The following Fedora 28 Security updates need testing:
Age URL
158
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d510cfd7eb
jgraphx-3.6.0.0-6.fc28
108
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d7aeaa74da
nodejs-brace-expansion-1.1.11-1.fc28
106
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc073fdc1a
nodejs-atob-2.1.1-1.fc28
99
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9dd3f7c013
unrtf-0.21.9-8.fc28
67
https://bodhi.fedoraproject.org/updates/FEDORA-2018-28e9841baf
docker-latest-1.13.1-37.git9cb56fd.fc28
16
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f0089c995
yum-utils-1.1.31-515.fc28
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0132af2176
devscripts-2.18.4-1.fc28
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1735cbc422 CImg-2.3.6-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b6072889db php-7.2.10-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dc060c6f2a
gitolite3-3.6.9-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2bba84217a
php-tcpdf-6.2.22-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9fc46b45ab
visualboyadvance-m-2.1.0-2.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1758d97170
yaml-cpp-0.6.1-4.fc28
The following Fedora 28 Critical Path updates have yet to be approved:
Age URL
16
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f0089c995
yum-utils-1.1.31-515.fc28
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9403743de2
edk2-20180815gitcb5f4f45ce-1.fc28
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6a3d2795ab
pungi-4.1.28-1.fc28
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f06af0ec34 qemu-2.11.2-4.fc28
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-221c934152
perl-File-Path-2.16-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b34ee01b0d
iproute-4.18.0-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0a09323ac0 fwupd-1.0.9-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8217a06c3a pcre2-10.32-1.fc28
perl-re-engine-PCRE2-0.14-4.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ec89f50711
highlight-3.44-1.fc28
The following builds have been pushed to Fedora 28 updates-testing
batctl-2018.3-1.fc28
chromium-69.0.3497.92-1.fc28
fedmod-0.3.0-1.fc28
ghostscript-9.25-1.fc28
inxi-3.0.24-1.fc28
java-11-openjdk-11.0.ea.28-5.fc28
kernel-4.18.8-200.fc28
kernel-headers-4.18.8-200.fc28
libabigail-1.4-2.fc28
mesa-18.0.5-4.fc28
mld2p4-2.1.1-2.fc28
moodle-3.4.5-1.fc28
mozilla-noscript-10.1.9.6-1.fc28
munin-2.0.40-4.fc28
perl-perlfaq-5.20180915-1.fc28
php-kolab-net-ldap3-1.0.7-2.fc28
psblas3-3.5.2-3.fc28
python-pocketlint-0.17-1.fc28
tdlib-1.3.0-2.fc28
wine-3.16-1.fc28
xorg-x11-drv-amdgpu-18.1.0-1.fc28
Details about builds:
================================================================================
batctl-2018.3-1.fc28 (FEDORA-2018-d50b363784)
B.A.T.M.A.N. advanced control and management tool
--------------------------------------------------------------------------------
Update Information:
Update to 2018.3.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Felix Kaechele <heffer(a)fedoraproject.org> - 2018.3-1
- update to 2018.3
* Fri Jul 20 2018 Felix Kaechele <heffer(a)fedoraproject.org> - 2018.2-1
- update to 2018.2
* Thu Jul 19 2018 John W. Linville <linville(a)redhat.com> - 2018.1-3
- Add previously unnecessary BuildRequires for gcc
* Thu Jul 12 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2018.1-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
chromium-69.0.3497.92-1.fc28 (FEDORA-2018-13d8c35127)
A WebKit (Blink) powered web browser
--------------------------------------------------------------------------------
Update Information:
Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug: 1629813, so as
soon as devtoolset-8 arrives...) Fixes a lot of security issues, like every
major release of Chromium, including CVE-2018-16087 CVE-2018-16088
CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068
CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073
CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 12 2018 Tom Callaway <spot(a)fedoraproject.org> - 69.0.3497.92-1
- update to 69.0.3497.92
* Wed Sep 5 2018 Tom Callaway <spot(a)fedoraproject.org> - 69.0.3497.81-1
- update to 69.0.3497.81
* Tue Aug 28 2018 Patrik Novotn�� <panovotn(a)redhat.com> - 68.0.3440.106-4
- change requires to minizip-compat(-devel), rhbz#1609830, rhbz#1615381
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1625488 - CVE-2018-16085 chromium-browser: Use after free in Memory
Instrumentation
https://bugzilla.redhat.com/show_bug.cgi?id=1625488
[ 2 ] Bug #1625487 - CVE-2018-16084 chromium-browser: User confirmation bypass in
external protocol handling
https://bugzilla.redhat.com/show_bug.cgi?id=1625487
[ 3 ] Bug #1625486 - CVE-2018-16083 chromium-browser: Out of bounds read in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1625486
[ 4 ] Bug #1625485 - CVE-2018-16082 chromium-browser: Stack buffer overflow in
SwiftShader
https://bugzilla.redhat.com/show_bug.cgi?id=1625485
[ 5 ] Bug #1625484 - CVE-2018-16081 chromium-browser: Local file access in DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1625484
[ 6 ] Bug #1625482 - CVE-2018-16080 chromium-browser: URL spoof in full screen mode
https://bugzilla.redhat.com/show_bug.cgi?id=1625482
[ 7 ] Bug #1625481 - CVE-2018-16079 chromium-browser: URL spoof in permission dialogs
https://bugzilla.redhat.com/show_bug.cgi?id=1625481
[ 8 ] Bug #1625480 - CVE-2018-16078 chromium-browser: Credit card information leak in
Autofill
https://bugzilla.redhat.com/show_bug.cgi?id=1625480
[ 9 ] Bug #1625479 - CVE-2018-16077 chromium-browser: Content security policy bypass in
Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625479
[ 10 ] Bug #1625478 - CVE-2018-16076 chromium-browser: Out of bounds read in PDFium
https://bugzilla.redhat.com/show_bug.cgi?id=1625478
[ 11 ] Bug #1625477 - CVE-2018-16075 chromium-browser: Local file access in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625477
[ 12 ] Bug #1625476 - CVE-2018-16074 chromium-browser: Site Isolation bypass using Blob
URLS
https://bugzilla.redhat.com/show_bug.cgi?id=1625476
[ 13 ] Bug #1625475 - CVE-2018-16073 chromium-browser: Site Isolation bypass after tab
restore
https://bugzilla.redhat.com/show_bug.cgi?id=1625475
[ 14 ] Bug #1625474 - CVE-2018-16072 chromium-browser: Cross origin pixel leak in
Chrome's interaction with Android's MediaPlayer
https://bugzilla.redhat.com/show_bug.cgi?id=1625474
[ 15 ] Bug #1625473 - CVE-2018-16071 chromium-browser: Use after free in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1625473
[ 16 ] Bug #1625472 - CVE-2018-16070 chromium-browser: Integer overflow in Skia
https://bugzilla.redhat.com/show_bug.cgi?id=1625472
[ 17 ] Bug #1625471 - CVE-2018-16069 chromium-browser: Out of bounds read in
SwiftShader
https://bugzilla.redhat.com/show_bug.cgi?id=1625471
[ 18 ] Bug #1625470 - CVE-2018-16068 chromium-browser: Out of bounds write in Mojo
https://bugzilla.redhat.com/show_bug.cgi?id=1625470
[ 19 ] Bug #1625469 - CVE-2018-16067 chromium-browser: Out of bounds read in WebAudio
https://bugzilla.redhat.com/show_bug.cgi?id=1625469
[ 20 ] Bug #1625467 - CVE-2018-16066 chromium-browser: Out of bounds read in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625467
[ 21 ] Bug #1625466 - CVE-2018-16065 chromium-browser: Out of bounds write in V8
https://bugzilla.redhat.com/show_bug.cgi?id=1625466
[ 22 ] Bug #1628080 - chromium-browser: URL Spoofing in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1628080
[ 23 ] Bug #1628078 - chromium-browser: Function signature mismatch in WebAssembly
https://bugzilla.redhat.com/show_bug.cgi?id=1628078
--------------------------------------------------------------------------------
================================================================================
fedmod-0.3.0-1.fc28 (FEDORA-2018-e8b8e4000f)
Utilities for generating & maintaining modulemd files
--------------------------------------------------------------------------------
Update Information:
This update introduces linting modulemd v2 documents using the `fedmod lint`
command.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Nils Philippsen <nils(a)redhat.com> 0.3.0-1
- Update version metadata for release 0.3.0 (nils(a)redhat.com)
- test that wrong data types in filter block get flagged (nils(a)redhat.com)
- test that wrong data types in api block get flagged (nils(a)redhat.com)
- test that wrong data types in profiles block get flagged (nils(a)redhat.com)
- test that non-scalar values in references get flagged (nils(a)redhat.com)
- test that unknown reference keys get flagged (nils(a)redhat.com)
- lint: cope gracefully with non-dict references block (nils(a)redhat.com)
- test that non-dict references block gets flagged (nils(a)redhat.com)
- test that non-dict xmd block gets flagged (nils(a)redhat.com)
- test that missing platform dependencies are flagged (nils(a)redhat.com)
- lint: warn about missing dependencies block (nils(a)redhat.com)
- test that a missing dependencies block gets flagged (nils(a)redhat.com)
- pytest: filter more deprecation warnings caused by koji (nils(a)redhat.com)
- test that items from infrastructure are flagged (nils(a)redhat.com)
- avoid other warnings when importing Modulemd (nils(a)redhat.com)
- make @linting_fails preserve method signatures (nils(a)redhat.com)
- refactor @linting_fails (nils(a)redhat.com)
- test license blocks that are unknown or not lists (nils(a)redhat.com)
- test license blocks that aren't dicts (nils(a)redhat.com)
- test summaries that are more than one sentence (nils(a)redhat.com)
- test non-Unicode and non-YAML documents (nils(a)redhat.com)
- test non-scalar license values (nils(a)redhat.com)
- test missing licenses, licenses.module blocks (nils(a)redhat.com)
- lint: fix lint_licenses_scalar() (nils(a)redhat.com)
- test dependencies blocks of the wrong version (nils(a)redhat.com)
- lint: check that a v1 dependencies block is a dict (nils(a)redhat.com)
- test for trailing periods in summary, description (nils(a)redhat.com)
- include all levels when linting by default (nils(a)redhat.com)
- lint: better cope with missing description (nils(a)redhat.com)
- test for missing summary and description (nils(a)redhat.com)
- test for wrong or missing document versions (nils(a)redhat.com)
- add class for generic modulemd tests (nils(a)redhat.com)
- add and use linting_fails decorator (nils(a)redhat.com)
- lint: test missing document element (nils(a)redhat.com)
- add basic harness to test linting (nils(a)redhat.com)
- require pytest for testing (nils(a)redhat.com)
- lint: update copyright year (nils(a)redhat.com)
- lint: update v1_dependencies_buildrequires_dict docstring (nils(a)redhat.com)
- lint: cope with modulemd v1/v2 dependencies blocks (nils(a)redhat.com)
- lint: accept modulemd v2 documents (nils(a)redhat.com)
- lint: add missing blank line before class (nils(a)redhat.com)
- lint: update linked anchors (nils(a)redhat.com)
- add period to sentence ends (nils(a)redhat.com)
- Fix error message when container.yaml exists (otaylor(a)fishsoup.net)
- pytest: filter deprecation warnings caused by koji (nils(a)redhat.com)
- avoid warning when importing Modulemd (nils(a)redhat.com)
- change back out of temporary directory after test (nils(a)redhat.com)
- tests: make check for Python 2 setuptools fuzzier (nils(a)redhat.com)
* Thu Sep 6 2018 Nils Philippsen <nils(a)redhat.com> 0.2.3-1
- Update version metadata for release 0.2.3 (nils(a)redhat.com)
- Default to the f29 dataset (otaylor(a)fishsoup.net)
- Flatpak: Base runtime and package branches off of the current dataset
(otaylor(a)fishsoup.net)
- Add a f29 release version (otaylor(a)fishsoup.net)
- Add a rawhide release version (otaylor(a)fishsoup.net)
- Allow for multiple release versions, and add a --dataset argument
(otaylor(a)fishsoup.net)
- Add F28 modular updates repo (otaylor(a)fishsoup.net)
- Fix usage of attrs (otaylor(a)fishsoup.net)
--------------------------------------------------------------------------------
================================================================================
ghostscript-9.25-1.fc28 (FEDORA-2018-bc0ef4eac0)
Interpreter for PostScript language & PDF
--------------------------------------------------------------------------------
Update Information:
This rebase fixes a crash of *ghostscript* when `GS_OPTIONS=` environment
variable is set.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 David Kaspar [Dee'Kej] <dkaspar(a)redhat.com> - 9.25-1
- rebase to latest upstream version to fix additional issues found in 9.24
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628875 - ghostscript coredumps if GS_OPTIONS is set
https://bugzilla.redhat.com/show_bug.cgi?id=1628875
--------------------------------------------------------------------------------
================================================================================
inxi-3.0.24-1.fc28 (FEDORA-2018-a2b93e24a7)
A full featured system information script
--------------------------------------------------------------------------------
Update Information:
Update to 3.0.24. Now you can see hardware vulnerabilities and it's mitigations
by -Ca key.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 12 2018 Vasiliy N. Glazov <vascom2(a)gmail.com> 3.0.24-1
- Update to 3.0.24
* Mon Sep 10 2018 Vasiliy N. Glazov <vascom2(a)gmail.com> 3.0.23-1
- Update to 3.0.23
* Tue Sep 4 2018 Vasiliy N. Glazov <vascom2(a)gmail.com> 3.0.22-1
- Update to 3.0.22
--------------------------------------------------------------------------------
================================================================================
java-11-openjdk-11.0.ea.28-5.fc28 (FEDORA-2018-22ef555fb7)
OpenJDK Runtime Environment 11
--------------------------------------------------------------------------------
Update Information:
Fixes a problem with Math.cos() on aarch64. See RHBZ#1628612.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 13 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:11.0.ea.28-5
- Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
JDK-8210461.
* Mon Sep 10 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:11.0.ea.28-4
- link to jhsdb followed its file to ifarch jit_arches ifnarch s390x
* Fri Sep 7 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:11.0.ea.28-3
- Enable ZGC on x86_64.
* Tue Sep 4 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:11.0.ea.28-2
- jfr/*jfc files listed for all arches
- lib/classlist do not exists s390, ifarch-ed via jit_arches out
* Fri Aug 31 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:11.0.ea.28-1
- Update to latest upstream build jdk11+28, the first release
candidate.
* Wed Aug 29 2018 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:11.0.ea.22-8
- Adjust system NSS patch, RHBZ-1565658-system-nss-SunEC.patch, so
as to filter -Wl,--as-needed from linker flags. Fixes FTBFS issue.
Resolves: RHBZ#1623437
* Thu Aug 23 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:11.0.ea.22-6
- dissabled accessibility, fixed provides for main package's debug variant
* Mon Jul 30 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:11.0.ea.22-5
- now buildrequires javapackages-filesystem as the issue with macros should be fixed
* Wed Jul 18 2018 Jiri Vanek <jvanek(a)redhat.com> - 1:11.0.ea.22-2
- changed to build by itself instead of by jdk10
--------------------------------------------------------------------------------
================================================================================
kernel-4.18.8-200.fc28 (FEDORA-2018-f93103ae20)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.18.8 contains a number of fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Sun Sep 16 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.8-300
- Linux v4.18.8
* Fri Sep 14 2018 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Additional Fixes for CVE-2018-5391 (rhbz 1616059)
* Thu Sep 13 2018 Laura Abbott <labbott(a)redhat.com>
- Use the CPU RNG for entropy (rhbz 1572944)
* Thu Sep 13 2018 Laura Abbott <labbott(a)redhat.com>
- HID fixes (rhbz 1627963 1628715)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628715 - Elan touchpad unable to perform right-click in kernel later than
4.17.19-200.fc28
https://bugzilla.redhat.com/show_bug.cgi?id=1628715
[ 2 ] Bug #1627963 - kernel 4.18.5-200 breaks some mice
https://bugzilla.redhat.com/show_bug.cgi?id=1627963
[ 3 ] Bug #1572944 - 4.16.4-200.fc27.x86_64 takes minutes to finish crng init on some
systems
https://bugzilla.redhat.com/show_bug.cgi?id=1572944
--------------------------------------------------------------------------------
================================================================================
kernel-headers-4.18.8-200.fc28 (FEDORA-2018-f93103ae20)
Header files for the Linux kernel for use by glibc
--------------------------------------------------------------------------------
Update Information:
The 4.18.8 contains a number of fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.8-200
- Linux v4.18.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628715 - Elan touchpad unable to perform right-click in kernel later than
4.17.19-200.fc28
https://bugzilla.redhat.com/show_bug.cgi?id=1628715
[ 2 ] Bug #1627963 - kernel 4.18.5-200 breaks some mice
https://bugzilla.redhat.com/show_bug.cgi?id=1627963
[ 3 ] Bug #1572944 - 4.16.4-200.fc27.x86_64 takes minutes to finish crng init on some
systems
https://bugzilla.redhat.com/show_bug.cgi?id=1572944
--------------------------------------------------------------------------------
================================================================================
libabigail-1.4-2.fc28 (FEDORA-2018-0f1a9b9137)
Set of ABI analysis tools
--------------------------------------------------------------------------------
Update Information:
Re-build to get a proper tag
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Dodji Seketeli <dodji(a)redhat.com> - 1.4-2
- Re-build to get a proper tag
* Fri Jul 13 2018 Dodji Seketeli <dodji(a)seketeli.org> - 1.4-1
- Update to upstream 1.4
- Merge change to build fedabipkgdiff in Fedora only
--------------------------------------------------------------------------------
================================================================================
mesa-18.0.5-4.fc28 (FEDORA-2018-74dd8af935)
Mesa graphics libraries
--------------------------------------------------------------------------------
Update Information:
Fix r600 sb crash (#1629401)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Dave Airlie <Airlied(a)redhat.com> - 18.0.5-4
- Fix r600 sb crash (#1629401)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629401 - glmark2 segfaults with CAICOS
https://bugzilla.redhat.com/show_bug.cgi?id=1629401
--------------------------------------------------------------------------------
================================================================================
mld2p4-2.1.1-2.fc28 (FEDORA-2018-39b4ebf8b5)
MultiLevel Domain Decomposition Parallel Preconditioners Package based on PSBLAS
--------------------------------------------------------------------------------
Update Information:
- Fix upstream bug #9 (rhbz #1628858) - Rebuild mld2p4
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 2.1.1-2
- Rebuild for psblas3-3.5.2 +bugfix
* Sun Sep 16 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 2.1.1-1
- Release 2.1.1
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
2.1.1-0.10
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 2.1.1-0.9
- Rebuild for psblas3-3.5.2
* Wed Apr 25 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 2.1.1-0.8
- Rebuild after SuperLU-5.2.1 fixing
* Tue Apr 24 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 2.1.1-0.7
- Rebuild for SuperLU-5.2.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628858 - Wrong bounds computation in set_vect
https://bugzilla.redhat.com/show_bug.cgi?id=1628858
--------------------------------------------------------------------------------
================================================================================
moodle-3.4.5-1.fc28 (FEDORA-2018-690535d30b)
A Course Management System
--------------------------------------------------------------------------------
Update Information:
Fix for CVE-2018-14630
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Gwyn Ciesla <limburgher(a)gmail.com> - 3.4.5-1
- 3.4.5
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629923 - CVE-2018-14630 moodle: Moodle XML import of ddwtos could lead to
intentional remote code execution (MSA-18-0017) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629923
--------------------------------------------------------------------------------
================================================================================
mozilla-noscript-10.1.9.6-1.fc28 (FEDORA-2018-e9821afbca)
JavaScript white list extension for Mozilla Firefox
--------------------------------------------------------------------------------
Update Information:
Changes since 10.1.8.16: === v 10.1.9.6
============================================================= * [TB] Gracefully
handle legacy external message recipients * [XSS] Updated known HTML5 events *
Better IPV6 support * UI support for protocol-only entries v 10.1.9.5
============================================================= * Fix for various
content script timing related issues (thanks therube for reporting) v
10.1.9.4 ============================================================= * Prevent
total breakages when policies accidentally map to invalid match patterns *
Internal messaging dispatch better coping with multiple option windows * Avoid
multiple CSP DOM insertions v 10.1.9.3
============================================================= * Fixed message
handling regression breaking embedders and causing potential internal message
loops v 10.1.9.2 =============================================================
* More efficient window.name-based tab-scoped permissions persistence * Fixed
URL parsing bugs * Fixed bug in requestKey generation * [Build] Enhanced TLD
data update subsystem * [UI] CUSTOM presets gets initialized with currently
applied preset, including temporary/permanent status * Improved internal
message dispatching, avoiding potential race conditions * [L10n] Transifex
integration * Work-around for DOM-injected CSP not being honored when appended
to the root element, rather than HEAD * Transparent support for FQDNs * Better
file: protocol support * Full-page placeholders for media/plugin documents v
10.1.9.1 ============================================================= * Fixed
NOSCRIPT emulation not running in contexts where service workers are disabled,
such as private windows (thanks Peter Wu for patch) v 10.1.9
============================================================= * Completely
revamped CSP backend, enforcing policies both in webRequest and in the DOM *
Reload-less service worker busting * removed obsoleted failsafes, including
forced reloads * Better timing for popup UI feedback on permissions changes *
Send out a "started" message after initialization to help embedders (like the
Tor browser) interact with NoScript * Updated TLDs v 10.1.8.23
============================================================= * Hotfix for
reload loops before CSP management refactoring v 10.1.8.22
============================================================= * Fixed reload
loop on unrestricted tabs (thanks random for reporting) v 10.1.8.20
============================================================= * Fixed
Sites.domainImplies() misplaced optimization. * [L10n] Added Catalan (ca) v
10.1.8.19 ============================================================= * Fixed
onResponseHeader failing on session restore because of onBeforeRequest not
having being called. * Fixed regression: framed documents' URLs not being
reported in the UI (thanks xaex for report) v 10.1.8.18
============================================================= * More resilient
and optimized Sites.domainImplies() * Update ChildPolicies when automatic temp
TRUST for top-level documents is enabled * Fixed messages from content scripts
being "eaten" by the wrong dispatcher when UI is open (thanks
skriptimaahinen) * Fixed typo causing accidental permissions/status mismatches
being checked only while pages are still loading (thanks skriptimaahinen) *
Fixed typo in XSS name sanitization script injection (thanks skriptimaahinen)
v 10.1.8.17 ============================================================= * Fix:
Sites.domainImplies() should match subdomains * More coherent wrapper around the
webex messaging API * Fixed inconsistencies affecting ChildPolicies content
script auto-generated matching rules. * Fixed potential issues with cross-
process messages * Simpler and more reliable safety net to ensure CSP headers
are injected last among WebExtensions * Fixed regression causing refresh loops
on pages which use type="object" requests to load images, css and other types
* [L10n] ru and de translations * [XSS] Updated HTML events auto-generate
matching code to use both latest Mozilla source code and archived data since
Firefox ESR 52 * New dynamic scripts management strategy based on the
browser.contentScripts API, should fix some elusive, likely requestFilter-
induced, bugs * Fixed no-dot domains threated as empty TLDs (thanks Peter Wu
for patch) * Removed requestFilter hack for dynamic scripts management * [L10n]
br and tr translations (thanks Transifex/OTF,
https://www.transifex.com/otf/noscript/) * Best effort to have
webRequest.onHeaderReceived listener run last (issue #6, thanks kkapsner) *
[L10n] Localized "NoScript Options" title (thanks Diklabyte) * Fixed inline
scripts not being reported to UI (thanks skriptimaahinen for patch) * Skip
non-content windows when deferring startup page loads (thanks Rob Wu for
reporting) * Broader detection of UTF-8 encoding in responses (thanks Rob Wu
for reporting) * Improved support for debugging code removal in releases * Fixed
startup race condition with pending request tracking * Fixed updating NoScript
reloads tabs with revoked temporary permissions. Legacy version: === v
5.1.8.7 ============================================================= *
[Security] Fixed script blocking bypass zero-day (thanks Zerodium for
unresponsible disclosure,
https://twitter.com/Zerodium/status/1039127214602641409) * [Surrogate] Fixed
typo in 2mdn replacement (thansk barbaz) * [XSS] Fixed InjectionChecker choking
at some big JSON payloads sents as POST form data * [XSS] In-depth protection
against native ES6 modules abuse * Fixed classic beta channel users being
accidentally migrated to stable (thanks barbaz)
--------------------------------------------------------------------------------
ChangeLog:
* Sun Sep 16 2018 Dominik Mierzejewski <rpm(a)greysector.net> - 10.1.9.6-1
- update to 10.1.9.6
- update classic version to 5.1.8.7 (fixes CVE-2018-16983)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629212 - CVE-2018-16983 mozilla-noscript: NoScript Bypass via the
text/html;/json Content-Type value
https://bugzilla.redhat.com/show_bug.cgi?id=1629212
--------------------------------------------------------------------------------
================================================================================
munin-2.0.40-4.fc28 (FEDORA-2018-6455129fce)
Network-wide resource monitoring tool
--------------------------------------------------------------------------------
Update Information:
Improve upgrade path from old 2.0.33 to 2.0.40: save old apache config files as
%ghost. Improve first install experience by automatically creating localhost-
config and better example httpd/nginx config files.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Kim B. Heino <b(a)bbbs.net> - 2.0.40-4
- rhbz#1327512: munin-limits not reporting actual state of variable to NSCA
- rhbz#1629438: Create localhost-config on first install
- rhbz#1629438: Include old httpd config files as ghost
* Fri Sep 14 2018 Kim B. Heino <b(a)bbbs.net> - 2.0.40-3
- rhbz#1628390: Fix missing Perl dependencies in Fedora
- Obsolete munin-netip-plugins for epel upgrade path
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628390 - munin-node requires perl-Getopt-Long but package does not require
it
https://bugzilla.redhat.com/show_bug.cgi?id=1628390
[ 2 ] Bug #1629438 - The 2.0.40-2 release of munin packages on Aug 25th 2018 is broken.
https://bugzilla.redhat.com/show_bug.cgi?id=1629438
[ 3 ] Bug #1327512 - munin-limits not reporting actual state of variable to NSCA
https://bugzilla.redhat.com/show_bug.cgi?id=1327512
--------------------------------------------------------------------------------
================================================================================
perl-perlfaq-5.20180915-1.fc28 (FEDORA-2018-2688c0822d)
Frequently asked questions about Perl
--------------------------------------------------------------------------------
Update Information:
This release corrects examples and out-dated refernces to extarnal documents.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Petr Pisar <ppisar(a)redhat.com> - 5.20180915-1
- 5.20180915 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629618 - perl-perlfaq-5.20180915 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1629618
--------------------------------------------------------------------------------
================================================================================
php-kolab-net-ldap3-1.0.7-2.fc28 (FEDORA-2018-f02c68f1ce)
Advanced functionality for accessing LDAP directories
--------------------------------------------------------------------------------
Update Information:
**Version 1.0.7** - Jun 20 2018 * Fix bug where ldapsearch command was failing
when configured host contained protocol schema prefix * Fix regression in
setting LDAP cache file path * Improve setup of the schema cache location ----
**Version 1.0.6** - Apr 7 2017 * strncasecmp() -> strcasecmp() * Support GSSAPI
authentication * Use packagist as a source of Net_LDAP2 package ---- **Version
1.0.5** - Apr 5 2016 * Fix package names to conform with packagist's naming
policies * Fix bug where LDAP_OPT_DEBUG_LEVEL option couldn't have been disabled
(#4918) * Fix ldap_sort() deprecation warning in PHP7 (T1107) * Remove unused
variable, remove @ on ldap_add(), this may print useful warnings��� * Ensure that
multi-valued attributes have sequential indexes in the array ---- **Version
1.0.4** - Oct 15 2015 * Unify some error, warning and debug messages * fixing
recursive deletion of domains * Don't execute LDAP queries for domains if
domain_base_dn is not configured * Support %s variable in 'domain_filter' config
option * Fix find_domain() result when domain wasn't found (#4959)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Remi Collet <remi(a)fedoraproject.org> - 1.0.7-2
- update to 1.0.7
- sources from git snapshot
- provide php-composer(kolab/net_ldap3)
--------------------------------------------------------------------------------
================================================================================
psblas3-3.5.2-3.fc28 (FEDORA-2018-39b4ebf8b5)
Parallel Sparse Basic Linear Algebra Subroutines
--------------------------------------------------------------------------------
Update Information:
- Fix upstream bug #9 (rhbz #1628858) - Rebuild mld2p4
--------------------------------------------------------------------------------
ChangeLog:
* Fri Sep 14 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 3.5.2-3
- Fix upstream bug #9 (rhbz #1628858)
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.5.2-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Antonio Trande <sagitter(a)fedoraproject.org> - 3.5.2-1
- Update to release 3.5.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1628858 - Wrong bounds computation in set_vect
https://bugzilla.redhat.com/show_bug.cgi?id=1628858
--------------------------------------------------------------------------------
================================================================================
python-pocketlint-0.17-1.fc28 (FEDORA-2018-b3bbd43795)
Support for running pylint against projects
--------------------------------------------------------------------------------
Update Information:
Update to the latest upstream version. Mostly small bugfixes to adjust to new
pylint/astroid versions.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Vojtech Trefny <vtrefny(a)redhat.com> - 0.17-1
- Ignore config file line printed by pylint (vtrefny)
* Thu Jun 7 2018 Vojtech Trefny <vtrefny(a)redhat.com> - 0.16-1
- Use new astroid API (vtrefny)
- Use new astroid class names (miro)
- Remove Python 2 subpackage was RHEL > 7 and Fedora > 28 (vtrefny)
- Add a new pylint executable name to check (vtrefny)
- Define "srcname" in SPEC (vtrefny)
- Fix Python 2 dependencies (vtrefny)
--------------------------------------------------------------------------------
================================================================================
tdlib-1.3.0-2.fc28 (FEDORA-2018-52cd85f983)
Cross-platform library for building Telegram clients
--------------------------------------------------------------------------------
Update Information:
Initial package upload.
--------------------------------------------------------------------------------
================================================================================
wine-3.16-1.fc28 (FEDORA-2018-4183c77f9e)
A compatibility layer for windows applications
--------------------------------------------------------------------------------
Update Information:
3.16 - Initial implementation of OPC Services. - Support for rendering
buttons from an ImageList. - Better support for CSS properties in MSHTML. -
Namespace fixes in XML Writer. - Various bug fixes. 3.15 - Support for DPI
scaling on Android. - HID device support in Raw Input. - Many more new icons
in Shell32. - WinHTTP converted to use Windows Sockets. - Syntax fixes in
the command line interpreter. - Various bug fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 17 2018 Michael Cronenworth <mike(a)cchtml.com> 3.16-1
- version update
* Mon Sep 3 2018 Michael Cronenworth <mike(a)cchtml.com> 3.15-1
- version update
--------------------------------------------------------------------------------
================================================================================
xorg-x11-drv-amdgpu-18.1.0-1.fc28 (FEDORA-2018-3cc8e6681a)
AMD GPU video driver
--------------------------------------------------------------------------------
Update Information:
Update to 18.1.0
--------------------------------------------------------------------------------
ChangeLog:
* Sun Sep 16 2018 Christopher Atherton <the8lack8ox(a)gmail.com> - 18.1.0-1
- Update to 18.1.0
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 18.0.1-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon Apr 9 2018 Iryna Shcherbina <ishcherb(a)redhat.com> - 18.0.1-3
- Update Python 2 dependency declarations to new packaging standards
(See
https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
* Mon Apr 2 2018 Adam Jackson <ajax(a)redhat.com> - 18.0.1-2
- Rebuild for xserver 1.20
--------------------------------------------------------------------------------