The following Fedora 25 Security updates need testing:
Age URL
269
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25
168
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e
python-XStatic-jquery-ui-1.12.0.1-4.fc25
107
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f
nodejs-brace-expansion-1.1.7-1.fc25
61
https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c
memcached-1.4.39-1.fc25
58
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4
docker-distribution-2.6.2-1.git48294d9.fc25
40
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7e5ac0896e
botan-1.10.16-1.fc25
38
https://bodhi.fedoraproject.org/updates/FEDORA-2017-fa1d8ad61a
mercurial-3.8.1-4.fc25
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e66393536
libwpd-0.10.2-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e314044789
oniguruma-6.1.3-3.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7edc2ea787
libbson-1.3.5-4.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f7fd3fe7eb xen-4.7.3-5.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-aa7a8871b7
mingw-LibRaw-0.17.2-3.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b97f9d82dc
libmspack-0.6-0.1.alpha.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7b4da5faba
php-horde-Horde-Image-2.5.2-1.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3bf0bd9c0c
wordpress-4.8.2-1.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ea57ed609f
pkgconf-1.3.9-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-c840f79347
moodle-3.1.8-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-581be259ef
samba-4.5.14-0.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7a3ddf2484
kernel-4.12.14-200.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e3bf383b11
gnome-shell-3.22.3-2.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-9d14020761
php-horde-passwd-5.0.7-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-037e1b31a0
php-horde-wicked-2.0.8-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f14c38d58f
php-horde-nag-4.2.17-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-01ab87482e
httpd-2.4.27-4.fc25
The following Fedora 25 Critical Path updates have yet to be approved:
Age URL
111
https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25
16
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3d979eabcb
gnome-online-accounts-3.22.7-1.fc25
16
https://bodhi.fedoraproject.org/updates/FEDORA-2017-bc3c16a54f kobo-0.6.0-1.fc25
15
https://bodhi.fedoraproject.org/updates/FEDORA-2017-504aeb74ba
rpcbind-0.2.4-7.rc2.fc25
11
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a44008dd1d
python-pysocks-1.6.7-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d41fab42fc
libssh2-1.8.0-5.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-43b6d5bc6b sssd-1.15.3-4.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-27ed767ca1
upower-0.99.6-1.fc25
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-9126f38bc2
libatasmart-0.19-13.fc25
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2802f82ef1
webkitgtk4-2.18.0-1.fc25
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6ec9b7110a
menu-cache-1.0.2-6.D20170913gitfd52af607c.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f7fd3fe7eb xen-4.7.3-5.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f8059ac0e5
nss-3.32.1-1.0.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ff140ad922
libguestfs-1.36.6-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-235298fa58
python-cryptography-2.0.2-2.fc25 python-cryptography-vectors-2.0.2-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-31d7cd5eab
pyOpenSSL-16.2.0-2.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7c8a36f37e audit-2.7.8-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd488c853f
libsolv-0.6.29-2.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d2803ce4f5
linux-firmware-20170828-77.gitb78acc9.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-00cfac3370
pungi-4.1.17-4.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-103ec7f899 cups-2.2.0-10.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e3bf383b11
gnome-shell-3.22.3-2.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7a3ddf2484
kernel-4.12.14-200.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-581be259ef
samba-4.5.14-0.fc25
The following builds have been pushed to Fedora 25 updates-testing
COPASI-4.20.165-1.fc25
bandit-1.4.0-1.fc25
buildah-0.4-1.git9cbccf8.fc25
container-selinux-2.24-1.fc25
cups-2.2.0-10.fc25
fedpkg-1.29-5.fc25
gnome-shell-extension-pomodoro-0.13.3-1.fc25
golang-github-bgentry-speakeasy-0-0.11.git4aabc24.fc25
golang-github-coreos-go-semver-0-0.14.git8ab6407.fc25
golang-github-golang-time-0-0.5.gitc06e80d.fc25
golang-github-grpc-ecosystem-grpc-gateway-1.0.0-0.7.git18d1596.fc25
golang-github-grpc-grpc-go-1.0.0-0.7.git8050b9c.fc25
golang-github-kr-pty-0-0.34.git2c10821.fc25
golang-github-mattn-go-runewidth-0-0.8.git9e777a8.fc25
golang-github-prometheus-client_model-0-0.12.git6f38060.fc25
golang-github-prometheus-common-0-0.10.git49fee29.fc25
golang-github-prometheus-procfs-0-0.20.gita1dba9c.fc25
golang-gopkg-yaml-1-19.fc25
libsodium-1.0.14-1.fc25
mailx-12.5-23.fc25
php-symfony-psr-http-message-bridge-1.0.0-3.fc25
php-symfony-security-acl-2.8.0-4.fc25
python-sphinx-1.5.2-3.fc25
switchboard-plug-about-0.2.4-1.fc25
urw-base35-fonts-20170801-1.fc25
Details about builds:
================================================================================
COPASI-4.20.165-1.fc25 (FEDORA-2017-d2b647ee0a)
Biochemical network simulator
--------------------------------------------------------------------------------
Update Information:
- Update to the build #365
--------------------------------------------------------------------------------
================================================================================
bandit-1.4.0-1.fc25 (FEDORA-2017-1873c409a6)
A framework for performing security analysis of Python source code
--------------------------------------------------------------------------------
Update Information:
New version 1.4.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1255723 - bandit-1.4.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1255723
--------------------------------------------------------------------------------
================================================================================
buildah-0.4-1.git9cbccf8.fc25 (FEDORA-2017-0c835725e7)
A command line tool used for creating OCI Images
--------------------------------------------------------------------------------
Update Information:
Lots of new features including support for creds
--------------------------------------------------------------------------------
================================================================================
container-selinux-2.24-1.fc25 (FEDORA-2017-c280874eff)
SELinux policies for container runtimes
--------------------------------------------------------------------------------
Update Information:
Fixes for NO_NEW_PRIVS Flags
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1494427 - Child type container_t exceeds bounds of parent
container_runtime_t
https://bugzilla.redhat.com/show_bug.cgi?id=1494427
[ 2 ] Bug #1489199 - Docker selinux problem; can't bind pty.sock
https://bugzilla.redhat.com/show_bug.cgi?id=1489199
[ 3 ] Bug #1486923 - SELinux is preventing runc:[2:INIT] from using the
'transition' accesses on a process.
https://bugzilla.redhat.com/show_bug.cgi?id=1486923
--------------------------------------------------------------------------------
================================================================================
cups-2.2.0-10.fc25 (FEDORA-2017-103ec7f899)
CUPS printing system
--------------------------------------------------------------------------------
Update Information:
1494558 - CUPS may fail to start if NIS groups are used
--------------------------------------------------------------------------------
================================================================================
fedpkg-1.29-5.fc25 (FEDORA-2017-24cd027bd9)
Fedora utility for working with dist-git
--------------------------------------------------------------------------------
Update Information:
Use correct build target for containers
--------------------------------------------------------------------------------
================================================================================
gnome-shell-extension-pomodoro-0.13.3-1.fc25 (FEDORA-2017-3a1b577a91)
A time management utility for GNOME
--------------------------------------------------------------------------------
Update Information:
Adds support for the latest versions of GNOME Shell.
--------------------------------------------------------------------------------
================================================================================
golang-github-bgentry-speakeasy-0-0.11.git4aabc24.fc25 (FEDORA-2017-e42cd098f6)
Golang helpers for reading password input without cgo
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 4aabc24848ce5fd31929f7d1e4ea74d3709c14cd
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1250454 - Tracker for golang-github-bgentry-speakeasy
https://bugzilla.redhat.com/show_bug.cgi?id=1250454
--------------------------------------------------------------------------------
================================================================================
golang-github-coreos-go-semver-0-0.14.git8ab6407.fc25 (FEDORA-2017-9c94907b53)
Go semantic versioning library
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 8ab6407b697782a06568d4b7f1db25550ec2e4c6
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1248718 - Tracker for golang-github-coreos-go-semver
https://bugzilla.redhat.com/show_bug.cgi?id=1248718
--------------------------------------------------------------------------------
================================================================================
golang-github-golang-time-0-0.5.gitc06e80d.fc25 (FEDORA-2017-3eebfb4dbd)
Go supplementary time packages
--------------------------------------------------------------------------------
Update Information:
Bump to upstream c06e80d9300e4443158a03817b8a8cb37d230320
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1494518 - Tracker for golang-github-golang-time
https://bugzilla.redhat.com/show_bug.cgi?id=1494518
--------------------------------------------------------------------------------
================================================================================
golang-github-grpc-ecosystem-grpc-gateway-1.0.0-0.7.git18d1596.fc25
(FEDORA-2017-53352429b7)
GRPC to JSON proxy generator
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 18d159699f2e83fc5bb9ef2f79465ca3f3122676
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1405682 - Tracker for golang-github-grpc-ecosystem-grpc-gateway
https://bugzilla.redhat.com/show_bug.cgi?id=1405682
--------------------------------------------------------------------------------
================================================================================
golang-github-grpc-grpc-go-1.0.0-0.7.git8050b9c.fc25 (FEDORA-2017-acc063e8c2)
The Go language implementation of gRPC. HTTP/2 based RPC
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 777daa17ff9b5daef1cfdf915088a2ada3332bf0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1250461 - Tracker for golang-github-grpc-grpc-go
https://bugzilla.redhat.com/show_bug.cgi?id=1250461
--------------------------------------------------------------------------------
================================================================================
golang-github-kr-pty-0-0.34.git2c10821.fc25 (FEDORA-2017-563b212365)
PTY interface for Go
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 2c10821df3c3cf905230d078702dfbe9404c9b23
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1313956 - Missing rpm because of typo in spec file
https://bugzilla.redhat.com/show_bug.cgi?id=1313956
--------------------------------------------------------------------------------
================================================================================
golang-github-mattn-go-runewidth-0-0.8.git9e777a8.fc25 (FEDORA-2017-f53c8ee997)
Functions for getting fixed width of the character or string
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 9e777a8366cce605130a531d2cd6363d07ad7317
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1405690 - Tracker for golang-github-mattn-go-runewidth
https://bugzilla.redhat.com/show_bug.cgi?id=1405690
--------------------------------------------------------------------------------
================================================================================
golang-github-prometheus-client_model-0-0.12.git6f38060.fc25 (FEDORA-2017-f890047c2a)
Data model artifacts for Prometheus
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 6f3806018612930941127f2a7c6c453ba2c527d2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1250496 - Tracker for golang-github-prometheus-client_model
https://bugzilla.redhat.com/show_bug.cgi?id=1250496
--------------------------------------------------------------------------------
================================================================================
golang-github-prometheus-common-0-0.10.git49fee29.fc25 (FEDORA-2017-ea4c021461)
Go libraries shared across Prometheus components and libraries
--------------------------------------------------------------------------------
Update Information:
Bump to upstream 49fee292b27bfff7f354ee0f64e1bc4850462edf
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1315096 - Tracker for golang-github-prometheus-common
https://bugzilla.redhat.com/show_bug.cgi?id=1315096
--------------------------------------------------------------------------------
================================================================================
golang-github-prometheus-procfs-0-0.20.gita1dba9c.fc25 (FEDORA-2017-e2909b3e02)
Functions to retrieve system, kernel and process metrics from the /proc fs
--------------------------------------------------------------------------------
Update Information:
Bump to upstream a1dba9ce8baed984a2495b658c82687f8157b98f
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1326057 - buggy spec for s390x/gcc-go
https://bugzilla.redhat.com/show_bug.cgi?id=1326057
--------------------------------------------------------------------------------
================================================================================
golang-gopkg-yaml-1-19.fc25 (FEDORA-2017-bcec5064c7)
Enables Go programs to comfortably encode and decode YAML values
--------------------------------------------------------------------------------
Update Information:
Bump to upstream cd8b52f8269e0feb286dfeef29f8fe4d5b397e0b
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1250524 - Tracker for golang-gopkg-yaml
https://bugzilla.redhat.com/show_bug.cgi?id=1250524
--------------------------------------------------------------------------------
================================================================================
libsodium-1.0.14-1.fc25 (FEDORA-2017-fe34cd4c93)
The Sodium crypto library
--------------------------------------------------------------------------------
Update Information:
** Version 1.0.14** - WebAssembly is now officially supported. Special thanks
to facekapow and pepyakin who helped to make it happen. - Internal consistency
checks failing and primitives used with dangerous/out-of-bounds/invalid
parameters used to call abort(3). Now, a custom handler *that doesn't return*
can be set with the `set_sodium_misuse()` function. It still aborts by default
or if the handler ever returns. This is not a replacement for non-fatal,
expected runtime errors. This handler will be only called in unexpected
situations due to potential bugs in the library or in language bindings. -
`*_MESSAGEBYTES_MAX` macros (and the corresponding `_messagebytes_max()`
symbols) have been added to represent the maximum message size that can be
safely handled by a primitive. Language bindings are encouraged to check user
inputs against these maximum lengths. - The test suite has been extended to
cover more edge cases. - crypto_sign_ed25519_pk_to_curve25519() now rejects
points that are not on the curve, or not in the main subgroup. - Further
changes have been made to ensure that smart compilers will not optimize out code
that we don't want to be optimized. - Visual Studio solutions are now included
in distribution tarballs. - The `sodium_runtime_has_*` symbols for CPU features
detection are now defined as weak symbols, i.e. they can be replaced with an
application-defined implementation. This can be useful to disable AVX* when
temperature/power consumption is a concern. - `crypto_kx_*()` now aborts if
called with no non-NULL pointers to store keys to. - SSE2 implementations of
`crypto_verify_*()` have been added. - Passwords can be hashed using a specific
algorithm with the new `crypto_pwhash_str_alg()` function. - Due to popular
demand, base64 encoding (`sodium_bin2base64()`) and decoding
(`sodium_base642bin()`) have been implemented. - A new
`crypto_secretstream_*()` API was added to safely encrypt files and multi-part
messages. - The `sodium_pad()` and `sodium_unpad()` helper functions have been
added in order to add & remove padding. - An AVX512 optimized implementation of
Argon2 has been added (written by Ondrej Mosn����ek, thanks!) - The
`crypto_pwhash_str_needs_rehash()` function was added to check if a password
hash string matches the given parameters, or if it needs an update. - The
library can now be compiled with recent versions of emscripten/binaryen that
don't allow multiple variables declarations using a single `var` statement.
--------------------------------------------------------------------------------
================================================================================
mailx-12.5-23.fc25 (FEDORA-2017-f4036b1131)
Enhanced implementation of the mailx command
--------------------------------------------------------------------------------
Update Information:
Fix multi-byte encoded line-folding
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1494559 - mailx is not properly encoding multibyte subjects
https://bugzilla.redhat.com/show_bug.cgi?id=1494559
--------------------------------------------------------------------------------
================================================================================
php-symfony-psr-http-message-bridge-1.0.0-3.fc25 (FEDORA-2017-fb5a627c07)
Symfony PSR HTTP message bridge
--------------------------------------------------------------------------------
Update Information:
RPM only release - Allow Symfony 3 - Modify tests - Apply patch to fix test
suite with !el6 and zendframework/zend-diactoros
--------------------------------------------------------------------------------
================================================================================
php-symfony-security-acl-2.8.0-4.fc25 (FEDORA-2017-a424d7f124)
Symfony Security Component - ACL (Access Control List)
--------------------------------------------------------------------------------
Update Information:
RPM only release - Add max versions to BuildRequires - Switch autoloader to
fedora/autoloader - Remove Conflicts for Suggests - Test with SCLs if available
--------------------------------------------------------------------------------
================================================================================
python-sphinx-1.5.2-3.fc25 (FEDORA-2017-ad8f604f74)
Python documentation generator
--------------------------------------------------------------------------------
Update Information:
Fix a crash on parallel build.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1494276 - Parallel build throws EOF exception
https://bugzilla.redhat.com/show_bug.cgi?id=1494276
--------------------------------------------------------------------------------
================================================================================
switchboard-plug-about-0.2.4-1.fc25 (FEDORA-2017-4fc40be754)
Switchboard System Information plug
--------------------------------------------------------------------------------
Update Information:
Update to version 0.2.4.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1494298 - switchboard-plug-about-0.2.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1494298
--------------------------------------------------------------------------------
================================================================================
urw-base35-fonts-20170801-1.fc25 (FEDORA-2017-612c622a20)
Core Font Set containing 35 freely distributable fonts from (URW)++
--------------------------------------------------------------------------------
Update Information:
This is a replacement package for now obsoleted `urw-fonts` package. More info
in Pagure:
https://src.fedoraproject.org/rpms/urw-base35-fonts
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1458840 - Review Request: urw-base35-fonts - Level 2 Core Font Set for
Ghostscript
https://bugzilla.redhat.com/show_bug.cgi?id=1458840
--------------------------------------------------------------------------------