc35
2
https://bodhi.fedoraproject.org/updates/FEDORA-2022-596a8be8cf expat-2.5.0-1.fc35
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-99af00f60e xen-4.15.3-7.fc35
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-3c76b13e24
libxcrypt-4.4.30-1.fc35
0
https://bodhi.fedoraproject.org/updates/FEDORA-2022-1eb121f472
thunderbird-102.4.1-1.fc35
The following builds have been pushed to Fedora 35 updates-testing
bzip3-1.2.0-3.fc35
gmailctl-0.10.6-1.fc35
golang-github-atotto-clipboard-0.1.4-7.fc35
icewm-3.2.0-1.fc35
jacktrip-1.6.6-1.fc35
libxml2-2.10.3-2.fc35
nvtop-3.0.0-1.fc35
phpunit9-9.5.26-1.fc35
python-pynamodb-5.3.0-1.fc35
rust-1.65.0-1.fc35
swift-lang-5.7.1-1.fc35
xmlsec1-1.2.29-5.fc35
xorgxrdp-0.9.19-4.fc35
Details about builds:
================================================================================
bzip3-1.2.0-3.fc35 (FEDORA-2022-52af963932)
Tools for compressing and decompressing bzip3 files
--------------------------------------------------------------------------------
Update Information:
This update brings bzip3, tools and libraries for handling bzip3 compression
format. bzip3 features higher compression ratios and better performance than
bzip2 thanks to an order-0 context mixing entropy coder.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 2 2022 Petr Pisar <ppisar(a)redhat.com> - 1.2.0-3
- Do not own pkg-config directory
* Wed Nov 2 2022 Petr Pisar <ppisar(a)redhat.com> - 1.2.0-2
- Less globs and and more verbose output in a spec file
* Tue Nov 1 2022 Petr Pisar <ppisar(a)redhat.com> - 1.2.0-1
- 1.2.0 bump
* Wed Oct 26 2022 Petr Pisar <ppisar(a)redhat.com> - 1.1.8-1
- 1.1.8 packaged
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2137932 - Review Request: bzip3 - Tools for compressing and decompressing
bzip3 files
https://bugzilla.redhat.com/show_bug.cgi?id=2137932
--------------------------------------------------------------------------------
================================================================================
gmailctl-0.10.6-1.fc35 (FEDORA-2022-b5df701b58)
Declarative configuration for Gmail filters
--------------------------------------------------------------------------------
Update Information:
update to v0.10.6, close rhbz#2139537
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Mark E. Fuller <mark.e.fuller(a)gmx.de> 0.10.6-1
- update to v0.10.6, close rhbz#2139537
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2139537 - gmailctl-0.10.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2139537
--------------------------------------------------------------------------------
================================================================================
golang-github-atotto-clipboard-0.1.4-7.fc35 (FEDORA-2022-d0895dbe63)
Clipboard for golang
--------------------------------------------------------------------------------
Update Information:
Fix FTBFS
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> 0.1.4-7
- Fix FTBFS
* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> 0.1.4-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Tue Jul 19 2022 Maxwell G <gotmax(a)e.email> 0.1.4-5
- Rebuild for
CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang
* Sat Jun 18 2022 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> 0.1.4-4
- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327,
CVE-2022-27191, CVE-2022-29526, CVE-2022-30629
* Fri Jun 17 2022 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> 0.1.4-3
- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327,
CVE-2022-27191, CVE-2022-29526, CVE-2022-30629
* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> 0.1.4-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2045472 - golang-github-atotto-clipboard: FTBFS in Fedora rawhide/f36
https://bugzilla.redhat.com/show_bug.cgi?id=2045472
[ 2 ] Bug #2096130 - golang-github-atotto-clipboard-1.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2096130
--------------------------------------------------------------------------------
================================================================================
icewm-3.2.0-1.fc35 (FEDORA-2022-d115fb5e49)
Window manager designed for speed, usability, and consistency
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.2.0-1
- chore: Update to 3.2.0
* Sun Oct 30 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.1.0-6
- build: Add xrandr as weak dep
* Sun Oct 30 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.1.0-5
- build: Make alsa-utils as weak dep
* Sun Oct 30 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.1.0-4
- build: Drop adwaita-icon-theme dep
* Sun Oct 30 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.1.0-3
- style: Update .spec
* Sun Oct 30 2022 Artem Polishchuk <ego.cordatus(a)gmail.com> 3.1.0-2
- build: Add mutt as weak dep
--------------------------------------------------------------------------------
================================================================================
jacktrip-1.6.6-1.fc35 (FEDORA-2022-f2a10de5e9)
A system for high-quality audio network performance over the Internet
--------------------------------------------------------------------------------
Update Information:
Update to v1.6.6
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 I��aki ��car <iucar(a)fedoraproject.org> 1.6.6-1
- Update to v1.6.6
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2137050 - jacktrip-1.6.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2137050
--------------------------------------------------------------------------------
================================================================================
libxml2-2.10.3-2.fc35 (FEDORA-2022-fcf5dbb447)
Library providing XML and HTML support
--------------------------------------------------------------------------------
Update Information:
Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Adam Williamson <awilliam(a)redhat.com> - 2.10.3-2
- Set build options to maintain (most) symbols from 2.9.14 (#2139546)
* Thu Oct 20 2022 David King <amigadave(a)amigadave.com> - 2.10.3-1
- Update to 2.10.3 (#2119077)
* Tue Aug 30 2022 David King <amigadave(a)amigadave.com> - 2.10.2-1
- Update to 2.10.2 (#2119077)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2119077 - libxml2-2.10.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2119077
[ 2 ] Bug #2136274 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2136274
[ 3 ] Bug #2136293 - CVE-2022-40304 libxml2: dict corruption caused by entity reference
cycles [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2136293
[ 4 ] Bug #2136800 - openconnect fails due to missing symbol xmlIOFTPRead
https://bugzilla.redhat.com/show_bug.cgi?id=2136800
--------------------------------------------------------------------------------
================================================================================
nvtop-3.0.0-1.fc35 (FEDORA-2022-e264ab809d)
GPU process monitoring for AMD, Intel and NVIDIA
--------------------------------------------------------------------------------
Update Information:
Initial release of `nvtop`, a GPU process monitoring tool for AMD, Intel and
NVIDIA (the latter via dlopen)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Michel Alexandre Salim <salimma(a)fedoraproject.org> 3.0.0-1
- Initial Fedora package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2139889 - Review Request: nvtop - GPU process monitoring for AMD, Intel and
NVIDIA
https://bugzilla.redhat.com/show_bug.cgi?id=2139889
--------------------------------------------------------------------------------
================================================================================
phpunit9-9.5.26-1.fc35 (FEDORA-2022-22f3248c59)
The PHP Unit Testing framework version 9
--------------------------------------------------------------------------------
Update Information:
**Version 9.5.26** - 2022-10-28 Fixed *
[#5076](https://github.com/sebastianbergmann/phpunit/issues/5076): Test Runner
does not warn about conflicting options
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 28 2022 Remi Collet <remi(a)remirepo.net> - 9.5.26-1
- update to 9.5.26
--------------------------------------------------------------------------------
================================================================================
python-pynamodb-5.3.0-1.fc35 (FEDORA-2022-a604666dac)
A pythonic interface to Amazon���s DynamoDB
--------------------------------------------------------------------------------
Update Information:
v5.3.0 ---------- * No longer call ``DescribeTable`` API before first operation
Before this change, we would call ``DescribeTable`` before the first operation
on a given table in order to discover its schema. This slowed down bootstrap
(particularly important for lambdas), complicated testing and could potentially
cause inconsistent behavior since queries were serialized using the table's
(key) schema but deserialized using the model's schema. With this change,
both queries and models now use the model's schema.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Benjamin A. Beasley <code(a)musicinmybrain.net> 5.3.0-1
- Update to 5.3.0 (close RHBZ#2139576)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2139576 - python-pynamodb-5.3.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2139576
--------------------------------------------------------------------------------
================================================================================
rust-1.65.0-1.fc35 (FEDORA-2022-0ded5a0127)
The Rust Programming Language
--------------------------------------------------------------------------------
Update Information:
Update to Rust 1.65.0: * Generic associated types (GATs) * `let`-`else`
statements * `break` from labeled blocks * Splitting Linux debuginfo *
Stabilized APIs See the [blog post](https://blog.rust-
lang.org/2022/11/03/Rust-1.65.0.html) and [release
notes](https://github.com/rust-
lang/rust/blob/stable/RELEASES.md#version-1650-2022-11-03) for more details. At
the packaging level, `rust-analyzer` now obsoletes `rls`.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 3 2022 Josh Stone <jistone(a)redhat.com> - 1.65.0-1
- Update to 1.65.0.
- rust-analyzer now obsoletes rls.
--------------------------------------------------------------------------------
================================================================================
swift-lang-5.7.1-1.fc35 (FEDORA-2022-c1728e6cb4)
The Swift programming language
--------------------------------------------------------------------------------
Update Information:
Updated to Swift 5.7.1-RELEASE
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 2 2022 Ron Olson <tachoknight(a)gmail.com> - 5.7.1-1
- Updated to Swift 5.7.1-RELEASE
Resolves: rhbz#2139320
* Tue Nov 1 2022 Ron Olson <tachoknight(a)gmail.com> - 5.7-4
- Merged fix from Lum��r Balhar to replace the pathfix.py tool
with the new way for Python 3.12
* Tue Sep 27 2022 Ron Olson <tachoknight(a)gmail.com> - 5.7-3
- Resolves: rhbz#2130233
* Tue Sep 27 2022 Ron Olson <tachoknight(a)gmail.com> - 5.7-2
- Added patch to handle an initialized variable but not
used
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2139320 - swift-lang-5.7.1-RELEASE is available
https://bugzilla.redhat.com/show_bug.cgi?id=2139320
--------------------------------------------------------------------------------
================================================================================
xmlsec1-1.2.29-5.fc35 (FEDORA-2022-fcf5dbb447)
Library providing support for "XML Signature" and "XML Encryption"
standards
--------------------------------------------------------------------------------
Update Information:
Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 24 2022 David King <amigadave(a)amigadave.com> - 1.2.29-5
- Rebuild against libxml2 (#2136800)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2119077 - libxml2-2.10.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2119077
[ 2 ] Bug #2136274 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2136274
[ 3 ] Bug #2136293 - CVE-2022-40304 libxml2: dict corruption caused by entity reference
cycles [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2136293
[ 4 ] Bug #2136800 - openconnect fails due to missing symbol xmlIOFTPRead
https://bugzilla.redhat.com/show_bug.cgi?id=2136800
--------------------------------------------------------------------------------
================================================================================
xorgxrdp-0.9.19-4.fc35 (FEDORA-2022-474317977f)
Implementation of xrdp backend as Xorg modules
--------------------------------------------------------------------------------
Update Information:
Provide alternative binary with glamor enabled.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 4 2022 Bojan Smojver <bojan(a)rexursive.com> - 0.9.19-4
- Build alternative binary with glamor enabled
--------------------------------------------------------------------------------