The following Fedora 25 Security updates need testing:
Age URL
325
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25
224
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e
python-XStatic-jquery-ui-1.12.0.1-4.fc25
163
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f
nodejs-brace-expansion-1.1.7-1.fc25
117
https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c
memcached-1.4.39-1.fc25
114
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4
docker-distribution-2.6.2-1.git48294d9.fc25
35
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0
thunderbird-52.4.0-2.fc25
29
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7089c6e789
suricata-3.2.4-1.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2017-51f49ebbce apr-1.6.3-1.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f563b201ba
apr-util-1.5.4-4.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2017-45ed341e61
httpd-2.4.29-1.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3
rpm-4.13.0.2-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5ad4107cc fedpkg-1.30-4.fc25
rpkg-1.51-2.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-c7514691cb
perl-Net-Ping-External-0.15-11.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b
poppler-0.45.0-10.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0188f21212
postgresql-9.5.10-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-481e4f6f8c
ldns-1.6.17-22.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e5bbb657c5
chromium-62.0.3202.89-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-1a9068594d
python-copr-1.84-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8016cc0bd0
backintime-1.1.24-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd
openssl-1.0.2m-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e
webkitgtk4-2.18.3-1.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f58bbbbdb0
konversation-1.7.4-1.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781
kernel-4.13.13-100.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8575fbfe90
varnish-5.0.0-5.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f1535b86fa
lucene4-4.10.4-11.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-580f91f6b0
qt5-qtwebengine-5.9.2-2.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5bcfedf10 mrbs-1.7.0-1.fc25
The following Fedora 25 Critical Path updates have yet to be approved:
Age URL
167
https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25
47
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fc5429e7e
iproute-4.12.0-1.fc25
35
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0
thunderbird-52.4.0-2.fc25
16
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b89e9f62d8
bind99-9.9.10-3.P3.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-dbf347055a
hwdata-0.306-1.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3
rpm-4.13.0.2-1.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e64b02d1b1
pcre2-10.23-10.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-65b10e63d5
pungi-4.1.20-1.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ec5efbcfc6 pcre-8.41-3.fc25
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-560cebc111
menu-cache-1.1.0-1.fc25
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a7f307017b
python-lxml-4.1.1-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e82231f2c7
libglvnd-1.0.0-1.fc25
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b
poppler-0.45.0-10.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-077334783e
webkitgtk4-2.18.3-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-55a3247cfd
openssl-1.0.2m-1.fc25
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-15b7f781f0 nss-3.34.0-1.0.fc25
nss-softokn-3.34.0-1.0.fc25 nss-util-3.34.0-1.0.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdfd888e2e git-2.9.5-3.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-1b4d140781
kernel-4.13.13-100.fc25
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-dc8c38e976
man-db-2.7.5-6.fc25
The following builds have been pushed to Fedora 25 updates-testing
fedfind-3.8.2-1.fc25
ignuit-2.24.3-1.fc25
module-build-service-1.5.0-1.fc25
mrbs-1.7.0-1.fc25
python-mwclient-0.8.6-1.fc25
python-pytest-httpbin-0.3.0-1.fc25
python-wikitcms-2.2.1-1.fc25
python-xapp-1.0.1-7.fc25
qt5-qtwebengine-5.9.2-2.fc25
redis-4.0.2-2.fc25
relval-2.2.0-1.fc25
slick-greeter-1.1.1-1.fc25
Details about builds:
================================================================================
fedfind-3.8.2-1.fc25 (FEDORA-2017-a113080467)
Fedora compose and image finder
--------------------------------------------------------------------------------
Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the
Modular Server candidate composes which are currently being produced. fedfind
3.8.1 returns to using the pkgdb `collections` API end point for
`get_current_release`, as it is now being manually updated until PDC is ready to
replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for
modular composes, and `get_package_nvras` with Python 3 (it previously raised an
exception for all composes in Python 3, and modular composes in Python 2).
python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora
wikis are being converted to use only OpenID Connect authentication, with
standard mediawiki authentication disabled.
--------------------------------------------------------------------------------
================================================================================
ignuit-2.24.3-1.fc25 (FEDORA-2017-8773729fd1)
Memorization aid based on the Leitner flashcard system
--------------------------------------------------------------------------------
Update Information:
Update to new upstream version 2.24.3 (rhbz#1514436)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1514436 - ignuit-2.24.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1514436
--------------------------------------------------------------------------------
================================================================================
module-build-service-1.5.0-1.fc25 (FEDORA-2017-c700241c98)
The Module Build Service for Modularity
--------------------------------------------------------------------------------
Update Information:
Changes: * Fix an issue where the latest ref for a branch wasn't being used *
Fixes the issue where builds stay in the "build" state even though they've
had a
component fail * Set the timeout on Koji sessions to 10 minutes (this will help
during outages) * Transition stale failed builds to the "garbage" state and
untag their components (after 180 days of inactivity) * Add a "short" query
parameter to show less detail on the "module-builds" API ---- Changes: *
Change the MBS builders into setuptools plugins so now you can now create your
own builder plugin * Updated some documentation * mbs-build local now builds
only from yaml files (this bypasses the need for SCM) * Only complete the module
build when all components are tagged and a KojiRepoRegen message is received *
Don't trigger init handler when importing a local build and mark the build as
done after import * Validate component git refs when a commit is explicitly
stated in the modulemd before starting the module build * Set Access-Control-
Allow-Origin to "*" on GET API routes * Fix duplicate module build state traces
* Make the module build log name configurable
--------------------------------------------------------------------------------
================================================================================
mrbs-1.7.0-1.fc25 (FEDORA-2017-b5bcfedf10)
Meeting Room Booking System
--------------------------------------------------------------------------------
Update Information:
Changes since MRBS 1.6.1: - Fixed a number of security issues in MRBS that were
disclosed to the project by SySS GmbH, including XSS, CSRF protection and
session fixation. - Improved behaviour of browser caching in MRBS. - Improved
localisation, especially the use of colons in labels. - Added new config
variable $weekdays to define weekdays and weekends, allowing for the possibility
that weekdays are not the same as working days. - MRBS now restricts form
actions which modify data/pass passwords to only accept POSTs. - Added the
ability to have different period names in each area. - Add SAML auth and session
schemes, thanks to J��rn ��ne. - Updated to jQuery 3.2.1 and jQueryUI 1.12.1,
which includes XSS fixes. - Plus a few other bug fixes/improvements. - Dropped
support for Internet Explorer 9 and lower.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1514285 - mrbs-1.7.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1514285
--------------------------------------------------------------------------------
================================================================================
python-mwclient-0.8.6-1.fc25 (FEDORA-2017-b79de50946)
Mwclient is a client to the MediaWiki API
--------------------------------------------------------------------------------
Update Information:
This update provides the latest upstream release of mwclient, with various
enhancements and bug fixes, notably for Semantic Mediawiki support. Please see
the [upstream release
notes](https://github.com/mwclient/mwclient/releases) for
more details. I don't believe any of the changes should break compatibility in
any way. Note that the previous "0.8.4" builds of mwclient were in fact still
0.8.3 due to an error on my part, so this update includes the changes from 0.8.4
as well as 0.8.5 and 0.8.6.
--------------------------------------------------------------------------------
================================================================================
python-pytest-httpbin-0.3.0-1.fc25 (FEDORA-2017-0c80a9f880)
Fixture providing local instance of httpbin test service
--------------------------------------------------------------------------------
Update Information:
This update provides a new release of pytest-httpbin. It adds some new features,
including one requested by @hroncok. It should not have any backward
compatibility issues. For Fedora 27, the update also includes a new build of
python-httpbin. The python-pytest-httpbin test suite belatedly discovered that
`python-httpbin-0.6.2-1` had several setuptools dependency issues. Those are
resolved in this build.
--------------------------------------------------------------------------------
================================================================================
python-wikitcms-2.2.1-1.fc25 (FEDORA-2017-a113080467)
Fedora QA wiki test management Python library
--------------------------------------------------------------------------------
Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the
Modular Server candidate composes which are currently being produced. fedfind
3.8.1 returns to using the pkgdb `collections` API end point for
`get_current_release`, as it is now being manually updated until PDC is ready to
replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for
modular composes, and `get_package_nvras` with Python 3 (it previously raised an
exception for all composes in Python 3, and modular composes in Python 2).
python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora
wikis are being converted to use only OpenID Connect authentication, with
standard mediawiki authentication disabled.
--------------------------------------------------------------------------------
================================================================================
python-xapp-1.0.1-7.fc25 (FEDORA-2017-2f8aa9a9a1)
Python bindings for xapps
--------------------------------------------------------------------------------
Update Information:
* Use unified macros for Python3
--------------------------------------------------------------------------------
================================================================================
qt5-qtwebengine-5.9.2-2.fc25 (FEDORA-2017-580f91f6b0)
Qt5 - QtWebEngine components
--------------------------------------------------------------------------------
Update Information:
An update of QtWebEngine to the security and bugfix release 5.9.2, including:
Chromium Snapshot: * Security fixes from Chromium up to version 61.0.3163.79
Including: CVE-2017-5092, CVE-2017-5093, CVE-2017-5095, CVE-2017-5097,
CVE-2017-5099, CVE-2017-5102, CVE-2017-5103, CVE-2017-5107, CVE-2017-5112,
CVE-2017-5114, CVE-2017-5117 and CVE-2017-5118 * Fixed Skia to to render text
correctly with FreeType 2.8.1 * [QTBUG-50389] Fixed assert on some flash content
QtWebEngine: * [QTBUG-57505] Handle --force-webrtc-ip-handling-policy on
command-line * [QTBUG-58306] Fixed handling of menu key * [QTBUG-60790] Fixed
dragging images to desktop * [QTBUG-61354] Set referrer on download requests *
[QTBUG-61429] Fixed cancelling IME composition * [QTBUG-61506] Stop searching
when navigating away * [QTBUG-61910] Fixed an issue where system proxy settings
were not picked up correctly * [QTBUG-62112] Fixed upside-down rendering in
software rendering mode * [QTBUG-62112] Fixed rendering of content with
preserve-3d in CSS * [QTBUG-62311] Fixed hang when exiting with open combobox *
[QTBUG-62808] Handle --explicitly-allowed-ports on command-line * [QTBUG-62898]
Fixed accessing webchannels from document-creation user-scripts after
navigation. * [QTBUG-62942] Fixed committing IME composition on touch events
QWebEngineView: * [QTBUG-61621] Fixed propagation of unhandled key press events
WebEngineView: * The callback version of printToPdf is now called with a proper
bytearray result instead of a PDF data in a javascript string. Platform
Specific Changes: * [QTBUG-61528, QTBUG-62673] Fixed various multilib build
configurations * [QTBUG-61846] Fixed host builds on Arm and MIPS
--------------------------------------------------------------------------------
================================================================================
redis-4.0.2-2.fc25 (FEDORA-2017-343c274808)
A persistent key-value database
--------------------------------------------------------------------------------
Update Information:
Update to Redis 4.0.2 upstream release. ---- Upstream 3.2.11 bug-fix-only
release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1172841 - Service start returns success even when service fails to start
https://bugzilla.redhat.com/show_bug.cgi?id=1172841
[ 2 ] Bug #788500 - redis bundles jemalloc and hiredis and lua
https://bugzilla.redhat.com/show_bug.cgi?id=788500
--------------------------------------------------------------------------------
================================================================================
relval-2.2.0-1.fc25 (FEDORA-2017-a113080467)
Tool for interacting with Fedora QA wiki pages
--------------------------------------------------------------------------------
Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the
Modular Server candidate composes which are currently being produced. fedfind
3.8.1 returns to using the pkgdb `collections` API end point for
`get_current_release`, as it is now being manually updated until PDC is ready to
replace it. fedfind 3.8.2 fixes `get_package_nvras` and `https_url_generic` for
modular composes, and `get_package_nvras` with Python 3 (it previously raised an
exception for all composes in Python 3, and modular composes in Python 2).
python-wikitcms 2.2.1 adds support for OpenID Connect authentication. The Fedora
wikis are being converted to use only OpenID Connect authentication, with
standard mediawiki authentication disabled.
--------------------------------------------------------------------------------
================================================================================
slick-greeter-1.1.1-1.fc25 (FEDORA-2017-e7101fe4b3)
A slick-looking LightDM greeter
--------------------------------------------------------------------------------
Update Information:
* New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1514464 - slick-greeter-1.1.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1514464
--------------------------------------------------------------------------------