The following Fedora 27 Security updates need testing:
Age URL
216
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ec1cd6db3 bro-2.5.3-1.fc27
148
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8dc6395408
dpdk-17.08.2-1.fc27
111
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b33f65b01
nodejs-brace-expansion-1.1.11-1.fc27
103
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a748acc219
unrtf-0.21.9-8.fc27
79
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f6ccdeb750
mailman-2.1.21-9.fc27
79
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc864bb9e1
openslp-2.0.0-15.fc27
37
https://bodhi.fedoraproject.org/updates/FEDORA-2018-21ffebf41c
tomcat-8.0.53-1.fc27
37
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e8533a3ef1
unixODBC-2.3.7-1.fc27
36
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7051d682fa
ntp-4.2.8p12-1.fc27
26
https://bodhi.fedoraproject.org/updates/FEDORA-2018-11ed8d95e2
libxkbcommon-0.8.2-1.fc27
20
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3aafb854a9
yum-utils-1.1.31-514.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3a7916c8b9
thunderbird-60.0-1.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bf613d82be CImg-2.3.6-1.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-5a82282e4e gmic-2.3.6-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9a4d7ec61e
glusterfs-3.12.14-1.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7993dea41b
gitolite3-3.6.9-1.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-25100b492c php-7.1.22-1.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-239a12d7aa
php-tcpdf-6.2.22-1.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-34fac89d51
visualboyadvance-m-2.1.0-2.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c2499e6025
yaml-cpp-0.6.1-4.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-09c51bbcec
mozilla-noscript-10.1.9.6-1.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-43ff5f6e5b
moodle-3.3.8-1.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-11b966722a
hylafax+-5.6.1-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-77d864ff39
libbson-1.9.5-3.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6a92b4f75c
zchunk-0.9.10-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3e9f26489b lcms2-2.8-6.fc27
The following Fedora 27 Critical Path updates have yet to be approved:
Age URL
132
https://bodhi.fedoraproject.org/updates/FEDORA-2018-25d5c86330 libidn-1.34-2.fc27
mcabber-1.1.0-1.fc27.1 pidgin-2.13.0-1.fc27.1 python-slixmpp-1.3.0-5.fc27.1
92
https://bodhi.fedoraproject.org/updates/FEDORA-2018-200dba6b93
upower-0.99.8-1.fc27
56
https://bodhi.fedoraproject.org/updates/FEDORA-2018-05a68ea22e
geoclue2-2.4.11-1.fc27
37
https://bodhi.fedoraproject.org/updates/FEDORA-2018-20c3deae24
iproute-4.17.0-1.fc27
26
https://bodhi.fedoraproject.org/updates/FEDORA-2018-11ed8d95e2
libxkbcommon-0.8.2-1.fc27
22
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c223c11259
libldb-1.3.2-2.fc27.1.2.3 samba-4.7.10-0.fc27
20
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3aafb854a9
yum-utils-1.1.31-514.fc27
19
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db7b8aabc5
edk2-20180815gitcb5f4f45ce-1.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3a7916c8b9
thunderbird-60.0-1.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d2f0264871
perl-File-Path-2.16-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9a4d7ec61e
glusterfs-3.12.14-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-60b107e6b6
gnome-software-3.28.2-2.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-5de433cf0f
pungi-4.1.28-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9dba618394
btrfs-progs-4.17.1-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-35efb2e3e1 rpm-4.14.2-1.fc27
12
https://bodhi.fedoraproject.org/updates/FEDORA-2018-227775ff3a ceph-12.2.8-1.fc27
9
https://bodhi.fedoraproject.org/updates/FEDORA-2018-afc61ca113
p11-kit-0.23.14-1.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6ec2c424b8
flatpak-1.0.2-1.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ca54aecfc8
highlight-3.44-1.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-14a1773017 koji-1.16.1-2.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-07054ad6d9
firefox-62.0-3.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ede34350d8
dash-0.5.10.2-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3e9f26489b lcms2-2.8-6.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-847a5b27f8 vim-8.1.408-1.fc27
The following builds have been pushed to Fedora 27 updates-testing
kernel-4.18.9-100.fc27
kernel-headers-4.18.9-100.fc27
nodejs-8.12.0-1.fc27
openas2-2.6.1-4.fc27
openssl-1.1.0i-1.fc27
orthanc-1.4.2-1.fc27
osinfo-db-20180920-1.fc27
spamassassin-3.4.2-2.fc27
standard-test-roles-2.17-1.fc27
usbip-4.18.9-2.fc27
Details about builds:
================================================================================
kernel-4.18.9-100.fc27 (FEDORA-2018-d77cc41f35)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.18.9 stable update contains a number of important fixes across the tree.
---- The 4.18.8 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.9-100
- Linux v4.18.9
* Sun Sep 16 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.8-100
- Linux v4.18.8
* Fri Sep 14 2018 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Additional Fixes for CVE-2018-5391 (rhbz 1616059)
* Thu Sep 13 2018 Laura Abbott <labbott(a)redhat.com>
- Use the CPU RNG for entropy (rhbz 1572944)
* Thu Sep 13 2018 Laura Abbott <labbott(a)redhat.com>
- HID fixes (rhbz 1627963 1628715)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631205 - CVE-2018-17182 kernel: Use-after-free in the vmacache_flush_all
function resulting in a possible privilege escalation
https://bugzilla.redhat.com/show_bug.cgi?id=1631205
--------------------------------------------------------------------------------
================================================================================
kernel-headers-4.18.9-100.fc27 (FEDORA-2018-d77cc41f35)
Header files for the Linux kernel for use by glibc
--------------------------------------------------------------------------------
Update Information:
The 4.18.9 stable update contains a number of important fixes across the tree.
---- The 4.18.8 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.9-100
- Linux v4.18.9
* Mon Sep 17 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.8-100
- Linux v4.18.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631205 - CVE-2018-17182 kernel: Use-after-free in the vmacache_flush_all
function resulting in a possible privilege escalation
https://bugzilla.redhat.com/show_bug.cgi?id=1631205
--------------------------------------------------------------------------------
================================================================================
nodejs-8.12.0-1.fc27 (FEDORA-2018-66ac0293f0)
JavaScript runtime
--------------------------------------------------------------------------------
Update Information:
Update to Node.js 10.11.0
https://nodejs.org/en/blog/release/v10.11.0/
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 11 2018 Stephen Gallagher <sgallagh(a)redhat.com> - -
- Update to 8.12.0
-
https://nodejs.org/en/blog/release/v8.12.0/
- Drop NPM symlinks
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1630937 - npm requires python2
https://bugzilla.redhat.com/show_bug.cgi?id=1630937
--------------------------------------------------------------------------------
================================================================================
openas2-2.6.1-4.fc27 (FEDORA-2018-e7055e367d)
Java-based implementation of the EDIINT AS2 standard
--------------------------------------------------------------------------------
Update Information:
This is an open Java implementation of the AS2 EDI transport standard. To test,
you need to install multiple instances, or use actual EDI partners. For
instance, if you are an Amazon EDI vendor, you can create a TEST connection to
your openas2 instance and run Amazon tests. You need to use the Java keytool
to create and exchange public keys to identify EDI partners. At some point, I
need to add a Fedora README with more Fedora specific howtos. While this is an
application designed to exchange business EDI documents, you can test by
creating 2 or more instances, and exchanging any arbitrary files. AS2 doesn't
look at the contents of documents other than to compute the hash for signatures.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1478210 - Review Request: openas2 - Java implementation of EDIINT AS2
https://bugzilla.redhat.com/show_bug.cgi?id=1478210
--------------------------------------------------------------------------------
================================================================================
openssl-1.1.0i-1.fc27 (FEDORA-2018-02a38af202)
Utilities from the general purpose cryptography library with TLS implementation
--------------------------------------------------------------------------------
Update Information:
Update to 1.1.0i version from upstream fixing minor security issues.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Tom���� Mr��z <tmraz(a)redhat.com> 1.1.0i-1
- update to upstream version 1.1.0i
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568256 - CVE-2018-0737 openssl: RSA key generation cache timing
vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1568256
[ 2 ] Bug #1591101 - CVE-2018-0732 openssl: Malicious server can send large prime to
client during DH(E) TLS handshake causing the client to hang [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1591101
--------------------------------------------------------------------------------
================================================================================
orthanc-1.4.2-1.fc27 (FEDORA-2018-51ec347296)
RESTful DICOM server for healthcare and medical research
--------------------------------------------------------------------------------
Update Information:
New upstream version
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Sebastien Jodogne <s.jodogne(a)gmail.com> - 1.4.2-1
- New upstream version
- Fix ambiguous Python shebang
--------------------------------------------------------------------------------
================================================================================
osinfo-db-20180920-1.fc27 (FEDORA-2018-387a30f785)
osinfo database files
--------------------------------------------------------------------------------
Update Information:
Update to new release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Fabiano Fid��ncio <fabiano(a)fidencio.org> - 20180920-1
- Update to new release
--------------------------------------------------------------------------------
================================================================================
spamassassin-3.4.2-2.fc27 (FEDORA-2018-6ed251c42b)
Spam filter for email which can be invoked from mail delivery agents
--------------------------------------------------------------------------------
Update Information:
Fixed some small bugs in the previous package: Initial rules now have the
correct version, sought channel config is dropped (since it doesn't exist
anymore) and build / runtime deps adjusted. ---- Update to 3.4.2. Fixes
CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes
and improvements. See
https://www.mail-
archive.com/announce@apache.org/msg04823.html for more information.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.2-2
- Misc small bug fixes and cleanups.
* Sun Sep 16 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.2-1
- Update to 3.4.2
- Fixes: CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781
* Mon Jul 23 2018 Jaroslav ��karvada <jskarvad(a)redhat.com> - 3.4.1-25
- perl-Razor-Agent and perl-Net-Patricia not used on RHEL
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.4.1-24
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jul 10 2018 Tomas Korbar <tkorbar(a)redhat.com> - 3.4.1-23
- Fix daemonize subroutine
- See
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7594
* Fri Jun 29 2018 Jitka Plesnikova <jplesnik(a)redhat.com> - 3.4.1-22
- Perl 5.28 rebuild
* Wed Jun 20 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.1-21
- Conditionalize Requires for /sbin/service and /sbin/chkconfig. Fixes bug #1592390
* Thu Jun 7 2018 Tomas Korbar <tomas.korb(a)seznam.cz> - 3.4.1-20
- Add razor log path and home directory option
* Tue Apr 10 2018 Rafael Santos <rdossant(a)redhat.com> - 3.4.1-19
- Use standard Fedora linker flags (bug #1548561)
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.4.1-18
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629537 - CVE-2018-11781 spamassassin: Local user code injection in the meta
rule syntax [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629537
[ 2 ] Bug #1629534 - CVE-2018-11780 spamassassin: Potential remote code execution
vulnerability in PDFInfo plugin [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629534
[ 3 ] Bug #1629522 - CVE-2017-15705 spamassassin: Certain unclosed tags in crafted
emails allow for scan timeouts and resulting denial of service [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629522
[ 4 ] Bug #1629491 - SpamAssassin 3.4.2 released with CVE disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1629491
[ 5 ] Bug #1590592 - Need spamassassin release with patch for bug 7208 included
https://bugzilla.redhat.com/show_bug.cgi?id=1590592
--------------------------------------------------------------------------------
================================================================================
standard-test-roles-2.17-1.fc27 (FEDORA-2018-d7f4ff074f)
Standard Test Interface Ansible roles
--------------------------------------------------------------------------------
Update Information:
Update to 2.17
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Andrei Stepanov <astepano(a)redhat.com> - 2.17-1
- Build with the latest merged PRs.
--------------------------------------------------------------------------------
================================================================================
usbip-4.18.9-2.fc27 (FEDORA-2018-28dce2eeba)
USB/IP user-space
--------------------------------------------------------------------------------
Update Information:
Fixes problem importing device when another directory is in
```/sys/devices/platform``` after ```vhci_hcd.0```
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.18.9-1
- Update to 4.18.9
- Add patch to fix problem importing device when another device is in
/sys/devices/platform after vhci (#1631148)
- Fix missing period in patch
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.15.10-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.15.10-2
- Remove unneeded ldconfig scriptlets
* Thu Mar 15 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.15.10-1
- Attempt another build after supposed failure the last time
- Update to 4.15.10 to fix GCC 8 build failure
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.14.11-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Feb 8 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.14.11-2
- Remove obsolete Group tag
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631148 - usbip doesn't work
https://bugzilla.redhat.com/show_bug.cgi?id=1631148
--------------------------------------------------------------------------------