The following Fedora 26 Security updates need testing:
Age URL
251
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb5c8d1e7
docker-distribution-2.6.2-1.git48294d9.fc26
83
https://bodhi.fedoraproject.org/updates/FEDORA-2018-66b885ae3c
keycloak-httpd-client-install-0.8-1.fc26
70
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f8a78a5ef
squid-4.0.23-1.fc26
45
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db5041e661 bro-2.5.3-1.fc26
33
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c967cee830
dovecot-2.2.34-1.fc26
28
https://bodhi.fedoraproject.org/updates/FEDORA-2018-122ea355a7
memcached-1.4.39-2.fc26
21
https://bodhi.fedoraproject.org/updates/FEDORA-2018-505e83d30e
webkitgtk4-2.20.0-1.fc26
11
https://bodhi.fedoraproject.org/updates/FEDORA-2018-010396b4a2
chromium-65.0.3325.181-1.fc26
9
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6f2df5ab6c
librelp-1.2.15-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5aa3e1d90
bchunk-1.2.2-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c71dd2e199 php-7.1.16-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e672eaf4df
nodejs-6.14.0-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d8269e4262
drupal7-7.58-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-922cc2fbaa
drupal8-8.3.9-1.fc26
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6855fa237d
mod_http2-1.10.16-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-22b25bab31
httpd-2.4.33-2.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4a2b875d6b
libofx-0.9.10-5.fc26
The following Fedora 26 Critical Path updates have yet to be approved:
Age URL
48
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ddd1e5c30a
iproute-4.14.1-5.fc26
21
https://bodhi.fedoraproject.org/updates/FEDORA-2018-505e83d30e
webkitgtk4-2.20.0-1.fc26
9
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ab61ad2e1b
osinfo-db-20180325-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d4cacdf9bc rpm-4.13.1-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2ef5c8a9a6
highlight-3.42-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9f22f8925f
hwdata-0.311-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8738070497
linux-firmware-20180402-83.git8c1e439c.fc26
The following builds have been pushed to Fedora 26 updates-testing
GeoIP-GeoLite-data-2018.04-1.fc26
clover2-3.7.6-1.D20180323git2b30ac5.fc26
clustersos-1.2.2-1.fc26
collectd-5.8.0-2.fc26.1
criu-3.8.1-1.fc26
cups-2.2.2-9.fc26
kernel-4.15.15-200.fc26
koji-1.15.1-1.fc26
libdasm-1.6-1.fc26
libmodulemd-1.2.0-1.fc26
libtaskotron-0.6.0-1.fc26
nheko-0.3.0-1.fc26
openssl-1.1.0h-3.fc26
pungi-4.1.23-1.fc26
python-neomodel-3.2.5-1.fc26
python-productmd-1.11-2.fc26
python-pyev-0.9.0-0.1.20130610gite31d137.fc26
python-resultsdb_api-2.1.0-1.fc26
qt5-qtdeclarative-5.9.4-2.fc26
resultsdb-2.1.0-1.fc26
spectre-meltdown-checker-0.36-1.fc26
sshuttle-0.78.4-3.fc26
wine-3.5-1.fc26
wordpress-4.9.5-1.fc26
Details about builds:
================================================================================
GeoIP-GeoLite-data-2018.04-1.fc26 (FEDORA-2018-d56cce0f48)
Free GeoLite IP geolocation country database
--------------------------------------------------------------------------------
Update Information:
Final database update from Maxmind. There will be no further updates of the free
databases, so geolocation data from the legacy GeoIP library will become
increasingly inaccurate over time.
--------------------------------------------------------------------------------
================================================================================
clover2-3.7.6-1.D20180323git2b30ac5.fc26 (FEDORA-2018-261761833c)
Yet another compiler language
--------------------------------------------------------------------------------
Update Information:
New version 3.7.6 is released.
--------------------------------------------------------------------------------
================================================================================
clustersos-1.2.2-1.fc26 (FEDORA-2018-bef3ec2d5b)
Capture sosreports from multiple nodes simultaneously
--------------------------------------------------------------------------------
Update Information:
New upstream release. Improves concurrency, logging, failure handling. Allows
non-root SSH user to become root on remote nodes if password is provided.
--------------------------------------------------------------------------------
================================================================================
collectd-5.8.0-2.fc26.1 (FEDORA-2018-a136bba4d4)
Statistics collection daemon for filling RRD files
--------------------------------------------------------------------------------
Update Information:
Enable nut plugin again
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1527672 - Missing update of collectd-nut to version 5.8.0
https://bugzilla.redhat.com/show_bug.cgi?id=1527672
--------------------------------------------------------------------------------
================================================================================
criu-3.8.1-1.fc26 (FEDORA-2018-e53eac67d1)
Tool for Checkpoint/Restore in User-space
--------------------------------------------------------------------------------
Update Information:
Update to 3.8.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1555087 - criu-3.8.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1555087
--------------------------------------------------------------------------------
================================================================================
cups-2.2.2-9.fc26 (FEDORA-2018-ec5f10e626)
CUPS printing system
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2017-18248
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1561296 - CVE-2017-18248 cups: Invalid usernames handled in
scheduler/ipp.c:add_job() allow remote attackers to cause a denial of service
https://bugzilla.redhat.com/show_bug.cgi?id=1561296
--------------------------------------------------------------------------------
================================================================================
kernel-4.15.15-200.fc26 (FEDORA-2018-709268aa8a)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.15.15 update contains a number of important fixes across the tree.
--------------------------------------------------------------------------------
================================================================================
koji-1.15.1-1.fc26 (FEDORA-2018-81d3af3f36)
Build system tools
--------------------------------------------------------------------------------
Update Information:
Fixes for CVE-2018-1002150.
--------------------------------------------------------------------------------
================================================================================
libdasm-1.6-1.fc26 (FEDORA-2018-a0917c8330)
Simple x86 disassembly library
--------------------------------------------------------------------------------
Update Information:
New package - libdasm Summary: Simple x86 disassembly library
Description: libdasm is a C-library that tries to provide simple and convenient
way to disassemble Intel x86 raw op-code bytes (machine code). It can parse and
print out op-codes in AT&T and Intel syntax. The op-codes are based on IA-32
Intel Architecture Software Developer's Manual Volume 2: Instruction Set
Reference, order number 243667, year 2004. Non-Intel instructions are not
supported at the moment (also, non-Intel but Intel-compatible CPU extensions,
like AMD 3DNow! are not supported).
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1559699 - Review Request: libdasm - Simple x86 disassembly library
https://bugzilla.redhat.com/show_bug.cgi?id=1559699
--------------------------------------------------------------------------------
================================================================================
libmodulemd-1.2.0-1.fc26 (FEDORA-2018-ed91186249)
Module metadata manipulation library
--------------------------------------------------------------------------------
Update Information:
# New Functions: * [Modulemd.objects_from_file()](https://sgallagh.fedorapeople.
org/docs/libmodulemd/1.2/modulemd-modulemd.html#modulemd-objects-from-file) * [M
odulemd.objects_from_string()](https://sgallagh.fedorapeople.org/docs/lib...
d/1.2/modulemd-modulemd.html#modulemd-objects-from-string) *
[
Modulemd.dump()](https://sgallagh.fedorapeople.org/docs/libmodulemd/1.2
/modulemd-modulemd.html#modulemd-dump) *
[
Modulemd.dumps()](https://sgallagh.fedorapeople.org/docs/libmodulemd/1.2
/modulemd-modulemd.html#modulemd-dumps) * [Modulemd.Defaults.new_from_file()](ht
tps://sgallagh.fedorapeople.org/docs/libmodulemd/1.2/modulemd-modulemd-
defaults.html#modulemd-defaults-new-from-file) * [Modulemd.Defaults.new_from_str
ing()](https://sgallagh.fedorapeople.org/docs/libmodulemd/1.2/modulemd-mo...
defaults.html#modulemd-defaults-new-from-string) # Deprecated Functions: * [Mod
ulemd.Module.new_all_from_file()](https://sgallagh.fedorapeople.org/docs/...
lemd/1.2/modulemd-modulemd-module.html#modulemd-module-new-all-from-file) * [Mod
ulemd.Module.new_all_from_file_ext()](https://sgallagh.fedorapeople.org/d...
modulemd/1.2/modulemd-modulemd-module.html#modulemd-module-new-all-from-file-
ext) * [
Modulemd.Module.new_all_from_string()](https://sgallagh.fedorapeople.org
/docs/libmodulemd/1.2/modulemd-modulemd-module.html#modulemd-module-new-all-
from-string) * [Modulemd.Module.new_all_from_string_ext()](https://sgallagh.fedo
rapeople.org/docs/libmodulemd/1.2/modulemd-modulemd-module.html#modulemd-...
new-all-from-string-ext) * [Modulemd.Module.dump_all()](https://sgallagh.fedorap
eople.org/docs/libmodulemd/1.2/modulemd-modulemd-module.html#modulemd-mod...
dump-all) * [
Modulemd.Module.dumps_all()](https://sgallagh.fedorapeople.org/docs
/libmodulemd/1.2/modulemd-modulemd-module.html#modulemd-module-dumps-all) #
Bugfixes * Properly use G_BEGIN_DECLS and G_END_DECLS in headers * Assorted
fixes for memory ownership in GObject Introspection
--------------------------------------------------------------------------------
================================================================================
libtaskotron-0.6.0-1.fc26 (FEDORA-2018-8050e8e8e8)
Taskotron Support Library
--------------------------------------------------------------------------------
Update Information:
- distgit_directive: use correct branch name for Rawhide - allow to specify COPR
repos in minion_repos - spawn new vm for each test*.yml - save output of 'rpm
-qa' to artifacts dir - yumrepoinfo: Fix F28 updates URL - distgit_directive:
add param ignore_missing - exit with non-zero code when some playbook crashes -
retry VM spawning when it fails
--------------------------------------------------------------------------------
================================================================================
nheko-0.3.0-1.fc26 (FEDORA-2018-e04d81bc94)
Desktop client for the Matrix protocol
--------------------------------------------------------------------------------
Update Information:
Updated to version 0.3.0.
--------------------------------------------------------------------------------
================================================================================
openssl-1.1.0h-3.fc26 (FEDORA-2018-d63ce90642)
Utilities from the general purpose cryptography library with TLS implementation
--------------------------------------------------------------------------------
Update Information:
Fix for regression affecting ca-certificates package.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1562953 - ca-certificates fails to install: Execution of /usr/bin/c_rehash
aborted due to compilation errors
https://bugzilla.redhat.com/show_bug.cgi?id=1562953
--------------------------------------------------------------------------------
================================================================================
pungi-4.1.23-1.fc26 (FEDORA-2018-0787a0a775)
Distribution compose tool
--------------------------------------------------------------------------------
Update Information:
New upstream release. Many of the fixes in this release have already been
backported into Fedora package. Most important changes in this release are: *
There is now a metadata file describing the modules that are included in the
compose. * Multilib packages in modules should not be included correctly. *
Modules can be retrieved from a Koji tag and not just from PDC * Instead of
Python modulemd library Pungi now depends on libmodulemd. * Ostree creation now
consumes packages from the same repository that buildinstall phase does. This
means it can run earlier in the process, in parallel to solving dependencies and
creating repositories for each variant. * It is now possible to configure
gathering separately for each variant and include packages from multiple
sources. Modular and non-modular packages do not mix. As always, there are
other minor fixes.
--------------------------------------------------------------------------------
================================================================================
python-neomodel-3.2.5-1.fc26 (FEDORA-2018-da3f24aa98)
A Python OGM for Neo4j
--------------------------------------------------------------------------------
Update Information:
Initial release To install, this requires python-neo4j-driver which is waiting
to be pushed to stable.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1562947 - Review Request: python-neomodel - A Python OGM for Neo4j
https://bugzilla.redhat.com/show_bug.cgi?id=1562947
--------------------------------------------------------------------------------
================================================================================
python-productmd-1.11-2.fc26 (FEDORA-2018-0787a0a775)
Library providing parsers for metadata related to OS installation
--------------------------------------------------------------------------------
Update Information:
New upstream release. Many of the fixes in this release have already been
backported into Fedora package. Most important changes in this release are: *
There is now a metadata file describing the modules that are included in the
compose. * Multilib packages in modules should not be included correctly. *
Modules can be retrieved from a Koji tag and not just from PDC * Instead of
Python modulemd library Pungi now depends on libmodulemd. * Ostree creation now
consumes packages from the same repository that buildinstall phase does. This
means it can run earlier in the process, in parallel to solving dependencies and
creating repositories for each variant. * It is now possible to configure
gathering separately for each variant and include packages from multiple
sources. Modular and non-modular packages do not mix. As always, there are
other minor fixes.
--------------------------------------------------------------------------------
================================================================================
python-pyev-0.9.0-0.1.20130610gite31d137.fc26 (FEDORA-2018-9bf4ff4e55)
Python binding for the libev library
--------------------------------------------------------------------------------
Update Information:
New package - python-pyev Summary: Python binding for the libev library
Description: Python binding for the libev library. The libev is an event loop:
you register interest in certain events (such as a file descriptor being
readable or a timeout occurring), and it will manage these event sources and
provide your program with events.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1560344 - Review Request: python-pyev - Python binding for the libev library
https://bugzilla.redhat.com/show_bug.cgi?id=1560344
--------------------------------------------------------------------------------
================================================================================
python-resultsdb_api-2.1.0-1.fc26 (FEDORA-2018-c6a47f607a)
Interface api to ResultsDB
--------------------------------------------------------------------------------
Update Information:
- Add support for auth token - Retry on HTTP 500 errors by default - py3:
Updates to work with Python 3
--------------------------------------------------------------------------------
================================================================================
qt5-qtdeclarative-5.9.4-2.fc26 (FEDORA-2018-99c2566953)
Qt5 - QtDeclarative component
--------------------------------------------------------------------------------
Update Information:
Backport candidate fix for a memory leak, one trigger is using plasma wallpaper
slideshow,
https://bugs.kde.org/show_bug.cgi?id=368838
--------------------------------------------------------------------------------
================================================================================
resultsdb-2.1.0-1.fc26 (FEDORA-2018-10ff78a72d)
Results store for automated tasks
--------------------------------------------------------------------------------
Update Information:
- Add OpenID Connect auth module for POST requests - Allow GET requests to just
pass without auth - Publish more metadata in bus messages - Update Python 2
dependency declarations - generic message format which matches the HTTP API v2
--------------------------------------------------------------------------------
================================================================================
spectre-meltdown-checker-0.36-1.fc26 (FEDORA-2018-15b7295f45)
Spectre & Meltdown vulnerability/mitigation checker for Linux
--------------------------------------------------------------------------------
Update Information:
Update to release 0.36: * Feature: Add support to detect RHEL 5 kernels
backported mitigations * Feature: Add `--prefix-arch` option for cross-
architecture kernel inspection * Feature: Add `--hw-only` option to only show
CPU microcode features supported for mitigation * Feature: Add support to
properly extract some previously unsupported ARM kernels * Feature: Check for
MSR/CPUID of each CPU core, not just the first one * Feature: Add `--batch
prometheus` option to produce output for consumption by prometheus-node-exporter
* Fix: Corrected a corner case of blacklist detection for some microcode
versions * Fix: Properly detect Xen PVHVM mode * Fix: No longer check MSR/CPUID
for non-x86 CPUs * Misc: Other tiny enhancements and fixes
--------------------------------------------------------------------------------
================================================================================
sshuttle-0.78.4-3.fc26 (FEDORA-2018-7f50409a24)
Transparent Proxy VPN
--------------------------------------------------------------------------------
Update Information:
Upstream bugfix release. ---- This is a new upstream bugfix release. Full
release notes:
https://github.com/sshuttle/sshuttle/releases
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1563238 - sshuttle-0.78.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1563238
--------------------------------------------------------------------------------
================================================================================
wine-3.5-1.fc26 (FEDORA-2018-2bbd8da66c)
A compatibility layer for windows applications
--------------------------------------------------------------------------------
Update Information:
- More Vulkan support, including the vulkan-1 loader. - Support for RSA and
ECDSA cryptographic keys. - Improved manifest file parser. - Support for the
Places toolbar in file dialogs. - Various bug fixes.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1562471 - wine-3.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1562471
--------------------------------------------------------------------------------
================================================================================
wordpress-4.9.5-1.fc26 (FEDORA-2018-97ad7e69c1)
Blog tool and publishing platform
--------------------------------------------------------------------------------
Update Information:
**WordPress 4.9.5 Security and Maintenance Release** WordPress 4.9.5 is now
available. This is a security and maintenance release for all versions since
WordPress 3.7. We strongly encourage you to update your sites immediately.
WordPress versions 4.9.4 and earlier are affected by three security issues. As
part of the core team's ongoing commitment to security hardening, the following
fixes have been implemented in 4.9.5: * Don't treat localhost as same host
by default. * Use safe redirects when redirecting the login page if SSL is
forced. * Make sure the version string is correctly escaped for use in
generator tags. Thank you to the reporters of these issues for practicing
���[coordinated security
disclosure](https://make.wordpress.org/core/handbook/testing/reporting-se...
vulnerabilities/): [
xknown](https://profiles.wordpress.org/xknown) of the
WordPress Security Team, [Nitin Venkatesh
(
nitstorm)](https://hackerone.com/nitstorm), and [Garth
Mortensen](https://twitter.com/voldemortensen) of the WordPress Security Team.
Twenty-five other bugs were fixed in WordPress 4.9.5. Particularly of note were:
* The previous styles on caption shortcodes have been restored. * Cropping
on touch screen devices is now supported. * A variety of strings such as
error messages have been updated for better clarity. * The position of an
attachment placeholder during uploads has been fixed. * Custom nonce
functionality in the REST API JavaScript client has been made consistent
throughout the code base. * Improved compatibility with PHP 7.2.
--------------------------------------------------------------------------------