The following Fedora 26 Security updates need testing:
Age URL
300
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb5c8d1e7
docker-distribution-2.6.2-1.git48294d9.fc26
132
https://bodhi.fedoraproject.org/updates/FEDORA-2018-66b885ae3c
keycloak-httpd-client-install-0.8-1.fc26
119
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f8a78a5ef
squid-4.0.23-1.fc26
94
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db5041e661 bro-2.5.3-1.fc26
60
https://bodhi.fedoraproject.org/updates/FEDORA-2018-010396b4a2
chromium-65.0.3325.181-1.fc26
55
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
35
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8ba4601398
dovecot-2.2.35-1.fc26
32
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7be77249d4 ruby-2.4.4-88.fc26
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-77c0da8eea
blktrace-1.2.0-6.fc26
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7cd077ddd3 xen-4.8.3-5.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c8f559e8c2
xdg-utils-1.1.3-1.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-32a88d0540
ca-certificates-2018.2.24-1.0.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6020628437
thunderbird-enigmail-2.0.4-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc04d8bfe8
vim-syntastic-3.9.0-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9cf836a54a
nodejs-base64-url-2.2.0-1.fc26
The following Fedora 26 Critical Path updates have yet to be approved:
Age URL
97
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ddd1e5c30a
iproute-4.14.1-5.fc26
55
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8306020865
python-productmd-1.12-1.fc26
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7cd077ddd3 xen-4.8.3-5.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2018-70b0c4dca9
osinfo-db-20180514-1.fc26
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e8706010aa
vim-8.0.1842-1.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-32a88d0540
ca-certificates-2018.2.24-1.0.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b9585aa356 sssd-1.16.1-8.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c8f559e8c2
xdg-utils-1.1.3-1.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-5e05834bb7
volume_key-0.3.10-1.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-21a38db20b
libidn2-2.0.5-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1486702873 vino-3.22.0-8.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-eb2435dd6a
ntfs-3g-2017.3.23-6.fc26
The following builds have been pushed to Fedora 26 updates-testing
R-Rcpp-0.12.17-1.fc26
batctl-2018.1-1.fc26
debootstrap-1.0.100-1.fc26
ibus-typing-booster-1.5.38-2.fc26
kernel-4.16.11-100.fc26
libreoffice-5.3.7.2-10.fc26
lollypop-0.9.513-1.fc26
rebase-helper-0.13.2-1.fc26
xmlrpc-3.1.3-20.fc26
Details about builds:
================================================================================
R-Rcpp-0.12.17-1.fc26 (FEDORA-2018-00738f7d39)
Seamless R and C++ Integration
--------------------------------------------------------------------------------
Update Information:
R-Rcoo 0.12.17.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 22 2018 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 0.12.17-1
- Update to 0.12.17
* Fri May 18 2018 Tom Callaway <spot(a)fedoraproject.org> - 0.12.16-2.1
- actually build against R 3.5.0
* Wed May 16 2018 TOm Callaway <spot(a)fedoraproject.org> - 0.12.16-2
- rebuild for R 3.5.0
--------------------------------------------------------------------------------
================================================================================
batctl-2018.1-1.fc26 (FEDORA-2018-d831d9aac5)
B.A.T.M.A.N. advanced control and management tool
--------------------------------------------------------------------------------
Update Information:
Upstream 2018.1 * synchronization of batman-adv netlink and packet headers *
add DAT cache and multicast flags netlink support * disable translation support
for non-unicast mac addresses
--------------------------------------------------------------------------------
ChangeLog:
* Mon Apr 30 2018 Felix Kaechele <heffer(a)fedoraproject.org> - 2018.1-1
- update to 2018.1
--------------------------------------------------------------------------------
================================================================================
debootstrap-1.0.100-1.fc26 (FEDORA-2018-08b27ef2a7)
Debian GNU/Linux bootstrapper
--------------------------------------------------------------------------------
Update Information:
- New upstream release (#1578167) - Do not use dpkg on el, dpkg cause broken
deps with man-pages-it in el6 and el7
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 23 2018 S��rgio Basto <sergio(a)serjux.com> - 1.0.100-1
- New upstream release (#1578167)
- Do not use dpkg on el, dpkg cause broken deps with man-pages-it in el6 and el7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1578167 - debootstrap-1.0.100 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1578167
--------------------------------------------------------------------------------
================================================================================
ibus-typing-booster-1.5.38-2.fc26 (FEDORA-2018-99960355b2)
A completion input method
--------------------------------------------------------------------------------
Update Information:
Update to 1.5.38; Refresh french translation (thanks to Thierry Thomas) ----
Update to 1.5.37; Make ���Add direct input��� option work correctly when ���Remember
last preedit input method��� option is off
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 22 2018 Mike FABIAN <mfabian(a)redhat.com> - 1.5.38-2
- Update to 1.5.38
- Refresh french translation (thanks to Thierry Thomas)
- Mark comments in the emoji-picker about dialog as translatable
* Mon May 14 2018 Mike FABIAN <mfabian(a)redhat.com> - 1.5.37-1
- Update to 1.5.37
- Update translations from Zanata (pl and uk updated)
- Make ���Add direct input��� option work correctly when
���Remember last preedit input method��� option is off
- Fix test case for Korean
- Rewrite setup UI completely in Python, without using Glade
- Fix format string in debug message when a dictionary .aff file has no encoding
(Resolves: rhbz#1575659)
- Return False in read_training_data_from_file() if file cannot be opened
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1575659 - [abrt] ibus-typing-booster: get_hunspell_dictionary_wordlist():
itb_util.py:420:get_hunspell_dictionary_wordlist:TypeError: not enough arguments for
format string
https://bugzilla.redhat.com/show_bug.cgi?id=1575659
--------------------------------------------------------------------------------
================================================================================
kernel-4.16.11-100.fc26 (FEDORA-2018-6367a17aa3)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The v4.16.11 kernel includes important fixes across the tree ---- The v4.16.9
stable update contains critical fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 22 2018 Jeremy Cline <jcline(a)redhat.com> - 4.16.11-100
- Linux v4.16.11
* Mon May 21 2018 Justin M. Forbes <jforbes(a)fedoraproject.org> - 4.16.10-101
- Fix CVE-2018-3639 (rhbz 1566890 1580713)
* Mon May 21 2018 Jeremy Cline <jcline(a)redhat.com> - 4.16.10-100
- Linux v4.16.10
* Sun May 20 2018 Hans de Goede <hdegoede(a)redhat.com>
- Enable GPIO_AMDPT, PINCTRL_AMD and X86_AMD_PLATFORM_DEVICE Kconfig options
to fix i2c and GPIOs not working on AMD based laptops (rhbz#1510649)
* Thu May 17 2018 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Fix CVE-2018-1120 (rhbz 1575472 1579542)
* Thu May 17 2018 Jeremy Cline <jcline(a)redhat.com> - 4.16.9-100
- Linux v4.16.9
- Silence unwanted "swiotlb buffer is full" warnings (rhbz 1556797)
* Thu May 10 2018 Jeremy Cline <jeremy(a)jcline.org> - 4.16.8-101
- Bump the release for a rebuild
* Wed May 9 2018 Jeremy Cline <jeremy(a)jcline.org>
- Workaround for m400 uart irq firmware description (rhbz 1574718)
* Wed May 9 2018 Jeremy Cline <jeremy(a)jcline.org> - 4.16.8-100
- Linux v4.16.8
* Mon May 7 2018 Jeremy Cline <jeremy(a)jcline.org>
- Fix issue with KVM on older Core 2 processors (rhbz 1566258)
* Sat May 5 2018 Peter Robinson <pbrobinson(a)fedoraproject.org>
- ARM and Raspberry Pi fixes
- Fix USB-2 on Tegra devices
* Fri May 4 2018 Laura Abbott <labbott(a)redhat.com>
- Fix for building out of tree modules on powerpc (rhbz 1574604)
* Fri May 4 2018 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Fix CVE-2018-10322 (rhbz 1571623 1571624)
- Fix CVE-2018-10323 (rhbz 1571627 1571630)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1580713 - CVE-2018-3639 kernel: hw: cpu: speculative store bypass
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1580713
[ 2 ] Bug #1556797 - [kernel] swiotlb buffer is full
https://bugzilla.redhat.com/show_bug.cgi?id=1556797
--------------------------------------------------------------------------------
================================================================================
libreoffice-5.3.7.2-10.fc26 (FEDORA-2018-c94805b2e3)
Free Software Productivity Suite
--------------------------------------------------------------------------------
Update Information:
Resolves: tdf#117093 sanitize the active grid window value
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 22 2018 Eike Rathke <erack(a)redhat.com> - 1:5.3.7.2-10
- Resolves: tdf#117093 sanitize the active grid window value
--------------------------------------------------------------------------------
================================================================================
lollypop-0.9.513-1.fc26 (FEDORA-2018-3076002d98)
Music player for GNOME
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.513 ---- Update to 0.9.512 ---- Update to 0.9.511 ----
Update to 0.9.510
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 23 2018 Martin Gansser <martinkg(a)fedoraproject.org> - 0.9.513-1
- Update to 0.9.513
* Wed May 16 2018 Martin Gansser <martinkg(a)fedoraproject.org> - 0.9.512-1
- Update to 0.9.512
* Wed May 16 2018 Martin Gansser <martinkg(a)fedoraproject.org> - 0.9.511-1
- Update to 0.9.511
* Tue May 15 2018 Martin Gansser <martinkg(a)fedoraproject.org> - 0.9.510-1
- Update to 0.9.510
--------------------------------------------------------------------------------
================================================================================
rebase-helper-0.13.2-1.fc26 (FEDORA-2018-d2c13c4e33)
The tool that helps you to rebase your package to the latest version
--------------------------------------------------------------------------------
Update Information:
Changes since **0.12.0**: - Added possibility to make changes to specfile
between build retries - Added **CommitHashUpdater** SPEC hook - Added
**hackage** versioneer - Added support for uncompressed tar archives - Created
integration environment for test suite to isolate it from the internet - Added
`--update-sources` option to update *sources* file and upload new sources to
lookaside cache - Added `--apply-changes` option to apply *changes.patch* after
successful rebase - Implemented *.gitignore* update with `--update-sources` -
Added **licensecheck** checker for detecting license changes - Added another
*not-so-verbose* verbosity level - Switched to `requests` library for downloads
- Made error messages from **Koji** builds more useful - Reworked handling of
downstream patches - Changed package build process to build first SRPMs and then
RPMs - Divided checkers into categories running at different phases of rebase -
**Koji** build tool refactored to be better adjustable and extensible -
Colorized **rebase-helper** output and enhanced log messages - Significatly
improved rebase summary and report - Extended `README.md` - Cleaned up constants
- Refactored `utils` module - Fixed `TestConsoleHelper.test_get_message()` test
- Fixed bug in **rpmdiff** output analysis - Fixed some code styling errors and
a large number of issues found by static analysis - Fixed crash after failed
rebase when no checkers were run - Fixed **abipkgdiff** detecting changes in
only one object file - Fixed uploads to lookaside cache - Fixed broken
consequent build retries
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 23 2018 Nikola Forr�� <nforro(a)redhat.com> - 0.13.2-1
- New release 0.13.2 (#1562375)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1562375 - rebase-helper-0.13.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1562375
--------------------------------------------------------------------------------
================================================================================
xmlrpc-3.1.3-20.fc26 (FEDORA-2018-1ec08a2143)
Java XML-RPC implementation
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2016-5003, CVE-2016-5002
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 18 2018 Michael Simacek <msimacek(a)redhat.com> - 1:3.1.3-20
- Disallow deserialization of <ex:serializable> tags by default
- Resolves CVE-2016-5003
- Disallow loading of external DTD
- Resolves CVE-2016-5002
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:3.1.3-19
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:3.1.3-18
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object
through <ex:serializable> tag
https://bugzilla.redhat.com/show_bug.cgi?id=1508123
[ 2 ] Bug #1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a
crafted DTD
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
--------------------------------------------------------------------------------