The following Fedora 25 Security updates need testing: Age URL 324 https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25 223 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e python-XStatic-jquery-ui-1.12.0.1-4.fc25 162 https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f nodejs-brace-expansion-1.1.7-1.fc25 116 https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c memcached-1.4.39-1.fc25 112 https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4 docker-distribution-2.6.2-1.git48294d9.fc25 33 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 27 https://bodhi.fedoraproject.org/updates/FEDORA-2017-7089c6e789 suricata-3.2.4-1.fc25 20 https://bodhi.fedoraproject.org/updates/FEDORA-2017-51f49ebbce apr-1.6.3-1.fc25 20 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f563b201ba apr-util-1.5.4-4.fc25 20 https://bodhi.fedoraproject.org/updates/FEDORA-2017-45ed341e61 httpd-2.4.29-1.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5ad4107cc fedpkg-1.30-4.fc25 rpkg-1.51-2.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-c7514691cb perl-Net-Ping-External-0.15-11.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-0188f21212 postgresql-9.5.10-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-481e4f6f8c ldns-1.6.17-22.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e5bbb657c5 chromium-62.0.3202.89-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1a9068594d python-copr-1.84-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-8016cc0bd0 backintime-1.1.24-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd openssl-1.0.2m-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e webkitgtk4-2.18.3-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-9a6569beb6 firefox-57.0-2.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f58bbbbdb0 konversation-1.7.4-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781 kernel-4.13.13-100.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-8575fbfe90 varnish-5.0.0-5.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f1535b86fa lucene4-4.10.4-11.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25
The following Fedora 25 Critical Path updates have yet to be approved: Age URL 166 https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25 45 https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fc5429e7e iproute-4.12.0-1.fc25 33 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 15 https://bodhi.fedoraproject.org/updates/FEDORA-2017-b89e9f62d8 bind99-9.9.10-3.P3.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-dbf347055a hwdata-0.306-1.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e64b02d1b1 pcre2-10.23-10.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-65b10e63d5 pungi-4.1.20-1.fc25 13 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ec5efbcfc6 pcre-8.41-3.fc25 9 https://bodhi.fedoraproject.org/updates/FEDORA-2017-560cebc111 menu-cache-1.1.0-1.fc25 9 https://bodhi.fedoraproject.org/updates/FEDORA-2017-a7f307017b python-lxml-4.1.1-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e82231f2c7 libglvnd-1.0.0-1.fc25 5 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-9a6569beb6 firefox-57.0-2.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e webkitgtk4-2.18.3-1.fc25 2 https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd openssl-1.0.2m-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781 kernel-4.13.13-100.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-15b7f781f0 nss-3.34.0-1.0.fc25 nss-softokn-3.34.0-1.0.fc25 nss-util-3.34.0-1.0.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-dc8c38e976 man-db-2.7.5-6.fc25
The following builds have been pushed to Fedora 25 updates-testing
alpine-2.21-4.fc25 git-2.9.5-3.fc25 kernel-4.13.13-100.fc25 ktikz-0.11-1.fc25 lucene4-4.10.4-11.fc25 man-db-2.7.5-6.fc25 nodejs-rhea-0.2.6-1.fc25 perl-Filter-1.58-1.fc25 perl-Net-CalDAVTalk-0.12-1.fc25 perl-Net-CardDAVTalk-0.08-1.fc25 python-markdown2-2.3.5-1.fc25 qutebrowser-0.11.1-1.fc25 varnish-5.0.0-5.fc25 zanata-platform-4.3.1-1.fc25
Details about builds:
================================================================================ alpine-2.21-4.fc25 (FEDORA-2017-b3cec83197) powerful, easy to use console email client -------------------------------------------------------------------------------- Update Information:
Build using alpine feature patches release. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1486453 - Problem with maildir https://bugzilla.redhat.com/show_bug.cgi?id=1486453 --------------------------------------------------------------------------------
================================================================================ git-2.9.5-3.fc25 (FEDORA-2017-cdfd888e2e) Fast Version Control System -------------------------------------------------------------------------------- Update Information:
Previous versions of git mishandled layers of tree objects, which allowed remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510457 - CVE-2017-15298 git: Mishandling layers of tree objects [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1510457 --------------------------------------------------------------------------------
================================================================================ kernel-4.13.13-100.fc25 (FEDORA-2017-1b4d140781) The Linux kernel -------------------------------------------------------------------------------- Update Information:
The 4.13.13 update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1513345 - CVE-2017-15115 kernel: use-after-free in sctp_cmp_addr_exact https://bugzilla.redhat.com/show_bug.cgi?id=1513345 --------------------------------------------------------------------------------
================================================================================ ktikz-0.11-1.fc25 (FEDORA-2017-8dbc844dd2) KDE Editor for the TikZ language -------------------------------------------------------------------------------- Update Information:
This provides the latest stable release of KTikZ and QTikZ. See https://raw.githubusercontent.com/fhackenberger/ktikz/0.11/Changelog for a complete list of changes. --------------------------------------------------------------------------------
================================================================================ lucene4-4.10.4-11.fc25 (FEDORA-2017-f1535b86fa) High-performance, full-featured text search engine -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2017-12629 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1501529 - CVE-2017-12629 Solr: Code execution via entity expansion https://bugzilla.redhat.com/show_bug.cgi?id=1501529 --------------------------------------------------------------------------------
================================================================================ man-db-2.7.5-6.fc25 (FEDORA-2017-dc8c38e976) Tools for searching and reading man pages -------------------------------------------------------------------------------- Update Information:
This update makes file trigger scriptlets run man-db cache update in a transient service configured to prevent system from reboot/shutdown until it finishes. So long-running cache update should no longer block dnf transaction, but at the same time it shouldn't be possible to interrupt the update prematurely leaving man page index corrupted. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1318058 - postransaction mandb run takes an unreasonably long time https://bugzilla.redhat.com/show_bug.cgi?id=1318058 --------------------------------------------------------------------------------
================================================================================ nodejs-rhea-0.2.6-1.fc25 (FEDORA-2017-d6a949915b) A reactive messaging library based on the AMQP protocol -------------------------------------------------------------------------------- Update Information:
Rebased to 0.2.6. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1492264 - nodejs-rhea-0.2.6 is available https://bugzilla.redhat.com/show_bug.cgi?id=1492264 --------------------------------------------------------------------------------
================================================================================ perl-Filter-1.58-1.fc25 (FEDORA-2017-4c3e0bc28b) Perl source filters -------------------------------------------------------------------------------- Update Information:
This release stops using deprecated Perl features and improves tests. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1513439 - perl-Filter-1.58 is available https://bugzilla.redhat.com/show_bug.cgi?id=1513439 --------------------------------------------------------------------------------
================================================================================ perl-Net-CalDAVTalk-0.12-1.fc25 (FEDORA-2017-5ed320e732) CalDAV client with JSON data interface -------------------------------------------------------------------------------- Update Information:
This release adds canSync response to GetCalendars. ---- This release adds support for GetEventLinks, GetEventsMulti, and SyncEventLinks. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1513448 - perl-Net-CalDAVTalk-0.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=1513448 [ 2 ] Bug #1512523 - perl-Net-CalDAVTalk-0.11 is available https://bugzilla.redhat.com/show_bug.cgi?id=1512523 --------------------------------------------------------------------------------
================================================================================ perl-Net-CardDAVTalk-0.08-1.fc25 (FEDORA-2017-01f78e9570) CardDAV client -------------------------------------------------------------------------------- Update Information:
This release always request syncToken and fetch canSync. ---- This release brings support for GetContactsMulti, SyncContactLinks, and GetContactLinks. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1513449 - perl-Net-CardDAVTalk-0.08 is available https://bugzilla.redhat.com/show_bug.cgi?id=1513449 [ 2 ] Bug #1512284 - perl-Net-CardDAVTalk-0.07 is available https://bugzilla.redhat.com/show_bug.cgi?id=1512284 --------------------------------------------------------------------------------
================================================================================ python-markdown2-2.3.5-1.fc25 (FEDORA-2017-1dfc94811d) A fast and complete Python implementation of Markdown -------------------------------------------------------------------------------- Update Information:
#### python-markdown2 2.3.5 #### - [pull #238] Fenced code blocks lang with leading space - [pull #260] Search for items only within metadata header - [pull #264] highlightjs language class support - [pull #265] FIPS compliance - [pull #274] Fix for double amp replacement inside link title --------------------------------------------------------------------------------
================================================================================ qutebrowser-0.11.1-1.fc25 (FEDORA-2017-d1a1731d8c) A keyboard-driven, vim-like browser based on PyQt5 and QtWebKit/QtWebEngine -------------------------------------------------------------------------------- Update Information:
Rebase to upstream version `0.11.1`. There is no major change. As upstream wrote in the related bug, it also comes with some security and bug fixes : *It comes with some important improvements, such as protection for some phishing attacks (using punycode domains) and not posting crash reports to a public place anymore. On top of that, it fixes various crashes ;-)* -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1512821 - Update qutebtowser to 0.11.1 on F26 https://bugzilla.redhat.com/show_bug.cgi?id=1512821 --------------------------------------------------------------------------------
================================================================================ varnish-5.0.0-5.fc25 (FEDORA-2017-8575fbfe90) High-performance HTTP accelerator -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2017-8807: This fixes a possible data leak in stevedore transient objects in varnishd. Upstream reports: "It is not inconceiveable that an attack can provoke this situation on vulnerable varnishd instances, where the leaked memory contains confidential data and therefore we have classified this as a security vulnerability." -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1513523 - CVE-2017-8807 varnish: Data leak - ���-sfile��� Stevedore transient objects https://bugzilla.redhat.com/show_bug.cgi?id=1513523 --------------------------------------------------------------------------------
================================================================================ zanata-platform-4.3.1-1.fc25 (FEDORA-2017-92f43f018d) Zanata the web-based translation platform -------------------------------------------------------------------------------- Update Information:
Upstream update to 4.3.1 --------------------------------------------------------------------------------