The following Fedora 30 Security updates need testing: Age URL 118 https://bodhi.fedoraproject.org/updates/FEDORA-2019-71b2273a9f libarchive-3.3.3-7.fc30 6 https://bodhi.fedoraproject.org/updates/FEDORA-2020-a69f99bc67 php-horde-Horde-Form-2.0.20-1.fc30 4 https://bodhi.fedoraproject.org/updates/FEDORA-2020-40fa1ae94b libxslt-1.1.34-1.fc30 4 https://bodhi.fedoraproject.org/updates/FEDORA-2020-4c3d74204a nethack-3.6.6-1.fc30 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-79f233b15e chromium-80.0.3987.132-1.fc30 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-f3fa778924 webkit2gtk3-2.28.0-5.fc30 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-c870aa8378 tomcat-9.0.31-2.fc30
The following Fedora 30 Critical Path updates have yet to be approved: Age URL 249 https://bodhi.fedoraproject.org/updates/FEDORA-2019-c05e4425d1 dash-0.5.10.2-3.fc30 118 https://bodhi.fedoraproject.org/updates/FEDORA-2019-71b2273a9f libarchive-3.3.3-7.fc30 13 https://bodhi.fedoraproject.org/updates/FEDORA-2020-4f4ab30209 glusterfs-6.8-1.fc30 13 https://bodhi.fedoraproject.org/updates/FEDORA-2020-c47f499c3b hwdata-0.333-1.fc30 12 https://bodhi.fedoraproject.org/updates/FEDORA-2020-f13060e7a5 vim-8.2.348-1.fc30 11 https://bodhi.fedoraproject.org/updates/FEDORA-2020-36282d2a6d cups-2.2.12-6.fc30 10 https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f6589f3ef ceph-14.2.8-1.fc30 9 https://bodhi.fedoraproject.org/updates/FEDORA-2020-6ff1ecb240 gnome-software-3.32.4-7.fc30 8 https://bodhi.fedoraproject.org/updates/FEDORA-2020-09e7d027b6 koji-1.20.1-1.fc30 python-pycdio-2.0.0-8.fc30 4 https://bodhi.fedoraproject.org/updates/FEDORA-2020-40fa1ae94b libxslt-1.1.34-1.fc30 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-7eb53be2a5 perl-Encode-3.04-13.fc30 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-b6287eafe3 dnsmasq-2.80-12.fc30 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-fffba1c2dd python3-3.7.7-1.fc30 python3-docs-3.7.7-1.fc30 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-94049d2962 nss-3.50.0-2.fc30 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-57216f2e13 kernel-5.5.9-100.fc30 kernel-headers-5.5.9-100.fc30 kernel-tools-5.5.9-100.fc30 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-02ee4b1a1c PackageKit-1.1.12-8.fc30 dnf-plugins-extras-4.0.8-4.fc30 libdnf-0.43.1-5.fc30
The following builds have been pushed to Fedora 30 updates-testing
WoeUSB-3.3.1-2.fc30 ccls-0.20190823.5-2.fc30 composer-1.10.1-1.fc30 glances-3.1.4-1.fc30 inxi-3.0.38-1.fc30 mozilla-ublock-origin-1.25.2-1.fc30 perl-CPAN-Perl-Releases-5.20200314-1.fc30 perl-Module-CoreList-5.20200314-1.fc30 php-phpmailer6-6.1.5-1.fc30 pungi-4.2.1-2.fc30 python-google-auth-1.11.3-1.fc30 redis-5.0.8-1.fc30 sourcextractor++-0.10-1.fc30 tang-7-3.fc30 timeshift-20.03-1.fc30 vagrant-sshfs-1.3.4-1.fc30 vgrive-1.5.0-1.fc30
Details about builds:
================================================================================ WoeUSB-3.3.1-2.fc30 (FEDORA-2020-027e677cfd) Windows USB installation media creator -------------------------------------------------------------------------------- Update Information:
Exclude s390x due to RHBZ#1813540 -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 mprahl mprahl@redhat.com - 3.3.1-2 - Stop building for s390x due to RHBZ#1813540 * Tue Mar 10 2020 mprahl mprahl@redhat.com - 3.3.1-1 - new version * Tue Jan 28 2020 Fedora Release Engineering releng@fedoraproject.org - 3.3.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1813540 - None https://bugzilla.redhat.com/show_bug.cgi?id=1813540 [ 2 ] Bug #1800906 - WoeUSB-3.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1800906 --------------------------------------------------------------------------------
================================================================================ ccls-0.20190823.5-2.fc30 (FEDORA-2020-7a4c9cca98) C/C++/ObjC language server -------------------------------------------------------------------------------- Update Information:
Fix dependency on the current clang version (fix for rhbz#1807574) -------------------------------------------------------------------------------- ChangeLog:
* Sun Mar 15 2020 Dan ��erm��k dan.cermak@cgc-instruments.com - 0.20190823.5-2 - Fix dependency on the current clang version (fix for rhbz#1807574) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1807574 - ccls points to wrong clang resource directory https://bugzilla.redhat.com/show_bug.cgi?id=1807574 --------------------------------------------------------------------------------
================================================================================ composer-1.10.1-1.fc30 (FEDORA-2020-8a3060382b) Dependency Manager for PHP -------------------------------------------------------------------------------- Update Information:
**Version 1.10.1** - 2020-03-13 * Fixed path repository warning on empty path when using wildcards * Fixed superfluous warnings when generating optimized autoloaders ---- **Version 1.10.0** - 2020-03-10 * Added `bearer` auth config to authenticate using `Authorization: Bearer <token>` headers * Added `plugin-api-version` in composer.lock so third-party tools can know which Composer version was used to generate a lock file * Fixed composer fund command and funding info parsing to be more useful * Fixed issue where --no- dev autoload generation was excluding some packages which should not have been excluded * Fixed 1.10-RC regression in create project's handling of absolute paths ---- **Version 1.10.0-RC** - 2020-02-14 * Breaking: `composer global exec ...` now executes the process in the current working directory instead of executing it in the global directory. * Warning: Added a warning when class names are being loaded by a PSR-4 or PSR-0 rule only due to classmap optimization, but would not otherwise be autoloadable. Composer 2.0 will stop autoloading these classes so make sure you fix your autoload configs. * Added new funding key to composer.json to describe ways your package's maintenance can be funded. This reads info from GitHub's FUNDING.yml by default so better configure it there so it shows on GitHub and Composer/Packagist * Added `composer fund` command to show funding info of your dependencies * Added support for --format=json output for show command when showing a single package * Added support for configuring suggestions using config command, e.g. `composer config suggest.foo/bar some text` * Added support for configuring fine-grained preferred-install using config command, e.g. `composer config preferred- install.foo/* dist` * Added `@putenv` script handler to set environment variables from composer.json for following scripts * Added `lock` option that can be set to false, in which case no composer.lock file will be generated * Added --add-repository flag to create-project command which will persist the repo given in --repository into the composer.json of the package being installed * Added support for IPv6 addresses in NO_PROXY * Added package homepage display in the show command * Added debug info about HTTP authentications * Added Symfony 5 compatibility * Added --fixed flag to require command to make it use a fixed constraint instead of a ^x.y constraint when adding the requirement * Fixed exclude-from-classmap matching subsets of directories e.g. foo/ was excluding foobar/ * Fixed archive command to persist file permissions inside the zip files * Fixed init/require command to avoid suggesting packages which are already selected in the search results * Fixed create-project UX issues * Fixed filemtime for vendor/composer/* files is now only changing when the files actually change * Fixed issues detecting docker environment with an active open_basedir -------------------------------------------------------------------------------- ChangeLog:
* Sat Mar 14 2020 Remi Collet remi@remirepo.net - 1.10.1-1 - update to 1.10.1 * Wed Mar 11 2020 Remi Collet remi@remirepo.net - 1.10.0-1 - update to 1.10.0 --------------------------------------------------------------------------------
================================================================================ glances-3.1.4-1.fc30 (FEDORA-2020-e9a70ffd37) CLI curses based monitoring tool -------------------------------------------------------------------------------- Update Information:
Please try this new version, I do not have the time to do lots of tests -------------------------------------------------------------------------------- ChangeLog:
* Sat Mar 14 2020 Edouard Bourguignon madko@linuxed.net - 3.1.4-1 - Upgrade to 3.1.4 * Tue Jan 28 2020 Fedora Release Engineering releng@fedoraproject.org - 3.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Thu Oct 3 2019 Miro Hron��ok mhroncok@redhat.com - 3.1.0-4 - Rebuilt for Python 3.8.0rc1 (#1748018) * Mon Aug 19 2019 Miro Hron��ok mhroncok@redhat.com - 3.1.0-3 - Rebuilt for Python 3.8 * Thu Jul 25 2019 Fedora Release Engineering releng@fedoraproject.org - 3.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1747073 - glances-3.1.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=1747073 --------------------------------------------------------------------------------
================================================================================ inxi-3.0.38-1.fc30 (FEDORA-2020-6d505024a3) A full featured system information script -------------------------------------------------------------------------------- Update Information:
Update to 3.0.38. -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Vasiliy N. Glazov vascom2@gmail.com - 3.0.38-1 - Update to 3.0.38 * Wed Jan 29 2020 Fedora Release Engineering releng@fedoraproject.org - 3.0.37-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ mozilla-ublock-origin-1.25.2-1.fc30 (FEDORA-2020-2c587c9455) An efficient blocker for Firefox -------------------------------------------------------------------------------- Update Information:
## Changes since 1.24.2 ### Changes: uBO requires a new permission, dns, which is required to solve issue 780. This may triggers a new permission warning from Firefox when uBO updates to the latest dev build, specifically "Access IP address and hostname information", even though this was already possible for uBO to access that information. From now on uBO will CNAME-uncloak network requests. CNAME-uncloaked network requests will appear as blue entries in the popup panel and the logger. The uncloaked entries in the popup panel will also show the related aliases (in smaller characters underneath the canonical names). Network requests which were blocked, redirected, or excepted by a filter/rule are not uncloaked. Canonical hostnames which are first party to the associated alias hostname are not fed back into uBO's filtering engine. Warning: CNAME- aliased hostnames exist most likely for content delivery purpose, i.e. legitimate. ### Closed as fixed: * In Element Zapper, support Mac keyboards��� Delete key (pull request from @roryokane) * Uncaught (in promise) ReferenceError: WebAssembly is not defined * Accessing localStorage delays startup * Need to whitelist Microsoft Edge internal page * Reverse lookup of filter fails with wildcard-leading patterns * Search Bar is partially hidden on list pages * "0" prefixes are currently not accepted as valid hosts entries * [Regression] Show requests blocked in the logger as a result of csp= option * Source list of entity filter with subdomain is not looked up correctly * Fanboy's Cookie List moved to better place * Cosmetic filtering issue with Shadow DOM/tree/root * "::" entry in notracking hosts file blocks URLs containing "::" * Adsbygoogle.js injectable does not validate whether iframe going to be injected is already exist or not * Allow clicking on domain to expand it to show hosts * Fix token position value when removing leading wildcard ### Notable commits with no entry in issue tracker: * Allow re- entrance in abort-current-inline-script * Make element picker mind that network filters are case-insensitive * Support loading of benchmark dataset in published versions * Wrap long hostnames in popup panel * New way to convey IDN and CNAME info in popup panel * Harden abort-current-inline-script scriplet * Remove "uBlock filters -- Experimental" from stock lists * Fix unescaped attr value in generated CSS selector * Fix regex-like filter representation in logger * Improve neutered Google Analytics replacement scriptlet -------------------------------------------------------------------------------- ChangeLog:
* Sat Mar 14 2020 Dominik Mierzejewski rpm@greysector.net - 1.25.2-1 - update to 1.25.2 (#1797341) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1797341 - mozilla-ublock-origin-1.25.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=1797341 --------------------------------------------------------------------------------
================================================================================ perl-CPAN-Perl-Releases-5.20200314-1.fc30 (FEDORA-2020-0b03b12929) Mapping Perl releases on CPAN to the location of the tarballs -------------------------------------------------------------------------------- Update Information:
Updated to the latest version -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Jitka Plesnikova jplesnik@redhat.com - 5.20200314-1 - 5.20200314 bump -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1813602 - perl-CPAN-Perl-Releases-5.20200314 is available https://bugzilla.redhat.com/show_bug.cgi?id=1813602 --------------------------------------------------------------------------------
================================================================================ perl-Module-CoreList-5.20200314-1.fc30 (FEDORA-2020-419e3082ee) What modules are shipped with versions of perl -------------------------------------------------------------------------------- Update Information:
This release brings data about Perl 5.30.2. -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Petr Pisar ppisar@redhat.com - 1:5.20200314-1 - 5.20200314 bump -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1813603 - perl-Module-CoreList-5.20200314 is available https://bugzilla.redhat.com/show_bug.cgi?id=1813603 --------------------------------------------------------------------------------
================================================================================ php-phpmailer6-6.1.5-1.fc30 (FEDORA-2020-eb39489962) Full-featured email creation and transfer class for PHP -------------------------------------------------------------------------------- Update Information:
**Version 6.1.5** (March 14th, 2020 * Reject invalid custom headers that are empty or contain breaks * Various fixes for DKIM issues, especially when using `mail()` transport * Drop the `l=` length tag from DKIM signatures; it's a mild security risk * Ensure CRLF is used explicitly when needed, rather than `static::$LE` * Add a method for trimming header content consistently * Some minor tweaks to resolve static analyser complaints * Check that attachment files are readable both when adding *and* when sending * Work around Outlook bug in mishandling MIME preamble * Danish translation improvements -------------------------------------------------------------------------------- ChangeLog:
* Sat Mar 14 2020 Remi Collet remi@remirepo.net - 6.1.5-1 - update to 6.1.5 --------------------------------------------------------------------------------
================================================================================ pungi-4.2.1-2.fc30 (FEDORA-2020-fa2df48609) Distribution compose tool -------------------------------------------------------------------------------- Update Information:
Fix incorrect detection of debuginfo packages. ---- New upstream release. Performance improvements: * Pkgset phase will reuse entire package set if it was not modified from previous compose. * Gather phase can also reuse results from previous compose. * Better parallelization of small createrepo_c processes. * Extra files phase no longer waits for gathering. Minor fixes: * Options for customizing latest symlink. * Resend message while waiting for ostree ref to be created. * Config validation can accept overrides for schema, making the validation more strict. -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Lubom��r Sedl���� lsedlar@redhat.com - 4.2.1-2 - Fix false positive debuginfo detection * Fri Mar 13 2020 Lubom��r Sedl���� lsedlar@redhat.com - 4.2.1-1 - New upstream release --------------------------------------------------------------------------------
================================================================================ python-google-auth-1.11.3-1.fc30 (FEDORA-2020-3a933676a3) Google Auth Python Library -------------------------------------------------------------------------------- Update Information:
Update. to 1.11.3 -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Jason Montleon jmontleo@redhat.com - 1:1.11.3-1 - Update to 1.11.3 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1813484 - python-google-auth-1.11.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1813484 --------------------------------------------------------------------------------
================================================================================ redis-5.0.8-1.fc30 (FEDORA-2020-9ae5608192) A persistent key-value database -------------------------------------------------------------------------------- Update Information:
Upstream 5.0.8 release. -------------------------------------------------------------------------------- ChangeLog:
* Fri Mar 13 2020 Nathan Scott nathans@redhat.com - 5.0.8-1 - Upstream 5.0.8 release. * Wed Feb 12 2020 Nathan Scott nathans@redhat.com - 5.0.7-3 - Patch extern SDS_NOINIT definition for gcc 10 (RHBZ #1799969) * Thu Jan 30 2020 Fedora Release Engineering releng@fedoraproject.org - 5.0.7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1812990 - redis-5.0.8 is available https://bugzilla.redhat.com/show_bug.cgi?id=1812990 --------------------------------------------------------------------------------
================================================================================ sourcextractor++-0.10-1.fc30 (FEDORA-2020-1fa48d274e) A program that extracts a catalog of sources from astronomical images, and the successor of SExtractor -------------------------------------------------------------------------------- Update Information:
New upstream release 0.10 -------------------------------------------------------------------------------- ChangeLog:
* Fri Mar 13 2020 Alejandro Alvarez Ayllon aalvarez@fedoraproject.org 0.10-1 - Update for upstream release 0.10 --------------------------------------------------------------------------------
================================================================================ tang-7-3.fc30 (FEDORA-2020-1f004bab47) Network Presence Binding Daemon -------------------------------------------------------------------------------- Update Information:
Rebuilt after http-parser update -------------------------------------------------------------------------------- ChangeLog:
* Sun Mar 1 2020 Sergio Correia scorreia@redhat.com - 7-3 - Rebuilt after http-parser update --------------------------------------------------------------------------------
================================================================================ timeshift-20.03-1.fc30 (FEDORA-2020-1050d60507) System restore tool for Linux -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2020-10174 -------------------------------------------------------------------------------- ChangeLog:
* Sun Mar 15 2020 Samuel Rakitni��an samuel.rakitnican@gmail.com 20.03-1 - Update to 20.03 - Rework the uninstall script removal * Fri Jan 31 2020 Fedora Release Engineering releng@fedoraproject.org - 19.08.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Sat Sep 28 2019 Richard Shaw hobbes1069@gmail.com - 19.08.1-1 - Update to 19.08.1. - Add patch to deal with abstract class compile error. * Sat Mar 9 2019 Samuel Rakitni��an samuel.rakitnican@gmail.com 19.01-1 - Update to 19.01 - Remove upstream gcc optimisation flag -O3 (Since timeshift 18.8) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1811684 - CVE-2020-10174 timeshift: Arbitrary local code execution due to unsafe usage of temporary directory in /tmp/timeshift https://bugzilla.redhat.com/show_bug.cgi?id=1811684 --------------------------------------------------------------------------------
================================================================================ vagrant-sshfs-1.3.4-1.fc30 (FEDORA-2020-998677fd3e) A Vagrant synced folder plugin that mounts folders via SSHFS -------------------------------------------------------------------------------- Update Information:
New upstream version: https://github.com/dustymabe/vagrant- sshfs/releases/tag/v1.3.4 -------------------------------------------------------------------------------- ChangeLog:
* Mon Mar 16 2020 Dusty Mabe dusty@dustymabe.com - 1.3.4-1 - new upstream release: 1.3.4 * Fri Jan 31 2020 Fedora Release Engineering releng@fedoraproject.org - 1.3.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ vgrive-1.5.0-1.fc30 (FEDORA-2020-1ae991983e) Google Drive client for Linux -------------------------------------------------------------------------------- Update Information:
Update to latest version -------------------------------------------------------------------------------- ChangeLog:
* Sun Mar 15 2020 Artem Polishchuk ego.cordatus@gmail.com - 1.5.0-1 - Update to 1.5.0 * Fri Jan 31 2020 Fedora Release Engineering releng@fedoraproject.org - 1.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild --------------------------------------------------------------------------------