The following Fedora 25 Security updates need testing: Age URL 319 https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25 217 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e python-XStatic-jquery-ui-1.12.0.1-4.fc25 157 https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f nodejs-brace-expansion-1.1.7-1.fc25 111 https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c memcached-1.4.39-1.fc25 107 https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4 docker-distribution-2.6.2-1.git48294d9.fc25 28 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 22 https://bodhi.fedoraproject.org/updates/FEDORA-2017-7089c6e789 suricata-3.2.4-1.fc25 15 https://bodhi.fedoraproject.org/updates/FEDORA-2017-51f49ebbce apr-1.6.3-1.fc25 15 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f563b201ba apr-util-1.5.4-4.fc25 15 https://bodhi.fedoraproject.org/updates/FEDORA-2017-45ed341e61 httpd-2.4.29-1.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-c4aa57d753 xen-4.7.3-8.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-184d078d87 perl-Catalyst-Plugin-Static-Simple-0.34-1.fc25 4 https://bodhi.fedoraproject.org/updates/FEDORA-2017-cfb950d8f4 hostapd-2.6-6.fc25 4 https://bodhi.fedoraproject.org/updates/FEDORA-2017-803a99828d php-PHPMailer-5.2.26-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5ad4107cc fedpkg-1.30-4.fc25 rpkg-1.51-2.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-08a350c878 kernel-4.13.12-100.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-c7514691cb perl-Net-Ping-External-0.15-11.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-0188f21212 postgresql-9.5.10-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-481e4f6f8c ldns-1.6.17-22.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e5bbb657c5 chromium-62.0.3202.89-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-2391f0551d firefox-57.0-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-1a9068594d python-copr-1.84-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-8016cc0bd0 backintime-1.1.24-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f58bbbbdb0 konversation-1.7.3-1.fc25
The following Fedora 25 Critical Path updates have yet to be approved: Age URL 161 https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25 40 https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fc5429e7e iproute-4.12.0-1.fc25 28 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6967efb3f0 thunderbird-52.4.0-2.fc25 22 https://bodhi.fedoraproject.org/updates/FEDORA-2017-4dc8e5a70f kobo-0.7.0-3.fc25 14 https://bodhi.fedoraproject.org/updates/FEDORA-2017-c4aa57d753 xen-4.7.3-8.fc25 11 https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5aa784a9c lua-5.3.4-6.fc25 9 https://bodhi.fedoraproject.org/updates/FEDORA-2017-b89e9f62d8 bind99-9.9.10-3.P3.fc25 9 https://bodhi.fedoraproject.org/updates/FEDORA-2017-b9a00d98e5 python-productmd-1.9-1.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-dbf347055a hwdata-0.306-1.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ab57a100f3 rpm-4.13.0.2-1.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e64b02d1b1 pcre2-10.23-10.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-65b10e63d5 pungi-4.1.20-1.fc25 8 https://bodhi.fedoraproject.org/updates/FEDORA-2017-ec5efbcfc6 pcre-8.41-3.fc25 6 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e91585cd60 ethtool-4.13-1.fc25 4 https://bodhi.fedoraproject.org/updates/FEDORA-2017-560cebc111 menu-cache-1.1.0-1.fc25 4 https://bodhi.fedoraproject.org/updates/FEDORA-2017-a7f307017b python-lxml-4.1.1-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-e82231f2c7 libglvnd-1.0.0-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-2391f0551d firefox-57.0-1.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e67e4e45b poppler-0.45.0-10.fc25 0 https://bodhi.fedoraproject.org/updates/FEDORA-2017-08a350c878 kernel-4.13.12-100.fc25
The following builds have been pushed to Fedora 25 updates-testing
backintime-1.1.24-1.fc25 brightlight-5-2.fc25 chromium-62.0.3202.89-1.fc25 copr-backend-1.107-1.fc25 copr-cli-1.65-1.fc25 copr-frontend-1.124-1.fc25 copr-rpmbuild-0.12-1.fc25 fedfind-3.8.0-1.fc25 fedpkg-1.30-4.fc25 firefox-57.0-1.fc25 globus-gridftp-server-12.4-1.fc25 globus-gridftp-server-control-6.0-3.fc25 globus-gsi-credential-7.14-1.fc25 globus-gsi-sysconfig-8.0-1.fc25 globus-gssapi-gsi-13.4-1.fc25 golang-github-ccding-go-stun-0.1.0-2.20171107.git82abcd5.fc25 golang-github-cznic-fileutil-0-0.3.git2d566d8.fc25 gretl-2017d-1.fc25 kernel-4.13.12-100.fc25 konversation-1.7.3-1.fc25 ldns-1.6.17-22.fc25 libglvnd-1.0.0-1.fc25 libmediainfo-17.10-1.fc25 mate-applets-1.18.2-2.fc25 mate-sensors-applet-1.18.3-2.fc25 mediaconch-17.08-2.fc25 mediainfo-17.10-1.fc25 nodejs-6.12.0-1.fc25 nyx-2.0.4-1.fc25 nyx-2.0.4-2.fc25 pantheon-session-settings-0.9.3-1.fc25 perl-Finance-Quote-1.45-1.fc25 perl-Gnome2-1.047-1.fc25 perl-Net-Ping-External-0.15-11.fc25 php-cs-fixer-2.2.10-1.fc25 poppler-0.45.0-10.fc25 postgresql-9.5.10-1.fc25 python-copr-1.83-1.fc25 python-copr-1.84-1.fc25 python-wikitcms-2.2.0-1.fc25 relval-2.2.0-1.fc25 rpkg-1.51-2.fc25 slick-greeter-1.1.0-4.fc25 zstd-1.3.2-1.fc25
Details about builds:
================================================================================ backintime-1.1.24-1.fc25 (FEDORA-2017-8016cc0bd0) Simple backup tool inspired from the Flyback project and TimeVault -------------------------------------------------------------------------------- Update Information:
- update to fix CVE-2017-16667 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1511398 - CVE-2017-16667 backintime: Improper escaping/quoting of file paths [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1511398 [ 2 ] Bug #1511397 - CVE-2017-16667 backintime: Improper escaping/quoting of file paths [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1511397 --------------------------------------------------------------------------------
================================================================================ brightlight-5-2.fc25 (FEDORA-2017-bb6b5c4df7) CLI tool to change screen back-light brightness -------------------------------------------------------------------------------- Update Information:
setuid to root to change back-light brightness as non-privileged user ---- First brightlight package; tweak to the Makefile, contributed by Igor Gnatenko -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1505026 - Review Request: brightlight - CLI tool to change screen back light brightness https://bugzilla.redhat.com/show_bug.cgi?id=1505026 --------------------------------------------------------------------------------
================================================================================ chromium-62.0.3202.89-1.fc25 (FEDORA-2017-e5bbb657c5) A WebKit (Blink) powered web browser -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2017-15398, CVE-2017-15399 ---- Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127. Build switched to use gtk3. ---- Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510431 - CVE-2017-15399 chromium-browser: use after free in v8 https://bugzilla.redhat.com/show_bug.cgi?id=1510431 [ 2 ] Bug #1510429 - CVE-2017-15398 chromium-browser: stack buffer overflow in quic https://bugzilla.redhat.com/show_bug.cgi?id=1510429 [ 3 ] Bug #1503550 - CVE-2017-15395 chromium-browser: null pointer dereference in imagecapture https://bugzilla.redhat.com/show_bug.cgi?id=1503550 [ 4 ] Bug #1503549 - CVE-2017-15394 chromium-browser: url spoofing in extensions ui https://bugzilla.redhat.com/show_bug.cgi?id=1503549 [ 5 ] Bug #1503548 - CVE-2017-15393 chromium-browser: referrer leak in devtools https://bugzilla.redhat.com/show_bug.cgi?id=1503548 [ 6 ] Bug #1503547 - CVE-2017-15392 chromium-browser: incorrect registry key handling in platformintegration https://bugzilla.redhat.com/show_bug.cgi?id=1503547 [ 7 ] Bug #1503546 - CVE-2017-15391 chromium-browser: extension limitation bypass in extensions https://bugzilla.redhat.com/show_bug.cgi?id=1503546 [ 8 ] Bug #1503545 - CVE-2017-15390 chromium-browser: url spoofing in omnibox https://bugzilla.redhat.com/show_bug.cgi?id=1503545 [ 9 ] Bug #1503544 - CVE-2017-15389 chromium-browser: url spoofing in omnibox https://bugzilla.redhat.com/show_bug.cgi?id=1503544 [ 10 ] Bug #1503543 - CVE-2017-15388 chromium-browser: out of bounds read in skia https://bugzilla.redhat.com/show_bug.cgi?id=1503543 [ 11 ] Bug #1503542 - CVE-2017-15387 chromium-browser: content security bypass https://bugzilla.redhat.com/show_bug.cgi?id=1503542 [ 12 ] Bug #1503540 - CVE-2017-15386 chromium-browser: ui spoofing in blink https://bugzilla.redhat.com/show_bug.cgi?id=1503540 [ 13 ] Bug #1503539 - CVE-2017-5133 chromium-browser: out of bounds write in skia https://bugzilla.redhat.com/show_bug.cgi?id=1503539 [ 14 ] Bug #1503538 - CVE-2017-5131 chromium-browser: out of bounds write in skia https://bugzilla.redhat.com/show_bug.cgi?id=1503538 [ 15 ] Bug #1503537 - CVE-2017-5130 chromium-browser: heap overflow in libxml2 https://bugzilla.redhat.com/show_bug.cgi?id=1503537 [ 16 ] Bug #1503536 - CVE-2017-5132 chromium-browser: incorrect stack manipulation in webassembly https://bugzilla.redhat.com/show_bug.cgi?id=1503536 [ 17 ] Bug #1503535 - CVE-2017-5129 chromium-browser: use after free in webaudio https://bugzilla.redhat.com/show_bug.cgi?id=1503535 [ 18 ] Bug #1503534 - CVE-2017-5128 chromium-browser: heap overflow in webgl https://bugzilla.redhat.com/show_bug.cgi?id=1503534 [ 19 ] Bug #1503533 - CVE-2017-5127 chromium-browser: use after free in pdfium https://bugzilla.redhat.com/show_bug.cgi?id=1503533 [ 20 ] Bug #1503532 - CVE-2017-5126 chromium-browser: use after free in pdfium https://bugzilla.redhat.com/show_bug.cgi?id=1503532 [ 21 ] Bug #1503531 - CVE-2017-5125 chromium-browser: heap overflow in skia https://bugzilla.redhat.com/show_bug.cgi?id=1503531 [ 22 ] Bug #1503530 - CVE-2017-5124 chromium-browser: uxss with mhtml https://bugzilla.redhat.com/show_bug.cgi?id=1503530 [ 23 ] Bug #1488782 - CVE-2017-5120 chromium-browser: potential https downgrade during redirect navigation https://bugzilla.redhat.com/show_bug.cgi?id=1488782 [ 24 ] Bug #1488781 - CVE-2017-5119 chromium-browser: use of uninitialized value in skia https://bugzilla.redhat.com/show_bug.cgi?id=1488781 [ 25 ] Bug #1488779 - CVE-2017-5118 chromium-browser: bypass of content security policy in blink https://bugzilla.redhat.com/show_bug.cgi?id=1488779 [ 26 ] Bug #1488778 - CVE-2017-5117 chromium-browser: use of uninitialized value in skia https://bugzilla.redhat.com/show_bug.cgi?id=1488778 [ 27 ] Bug #1488777 - CVE-2017-5116 chromium-browser: type confusion in v8 https://bugzilla.redhat.com/show_bug.cgi?id=1488777 [ 28 ] Bug #1488776 - CVE-2017-5115 chromium-browser: type confusion in v8 https://bugzilla.redhat.com/show_bug.cgi?id=1488776 [ 29 ] Bug #1488775 - CVE-2017-5114 chromium-browser: memory lifecycle issue in pdfium https://bugzilla.redhat.com/show_bug.cgi?id=1488775 [ 30 ] Bug #1488774 - CVE-2017-5113 chromium-browser: heap buffer overflow in skia https://bugzilla.redhat.com/show_bug.cgi?id=1488774 [ 31 ] Bug #1488773 - CVE-2017-5112 chromium-browser: heap buffer overflow in webgl https://bugzilla.redhat.com/show_bug.cgi?id=1488773 [ 32 ] Bug #1488772 - CVE-2017-5111 chromium-browser: use after free in pdfium https://bugzilla.redhat.com/show_bug.cgi?id=1488772 [ 33 ] Bug #1494392 - CVE-2017-5122 chromium-browser: out-of-bounds access in v8 https://bugzilla.redhat.com/show_bug.cgi?id=1494392 [ 34 ] Bug #1494391 - CVE-2017-5121 chromium-browser: out-of-bounds access in v8 https://bugzilla.redhat.com/show_bug.cgi?id=1494391 --------------------------------------------------------------------------------
================================================================================ copr-backend-1.107-1.fc25 (FEDORA-2017-186e2505a9) Backend for Copr -------------------------------------------------------------------------------- Update Information:
- kill all processes in copr-rpmbuild's process group - add --drop-resultdir switch to copr-rpmbuild call - release_vm immediately after VM is no longer needed - remove --ignore-lock from createrepo_c ---- - invoke copr-rpmbuild with --verbose --------------------------------------------------------------------------------
================================================================================ copr-cli-1.65-1.fc25 (FEDORA-2017-ce5b52a631) Command line interface for COPR -------------------------------------------------------------------------------- Update Information:
- allow to set use_bootstrap_container via API --------------------------------------------------------------------------------
================================================================================ copr-frontend-1.124-1.fc25 (FEDORA-2017-e1fb058896) Frontend for Copr -------------------------------------------------------------------------------- Update Information:
- fix build_on_pagure_commit.py - optimize check_for_anitya_version_updates - Bug 1508888 - Webhook triggered from GitHub does not start the build - allow to set use_bootstrap_container via API - fix job stucking provisionally - add PoC scripts for fedora-ci ---- - also set srpm_url when --initial-pkgs is used when creating new project - for tag webhook events, rebuild the package on the specified tag - check for pagure hostname in pagure auto-rebuilding script - fix for fatal error when accessing old upload builds that do not contain 'url' key in source_json - unify SCM source types - deprecate tito and mock-scm methods - add index on package(webhook_rebuild, source_type) and copr(copr_webhook_secret) - update docs for requests/flask interaction ---- - Fix for internal server error when old srpm upload build is accessed. --------------------------------------------------------------------------------
================================================================================ copr-rpmbuild-0.12-1.fc25 (FEDORA-2017-df823984b1) Run COPR build tasks -------------------------------------------------------------------------------- Update Information:
- fix get_mock_uniqueext call - fortify make_srpm - add '--private-users=pick' to make_srpm container to improve security - compatibility with rpkg- client-0.11 - add config for src.stg.fedoraproject.org into default rpmbuild config - fix download url for new rpkg-client version ---- - provide option to root spec file path in SCM with '/' - fix exception raising in scm provider - make command debug info nicer - print task structure in the beginning even without -v - add listdir after srpm production - some Git backends do not support --depth - remove unused run method - checkout master by default - with limited depth, we need to clone with --no-single-branch - remove original perl script and mock config for it - remove no longer needed options from rpkg.conf.j2 - SCM source types unification - apply continuing line filtering from f4561c149893 - increase clone depth to address pag#129 SCM source type error --------------------------------------------------------------------------------
================================================================================ fedfind-3.8.0-1.fc25 (FEDORA-2017-a113080467) Fedora compose and image finder -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. --------------------------------------------------------------------------------
================================================================================ fedpkg-1.30-4.fc25 (FEDORA-2017-f5ad4107cc) Fedora utility for working with dist-git -------------------------------------------------------------------------------- Update Information:
**Update** - Fixed chain-build - Remove hard dependency of bash-completion from fedpkg **rpkg** - Ignore TestModulesCli if openidc-client is unavailable (cqi) - Port mbs-build to rpkg (mprahl) - Add .vscode to .gitignore (mprahl) - Fix TestPatch.test_rediff in order to run with old version of mock (cqi) - Allow to specify alternative Copr config file - #184 (cqi) - Tests for patch command (cqi) - More Tests for mockbuild command (cqi) - More tests for getting spec file (cqi) - Tests for container-build-setup command (cqi) - Test for container- build to use custom config (cqi) - Suppress output from git command within setUp (cqi) - Skip test if rpmfluff is not available (lsedlar) - Allow to override build URL (cqi) - Test for mock-config command (cqi) - Tests for copr-build command (cqi) - Fix arch-override for container-build (lucarval) - Remove unsupported osbs for container-build (lucarval) - cli: add --arches support for koji_cointainerbuild (mlangsdo) - Strip refs/heads/ from branch only once (lsedlar) - Don't install bin and config files (cqi) - Fix kojiprofile selection in cliClient.container_build_koji (cqi) - Avoid branch detection for 'rpkg sources' (praiskup) - Fix encoding in new command (cqi) - Minor wording improvement in help (pgier) - Fix indentation (pviktori) - Add --with and --without options to mockbuild (pviktori) **fedpkg** - Tests for update command (cqi) - Add support for module commands (mprahl) - Clean rest cert related code (cqi) - Remove fedora cert (cqi) - Override build URL for Koji (cqi) - changing anongiturl to use src.fp.o instead of pkgs.fp.o. - #119 (tflink) - Add tests (cqi) - Enable lookaside_namespaced - #130 (cqi) - Detect dist tag correctly for RHEL and CentOS - #141 (cqi) - Remove deprecated call to platform.dist (cqi) - Do not prompt hint for SSL cert if fail to log into Koji (cqi) - Add more container-build options to bash completion (cqi) - Remove osbs from bash completion - #138 (cqi) - Install executables via entry_points - #134 (cqi) - Fix container build target (lsedlar) - Get correct build target for rawhide containers (lsedlar) - Update error message to reflect deprecation of --dist option (pgier) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1188634 - fedpkg clone -a should use https:// transport https://bugzilla.redhat.com/show_bug.cgi?id=1188634 [ 2 ] Bug #1509322 - fedpkg >= 1.30-1 depends on bash-completion https://bugzilla.redhat.com/show_bug.cgi?id=1509322 --------------------------------------------------------------------------------
================================================================================ firefox-57.0-1.fc25 (FEDORA-2017-2391f0551d) Mozilla Firefox Web browser -------------------------------------------------------------------------------- Update Information:
Update to Firefox 57 a.k.a. Quantum This update may break your installed extension, please see this Fedora Magazine article for details: https://fedoramagazine.org/firefox-57-coming-soon-quantum-leap/ --------------------------------------------------------------------------------
================================================================================ globus-gridftp-server-12.4-1.fc25 (FEDORA-2017-796fca789a) Globus Toolkit - Globus GridFTP Server -------------------------------------------------------------------------------- Update Information:
globus-gridftp-server * Ignore backup & packaging files in config.d globus- gridftp-server-control * Terminate the connection if server fails to write the 220 banner globus-gsi-credential * Remove prototype for non-existing function (7.12) * Fix crash when handle->cert not set in call to globus_gsi_cred_get_cert (7.13) * Remove compatibility shims for old versions of OpenSSL (7.13) * Fix issue with voms proxy and openssl 1.1 (7.14) globus-gsi-sysconfig * Add cert and key checks based on different uid globus-gssapi-gsi * Allow configuration of non-root user to own credentials for root services (13.3) * Improve vhost support (13.4) --------------------------------------------------------------------------------
================================================================================ globus-gridftp-server-control-6.0-3.fc25 (FEDORA-2017-796fca789a) Globus Toolkit - Globus GridFTP Server Library -------------------------------------------------------------------------------- Update Information:
globus-gridftp-server * Ignore backup & packaging files in config.d globus- gridftp-server-control * Terminate the connection if server fails to write the 220 banner globus-gsi-credential * Remove prototype for non-existing function (7.12) * Fix crash when handle->cert not set in call to globus_gsi_cred_get_cert (7.13) * Remove compatibility shims for old versions of OpenSSL (7.13) * Fix issue with voms proxy and openssl 1.1 (7.14) globus-gsi-sysconfig * Add cert and key checks based on different uid globus-gssapi-gsi * Allow configuration of non-root user to own credentials for root services (13.3) * Improve vhost support (13.4) --------------------------------------------------------------------------------
================================================================================ globus-gsi-credential-7.14-1.fc25 (FEDORA-2017-796fca789a) Globus Toolkit - Globus GSI Credential Library -------------------------------------------------------------------------------- Update Information:
globus-gridftp-server * Ignore backup & packaging files in config.d globus- gridftp-server-control * Terminate the connection if server fails to write the 220 banner globus-gsi-credential * Remove prototype for non-existing function (7.12) * Fix crash when handle->cert not set in call to globus_gsi_cred_get_cert (7.13) * Remove compatibility shims for old versions of OpenSSL (7.13) * Fix issue with voms proxy and openssl 1.1 (7.14) globus-gsi-sysconfig * Add cert and key checks based on different uid globus-gssapi-gsi * Allow configuration of non-root user to own credentials for root services (13.3) * Improve vhost support (13.4) --------------------------------------------------------------------------------
================================================================================ globus-gsi-sysconfig-8.0-1.fc25 (FEDORA-2017-796fca789a) Globus Toolkit - Globus GSI System Config Library -------------------------------------------------------------------------------- Update Information:
globus-gridftp-server * Ignore backup & packaging files in config.d globus- gridftp-server-control * Terminate the connection if server fails to write the 220 banner globus-gsi-credential * Remove prototype for non-existing function (7.12) * Fix crash when handle->cert not set in call to globus_gsi_cred_get_cert (7.13) * Remove compatibility shims for old versions of OpenSSL (7.13) * Fix issue with voms proxy and openssl 1.1 (7.14) globus-gsi-sysconfig * Add cert and key checks based on different uid globus-gssapi-gsi * Allow configuration of non-root user to own credentials for root services (13.3) * Improve vhost support (13.4) --------------------------------------------------------------------------------
================================================================================ globus-gssapi-gsi-13.4-1.fc25 (FEDORA-2017-796fca789a) Globus Toolkit - GSSAPI library -------------------------------------------------------------------------------- Update Information:
globus-gridftp-server * Ignore backup & packaging files in config.d globus- gridftp-server-control * Terminate the connection if server fails to write the 220 banner globus-gsi-credential * Remove prototype for non-existing function (7.12) * Fix crash when handle->cert not set in call to globus_gsi_cred_get_cert (7.13) * Remove compatibility shims for old versions of OpenSSL (7.13) * Fix issue with voms proxy and openssl 1.1 (7.14) globus-gsi-sysconfig * Add cert and key checks based on different uid globus-gssapi-gsi * Allow configuration of non-root user to own credentials for root services (13.3) * Improve vhost support (13.4) --------------------------------------------------------------------------------
================================================================================ golang-github-ccding-go-stun-0.1.0-2.20171107.git82abcd5.fc25 (FEDORA-2017-97302b7a70) STUN client (RFC 3489 and RFC 5389) implementation in Go -------------------------------------------------------------------------------- Update Information:
Bump to commit 82abcd5. This fixes a typo in a constant (backwards compatible change). --------------------------------------------------------------------------------
================================================================================ golang-github-cznic-fileutil-0-0.3.git2d566d8.fc25 (FEDORA-2017-9cbe6a6c78) File utility functions for Go -------------------------------------------------------------------------------- Update Information:
Bump to commit 2d566d8. This fixes a race condition. --------------------------------------------------------------------------------
================================================================================ gretl-2017d-1.fc25 (FEDORA-2017-2ec1d08366) A tool for econometric analysis -------------------------------------------------------------------------------- Update Information:
- update to 2017d - http://lists.wfu.edu/pipermail/gretl- announce/2017/000044.html --------------------------------------------------------------------------------
================================================================================ kernel-4.13.12-100.fc25 (FEDORA-2017-08a350c878) The Linux kernel -------------------------------------------------------------------------------- Update Information:
The 4.13.12 update contains a number of important fixes across the tree. It contains security fixes for CVE-2017-16532 and CVE-2017-16538. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510826 - CVE-2017-16538 kernel: general protection fault in drivers/media/usb/dvb-usb-v2/lmedm04.c https://bugzilla.redhat.com/show_bug.cgi?id=1510826 [ 2 ] Bug #1510835 - CVE-2017-16532 kernel: Null pointer dereference in get_endpoints function in drivers/usb/misc/usbtest.c https://bugzilla.redhat.com/show_bug.cgi?id=1510835 --------------------------------------------------------------------------------
================================================================================ konversation-1.7.3-1.fc25 (FEDORA-2017-f58bbbbdb0) A user friendly IRC client -------------------------------------------------------------------------------- Update Information:
Latest stable release, see also ���https://konversation.kde.org/ --------------------------------------------------------------------------------
================================================================================ ldns-1.6.17-22.fc25 (FEDORA-2017-481e4f6f8c) Low-level DNS(SEC) library with API -------------------------------------------------------------------------------- Update Information:
Fix memory corruption in ldns_rr_new_frm_fp_l (#1511046) Fix memory corruption in ldns_str2rdf_long_str (#1511046) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510993 - ldns: Memory corruption in ldns_str2rdf_long_str https://bugzilla.redhat.com/show_bug.cgi?id=1510993 [ 2 ] Bug #1510985 - ldns: Memory corruption in ldns_rr_new_frm_fp_l https://bugzilla.redhat.com/show_bug.cgi?id=1510985 --------------------------------------------------------------------------------
================================================================================ libglvnd-1.0.0-1.fc25 (FEDORA-2017-e82231f2c7) The GL Vendor-Neutral Dispatch library -------------------------------------------------------------------------------- Update Information:
Update to 1.0.0 release --------------------------------------------------------------------------------
================================================================================ libmediainfo-17.10-1.fc25 (FEDORA-2017-688ebaecd8) Library for supplies technical and tag information about a video or audio file -------------------------------------------------------------------------------- Update Information:
Update to 17.10. --------------------------------------------------------------------------------
================================================================================ mate-applets-1.18.2-2.fc25 (FEDORA-2017-13efef95a3) MATE Desktop panel applets -------------------------------------------------------------------------------- Update Information:
- add some upstream fixes ---- - update to 1.18.2 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1375377 - False value in tooltip https://bugzilla.redhat.com/show_bug.cgi?id=1375377 --------------------------------------------------------------------------------
================================================================================ mate-sensors-applet-1.18.3-2.fc25 (FEDORA-2017-4723059c9b) MATE panel applet for hardware sensors -------------------------------------------------------------------------------- Update Information:
- some backports form upstream master branch --------------------------------------------------------------------------------
================================================================================ mediaconch-17.08-2.fc25 (FEDORA-2017-de2b199cb3) Most relevant technical and tag data for video and audio files (CLI) -------------------------------------------------------------------------------- Update Information:
Rebuild for new libmediainfo. --------------------------------------------------------------------------------
================================================================================ mediainfo-17.10-1.fc25 (FEDORA-2017-688ebaecd8) Supplies technical and tag information about a video or audio file (CLI) -------------------------------------------------------------------------------- Update Information:
Update to 17.10. --------------------------------------------------------------------------------
================================================================================ nodejs-6.12.0-1.fc25 (FEDORA-2017-76f5059388) JavaScript runtime -------------------------------------------------------------------------------- Update Information:
Update --------------------------------------------------------------------------------
================================================================================ nyx-2.0.4-1.fc25 (FEDORA-2017-999c5c7009) Command-line monitor for Tor -------------------------------------------------------------------------------- Update Information:
Version 2.0.4 --------------------------------------------------------------------------------
================================================================================ nyx-2.0.4-2.fc25 (FEDORA-2017-ce15b40d3e) Command-line monitor for Tor -------------------------------------------------------------------------------- Update Information:
Add Obsoletes for all tor-arm subpackages --------------------------------------------------------------------------------
================================================================================ pantheon-session-settings-0.9.3-1.fc25 (FEDORA-2017-256c15ad82) Pantheon session configuration files -------------------------------------------------------------------------------- Update Information:
Update to version 0.9.3. --------------------------------------------------------------------------------
================================================================================ perl-Finance-Quote-1.45-1.fc25 (FEDORA-2017-ca4e0dd503) A Perl module that retrieves stock and mutual fund quotes -------------------------------------------------------------------------------- Update Information:
Current upstream maintenance release. Various sources fixed, new source AlphaVantage added. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1509722 - perl-Finance-Quote-1.40 is available https://bugzilla.redhat.com/show_bug.cgi?id=1509722 [ 2 ] Bug #1510220 - perl-Finance-Quote-1.42 is available https://bugzilla.redhat.com/show_bug.cgi?id=1510220 [ 3 ] Bug #1510678 - perl-Finance-Quote-1.44 is available https://bugzilla.redhat.com/show_bug.cgi?id=1510678 [ 4 ] Bug #1511240 - perl-Finance-Quote-1.45 is available https://bugzilla.redhat.com/show_bug.cgi?id=1511240 --------------------------------------------------------------------------------
================================================================================ perl-Gnome2-1.047-1.fc25 (FEDORA-2017-3666ed06d7) Perl interface to the 2.x series of the GNOME libraries -------------------------------------------------------------------------------- Update Information:
This release corrects tests. We deliver it only to provide up-to-date version string. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510894 - perl-Gnome2-1.047 is available https://bugzilla.redhat.com/show_bug.cgi?id=1510894 --------------------------------------------------------------------------------
================================================================================ perl-Net-Ping-External-0.15-11.fc25 (FEDORA-2017-c7514691cb) Cross-platform interface to ICMP "ping" utilities -------------------------------------------------------------------------------- Update Information:
Fixes a command injection vulnerability (CVE-2008-7319) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510785 - CVE-2008-7319 perl-Net-Ping-External: Unproper argument sanitization [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1510785 --------------------------------------------------------------------------------
================================================================================ php-cs-fixer-2.2.10-1.fc25 (FEDORA-2017-e75808bc8e) A tool to automatically fix PHP code style -------------------------------------------------------------------------------- Update Information:
**Changelog for v2.2.10** * bug #3199 TokensAnalyzer - getClassyElements (SpacePossum) * bug #3208 BracesFixer - Fix for instantiation in control structures (julienfalque, SpacePossum) * bug #3215 BinaryOperatorSpacesFixer - Fix spaces around multiple exception catching (|) (ntzm) * bug #3216 AbstractLinesBeforeNamespaceFixer - add min. and max. option, not only single target count (SpacePossum) * bug #3217 TokenizerLinter - fix lack of linting when code is cached (SpacePossum, keradus) * minor #3200 Skip slow test when Xdebug is loaded (julienfalque) * minor #3219 Normalise references to GitHub in docs (ntzm) * minor #3226 Remove unused imports (ntzm) * minor #3231 Fix typos (ntzm) * minor #3234 Simplify Cache\Signature::equals (ntzm) * minor #3237 UnconfigurableFixer - use only LF (keradus) * minor #3238 AbstractFixerTest - fix @cover annotation (keradus) ---- **Changelog for v2.2.9** * bug #3062 BraceClassInstantiationTransformer - Fix instantiation inside method call braces case (julienfalque, keradus) * bug #3083 SingleBlankLineBeforeNamespaceFixer - Fix handling namespace right after opening tag (mlocati) * bug #3109 SwitchCaseSemicolonToColonFixer - Fix bug with nested constructs (SpacePossum) * bug #3123 Cache - File permissions (SpacePossum) * bug #3172 IndentationTypeFixer - do not touch whitespace that is not indentation (SpacePossum) * bug #3176 NoMultilineWhitespaceBeforeSemicolonsFixer - SpaceAfterSemicolonFixer - priority fix (SpacePossum) * bug #3193 TokensAnalyzer::getClassyElements - sort result before returning (SpacePossum) * bug #3196 SelfUpdateCommand - fix exit status when can't determine newest version (julienfalque) * minor #3107 ConfigurationResolver - improve error message when rule is not found (SpacePossum) * minor #3113 Add WordMatcher (keradus) * minor #3133 Unify Reporter tests (keradus) * minor #3134 Allow Symfony 4 (keradus, garak) * minor #3136 PHPUnit - call hooks from parent class as well (keradus) * minor #3145 misc - Typo (localheinz) * minor #3150 Fix CircleCI (julienfalque) * minor #3151 Update gitattributes to ignore next file (keradus) * minor #3156 Update php-coveralls (keradus) * minor #3166 README - add link to new gitter channel. (SpacePossum) * minor #3174 Update UPGRADE.md (vitek-rostislav) * minor #3180 Fix usage of static variables (kubawerlos) * minor #3184 Code grooming - sort content of arrays (keradus) * minor #3191 Travis - add nightly build to allow_failures due to Travis issues (keradus) * minor #3197 DX groom CS (keradus) --------------------------------------------------------------------------------
================================================================================ poppler-0.45.0-10.fc25 (FEDORA-2017-6e67e4e45b) PDF rendering library -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2017-15565 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1510977 - CVE-2017-15565 poppler: NULL pointer dereference in the GfxImageColorMap::getGrayLine() function https://bugzilla.redhat.com/show_bug.cgi?id=1510977 --------------------------------------------------------------------------------
================================================================================ postgresql-9.5.10-1.fc25 (FEDORA-2017-0188f21212) PostgreSQL client programs -------------------------------------------------------------------------------- Update Information:
update to 9.5.10, per release notes http://www.postgresql.org/docs/9.5/static/release-9-5-10.html --------------------------------------------------------------------------------
================================================================================ python-copr-1.83-1.fc25 (FEDORA-2017-ce5b52a631) Python interface for Copr -------------------------------------------------------------------------------- Update Information:
- allow to set use_bootstrap_container via API --------------------------------------------------------------------------------
================================================================================ python-copr-1.84-1.fc25 (FEDORA-2017-1a9068594d) Python interface for Copr -------------------------------------------------------------------------------- Update Information:
Change default COPR URL route from http://copr.fedoraproject.org to https://copr.fedorainfracloud.org --------------------------------------------------------------------------------
================================================================================ python-wikitcms-2.2.0-1.fc25 (FEDORA-2017-a113080467) Fedora QA wiki test management Python library -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. --------------------------------------------------------------------------------
================================================================================ relval-2.2.0-1.fc25 (FEDORA-2017-a113080467) Tool for interacting with Fedora QA wiki pages -------------------------------------------------------------------------------- Update Information:
These new releases of fedfind, python-wikitcms and relval add support for the Modular Server candidate composes which are currently being produced. --------------------------------------------------------------------------------
================================================================================ rpkg-1.51-2.fc25 (FEDORA-2017-f5ad4107cc) Python library for interacting with rpm+git -------------------------------------------------------------------------------- Update Information:
**Update** - Fixed chain-build - Remove hard dependency of bash-completion from fedpkg **rpkg** - Ignore TestModulesCli if openidc-client is unavailable (cqi) - Port mbs-build to rpkg (mprahl) - Add .vscode to .gitignore (mprahl) - Fix TestPatch.test_rediff in order to run with old version of mock (cqi) - Allow to specify alternative Copr config file - #184 (cqi) - Tests for patch command (cqi) - More Tests for mockbuild command (cqi) - More tests for getting spec file (cqi) - Tests for container-build-setup command (cqi) - Test for container- build to use custom config (cqi) - Suppress output from git command within setUp (cqi) - Skip test if rpmfluff is not available (lsedlar) - Allow to override build URL (cqi) - Test for mock-config command (cqi) - Tests for copr-build command (cqi) - Fix arch-override for container-build (lucarval) - Remove unsupported osbs for container-build (lucarval) - cli: add --arches support for koji_cointainerbuild (mlangsdo) - Strip refs/heads/ from branch only once (lsedlar) - Don't install bin and config files (cqi) - Fix kojiprofile selection in cliClient.container_build_koji (cqi) - Avoid branch detection for 'rpkg sources' (praiskup) - Fix encoding in new command (cqi) - Minor wording improvement in help (pgier) - Fix indentation (pviktori) - Add --with and --without options to mockbuild (pviktori) **fedpkg** - Tests for update command (cqi) - Add support for module commands (mprahl) - Clean rest cert related code (cqi) - Remove fedora cert (cqi) - Override build URL for Koji (cqi) - changing anongiturl to use src.fp.o instead of pkgs.fp.o. - #119 (tflink) - Add tests (cqi) - Enable lookaside_namespaced - #130 (cqi) - Detect dist tag correctly for RHEL and CentOS - #141 (cqi) - Remove deprecated call to platform.dist (cqi) - Do not prompt hint for SSL cert if fail to log into Koji (cqi) - Add more container-build options to bash completion (cqi) - Remove osbs from bash completion - #138 (cqi) - Install executables via entry_points - #134 (cqi) - Fix container build target (lsedlar) - Get correct build target for rawhide containers (lsedlar) - Update error message to reflect deprecation of --dist option (pgier) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1188634 - fedpkg clone -a should use https:// transport https://bugzilla.redhat.com/show_bug.cgi?id=1188634 [ 2 ] Bug #1509322 - fedpkg >= 1.30-1 depends on bash-completion https://bugzilla.redhat.com/show_bug.cgi?id=1509322 --------------------------------------------------------------------------------
================================================================================ slick-greeter-1.1.0-4.fc25 (FEDORA-2017-656476b315) A slick-looking LightDM greeter -------------------------------------------------------------------------------- Update Information:
- Show system-logo in lower left corner by default - Add patch from upstream to use gsettings default if there is no different preset in the config file --------------------------------------------------------------------------------
================================================================================ zstd-1.3.2-1.fc25 (FEDORA-2017-6100609fef) Zstd compression library -------------------------------------------------------------------------------- Update Information:
Latest upstream --------------------------------------------------------------------------------