The following Fedora 25 Security updates need testing:
Age URL
138
https://bodhi.fedoraproject.org/updates/FEDORA-2016-9b3ed5f170
chicken-4.11.0-3.fc25
90
https://bodhi.fedoraproject.org/updates/FEDORA-2016-6dd3bc37c3
compat-guile18-1.8.8-14.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2016-c614315d29
squid-4.0.17-1.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25
10
https://bodhi.fedoraproject.org/updates/FEDORA-2016-87dc28b1a0
w3m-0.5.3-27.git20161120.fc25
7
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f0d976df9e
mingw-flac-1.3.2-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7b181f9c98
qpid-java-6.0.4-5.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-16a7aa8e4f
springframework-security-3.2.10-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e6a9108cce
onionshare-0.9.1-1.fc25
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6a2709f065
SimGear-2016.3.1-3.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3d7734a8b2
icoutils-0.31.1-1.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-21edf966b0
mingw-libgsf-1.14.41-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-77ab791c90 ark-16.08.3-2.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2ddf7d452a
libgit2-0.24.6-1.fc25
The following Fedora 25 Critical Path updates have yet to be approved:
Age URL
45
https://bodhi.fedoraproject.org/updates/FEDORA-2016-940ecb5c59
wpa_supplicant-2.6-1.fc25
32
https://bodhi.fedoraproject.org/updates/FEDORA-2016-9c25320b71
pungi-4.1.11-3.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a42cba00c1
python-lxml-3.7.2-1.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5758dfef76
tigervnc-1.7.0-6.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-db33e6c6f4
thunderbird-45.6.0-3.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-47f2b2e9ae
kernel-4.9.2-200.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-70547b9af8
python-productmd-1.4-1.fc25
The following builds have been pushed to Fedora 25 updates-testing
BackupPC-3.3.1-7.fc25
arc-theme-20161119-1.fc25
ark-16.08.3-2.fc25
bcc-0.2.0-2.fc25
erlang-basho_stats-1.0.4-1.fc25
erlang-bitcask-2.0.7-1.fc25
evince-3.22.1-3.fc25
fail2ban-0.9.6-2.fc25
fegistry-0.0.0-1.fc25
gnome-boxes-3.22.3-2.fc25
gplugin-0.27.0-2.fc25
ibus-typing-booster-1.5.16-1.fc25
kernel-4.9.2-200.fc25
libgit2-0.24.6-1.fc25
libnfsidmap-0.27-0.fc25
log4cxx-0.10.0-22.fc25
mediawriter-4.0.8-0.fc25
mod_wsgi-4.4.23-4.fc25
nodejs-6.9.4-1.fc25
packagedb-cli-2.14-1.fc25
php-pdepend-PHP-Depend-2.4.0-1.fc25
pylast-1.7.0-2.fc25
python-peewee-2.8.5-1.fc25
qdigidoc-3.12.3-1.fc25
qesteidutil-3.12.4-1.fc25
renrot-1.2.0-1.fc25
rubygem-rugged-0.24.6-1.fc25
tito-0.6.9-1.fc25
Details about builds:
================================================================================
BackupPC-3.3.1-7.fc25 (FEDORA-2017-43835f9e0d)
High-performance backup system
--------------------------------------------------------------------------------
Update Information:
Perl unescaped braces (BZ 1259481)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1259481 - BackupPC Lib.pm Browse.pm fail - using tar method
https://bugzilla.redhat.com/show_bug.cgi?id=1259481
--------------------------------------------------------------------------------
================================================================================
arc-theme-20161119-1.fc25 (FEDORA-2017-0b2abab9a3)
Flat theme with transparent elements
--------------------------------------------------------------------------------
Update Information:
* Initial rpm-release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411438 - Review Request: arc-theme - Flat theme with transparent elements
https://bugzilla.redhat.com/show_bug.cgi?id=1411438
--------------------------------------------------------------------------------
================================================================================
ark-16.08.3-2.fc25 (FEDORA-2017-77ab791c90)
Archive manager
--------------------------------------------------------------------------------
Update Information:
CVE-2017-5330 ark: Unintended execution of scripts and executable files
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411822 - CVE-2017-5330 ark: Unintended execution of scripts and executable
files [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1411822
--------------------------------------------------------------------------------
================================================================================
bcc-0.2.0-2.fc25 (FEDORA-2017-7d872cfc00)
BPF Compiler Collection (BCC)
--------------------------------------------------------------------------------
Update Information:
Inclusion of BCC package into Fedora
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1404305 - Review Request: bcc - BPF Compiler Collection
https://bugzilla.redhat.com/show_bug.cgi?id=1404305
--------------------------------------------------------------------------------
================================================================================
erlang-basho_stats-1.0.4-1.fc25 (FEDORA-2017-4ad9a733ae)
Basic Erlang statistics library
--------------------------------------------------------------------------------
Update Information:
* Ver. 1.0.4
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1410634 - erlang-basho_stats-1.0.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1410634
--------------------------------------------------------------------------------
================================================================================
erlang-bitcask-2.0.7-1.fc25 (FEDORA-2017-20ccaa85f4)
Eric Brewer-inspired key/value store
--------------------------------------------------------------------------------
Update Information:
* Ver. 2.0.7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1410266 - erlang-bitcask-2.0.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1410266
--------------------------------------------------------------------------------
================================================================================
evince-3.22.1-3.fc25 (FEDORA-2017-80c6e45342)
Document viewer
--------------------------------------------------------------------------------
Update Information:
* fix a crash on repeated opening of new windows
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1404656 - [abrt] evince: _gtk_widget_get_toplevel(): evince killed by
SIGSEGV
https://bugzilla.redhat.com/show_bug.cgi?id=1404656
--------------------------------------------------------------------------------
================================================================================
fail2ban-0.9.6-2.fc25 (FEDORA-2017-bb1e01ca29)
Daemon to ban hosts that cause multiple authentication errors
--------------------------------------------------------------------------------
Update Information:
Fix fail2ban-regex with journal broken in 0.9.6-1. ---- Update to 0.9.6: *
Misleading add resp. enable of (already available) jail in database, that
induced a subsequent error: last position of log file will be never retrieved
(gh-795) * Fixed a distribution related bug within
testReadStockJailConfForceEnabled (e.g. test-cases faults on Fedora, see
gh-1353) * Fixed pythonic filters and test scripts (running via wrong python
version, uses "fail2ban-python" now); * Fixed test case
"testSetupInstallRoot"
for not default python version (also using direct call, out of virtualenv); *
Fixed ambiguous wrong recognized date pattern resp. its optional parts (see
gh-1512); * FIPS compliant, use sha1 instead of md5 if it not allowed (see
gh-1540) * Monit config: scripting is not supported in path (gh-1556) *
`filter.d/apache-modsecurity.conf` - Fixed for newer version (one space,
gh-1626), optimized: non-greedy catch-all replaced for safer match,
unneeded catch-all anchoring removed, non-capturing * `filter.d/asterisk.conf`
- Fixed to match different asterisk log prefix (source file: method:) *
`filter.d/dovecot.conf` - Fixed failregex ignores failures through some not
relevant info (gh-1623) * `filter.d/ignorecommands/apache-fakegooglebot` -
Fixed error within apache-fakegooglebot, that will be called with wrong
python version (gh-1506) * `filter.d/assp.conf` - Extended failregex and
test cases to handle ASSP V1 and V2 (gh-1494) * `filter.d/postfix-sasl.conf`
- Allow for having no trailing space after 'failed:' (gh-1497) *
`filter.d/vsftpd.conf` - Optional reason part in message after FAIL LOGIN
(gh-1543) * `filter.d/sendmail-reject.conf` - removed mandatory double space
(if dns-host available, gh-1579) * filter.d/sshd.conf - recognized "Failed
publickey for" (gh-1477); - optimized failregex to match all of "Failed
any-
method for ... from <HOST>" (gh-1479) - eliminated possible complex
injections (on user-name resp. auth-info, see gh-1479) - optional port part
after host (see gh-1533, gh-1581) * New Actions: - `action.d/npf.conf` for
NPF, the latest packet filter for NetBSD * New Filters: - `filter.d/mongodb-
auth.conf` for MongoDB (document-oriented NoSQL database engine) (gh-1586,
gh-1606 and gh-1607) * DateTemplate regexp extended with the word-end boundary,
additionally to word-start boundary * Introduces new command "fail2ban-
python", as automatically created symlink to python executable, where fail2ban
currently installed (resp. its modules are located): - allows to use the
same version, fail2ban currently running, e.g. in external scripts just
via replace python with fail2ban-python: ```diff -#!/usr/bin/env
python +#!/usr/bin/env fail2ban-python ``` - always the same
pickle protocol - the same (and also guaranteed available) fail2ban modules
- simplified stand-alone install, resp. stand-alone installation possibility
via setup (like gh-1487) is getting closer * Several test cases rewritten using
new methods assertIn, assertNotIn * New forward compatibility method
assertRaisesRegexp (normally python >= 2.7). Methods assertIn, assertNotIn,
assertRaisesRegexp, assertLogged, assertNotLogged are test covered now * Jail
configuration extended with new syntax to pass options to the backend (see
gh-1408), examples: - `backend =
systemd[journalpath=/run/log/journal/machine-1]` - `backend =
systemd[journalfiles="/run/log/journal/machine-1/system.journal,
/run/log/journal/machine-1/user.journal"]` - `backend =
systemd[journalflags=2]` Fix sendmail-auth filter (bug #1329919)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1329919 - sendmail-auth.conf filter never matchs on failregex condition
https://bugzilla.redhat.com/show_bug.cgi?id=1329919
--------------------------------------------------------------------------------
================================================================================
fegistry-0.0.0-1.fc25 (FEDORA-2017-af195b1854)
The Fedora registry endpoint
--------------------------------------------------------------------------------
Update Information:
Initial release.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411462 - Review Request: fegistry - The Fedora registry endpoint
https://bugzilla.redhat.com/show_bug.cgi?id=1411462
--------------------------------------------------------------------------------
================================================================================
gnome-boxes-3.22.3-2.fc25 (FEDORA-2017-7fa773d9e2)
A simple GNOME 3 application to access remote or virtual systems
--------------------------------------------------------------------------------
Update Information:
Fixes a crash on startup when G_MESSAGES_DEBUG=all is set in the environment.
--------------------------------------------------------------------------------
================================================================================
gplugin-0.27.0-2.fc25 (FEDORA-2017-5c35b5838d)
GObject based library that implements a reusable plugin system
--------------------------------------------------------------------------------
Update Information:
New package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411354 - Review Request: gplugin - GObject based library that implements a
reusable plugin system
https://bugzilla.redhat.com/show_bug.cgi?id=1411354
--------------------------------------------------------------------------------
================================================================================
ibus-typing-booster-1.5.16-1.fc25 (FEDORA-2017-c2b4c1b068)
A completion input method
--------------------------------------------------------------------------------
Update Information:
update to 1.5.16
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411659 - ibus-typing-booster sometimes shows weird number after candidates
when using French
https://bugzilla.redhat.com/show_bug.cgi?id=1411659
[ 2 ] Bug #1411676 - Deleting candidates from the user database doesn���t work if the
candidate is typed with a prefix
https://bugzilla.redhat.com/show_bug.cgi?id=1411676
[ 3 ] Bug #1411688 - Backspace and delete don���t work well when reaching the end of the
pre��dit, making it hard to delete spaces between words when surrounding text is
supported
https://bugzilla.redhat.com/show_bug.cgi?id=1411688
--------------------------------------------------------------------------------
================================================================================
kernel-4.9.2-200.fc25 (FEDORA-2017-47f2b2e9ae)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
This is a rebase of the 4.9.2 kernel. The 4.9.2 update contains a number of
important fixes across the tree
--------------------------------------------------------------------------------
================================================================================
libgit2-0.24.6-1.fc25 (FEDORA-2017-2ddf7d452a)
C implementation of the Git core methods as a library with a solid API
--------------------------------------------------------------------------------
Update Information:
Update to 0.24.6
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411859 - libgit2: Two vulnerabilities fixed in libgit 0.25.1 and 0.24.6
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1411859
--------------------------------------------------------------------------------
================================================================================
libnfsidmap-0.27-0.fc25 (FEDORA-2017-d28afa209a)
NFSv4 User and Group ID Mapping Library
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411863 - NFSv4 id mapping issues in multi-domain environments
https://bugzilla.redhat.com/show_bug.cgi?id=1411863
--------------------------------------------------------------------------------
================================================================================
log4cxx-0.10.0-22.fc25 (FEDORA-2017-c6094fd7f8)
A port to C++ of the Log4j project
--------------------------------------------------------------------------------
Update Information:
- Unorphan package - Split documentation into a subpackage - Rebuild for GCC6
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1408428 - Review Request: log4cxx - A port to C++ of the Log4j project
https://bugzilla.redhat.com/show_bug.cgi?id=1408428
--------------------------------------------------------------------------------
================================================================================
mediawriter-4.0.8-0.fc25 (FEDORA-2017-f4b2752eaf)
Fedora Media Writer
--------------------------------------------------------------------------------
Update Information:
Update to 4.0.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1399137 - Not showing download progress
https://bugzilla.redhat.com/show_bug.cgi?id=1399137
[ 2 ] Bug #1397461 - mediawriter offers previous version of workstation by default
https://bugzilla.redhat.com/show_bug.cgi?id=1397461
[ 3 ] Bug #1405693 - Mediawriter shows a ever changing size of USB device
https://bugzilla.redhat.com/show_bug.cgi?id=1405693
[ 4 ] Bug #1405681 - Fedora Media Writer corrupts downloaded 25 image
https://bugzilla.redhat.com/show_bug.cgi?id=1405681
--------------------------------------------------------------------------------
================================================================================
mod_wsgi-4.4.23-4.fc25 (FEDORA-2017-cd76b22101)
A WSGI interface for Python web applications in Apache
--------------------------------------------------------------------------------
Update Information:
Update to upstream version 4.4.23
--------------------------------------------------------------------------------
================================================================================
nodejs-6.9.4-1.fc25 (FEDORA-2017-0b0fe75f24)
JavaScript runtime
--------------------------------------------------------------------------------
Update Information:
Update to 6.9.4 ----
https://nodejs.org/en/blog/release/v6.9.3/
--------------------------------------------------------------------------------
================================================================================
packagedb-cli-2.14-1.fc25 (FEDORA-2017-d835a39752)
A CLI for pkgdb
--------------------------------------------------------------------------------
Update Information:
- Update to 2.14: - Fix finding the identifier in a bugzilla URL - Fix
setting the co-maintainers when auto-approving new branche - Better
description of the 'acl' action (Jason Tibbitts) - Return more information
upon failure (Ralph Bean) - Make easier for other pkgdb instances to use
pkgdb-cli (Nicolas Chauvet) - Handle request to unretire package without a
package review url
--------------------------------------------------------------------------------
================================================================================
php-pdepend-PHP-Depend-2.4.0-1.fc25 (FEDORA-2017-4b8b46517f)
PHP_Depend design quality metrics for PHP package
--------------------------------------------------------------------------------
Update Information:
**pdepend-2.4.0** (2017/01/10) This release implements language features like
Anonymous Classes, Group use Declarations, Uniform Variable Syntax or Loosening
Reserved Word Restrictions that were introduced with PHP 7.0, so that PDepend
2.4 is now PHP 7.0 compatible. - Fixed #281: PHP 7 - Anonymous Class - Internal
parser state issues - Fixed #285: Parse the magic constant __TRAIT__ - Fixed
#210: Partial Class Namespace is Calculated Twice: in Global and it's Own
Namespace - Implemented #280: Refactor SymbolTable - Implemented #282: PHP 7 -
Group use declarations - Implemented #269: Unexpected token: :: (implicit object
/ method usage) - Implemented #204: Support for the ... operator in function
calls - Implemented #290: Unexpected token: ARRAY (reserved keyword as a
class constant)
--------------------------------------------------------------------------------
================================================================================
pylast-1.7.0-2.fc25 (FEDORA-2017-6a1587343d)
A Python interface to Last.fm API compatible social networks
--------------------------------------------------------------------------------
Update Information:
* Obsolete pylast (w/o python2- prefix) ---- * Ver. 1.7.0
--------------------------------------------------------------------------------
================================================================================
python-peewee-2.8.5-1.fc25 (FEDORA-2017-06877474ae)
A small, expressive orm
--------------------------------------------------------------------------------
Update Information:
Update to 2.8.5
--------------------------------------------------------------------------------
================================================================================
qdigidoc-3.12.3-1.fc25 (FEDORA-2017-d4291ddbc1)
Estonian digital signature application
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411508 - qdigidoc 3.12.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1411508
[ 2 ] Bug #1411522 - "Update certificate" button does not work
https://bugzilla.redhat.com/show_bug.cgi?id=1411522
--------------------------------------------------------------------------------
================================================================================
qesteidutil-3.12.4-1.fc25 (FEDORA-2017-23e209b1f5)
Estonian ID card utility
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1411508 - qdigidoc 3.12.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1411508
[ 2 ] Bug #1411522 - "Update certificate" button does not work
https://bugzilla.redhat.com/show_bug.cgi?id=1411522
--------------------------------------------------------------------------------
================================================================================
renrot-1.2.0-1.fc25 (FEDORA-2017-15149f3ef8)
A program to rename and rotate files according to EXIF tags
--------------------------------------------------------------------------------
Update Information:
Update to latest version. Fixes perl errors.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1308425 - renrot fails with Can't use 'defined(%hash)'
https://bugzilla.redhat.com/show_bug.cgi?id=1308425
[ 2 ] Bug #1409691 - please update to 1.2.0
https://bugzilla.redhat.com/show_bug.cgi?id=1409691
--------------------------------------------------------------------------------
================================================================================
rubygem-rugged-0.24.6-1.fc25 (FEDORA-2017-f00cfda2c1)
Rugged is a Ruby binding to the libgit2 library
--------------------------------------------------------------------------------
Update Information:
Update to 0.24.6
--------------------------------------------------------------------------------
================================================================================
tito-0.6.9-1.fc25 (FEDORA-2017-c76f29d655)
A tool for managing rpm based git projects
--------------------------------------------------------------------------------
Update Information:
Add support for --use-release when tagging. Add support for bumping version in
Rust Cargo.toml files. Bug, pep8, documentation fixes.
--------------------------------------------------------------------------------