The following Fedora 26 Security updates need testing:
Age URL
288
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb5c8d1e7
docker-distribution-2.6.2-1.git48294d9.fc26
119
https://bodhi.fedoraproject.org/updates/FEDORA-2018-66b885ae3c
keycloak-httpd-client-install-0.8-1.fc26
107
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f8a78a5ef
squid-4.0.23-1.fc26
82
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db5041e661 bro-2.5.3-1.fc26
48
https://bodhi.fedoraproject.org/updates/FEDORA-2018-010396b4a2
chromium-65.0.3325.181-1.fc26
43
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
22
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8ba4601398
dovecot-2.2.35-1.fc26
19
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7be77249d4 ruby-2.4.4-88.fc26
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f9e0f1caf7
glusterfs-3.10.12-1.fc26
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-eb69078020 xen-4.8.3-4.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e6d9251471
httpd-2.4.33-4.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-88a4219528 patch-2.7.6-4.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db8f322bb0 guava-18.0-12.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cf8e6c1a35
seamonkey-2.49.3-1.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-92f04c6b61
mysql-mmm-2.2.1-20.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a954bb958b
pam-kwallet-5.12.5-3.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-77c0da8eea
blktrace-1.2.0-6.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-89a0086f56
firefox-60.0-4.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6a9fea1b3a
webkitgtk4-2.20.2-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f29459149a wget-1.19.5-1.fc26
The following Fedora 26 Critical Path updates have yet to be approved:
Age URL
85
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ddd1e5c30a
iproute-4.14.1-5.fc26
43
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f9e0f1caf7
glusterfs-3.10.12-1.fc26
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-eb69078020 xen-4.8.3-4.fc26
12
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6d82adbfeb
libnfs-1.11.0-1.fc26
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-afc4f5f88f
osinfo-db-20180502-1.fc26
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a311ccc70c
pungi-4.1.24-1.fc26
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-88a4219528 patch-2.7.6-4.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8306020865
python-productmd-1.12-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-fcbef2ab8c
python-pip-9.0.3-2.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-294c5a591e
iptables-1.6.2-3.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7efba18539 sssd-1.16.1-4.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7979a42ded
python2-2.7.15-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6a9fea1b3a
webkitgtk4-2.20.2-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-89a0086f56
firefox-60.0-4.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8d567575dd
python-urllib3-1.20-3.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d35693d829 krb5-1.15.2-8.fc26
The following builds have been pushed to Fedora 26 updates-testing
LibRaw-0.18.11-1.fc26
fmf-0.4-1.fc26
gnome-chemistry-utils-0.14.17-9.fc26
gnumeric-1.12.41-1.fc26
goffice-0.10.41-1.fc26
greenwave-0.7.0-1.fc26
nuvolasdk-4.11.0-1.fc26
open-vm-tools-10.2.5-2.fc26
perl-experimental-0.020-1.fc26
puppetlabs-stdlib-4.25.1-1.fc26
st-0.8.1-2.fc26
vim-8.0.1806-1.fc26
waiverdb-0.10.0-1.fc26
Details about builds:
================================================================================
LibRaw-0.18.11-1.fc26 (FEDORA-2018-742a69ccc3)
Library for reading RAW files obtained from digital photo cameras
--------------------------------------------------------------------------------
Update Information:
https://www.libraw.org/news/libraw-0-18-11 ---- CVE-2018-10529 fixed: out
of bounds read in X3F parser CVE-2018-10528 fixed: possible stack overrun in
X3F parser
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Gwyn Ciesla <limburgher(a)gmail.com> - 0.18.11-1
- 0.18.11.
* Thu May 3 2018 Gwyn Ciesla <limburgher(a)gmail.com> - 0.18.10-1
- 0.18.10.
* Wed Apr 25 2018 Gwyn Ciesla <limburgher(a)gmail.com> - 0.18.9-1
- 0.18.9.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1576801 - LibRaw-0.18.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1576801
[ 2 ] Bug #1574326 - CVE-2018-10529 LibRaw: Out-of-bounds read in X3F property table
list functionality in libraw_x3f.cpp and libraw_cxx.cpp [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1574326
[ 3 ] Bug #1574322 - CVE-2018-10528 LibRaw: Stack-based buffer overflow in
libraw_cxx.cpp:utf2char() allows for potential code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1574322
[ 4 ] Bug #1574486 - LibRaw-0.18.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1574486
--------------------------------------------------------------------------------
================================================================================
fmf-0.4-1.fc26 (FEDORA-2018-cea87af9ca)
Flexible Metadata Format
--------------------------------------------------------------------------------
Update Information:
Initial release of Flexible Metadata Format
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1575645 - Review Request: fmf - Flexible Metadata Format
https://bugzilla.redhat.com/show_bug.cgi?id=1575645
--------------------------------------------------------------------------------
================================================================================
gnome-chemistry-utils-0.14.17-9.fc26 (FEDORA-2018-8760751758)
A set of chemical utilities
--------------------------------------------------------------------------------
Update Information:
An update to the latest gnumeric and goffice releases: *
http://gnumeric.org/announcements/1.12/gnumeric-1.12.41.html ---- An update to
the latest gnumeric and goffice releases: *
gnumeric.org/announcements/1.12/gnumeric-1.12.40.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 0.14.17-9
- Rebuilt for gnumeric-1.12.41
* Sun May 6 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 0.14.17-8
- Rebuilt for gnumeric-1.12.40
--------------------------------------------------------------------------------
================================================================================
gnumeric-1.12.41-1.fc26 (FEDORA-2018-8760751758)
Spreadsheet program for GNOME
--------------------------------------------------------------------------------
Update Information:
An update to the latest gnumeric and goffice releases: *
http://gnumeric.org/announcements/1.12/gnumeric-1.12.41.html ---- An update to
the latest gnumeric and goffice releases: *
gnumeric.org/announcements/1.12/gnumeric-1.12.40.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 0:1.12.41-2
- Updated to 1.12.41
- Ensured python2 is called explicitly as per
https://fedoraproject.org/wiki/Changes/Avoid_usr_bin_python_in_RPM_Build
* Sun May 6 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 1:1.12.40-1
- Updated to 1.12.40
--------------------------------------------------------------------------------
================================================================================
goffice-0.10.41-1.fc26 (FEDORA-2018-8760751758)
G Office support libraries
--------------------------------------------------------------------------------
Update Information:
An update to the latest gnumeric and goffice releases: *
http://gnumeric.org/announcements/1.12/gnumeric-1.12.41.html ---- An update to
the latest gnumeric and goffice releases: *
gnumeric.org/announcements/1.12/gnumeric-1.12.40.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 0.10.41-1
- Updated to 0.10.41
* Sun May 6 2018 Julian Sikorski <belegdol(a)fedoraproject.org> - 0.10.40-1
- Updated to 0.10.40
--------------------------------------------------------------------------------
================================================================================
greenwave-0.7.0-1.fc26 (FEDORA-2018-a5b59d6ef0)
Service for gating on automated tests
--------------------------------------------------------------------------------
Update Information:
* New `RemoteOriginalSpecNvrRule` for extending policies (#75). * In case
Greenwave found no matching results for a decision, the summary text has been
re-worded to be clearer and to indicate how many results were expected (#145).
* Wildcard support for matching multiple product versions. This allows to
specify ``product_versions`` like ``fedora-*`` in policies to match
``fedora-27``, ``fedora-28`` and any future release. * Wildcard support in the
``repos`` list in ``rules`` in policy files (#155). * Both new and old
ResultsDB message format are now supported.
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Lukas Holecek <lholecek(a)redhat.com> - 0.7.0-1
- New RemoteOriginalSpecNvrRule for extending policies (#75).
- In case Greenwave found no matching results for a decision, the summary text
has been re-worded to be clearer and to indicate how many results were
expected (#145).
- Wildcard support for matching multiple product versions. This allows to
specify ``product_versions`` like ``fedora-*`` in policies to match
``fedora-27``, ``fedora-28`` and any future release.
- Wildcard support in the ``repos`` list in ``rules`` in policy files (#155).
- Both new and old ResultsDB message format are now supported.
--------------------------------------------------------------------------------
================================================================================
nuvolasdk-4.11.0-1.fc26 (FEDORA-2018-0c177426b3)
SDK for building Nuvola Player's web app scripts
--------------------------------------------------------------------------------
Update Information:
Update to 4.11.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Martin Gansser <martinkg(a)fedoraproject.org> - 4.11.0-1
- Update to stable 4.11.0-1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1576616 - nuvolasdk-4.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1576616
--------------------------------------------------------------------------------
================================================================================
open-vm-tools-10.2.5-2.fc26 (FEDORA-2018-082f8985de)
Open Virtual Machine Tools for virtual machines hosted on VMware
--------------------------------------------------------------------------------
Update Information:
Package new upstream version 10.2.5 that also fixes RHBZ#1431376.
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 9 2018 Ravindra Kumar <ravindrakumar(a)vmware.com> - 10.2.5-2
- Use tirpc for Fedora 28 onwards.
* Wed May 9 2018 Ravindra Kumar <ravindrakumar(a)vmware.com> - 10.2.5-1
- Package new upstream version open-vm-tools-10.2.5-8068406 (RHBZ#1431376).
- Added use-tirpc.patch to use libtirpc instead of deprecated Sun RPC.
- Removed wayland-crash.patch which is no longer needed.
* Mon Apr 30 2018 Pete Walter <pwalter(a)fedoraproject.org> - 10.2.0-5
- Rebuild for ICU 61.1
* Thu Feb 8 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 10.2.0-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1431376 - "/sys$DEVPATH/device/timeout" does not expand to a path
https://bugzilla.redhat.com/show_bug.cgi?id=1431376
--------------------------------------------------------------------------------
================================================================================
perl-experimental-0.020-1.fc26 (FEDORA-2018-4c58016e10)
Experimental features made easy
--------------------------------------------------------------------------------
Update Information:
Updated to the latest version
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Jitka Plesnikova <jplesnik(a)redhat.com> - 0.020-1
- 0.020 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1576612 - perl-experimental-0.020 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1576612
--------------------------------------------------------------------------------
================================================================================
puppetlabs-stdlib-4.25.1-1.fc26 (FEDORA-2018-bcf4ef02b0)
Puppet Labs Standard Library
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Andrea Veri <averi(a)fedoraproject.org> - 4.25.1-1
- New upstream release.
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
4.5.1-7.20150121git7a91f20
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
4.5.1-6.20150121git7a91f20
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
st-0.8.1-2.fc26 (FEDORA-2018-96813c068c)
A simple terminal implementation for X
--------------------------------------------------------------------------------
Update Information:
This update fixes the st-user subpackage so that it installs all necessary
source files once again. ---- A new version of
suckless.org simple terminal,
aka st, is available for Fedora. See upstream release notes for 0.8 and 0.8.1
for the summary of changes:
https://lists.suckless.org/dev/1803/32584.html
https://lists.suckless.org/dev/1803/32600.html
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Petr ��abata <contyk(a)redhat.com> - 0.8.1-2
- Install all source files for st-user (rhbz#1574165)
* Mon Apr 9 2018 Petr ��abata <contyk(a)redhat.com> - 0.8.1-1
- 0.8.1 bump
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.7-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1574165 - st-user 0.8.1-1 cannot build custom st because install is missing
new source files
https://bugzilla.redhat.com/show_bug.cgi?id=1574165
[ 2 ] Bug #1556651 - st-0.8.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1556651
--------------------------------------------------------------------------------
================================================================================
vim-8.0.1806-1.fc26 (FEDORA-2018-e56905871e)
The VIM editor
--------------------------------------------------------------------------------
Update Information:
The newest upstream commit ---- 1575354 - Vim's update fails on perl
dependency
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1806-1
- patchlevel 1806
* Wed May 9 2018 Zdenek Dohnal <zdohnal(a)redhat.com> - 8.0.1789-2
- 1575354 - suggest more packages for embedded interpreters
* Fri May 4 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1789-1
- patchlevel 1789
* Thu May 3 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1788-1
- patchlevel 1788
* Wed May 2 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1787-1
- patchlevel 1787
* Fri Apr 27 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1766-1
- patchlevel 1766
* Thu Apr 26 2018 Karsten Hopp <karsten(a)redhat.com> 8.0.1765-1
- patchlevel 1765
--------------------------------------------------------------------------------
================================================================================
waiverdb-0.10.0-1.fc26 (FEDORA-2018-99b3f48b6a)
Service for waiving results in ResultsDB
--------------------------------------------------------------------------------
Update Information:
* Comment is now explicitly required when creating waivers (both in API and
CLI). * Multiple waivers can now be created with single POST request (#98). To
create multiple waivers, POST list to "waivers/" instead of single waiver. *
When creating a waiver by referring to a result ID, WaiverDB now accepts
results with ``'type': 'brew-build'`` as an alias for
``'koji_build'``. *
Messaging can be disabled is settings with ``MESSAGE_PUBLISHER = None``. * The
``KERBEROS_HTTP_HOST`` setting in the server configuration is now ignored.
This setting is no longer needed because GSSAPI will automatically find a key
in the Kerberos keytab matching the service principal in the client request.
* New man pages are available for ``waiverdb-cli(1)`` and ``waiverdb(7)`` (REST
API). * Changed error message for bad ``since`` value. E.g.
``api/v1.0/waivers/?since=123`` results in HTTP 400 with message
``{"message":
{"since": "time data '123' does not match format
'%Y-%m-%dT%H:%M:%S.%f'"}}``.
* CORS headers are now supported for every request (#160). * Wrong ``subject``
filter produces more user-friendly error (#162). * Setting a keytab file is no
longer required: if one is not explicitly set, ``/etc/krb5.keytab`` will be
used (#55). * Unused option ``resultsdb_api_url`` was removed from client.conf.
* Containers on Quay (`https://quay.io/repository/factory2/waiverdb`).
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 10 2018 Lukas Holecek <lholecek(a)redhat.com> - 0.10.0-1
- Comment is now explicitly required when creating waivers (both in API and
CLI).
- Multiple waivers can now be created with single POST request (#98). To create
multiple waivers, POST list to "waivers/" instead of single waiver.
- When creating a waiver by referring to a result ID, WaiverDB now accepts
results with ``'type': 'brew-build'`` as an alias for
``'koji_build'``.
- Messaging can be disabled is settings with ``MESSAGE_PUBLISHER = None``.
- The ``KERBEROS_HTTP_HOST`` setting in the server configuration is now
ignored. This setting is no longer needed because GSSAPI will automatically
find a key in the Kerberos keytab matching the service principal in the
client request.
- New man pages are available for ``waiverdb-cli(1)`` and ``waiverdb(7)`` (REST
API).
- Changed error message for bad ``since`` value. E.g.
``api/v1.0/waivers/?since=123`` results in HTTP 400 with message
``{"message": {"since": "time data '123' does not match
format
'%Y-%m-%dT%H:%M:%SOURCE.%f'"}}``.
- CORS headers are now supported for every request (#160).
- Wrong ``subject`` filter produces more user-friendly error (#162).
- Setting a keytab file is no longer required: if one is not explicitly set,
``/etc/krb5.keytab`` will be used (#55).
- Unused option ``resultsdb_api_url`` was removed from client.conf.
- Containers on Quay (`<https://quay.io/repository/factory2/waiverdb>`__).
* Mon Mar 12 2018 Ralph Bean <rbean(a)redhat.com - 0.9.1-1
- Include new resultsdb_api_url config for the client.
- Port to python3.
--------------------------------------------------------------------------------