The following Fedora 27 Security updates need testing:
Age URL
22
https://bodhi.fedoraproject.org/updates/FEDORA-2018-969328b17c jhead-3.00-7.fc27
12
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ec1cd6db3 bro-2.5.3-1.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a0a356fb68
cryptopp-5.6.5-2.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-81e1618ab9
glibc-arm-linux-gnu-2.26-4.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-023baab00f
mingw-wavpack-5.1.0-4.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9cd3ff3784
quagga-1.2.2-2.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f4b3fa844
sharutils-4.15.2-8.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2eb691e7d7
freexl-1.0.5-1.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-60c4aa0e01
nx-libs-3.5.0.33-4.fc27 x2goserver-4.0.1.22-2.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dc984c59e5
drupal7-7.57-1.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e27b435a7f
libXfont-1.5.4-1.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f5a3e792f
libXfont2-2.0.3-1.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c5dada34b
libXcursor-1.1.15-1.fc27
The following Fedora 27 Critical Path updates have yet to be approved:
Age URL
8
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dab548649a
perl-PathTools-3.74-1.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2f076fcd3c pcre-8.41-6.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2db4bd7ebb
zerofree-1.1.1-1.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a6b436d186 sssd-1.16.0-8.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-108cf7dc52
policycoreutils-2.7-5.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a46d993969
libtevent-0.9.36-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-63caeb457a soxr-0.1.3-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc39bbae38 mpfr-3.1.6-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7aa4244196
glade-3.20.3-1.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6d151d12f9
libwebp-0.6.1-8.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c5dada34b
libXcursor-1.1.15-1.fc27
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f5a3e792f
libXfont2-2.0.3-1.fc27
The following builds have been pushed to Fedora 27 updates-testing
CGAL-4.11.1-1.fc27
agedu-0-15.20171202.8a8299e.fc27
android-tools-20170311gite7195be7725a-5.fc27
community-mysql-5.7.21-6.fc27
gpxsee-5.2-1.fc27
hunspell-de-0.20161207-1.fc27
kernel-4.15.6-300.fc27
leptonica-1.74.4-5.fc27
libcdio-0.94-5.fc27
libinput-1.10.1-1.fc27
libmspub-0.1.4-1.fc27
libp11-0.4.7-3.fc27
mingw-leptonica-1.74.4-4.fc27
openblas-0.2.20-8.fc27
p11-kit-0.23.10-1.fc27
pcre2-10.31-3.fc27
perl-CryptX-0.053-2.fc27
perl-RDF-NS-20180227-1.fc27
perl-RT-Client-REST-0.51-1.fc27
perl-Test-Harness-3.41-1.fc27
perl-libwww-perl-6.33-1.fc27
powerline-2.6-5.fc27
proselint-0.8.0-4.fc27
publicsuffix-list-20180223-1.fc27
py4j-0.10.6-4.fc27
pylint-1.7.5-1.fc27
pymol-1.9.0-1.20180224svn4178.fc27
pyrenamer-0.6.0-21.fc27
python-sqlalchemy-1.1.17-1.fc27
python2-2.7.14-8.fc27
ravada-0.2.13-1.fc27
runc-1.0.0-19.rc5.git4bb1fe4.fc27
subscription-manager-1.21.2-3.fc27
systemtap-3.2-3.fc27
transtats-cli-0.1.2-1.fc27
vacuum-im-1.3.0-0.8.20180214git01910e9.fc27
vim-8.0.1553-1.fc27
xdg-utils-1.1.2-4.fc27
xen-4.9.1-5.fc27
Details about builds:
================================================================================
CGAL-4.11.1-1.fc27 (FEDORA-2018-40ba2772f2)
Computational Geometry Algorithms Library
--------------------------------------------------------------------------------
Update Information:
New bug-fix release [CGAL-4.11.1]. [CGAL-4.11.1]:
https://github.com/CGAL/cgal/releases/tag/releases/CGAL-4.11.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549340 - CGAL-4.11.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1549340
--------------------------------------------------------------------------------
================================================================================
agedu-0-15.20171202.8a8299e.fc27 (FEDORA-2018-1a9c4db7e8)
An utility for tracking down wasted disk space
--------------------------------------------------------------------------------
Update Information:
Update to the newest snapshot.
--------------------------------------------------------------------------------
================================================================================
android-tools-20170311gite7195be7725a-5.fc27 (FEDORA-2018-ad3b664827)
Android platform tools(adb, fastboot)
--------------------------------------------------------------------------------
Update Information:
This update fixes Android devices constantly connecting and disconnecting when
the "adb" daemon has been launched.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1470740 - adb does not reckognize connected devices
https://bugzilla.redhat.com/show_bug.cgi?id=1470740
--------------------------------------------------------------------------------
================================================================================
community-mysql-5.7.21-6.fc27 (FEDORA-2018-ed0277d513)
MySQL client programs and shared libraries
--------------------------------------------------------------------------------
Update Information:
**MySQL 5.7.21** ldconfig fix
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548331 - ldconfig changes breaks package
https://bugzilla.redhat.com/show_bug.cgi?id=1548331
--------------------------------------------------------------------------------
================================================================================
gpxsee-5.2-1.fc27 (FEDORA-2018-0952a0bb67)
GPS log file viewer and analyzer
--------------------------------------------------------------------------------
Update Information:
News in version **5.2**: * Fixed broken GeoTIFF (Web) Mercator projection *
Several minor bug fixes
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548602 - gpxsee-5.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1548602
--------------------------------------------------------------------------------
================================================================================
hunspell-de-0.20161207-1.fc27 (FEDORA-2018-cc58dc2de2)
German hunspell dictionaries
--------------------------------------------------------------------------------
Update Information:
Resolves: rhbz#1549640 upgrade to latest release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549640 - Update hunspell-de to upstream
https://bugzilla.redhat.com/show_bug.cgi?id=1549640
--------------------------------------------------------------------------------
================================================================================
kernel-4.15.6-300.fc27 (FEDORA-2018-8a2bd7195f)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.15.6 update contains a number of important fixes across the tree ----
The 4.15.5 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1397041 - Brightness controls doesn't work on MacBook Pro Mid 2015
https://bugzilla.redhat.com/show_bug.cgi?id=1397041
--------------------------------------------------------------------------------
================================================================================
leptonica-1.74.4-5.fc27 (FEDORA-2018-cbf621a53c)
C library for efficient image processing and image analysis operations
--------------------------------------------------------------------------------
Update Information:
This update fixes CVE-2017-18196. ---- This update backports security fixes
for CVE-2018-3836, CVE-2018-7186 and CVE-2018-7247.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549410 - CVE-2017-18196 leptonica: Mishandled pathnames in /tmp
subdirectories can allow users to bypass intended file restrictions
https://bugzilla.redhat.com/show_bug.cgi?id=1549410
--------------------------------------------------------------------------------
================================================================================
libcdio-0.94-5.fc27 (FEDORA-2018-30a8492364)
CD-ROM input and control library
--------------------------------------------------------------------------------
Update Information:
Added patch to fix: CVE-2017-18198 (#1549644) Added patch to fix: CVE-2017-18199
(#1549701) Added patches to fix: CVE-2017-18201 (#1549707)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549644 - CVE-2017-18198 libcdio: Heap-based buffer over-read in
print_iso9660_recurse function in iso-info.c
https://bugzilla.redhat.com/show_bug.cgi?id=1549644
[ 2 ] Bug #1549701 - CVE-2017-18199 libcdio: Null pointer dereference in realloc_symlink
in rock.c
https://bugzilla.redhat.com/show_bug.cgi?id=1549701
[ 3 ] Bug #1549707 - CVE-2017-18201 libcdio: Double free in get_cdtext_generic() in
lib/driver/_cdio_generic.c
https://bugzilla.redhat.com/show_bug.cgi?id=1549707
--------------------------------------------------------------------------------
================================================================================
libinput-1.10.1-1.fc27 (FEDORA-2018-cde0e0bb14)
Input device library
--------------------------------------------------------------------------------
Update Information:
libinput 1.10.1, fixes a touchpad tapping crash and a few resume/init crashers
--------------------------------------------------------------------------------
================================================================================
libmspub-0.1.4-1.fc27 (FEDORA-2018-457a8e22e9)
A library for import of Microsoft Publisher documents
--------------------------------------------------------------------------------
Update Information:
new upstream release
--------------------------------------------------------------------------------
================================================================================
libp11-0.4.7-3.fc27 (FEDORA-2018-db9929f301)
Library for using PKCS#11 modules
--------------------------------------------------------------------------------
Update Information:
Add a patch to avoid an error in forking processes (commit cf5e7a3)
--------------------------------------------------------------------------------
================================================================================
mingw-leptonica-1.74.4-4.fc27 (FEDORA-2018-cbf621a53c)
MinGW Windows Leptonica library
--------------------------------------------------------------------------------
Update Information:
This update fixes CVE-2017-18196. ---- This update backports security fixes
for CVE-2018-3836, CVE-2018-7186 and CVE-2018-7247.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549410 - CVE-2017-18196 leptonica: Mishandled pathnames in /tmp
subdirectories can allow users to bypass intended file restrictions
https://bugzilla.redhat.com/show_bug.cgi?id=1549410
--------------------------------------------------------------------------------
================================================================================
openblas-0.2.20-8.fc27 (FEDORA-2018-977d3a6bef)
An optimized BLAS library based on GotoBLAS2
--------------------------------------------------------------------------------
Update Information:
Use proper Fedora linker flags.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548750 - openblas: Partial build flags injection
https://bugzilla.redhat.com/show_bug.cgi?id=1548750
--------------------------------------------------------------------------------
================================================================================
p11-kit-0.23.10-1.fc27 (FEDORA-2018-ae0e6e4949)
Library for loading and sharing PKCS#11 modules
--------------------------------------------------------------------------------
Update Information:
- Update to upstream 0.23.10 release
--------------------------------------------------------------------------------
================================================================================
pcre2-10.31-3.fc27 (FEDORA-2018-e27287a733)
Perl-compatible regular expression library
--------------------------------------------------------------------------------
Update Information:
This release fixes returning unset groups in POSIX interface if REG_STARTEND has
a non-zero starting offset, pcre2test -C to correctly show what \R matches,
matching repeated character classes against an 8-bit string containting multi-
code-unit characters, and compiler warnings in pcre2grep. It also adds support
to pcre2grep for binary zeros in -f files.
--------------------------------------------------------------------------------
================================================================================
perl-CryptX-0.053-2.fc27 (FEDORA-2018-ecd4be3fac)
Cryptographic toolkit
--------------------------------------------------------------------------------
Update Information:
This release fixes decode_b58b input validation.
--------------------------------------------------------------------------------
================================================================================
perl-RDF-NS-20180227-1.fc27 (FEDORA-2018-9d85899558)
Popular RDF name space prefixes from prefix.cc
--------------------------------------------------------------------------------
Update Information:
This releases ignores
example.com URLs. It also adds besluit, bgt, geo7, and
shui prefixes.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549884 - perl-RDF-NS-20180227 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1549884
--------------------------------------------------------------------------------
================================================================================
perl-RT-Client-REST-0.51-1.fc27 (FEDORA-2018-2ff63a0451)
Talk to RT using REST protocol
--------------------------------------------------------------------------------
Update Information:
This release fixes file name parsing in get_attachment_ids() method. It also
adds a new method to retrieve attachment metadata.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1550056 - perl-RT-Client-REST-0.51 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1550056
--------------------------------------------------------------------------------
================================================================================
perl-Test-Harness-3.41-1.fc27 (FEDORA-2018-675bf97721)
Run Perl standard test scripts with statistics
--------------------------------------------------------------------------------
Update Information:
This release fixes file source handler to accept single extensions option and
non-deterministic source handling. It also adds --statefile option to customize
the .prove file, adds support for TAPv13 plan with trailing white spaces and
returns a handle for pipes and sockets.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1550055 - perl-Test-Harness-3.41 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1550055
--------------------------------------------------------------------------------
================================================================================
perl-libwww-perl-6.33-1.fc27 (FEDORA-2018-d007de5566)
A Perl interface to the World-Wide Web
--------------------------------------------------------------------------------
Update Information:
This release corrects send_te option handling to unbreak
LWP::Parallel::UserAgent and Test::Override::UserAgent.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549556 - perl-libwww-perl-6.33 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1549556
--------------------------------------------------------------------------------
================================================================================
powerline-2.6-5.fc27 (FEDORA-2018-a07ac6bb95)
The ultimate status-line/prompt utility
--------------------------------------------------------------------------------
Update Information:
Fix powerline requiring both python2 and python3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1546752 - powerline: powerline requires both Python 2 and Python 3
https://bugzilla.redhat.com/show_bug.cgi?id=1546752
[ 2 ] Bug #1514830 - Missing "which" dependency
https://bugzilla.redhat.com/show_bug.cgi?id=1514830
--------------------------------------------------------------------------------
================================================================================
proselint-0.8.0-4.fc27 (FEDORA-2018-2014ebe2e6)
A linter for English prose
--------------------------------------------------------------------------------
Update Information:
Initial package.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1433617 - Review Request: proselint - A linter for English prose
https://bugzilla.redhat.com/show_bug.cgi?id=1433617
--------------------------------------------------------------------------------
================================================================================
publicsuffix-list-20180223-1.fc27 (FEDORA-2018-6573d822ec)
Cross-vendor public domain suffix database
--------------------------------------------------------------------------------
Update Information:
Recent revision - 20180223
https://github.com/publicsuffix/list/compare/fcd8cc6...d311456
--------------------------------------------------------------------------------
================================================================================
py4j-0.10.6-4.fc27 (FEDORA-2018-3c296c1b41)
Dynamically access in Python programs to arbitrary Java objects
--------------------------------------------------------------------------------
Update Information:
provide proper update path, rhbz#1548046
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548046 - py4j renamed to python2-py4j
https://bugzilla.redhat.com/show_bug.cgi?id=1548046
--------------------------------------------------------------------------------
================================================================================
pylint-1.7.5-1.fc27 (FEDORA-2018-9ec3e0edb7)
Analyzes Python code looking for bugs and signs of poor quality
--------------------------------------------------------------------------------
Update Information:
1.7.5
--------------------------------------------------------------------------------
================================================================================
pymol-1.9.0-1.20180224svn4178.fc27 (FEDORA-2018-42ac8c298a)
PyMOL Molecular Graphics System
--------------------------------------------------------------------------------
Update Information:
- update to 1.9.0, includes fix for BZ 1539225
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1539225 - Pymol loads wrong coordinates from PDB files in some locales
https://bugzilla.redhat.com/show_bug.cgi?id=1539225
--------------------------------------------------------------------------------
================================================================================
pyrenamer-0.6.0-21.fc27 (FEDORA-2018-5e3e38032c)
A mass file renamer
--------------------------------------------------------------------------------
Update Information:
Fix eyed3 imports.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549840 - Pyrenamer fails to use eyed3
https://bugzilla.redhat.com/show_bug.cgi?id=1549840
--------------------------------------------------------------------------------
================================================================================
python-sqlalchemy-1.1.17-1.fc27 (FEDORA-2018-e153b77938)
Modular and flexible ORM library for python
--------------------------------------------------------------------------------
Update Information:
This update contains a new upstream bugfix release. The upstream [changelog](ht
tp://docs.sqlalchemy.org/en/latest/changelog/changelog_11.html#change-1.1.17)
contains a list of all changes in version 1.1.17.
--------------------------------------------------------------------------------
================================================================================
python2-2.7.14-8.fc27 (FEDORA-2018-76e9d22b5c)
An interpreted, interactive, object-oriented programming language
--------------------------------------------------------------------------------
Update Information:
Fix -Wint-in-bool-context warnings when using Python2's public pymem.h header
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1473425 - gcc7 throws error on pymem.h (python2-devel) macros
https://bugzilla.redhat.com/show_bug.cgi?id=1473425
--------------------------------------------------------------------------------
================================================================================
ravada-0.2.13-1.fc27 (FEDORA-2018-19cf2b591c)
Remote Virtual Desktops Manager
--------------------------------------------------------------------------------
Update Information:
Release 0.2.13
--------------------------------------------------------------------------------
================================================================================
runc-1.0.0-19.rc5.git4bb1fe4.fc27 (FEDORA-2018-82e0e81dc3)
CLI for running Open Containers
--------------------------------------------------------------------------------
Update Information:
RC5
--------------------------------------------------------------------------------
================================================================================
subscription-manager-1.21.2-3.fc27 (FEDORA-2018-86e5b34bdd)
Tools and libraries for subscription and repository management
--------------------------------------------------------------------------------
Update Information:
Numerous bug fixes.
--------------------------------------------------------------------------------
================================================================================
systemtap-3.2-3.fc27 (FEDORA-2018-8ef58b06d9)
Programmable system-wide instrumentation system
--------------------------------------------------------------------------------
Update Information:
rhbz1546563 (backport fix for removed timers in kernel 4.15)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1546563 - systemtap breaks with kernel 4.15 due to apparent timer changes
https://bugzilla.redhat.com/show_bug.cgi?id=1546563
--------------------------------------------------------------------------------
================================================================================
transtats-cli-0.1.2-1.fc27 (FEDORA-2018-b47bb6752e)
Transtats command line interface to query transtats server
--------------------------------------------------------------------------------
Update Information:
Update transtats-cli to version 0.1.2, update
--------------------------------------------------------------------------------
================================================================================
vacuum-im-1.3.0-0.8.20180214git01910e9.fc27 (FEDORA-2018-82d268520b)
XMPP/Jabber client
--------------------------------------------------------------------------------
Update Information:
Update to 1.3.0-0.8.20180214git01910e9
--------------------------------------------------------------------------------
================================================================================
vim-8.0.1553-1.fc27 (FEDORA-2018-49e643a1ee)
The VIM editor
--------------------------------------------------------------------------------
Update Information:
The newest upstream commit
--------------------------------------------------------------------------------
================================================================================
xdg-utils-1.1.2-4.fc27 (FEDORA-2018-c585d8cf91)
Basic desktop integration functions
--------------------------------------------------------------------------------
Update Information:
Pull in upstream fixes, particularly one to improve xdg-open behavior on lxqt
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1505149 - file associations completely broken on lxqt
https://bugzilla.redhat.com/show_bug.cgi?id=1505149
--------------------------------------------------------------------------------
================================================================================
xen-4.9.1-5.fc27 (FEDORA-2018-c553a586c8)
Xen is a virtual machine monitor
--------------------------------------------------------------------------------
Update Information:
add Xen page-table isolation (XPTI) mitigation and Branch Target Injection (BTI)
mitigation for XSA-254 DoS via non-preemptable L3/L4 pagetable freeing [XSA-252]
(#1549568) grant table v2 -> v1 transition may crash Xen [XSA-255] (#1549570)
x86 PVH guest without LAPIC may DoS the host [XSA-256] (#1549572)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1544456 - CVE-2018-7540 xsa252 xen: DoS via non-preemptable L3/L4 pagetable
freeing (XSA-252)
https://bugzilla.redhat.com/show_bug.cgi?id=1544456
[ 2 ] Bug #1544459 - CVE-2018-7541 xsa255 xen: grant table v2 -> v1 transition may
crash Xen (XSA-255)
https://bugzilla.redhat.com/show_bug.cgi?id=1544459
[ 3 ] Bug #1544453 - CVE-2018-7542 xsa256 xen: x86 PVH guest without LAPIC may DoS the
host (XSA-256)
https://bugzilla.redhat.com/show_bug.cgi?id=1544453
--------------------------------------------------------------------------------