The following Fedora 25 Security updates need testing:
Age URL
52
https://bodhi.fedoraproject.org/updates/FEDORA-2016-9b3ed5f170
chicken-4.11.0-3.fc25
7
https://bodhi.fedoraproject.org/updates/FEDORA-2016-2df27a2224
ghostscript-9.20-2.fc25
7
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d2a05a0644
libass-0.13.4-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2016-6dd3bc37c3
compat-guile18-1.8.8-14.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d6b82fc729 php-7.0.12-2.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2016-ea58a428a1
php-pecl-zip-1.13.5-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2016-3d3218ec41 qemu-2.7.0-4.fc25
The following Fedora 25 Critical Path updates have yet to be approved:
Age URL
7
https://bodhi.fedoraproject.org/updates/FEDORA-2016-6cb65ea55b
pungi-4.1.10-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2016-a5c3ebe67a
libXfont2-2.0.1-2.fc25 tigervnc-1.7.0-3.fc25 xorg-x11-drivers-7.7-18.fc25
xorg-x11-drv-amdgpu-1.1.2-3.20160929git97d7386c.fc25
xorg-x11-drv-armsoc-1.4.0-3.20160929.fc25
xorg-x11-drv-ati-7.7.1-1.20160928git3fc839ff.fc25 xorg-x11-drv-dummy-0.3.6-26.fc25
xorg-x11-drv-evdev-2.10.4-1.fc25 xorg-x11-drv-fbdev-0.4.3-25.fc25
xorg-x11-drv-fbturbo-0.5.1-0.8.20150221.fc25 xorg-x11-drv-freedreno-1.4.0-3.20160929.fc25
xorg-x11-drv-geode-2.11.18-2.fc25 xorg-x11-drv-intel-2.99.917-26.20160929.fc25
xorg-x11-drv-ivtv-1.2.0-0.22.fc25 xorg-x11-drv-libinput-0.19.1-3.20160929.fc25
xorg-x11-drv-nouveau-1.0.13-1.fc25 xorg-x11-drv-omap-0.4.4-3.fc25
xorg-x11-drv-openchrome-0.5.0-2.fc25 xorg-x11-drv-opentegra-0.7.0-8.fc25
xorg-x11-drv-qxl-0.1.4-10.20160929gite13d28ee.fc25 xorg-x11-drv-sisusb-0.9.6-24.fc25
xorg-x11-drv-synaptics-1.8.99.2-2.fc25 xorg-x11-drv-v4l-0.2.0-47.fc25
xorg-x11-drv-vesa-2.3.2-25.fc25 xorg-x11-drv-vmware-13.0.2-12.20150
211git8f0cf7c.fc25 xorg-x11-drv-voodoo-1.2.5-25.fc25
xorg-x11-drv-wacom-0.33.0-2.20160929gitb61d1711.fc25 xorg-x11-font-utils-7.5-32.fc25
xorg-x11-proto-devel-7.7-20.fc25 xorg-x11-server-1.19.0-0.2.20160929.fc25
The following builds have been pushed to Fedora 25 updates-testing
cjdns-18-3.fc25
erlang-19.1.4-1.fc25
findbugs-contrib-6.8.0-1.fc25
frogr-1.2-1.fc25
gssdp-1.0.1-1.fc25
gupnp-1.0.1-1.fc25
gupnp-av-0.12.10-1.fc25
kaccounts-integration-16.08.2-1.fc25
kaccounts-providers-16.08.2-1.fc25
kdenetwork-filesharing-16.08.2-1.fc25
kdnssd-16.08.2-1.fc25
kget-16.08.2-1.fc25
kio-extras-16.08.2-1.fc25
kopete-16.08.2-1.fc25
kppp-16.08.2-1.fc25
krdc-16.08.2-1.fc25
krfb-16.08.2-1.fc25
ktp-accounts-kcm-16.08.2-1.fc25
ktp-approver-16.08.2-1.fc25
ktp-auth-handler-16.08.2-1.fc25
ktp-common-internals-16.08.2-1.fc25
ktp-contact-list-16.08.2-1.fc25
ktp-contact-runner-16.08.2-1.fc25
ktp-desktop-applets-16.08.2-1.fc25
ktp-filetransfer-handler-16.08.2-1.fc25
ktp-kded-integration-module-16.08.2-1.fc25
ktp-send-file-16.08.2-1.fc25
ktp-text-ui-16.08.2-1.fc25
lua-rex-2.7.2-12.fc25
mate-notification-daemon-1.16.0-2.fc25
mingw-gdb-7.12-1.fc25
mingw-harfbuzz-1.3.2-1.fc25
mingw-libpng-1.6.25-1.fc25
monit-5.19.0-1.fc25
nodejs-6.8.1-3.fc25
perl-App-Cmd-0.331-2.fc25
perl-Specio-0.30-1.fc25
purple-skypeweb-1.2.2-3.20161015gitd23eab9.fc25
qemu-2.7.0-4.fc25
signon-kwallet-extension-16.08.2-1.fc25
subtitleeditor-0.53.0-1.fc25
vulkan-1.0.30.0-1.fc25
Details about builds:
================================================================================
cjdns-18-3.fc25 (FEDORA-2016-e4ad76ccf9)
The privacy-friendly network without borders
--------------------------------------------------------------------------------
Update Information:
New upstream release has protocol 18 which supports supernodes.
Supernode/Subnode code is still a work in progress with this release, so it is
disabled. Fedora and EL7 use libsodium, as it gives the best performance with a
dynamic library. EL6 uses the bundled NaCl library to avoid the libstdc++
dependency of the dynamic library.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1383844 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1383844
--------------------------------------------------------------------------------
================================================================================
erlang-19.1.4-1.fc25 (FEDORA-2016-4421c7d7b8)
General-purpose programming language and runtime environment
--------------------------------------------------------------------------------
Update Information:
* Ver. 19.1.4 ---- * Ver. 19.1.3 ---- * Ver. 19.1.2 ---- * Ver. 19.1.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1385273 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1385273
[ 2 ] Bug #1383671 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1383671
[ 3 ] Bug #1378049 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1378049
--------------------------------------------------------------------------------
================================================================================
findbugs-contrib-6.8.0-1.fc25 (FEDORA-2016-02274602f7)
Extra findbugs detectors
--------------------------------------------------------------------------------
Update Information:
Update to 6.8.0. Detectors added in this version: * **[DMC] Dubious Map
Collection** - Looks for fields that are implementations of `java.util.Map`, but
that are only ever iterated over. This probably means that this data structure
should be a `List` of some class that holds two values, or at the least `Pair`.
`Map` was probably chosen as it was the easiest thing to use, but obfuscates the
reason for the data structure. * **[BL] Burying Logic** - Looks for relatively
large `if` blocks of code, where you unconditionally `return` from them, and
then follow that with an unconditional `return` of a small block. This places
the bulk of the logic to the right indentation-wise, making it more difficult to
read than needed. It would be better to invert the logic of the `if` block, and
immediately `return`, allowing the bulk of the logic to be moved to the left,
for easier reading. * **[WI] Wiring Issues** - Looks for various issues around
`@Autowired`/`@Inject` fields in DI classes * Injecting the same bean twice
into the same class hierarchy, even with different field names * **[CCI]
Concurrent Collection Issues** - Looks for various issues around using
concurrent collections including: * Using `get`/`put` with collection
values, when you should use `putIfAbsent`
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1383534 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1383534
--------------------------------------------------------------------------------
================================================================================
frogr-1.2-1.fc25 (FEDORA-2016-15d6061baf)
Flickr Remote Organizer for GNOME
--------------------------------------------------------------------------------
Update Information:
frogr 1.2 release. * Added flatpak support. * Improved content inside the
AppData file. * Fix cancellation of the image upload process. * Remove
build-dependency on intltool, now relying on gettext only.
--------------------------------------------------------------------------------
================================================================================
gssdp-1.0.1-1.fc25 (FEDORA-2016-3aac6fddd1)
Resource discovery and announcement over SSDP
--------------------------------------------------------------------------------
Update Information:
1.0.1 releases of the gupnp stack.
--------------------------------------------------------------------------------
================================================================================
gupnp-1.0.1-1.fc25 (FEDORA-2016-3aac6fddd1)
A framework for creating UPnP devices & control points
--------------------------------------------------------------------------------
Update Information:
1.0.1 releases of the gupnp stack.
--------------------------------------------------------------------------------
================================================================================
gupnp-av-0.12.10-1.fc25 (FEDORA-2016-3aac6fddd1)
A collection of helpers for building UPnP AV applications
--------------------------------------------------------------------------------
Update Information:
1.0.1 releases of the gupnp stack.
--------------------------------------------------------------------------------
================================================================================
kaccounts-integration-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Small system to administer web accounts across the KDE desktop
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kaccounts-providers-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Additional service providers for KAccounts framework
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kdenetwork-filesharing-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Network filesharing
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kdnssd-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KDE Network Monitor for DNS-SD services (Zeroconf)
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kget-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Download manager
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kio-extras-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Additional components to increase the functionality of KIO Framework
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kopete-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Instant messenger
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
kppp-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Dialer and Front end for pppd
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
krdc-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Remote desktop client
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
krfb-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Desktop sharing
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-accounts-kcm-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KDE Configuration Module for Telepathy Instant Messaging Accounts
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-approver-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KDE Channel Approver for Telepathy
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-auth-handler-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Provide UI/KWallet Integration
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-common-internals-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Common internals for KDE Telepathy
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-contact-list-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Telepathy contact list application
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-contact-runner-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Plasma runner for KDE Telepathy
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-desktop-applets-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KDE Telepathy desktop applets
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-filetransfer-handler-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Telepathy file transfer handler
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-kded-integration-module-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KDE integration for telepathy
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-send-file-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
A File manager plugin to launch file transfer jobs
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
ktp-text-ui-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
Telepathy text chat handler
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
lua-rex-2.7.2-12.fc25 (FEDORA-2016-aaab5d3629)
Regular expression handling library for Lua
--------------------------------------------------------------------------------
Update Information:
Fix broken dependencies.
--------------------------------------------------------------------------------
================================================================================
mate-notification-daemon-1.16.0-2.fc25 (FEDORA-2016-07aecbc405)
Notification daemon for MATE Desktop
--------------------------------------------------------------------------------
Update Information:
- Fix bold formating
--------------------------------------------------------------------------------
================================================================================
mingw-gdb-7.12-1.fc25 (FEDORA-2016-c52626ad7f)
MinGW Windows port of the GDB debugger
--------------------------------------------------------------------------------
Update Information:
MinGW cross compiled gdb 7.12 release.
--------------------------------------------------------------------------------
================================================================================
mingw-harfbuzz-1.3.2-1.fc25 (FEDORA-2016-bd30dc0071)
MinGW Windows Harfbuzz library
--------------------------------------------------------------------------------
Update Information:
MinGW cross compiled harfbuzz 1.3.2 release.
--------------------------------------------------------------------------------
================================================================================
mingw-libpng-1.6.25-1.fc25 (FEDORA-2016-ac30e9617e)
MinGW Windows Libpng library
--------------------------------------------------------------------------------
Update Information:
MinGW cross compiled libpng 1.6.25 release.
--------------------------------------------------------------------------------
================================================================================
monit-5.19.0-1.fc25 (FEDORA-2016-73d71ed643)
Manages and monitors processes, files, directories and devices
--------------------------------------------------------------------------------
Update Information:
Updates Monit to 5.19.0. Please note that this update may require minor updates
to your configuration files if you wish to preserve identical behaviour to
5.14.0. See
https://mmonit.com/monit/changes for details.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1325633 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1325633
--------------------------------------------------------------------------------
================================================================================
nodejs-6.8.1-3.fc25 (FEDORA-2016-161d3d82d0)
JavaScript runtime
--------------------------------------------------------------------------------
Update Information:
Update to Node.js 6.8.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1384267 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1384267
--------------------------------------------------------------------------------
================================================================================
perl-App-Cmd-0.331-2.fc25 (FEDORA-2016-c5a776d731)
Write command line apps with less suffering
--------------------------------------------------------------------------------
Update Information:
The upstream tests have been removed from the package, per user request.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1385280 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1385280
--------------------------------------------------------------------------------
================================================================================
perl-Specio-0.30-1.fc25 (FEDORA-2016-678f5c6111)
Type constraints and coercions for Perl
--------------------------------------------------------------------------------
Update Information:
Minor bugfix for a corner case.
--------------------------------------------------------------------------------
================================================================================
purple-skypeweb-1.2.2-3.20161015gitd23eab9.fc25 (FEDORA-2016-097e115239)
Adds support for Skype to Pidgin
--------------------------------------------------------------------------------
Update Information:
Fixed warning. ---- * Updated to version 1.2.2. * Fixed accounts login. ----
* Updated to version 1.2.2. * Fixed non-Live logins.
--------------------------------------------------------------------------------
================================================================================
qemu-2.7.0-4.fc25 (FEDORA-2016-3d3218ec41)
QEMU is a FAST! processor emulator
--------------------------------------------------------------------------------
Update Information:
* CVE-2016-7155: pvscsi: OOB read and infinite loop (bz #1373463) *
CVE-2016-7156: pvscsi: infinite loop when building SG list (bz #1373480) *
CVE-2016-7156: pvscsi: infinite loop when processing IO requests (bz #1373480) *
CVE-2016-7170: vmware_vga: OOB stack memory access (bz #1374709) *
CVE-2016-7157: mptsas: invalid memory access (bz #1373505) * CVE-2016-7466: usb:
xhci memory leakage during device unplug (bz #1377838) * CVE-2016-7423: scsi:
mptsas: OOB access (bz #1376777) * CVE-2016-7422: virtio: null pointer
dereference (bz #1376756) * CVE-2016-7908: net: Infinite loop in mcf_fec_do_tx
(bz #1381193) * CVE-2016-8576: usb: xHCI: infinite loop vulnerability (bz
#1382322) * CVE-2016-7995: usb: hcd-ehci: memory leak (bz #1382669)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1373462 - CVE-2016-7155 Qemu: scsi: pvscsi: OOB read and infinite loop while
setting descriptor rings
https://bugzilla.redhat.com/show_bug.cgi?id=1373462
[ 2 ] Bug #1373478 - CVE-2016-7156 Qemu: scsi: pvscsi: infintie loop when building SG
list
https://bugzilla.redhat.com/show_bug.cgi?id=1373478
[ 3 ] Bug #1374702 - CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when
processing svga command
https://bugzilla.redhat.com/show_bug.cgi?id=1374702
[ 4 ] Bug #1373504 - CVE-2016-7157 Qemu: scsi: mptsas: invalid memory access while
building configuration pages
https://bugzilla.redhat.com/show_bug.cgi?id=1373504
[ 5 ] Bug #1377837 - CVE-2016-7466 Qemu: usb: xhci memory leakage during device unplug
https://bugzilla.redhat.com/show_bug.cgi?id=1377837
[ 6 ] Bug #1376776 - CVE-2016-7423 Qemu: scsi: mptsas: OOB access when freeing
MPTSASRequest object
https://bugzilla.redhat.com/show_bug.cgi?id=1376776
[ 7 ] Bug #1376755 - CVE-2016-7422 Qemu: virtio: null pointer dereference in
virtqueu_map_desc
https://bugzilla.redhat.com/show_bug.cgi?id=1376755
[ 8 ] Bug #1327465 - CVE-2016-7908 Qemu: net: Infinite loop in mcf_fec_do_tx()
https://bugzilla.redhat.com/show_bug.cgi?id=1327465
[ 9 ] Bug #1333425 - CVE-2016-8576 Qemu: usb: xHCI: infinite loop vulnerability in
xhci_ring_fetch
https://bugzilla.redhat.com/show_bug.cgi?id=1333425
[ 10 ] Bug #1382668 - CVE-2016-7995 Qemu: usb: hcd-ehci: memory leak in
ehci_process_itd
https://bugzilla.redhat.com/show_bug.cgi?id=1382668
--------------------------------------------------------------------------------
================================================================================
signon-kwallet-extension-16.08.2-1.fc25 (FEDORA-2016-8b494f4606)
KWallet integration for Sign-on framework
--------------------------------------------------------------------------------
Update Information:
KDE Network Applications 16.08.2
--------------------------------------------------------------------------------
================================================================================
subtitleeditor-0.53.0-1.fc25 (FEDORA-2016-42f17cdbbb)
GTK+2 tool to edit subtitles for GNU/Linux/*BSD
--------------------------------------------------------------------------------
Update Information:
Fix broken dependencies.
--------------------------------------------------------------------------------
================================================================================
vulkan-1.0.30.0-1.fc25 (FEDORA-2016-7b73fbcc99)
Vulkan loader and validation layers
--------------------------------------------------------------------------------
Update Information:
Update ---- Add wayland support
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1383115 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1383115
--------------------------------------------------------------------------------