The following Fedora 27 Security updates need testing:
Age URL
55
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d7c0748c1b pdns-4.1.0-1.fc27
29
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2d4c9a6e37
monit-5.25.1-1.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f8c54aeec4
mingw-libtasn1-4.13-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8c3a01cc65
wireshark-2.4.4-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d553b29a30
community-mysql-5.7.21-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7c61d08c4f
GraphicsMagick-1.3.28-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-69316c5b7a
unbound-1.6.8-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-87971e3c98 gcab-1.0-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c587c0a62d
moodle-3.3.4-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4fabf63492
squid-4.0.23-2.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-be361f407a
knot-resolver-1.5.3-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db610fff5b
libxml2-2.9.7-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7982ad5f2a
mupdf-1.12.0-2.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0b4c4e1fed
kernel-4.14.15-300.fc27
The following Fedora 27 Critical Path updates have yet to be approved:
Age URL
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-87971e3c98 gcab-1.0-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdfc84a51c
libappstream-glib-0.7.5-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0fc5258b73 dtc-1.4.6-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b7004c69d2
gnome-shell-3.26.2-4.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0b4c4e1fed
kernel-4.14.15-300.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-22e63cffa4
perl-threads-shared-1.58-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b77c61238c
perl-threads-2.21-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db610fff5b
libxml2-2.9.7-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-fbcc83aa97 grub2-2.02-22.fc27
The following builds have been pushed to Fedora 27 updates-testing
adapta-gtk-theme-3.93.0.81-1.fc27
condor-8.6.9-1.fc27
coreutils-8.27-19.fc27
fwupd-1.0.4-1.fc27
gdb-8.0.1-35.fc27
gnome-pkg-tools-0.20.1-1.fc27
hyperscan-4.7.0-1.fc27
icecat-52.6.0-1.fc27
ixpdimm_sw-01.00.00.2419-2.fc27
jackson-databind-2.7.6-8.fc27
java-1.8.0-openjdk-1.8.0.161-0.b14.fc27
koschei-2.2.0-1.fc27
libguestfs-1.37.36-1.fc27
libreswan-3.23-1.fc27
mate-control-center-1.19.3-1.fc27
mate-desktop-1.19.3-1.fc27
mate-panel-1.19.5-1.fc27
mate-settings-daemon-1.19.2-1.fc27
metamath-0.160-1.fc27
module-build-service-1.6.3-2.fc27
mtd-utils-2.0.1-1.fc27
nodejs-rhea-0.2.9-1.fc27
pbuilder-0.229.1-1.fc27
persepolis-3.0.1-3.fc27
pew-1.1.2-1.fc27
php-alcaeus-mongo-php-adapter-1.1.4-1.fc27
php-horde-Horde-Ldap-2.4.1-1.fc27
php-horde-Horde-Socket-Client-2.1.2-1.fc27
php-nikic-php-parser3-3.1.4-1.fc27
satyr-0.25-1.fc27
snapd-2.30-1.fc27
speech-dispatcher-0.8.8-2.fc27
sscg-2.3.2-1.fc27
vdr-epg2vdr-1.1.79-1.fc27
waiverdb-0.5.0-2.fc27
webkitgtk4-2.18.6-1.fc27
xpra-2.2.3-3.fc27
Details about builds:
================================================================================
adapta-gtk-theme-3.93.0.81-1.fc27 (FEDORA-2018-2fd9e8c50f)
An adaptive Gtk+ theme based on Material Design Guidelines
--------------------------------------------------------------------------------
Update Information:
- New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1537086 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1537086
--------------------------------------------------------------------------------
================================================================================
condor-8.6.9-1.fc27 (FEDORA-2018-7be85da5c8)
HTCondor: High Throughput Computing
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream 8.6.9
--------------------------------------------------------------------------------
================================================================================
coreutils-8.27-19.fc27 (FEDORA-2018-669520d2ba)
A set of basic GNU tools commonly used in shell scripts
--------------------------------------------------------------------------------
Update Information:
- doc: warn about following symlinks recursively in chown/chgrp (CVE-2017-18018)
- mv -n: do not overwrite the destination - mv -n: provide more reliable
diagnostic messages
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1532285 - CVE-2017-18018 coreutils: race condition vulnerability in chown and
chgrp [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1532285
--------------------------------------------------------------------------------
================================================================================
fwupd-1.0.4-1.fc27 (FEDORA-2018-3cda07e9b3)
Firmware update daemon
--------------------------------------------------------------------------------
Update Information:
- New upstream release - Add a device name for locked UEFI devices - Add D-Bus
methods to get and modify the history information - Allow the user to share
firmware update success or failure - Ask the user to refresh metadata when it is
very old - Never add two devices to the daemon with the same ID - Rescan
supported flags when refreshing metadata - Store firmware update success and
failure to a local database
--------------------------------------------------------------------------------
================================================================================
gdb-8.0.1-35.fc27 (FEDORA-2018-20dda3856b)
A stub package for GNU source-level debugger
--------------------------------------------------------------------------------
Update Information:
Fix random 'FAIL: libstdc++-prettyprinters/80276.cc whatis p4' (GCC PR83906)
(Pedro Alves).
--------------------------------------------------------------------------------
================================================================================
gnome-pkg-tools-0.20.1-1.fc27 (FEDORA-2018-8661242834)
Tools for the Debian GNOME Packaging Team
--------------------------------------------------------------------------------
Update Information:
Update to 0.20.1, see
http://metadata.ftp-master.debian.org/changelogs/main/g
/gnome-pkg-tools/gnome-pkg-tools_0.20.1_changelog for details.
--------------------------------------------------------------------------------
================================================================================
hyperscan-4.7.0-1.fc27 (FEDORA-2018-a8f3e111c7)
High-performance regular expression matching library
--------------------------------------------------------------------------------
Update Information:
upstream bugfix release ---- latest upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1537832 - hyperscan-4.7.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1537832
--------------------------------------------------------------------------------
================================================================================
icecat-52.6.0-1.fc27 (FEDORA-2018-761673d702)
GNU version of Firefox browser
--------------------------------------------------------------------------------
Update Information:
- Update to 52.6.0
--------------------------------------------------------------------------------
================================================================================
ixpdimm_sw-01.00.00.2419-2.fc27 (FEDORA-2018-89fc946ae3)
API for development of IXPDIMM management utilities
--------------------------------------------------------------------------------
Update Information:
Release v01.00.00.2418 Spec has been refreshed. ixpdimm_sw now a src packages,
other packages renamed/reorganized. Some files have been moved to more standard
locations. ---- Release v01.00.00.2419 ixpdimm_sw is now the src package name.
Some packages have been renamed and files moved to proper install locations.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1523963 - ixpdimm_sw-01.00.00.2419 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1523963
--------------------------------------------------------------------------------
================================================================================
jackson-databind-2.7.6-8.fc27 (FEDORA-2018-e4b025841e)
General data-binding package for Jackson (2.x)
--------------------------------------------------------------------------------
Update Information:
Security fixes for CVE-2017-17485 and CVE-2018-5968.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1528565 - CVE-2017-17485 jackson-databind: Unsafe deserialization due to
incomplete black list (incomplete fix for CVE-2017-15095)
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
[ 2 ] Bug #1538332 - CVE-2018-5968 jackson-databind: unsafe deserialization due to
incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
--------------------------------------------------------------------------------
================================================================================
java-1.8.0-openjdk-1.8.0.161-0.b14.fc27 (FEDORA-2018-a82015aa02)
OpenJDK Runtime Environment
--------------------------------------------------------------------------------
Update Information:
updated to Security u161 (Oracle CPU 1/2018)
--------------------------------------------------------------------------------
================================================================================
koschei-2.2.0-1.fc27 (FEDORA-2018-47683c90f0)
Continuous integration for Fedora packages
--------------------------------------------------------------------------------
Update Information:
Update to upstream version 2.2.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1538605 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1538605
--------------------------------------------------------------------------------
================================================================================
libguestfs-1.37.36-1.fc27 (FEDORA-2018-cda38a39cf)
Access and modify virtual machine disk images
--------------------------------------------------------------------------------
Update Information:
New upstream version 1.37.36.
--------------------------------------------------------------------------------
================================================================================
libreswan-3.23-1.fc27 (FEDORA-2018-4fd73bb85d)
IPsec implementation with IKEv1 and IKEv2 keying protocols
--------------------------------------------------------------------------------
Update Information:
Updated to 3.23 - support for MOBIKE, PPK, CMAC, nic offload and performance
improvements
--------------------------------------------------------------------------------
================================================================================
mate-control-center-1.19.3-1.fc27 (FEDORA-2018-0679fc4c4f)
MATE Desktop control-center
--------------------------------------------------------------------------------
Update Information:
- update to latest upstream releases
--------------------------------------------------------------------------------
================================================================================
mate-desktop-1.19.3-1.fc27 (FEDORA-2018-0679fc4c4f)
Shared code for mate-panel, mate-session, mate-file-manager, etc
--------------------------------------------------------------------------------
Update Information:
- update to latest upstream releases
--------------------------------------------------------------------------------
================================================================================
mate-panel-1.19.5-1.fc27 (FEDORA-2018-0679fc4c4f)
MATE Desktop panel and applets
--------------------------------------------------------------------------------
Update Information:
- update to latest upstream releases
--------------------------------------------------------------------------------
================================================================================
mate-settings-daemon-1.19.2-1.fc27 (FEDORA-2018-0679fc4c4f)
MATE Desktop settings daemon
--------------------------------------------------------------------------------
Update Information:
- update to latest upstream releases
--------------------------------------------------------------------------------
================================================================================
metamath-0.160-1.fc27 (FEDORA-2018-300af8538c)
Construct mathematics from basic axioms
--------------------------------------------------------------------------------
Update Information:
Changes in version 0.157: - Major rewrite of READ-related functions. - Added
HELP MARKUP. - Track line numbers for error messages in included files. -
Changed HOME_DIRECTORY to ROOT_DIRECTORY. - add virtual includes "$( Begin
$[...$] $)", $( End $[...$] $)", "$( Skip $[...$] $)" Changes in
version 0.158:
- strip CRs from Windows SUBMIT files run on Linux Changes in version 0.159: -
fix crash due to missing include file Changes in version 0.160: - fix bug
introduced in version 0.158
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1536242 - metamath-0.157 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1536242
[ 2 ] Bug #1538606 - metamath-0.160 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1538606
--------------------------------------------------------------------------------
================================================================================
module-build-service-1.6.3-2.fc27 (FEDORA-2018-3fc96bbabb)
The Module Build Service for Modularity
--------------------------------------------------------------------------------
Update Information:
Changes ------- * Fix a bug that caused a module build to fail when it was
cancelled during the module-build-macros phase and then resumed * Reset the
"state_reason" field on all components after a module build is resumed * Cancel
new repo tasks on module build failures in Koji * Use available Koji repos
during local builds instead of building them locally * Add an incrementing
prefix to module components' releases * Add a "context" field on component
and
module releases in Koji for uniqueness for when Module Stream Expansion is
implemented * Remove urlgrabber as a dependency * Set an explicit log level on
our per-build file handler * Set the timeout on git operations to 60 seconds to
help alleviate client tooling timeouts * Improve the efficiency of the stale
module builds poller * Fix situations where module-build-macros builds in Koji
but fails in MBS and the build is resumed
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1487065 - module-build-service-1.3.26-3.fc26: local build always disables
tests
https://bugzilla.redhat.com/show_bug.cgi?id=1487065
[ 2 ] Bug #1514631 - module-build-service-1.5.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1514631
--------------------------------------------------------------------------------
================================================================================
mtd-utils-2.0.1-1.fc27 (FEDORA-2018-e663d9d31c)
Utilities for dealing with MTD (flash) devices
--------------------------------------------------------------------------------
Update Information:
Update to 2.0.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1485088 - mtd-utils-2.0.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1485088
--------------------------------------------------------------------------------
================================================================================
nodejs-rhea-0.2.9-1.fc27 (FEDORA-2018-c05a9f2a54)
A reactive messaging library based on the AMQP protocol
--------------------------------------------------------------------------------
Update Information:
Rebased to 0.2.9.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1523897 - nodejs-rhea-0.2.9 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1523897
--------------------------------------------------------------------------------
================================================================================
pbuilder-0.229.1-1.fc27 (FEDORA-2018-1d9886294f)
Personal package builder for Debian packages
--------------------------------------------------------------------------------
Update Information:
Update to version 0.229.1, see
http://metadata.ftp-
master.debian.org/changelogs/main/p/pbuilder/pbuilder_0.229.1_changelog for
details.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1537512 - pbuilder-0.229.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1537512
--------------------------------------------------------------------------------
================================================================================
persepolis-3.0.1-3.fc27 (FEDORA-2018-5aceb26d93)
A powerful download manager powered by aria2
--------------------------------------------------------------------------------
Update Information:
Fixes a small exception for users which don't have any autostart directory.
(#1535604)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1535604 - [abrt] persepolis: addstartup():
startup.py:101:addstartup:FileNotFoundError: [Errno 2] No such file or directory:
'/home/sajjad/.config/.autostart/persepolis.desktop'
https://bugzilla.redhat.com/show_bug.cgi?id=1535604
--------------------------------------------------------------------------------
================================================================================
pew-1.1.2-1.fc27 (FEDORA-2018-5ecbcbff22)
Tool to manage multiple virtualenvs written in pure Python
--------------------------------------------------------------------------------
Update Information:
New package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1525570 - Review Request: pew - Tool to manage multiple virtualenvs written
in pure python
https://bugzilla.redhat.com/show_bug.cgi?id=1525570
--------------------------------------------------------------------------------
================================================================================
php-alcaeus-mongo-php-adapter-1.1.4-1.fc27 (FEDORA-2018-65b49fb3ac)
Mongo PHP Adapter
--------------------------------------------------------------------------------
Update Information:
**Version 1.1.4** (2019-01-24) * [#214](https://github.com/alcaeus/mongo-php-
adapter/pull/214) fixes the return values of MongoBatch calls with
unacknowledged write concerns.
--------------------------------------------------------------------------------
================================================================================
php-horde-Horde-Ldap-2.4.1-1.fc27 (FEDORA-2018-9342067b2f)
Horde LDAP libraries
--------------------------------------------------------------------------------
Update Information:
**Horde_Ldap 2.4.1** * [jan] Avoid unnecessary binds.
--------------------------------------------------------------------------------
================================================================================
php-horde-Horde-Socket-Client-2.1.2-1.fc27 (FEDORA-2018-2ec82535e8)
Horde Socket Client
--------------------------------------------------------------------------------
Update Information:
**Horde_Socket_Client 2.1.2** * [mjr] Fix issues when retrying a failed
connection (PR #1, Antoine Desch��nes).
--------------------------------------------------------------------------------
================================================================================
php-nikic-php-parser3-3.1.4-1.fc27 (FEDORA-2018-901559b09e)
A PHP parser written in PHP
--------------------------------------------------------------------------------
Update Information:
**Version 3.1.4** * Fixed pretty printing of `-(-$x)` and `+(+$x)`. (#459)
--------------------------------------------------------------------------------
================================================================================
satyr-0.25-1.fc27 (FEDORA-2018-580c89505f)
Tools to create anonymous, machine-friendly problem reports
--------------------------------------------------------------------------------
Update Information:
Update list of normalized functions. - These functions are "blacklisted" to
not mark crashes as duplicates.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1509086 - Many GNOME crashes erroneously marked as dupes of 1469813,
1510059... due to glib 'log and then crash' codepaths (_g_log_abort)
https://bugzilla.redhat.com/show_bug.cgi?id=1509086
--------------------------------------------------------------------------------
================================================================================
snapd-2.30-1.fc27 (FEDORA-2018-04bdce8944)
A transactional software package manager
--------------------------------------------------------------------------------
Update Information:
Release 2.30 to Fedora and fix issues with derivatives using snapd
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1527519 - snapd-2.30 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1527519
[ 2 ] Bug #1536895 - Snapd support currently broken , missing links to /usr/lib/snapd
https://bugzilla.redhat.com/show_bug.cgi?id=1536895
--------------------------------------------------------------------------------
================================================================================
speech-dispatcher-0.8.8-2.fc27 (FEDORA-2018-9bd2359cef)
To provide a high-level device independent layer for speech synthesis
--------------------------------------------------------------------------------
Update Information:
include translations, pkgconfig support (#1538715)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1538715 - missing pkgconfig support: speech-dispatcher.pc
https://bugzilla.redhat.com/show_bug.cgi?id=1538715
--------------------------------------------------------------------------------
================================================================================
sscg-2.3.2-1.fc27 (FEDORA-2018-6c8dcd589d)
Simple SSL certificate generator
--------------------------------------------------------------------------------
Update Information:
Update to 2.3.3 Properly support hostnames up to 64 characters
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1535537 - httpd-init.service fails with long hostname (>=42)
https://bugzilla.redhat.com/show_bug.cgi?id=1535537
--------------------------------------------------------------------------------
================================================================================
vdr-epg2vdr-1.1.79-1.fc27 (FEDORA-2018-aaf1286fde)
A plugin to retrieve EPG data from a mysql database into VDR
--------------------------------------------------------------------------------
Update Information:
Update to 1.1.79 ---- Update to 1.1.78-1
--------------------------------------------------------------------------------
================================================================================
waiverdb-0.5.0-2.fc27 (FEDORA-2018-a6ca9bbe46)
Service for waiving results in ResultsDB
--------------------------------------------------------------------------------
Update Information:
Added missing requirement on python2-configparser ---- New upstream release:
https://docs.pagure.org/waiverdb/release-notes.html#waiverdb-0-5 ----
Synchronize specfile with upstream.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1538463 - waiverdb-cli --help crashes
https://bugzilla.redhat.com/show_bug.cgi?id=1538463
--------------------------------------------------------------------------------
================================================================================
webkitgtk4-2.18.6-1.fc27 (FEDORA-2018-3199135a7e)
GTK+ Web content engine library
--------------------------------------------------------------------------------
Update Information:
This update addresses the following vulnerabilities: *
[
CVE-2018-4088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4088),
[
CVE-2017-13885](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...,
[
CVE-2017-7165](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7165),
[
CVE-2017-13884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...,
[
CVE-2017-7160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7160),
[
CVE-2017-7153](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7153),
[
CVE-2017-7161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7161),
[
CVE-2018-4096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4096)
Additional fixes: * Fix deadlock in GStreamer video sink during shutdown when
accelerated compositing is disabled. * Several fixes and improvements in
WebDriver.
--------------------------------------------------------------------------------
================================================================================
xpra-2.2.3-3.fc27 (FEDORA-2018-2602576102)
Remote display server for applications and desktops
--------------------------------------------------------------------------------
Update Information:
- Still require python-gobject on fedora < 27 - Remove obsolete scriptlets -
Update to 2.2.3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1536005 - xpra-2.2.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1536005
--------------------------------------------------------------------------------