The following Fedora 27 Security updates need testing:
Age URL
25
https://bodhi.fedoraproject.org/updates/FEDORA-2018-969328b17c jhead-3.00-7.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ec1cd6db3 bro-2.5.3-1.fc27
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a0a356fb68
cryptopp-5.6.5-2.fc27
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-81e1618ab9
glibc-arm-linux-gnu-2.26-4.fc27
8
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f4b3fa844
sharutils-4.15.2-8.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-60c4aa0e01
nx-libs-3.5.0.33-4.fc27 x2goserver-4.0.1.22-2.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dc984c59e5
drupal7-7.57-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cbf621a53c
mingw-leptonica-1.74.4-4.fc27 leptonica-1.74.4-5.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-30a8492364
libcdio-0.94-5.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-de113aeac6
ntp-4.2.8p11-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a32082df51
postgresql-9.6.8-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-52d79f4f36
dovecot-2.2.34-1.fc27
The following Fedora 27 Critical Path updates have yet to be approved:
Age URL
11
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dab548649a
perl-PathTools-3.74-1.fc27
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2f076fcd3c pcre-8.41-6.fc27
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2db4bd7ebb
zerofree-1.1.1-1.fc27
10
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a6b436d186 sssd-1.16.0-8.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dcbc86e9a8
libreport-2.9.3-2.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-61cc5475b4
libunistring-0.9.9-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e27287a733 pcre2-10.31-3.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ae0e6e4949
p11-kit-0.23.10-1.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-30a8492364
libcdio-0.94-5.fc27
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c585d8cf91
xdg-utils-1.1.2-4.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7a0f4eaf80
appstream-data-27-9.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-795b6b08ac
gnome-software-3.26.7-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f713acf203
redhat-rpm-config-76-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-82be4acb08
libinput-1.10.1-2.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-851b6b0737
libdrm-2.4.90-2.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1eb9af6691
kernel-4.15.7-300.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c31f1eccd
iptables-1.6.2-2.fc27 libnftnl-1.0.9-2.fc27 nftables-0.8.2-2.fc27
The following builds have been pushed to Fedora 27 updates-testing
ProDy-1.9.4-0.1.fc27
clamav-0.99.4-1.fc27
cqrlog-2.2.0-4.fc27
cyrus-imapd-3.0.5-8.fc27
esptool-2.3.1-1.fc27
gnome-shell-extension-netspeed-3.28-0.3.20180208gite3cea60.fc27
gnupg2-2.2.5-1.fc27
libtirpc-1.0.2-4.rc2.fc27
m2crypto-0.28.2-2.fc27
mariadb-10.2.13-1.fc27
open-eid-17.12-1.fc27
otter-browser-0.9.96-0.1.rc6git1b61eec.fc27
php-7.1.15-1.fc27
php-twig-1.35.1-2.fc27
php-twig2-2.4.5-1.fc27
podman-0.3.1-1.gitc187538.fc27
python-pytelegrambotapi-3.6.0-1.fc27
siril-0.9.8.3-1.fc27
stunnel-5.44-5.fc27
tor-0.3.1.10-1.fc27
vala-0.38.8-1.fc27
webextension-token-signing-1.0.6-1.fc27
wine-3.3-2.fc27
xfig-3.2.6a-7.fc27
Details about builds:
================================================================================
ProDy-1.9.4-0.1.fc27 (FEDORA-2018-c4f0d85a1f)
Application for protein structure, dynamics and sequence analysis
--------------------------------------------------------------------------------
Update Information:
- Pre-release 1.9.4
--------------------------------------------------------------------------------
================================================================================
clamav-0.99.4-1.fc27 (FEDORA-2018-602b5345fa)
End-user tools for the Clam Antivirus scanner
--------------------------------------------------------------------------------
Update Information:
Update to 0.99.4 0.99.4 addresses a few outstanding vulnerability bugs. It
includes fixes for: - CVE-2012-6706 - CVE-2017-6419 - CVE-2017-11423
- CVE-2018-1000085 There are also a few bug fixes that were not assigned
CVE���s, but were important enough to address while we had the chance. One of
these was the notorious file descriptor exhaustion bug that caused outages late
last January. In addition to the above, 0.99.4 fixes: - CVE-2018-0202: Two
newly reported vulnerabilities in the PDF parsing code.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1549071 - CVE-2018-1000085 clamav: Out-of-bounds heap read in XAR parser
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1549071
[ 2 ] Bug #1550747 - clamav-0.99.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1550747
--------------------------------------------------------------------------------
================================================================================
cqrlog-2.2.0-4.fc27 (FEDORA-2018-e3587b601a)
An amateur radio contact logging program
--------------------------------------------------------------------------------
Update Information:
Fix arm builds, improved translations, and other fixes.
--------------------------------------------------------------------------------
================================================================================
cyrus-imapd-3.0.5-8.fc27 (FEDORA-2018-21f3adb178)
A high-performance email, contacts and calendar server
--------------------------------------------------------------------------------
Update Information:
Fix issue with imtest (in cyrus-imapd-tools) not parsing IMAP capabilities from
some IMAP servers. This release also contains patches for potential crashes
when sockets are stored in an extremely deep directory hierarchy, and when
Xapian search databases are first created for a user.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1543481 - cyrus-imapd: imtest -m gssapi reports GSSAPI not advertised
https://bugzilla.redhat.com/show_bug.cgi?id=1543481
--------------------------------------------------------------------------------
================================================================================
esptool-2.3.1-1.fc27 (FEDORA-2018-f4e8569f44)
A utility to communicate with the ROM bootloader in Espressif ESP8266
--------------------------------------------------------------------------------
Update Information:
Updated to 2.3.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1551162 - esptool-2.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1551162
--------------------------------------------------------------------------------
================================================================================
gnome-shell-extension-netspeed-3.28-0.3.20180208gite3cea60.fc27 (FEDORA-2018-5370c5dfc6)
A gnome-shell extension to show speed of the internet
--------------------------------------------------------------------------------
Update Information:
- Remove scriptlet glib-compile-schemas: This scriptlet SHOULD NOT be used in
Fedora 24 or later. - Remove Group: is not used in Fedora - Add -q to %%setup to
make it quiet
--------------------------------------------------------------------------------
================================================================================
gnupg2-2.2.5-1.fc27 (FEDORA-2018-39d162dd6d)
Utility for secure communication and data storage
--------------------------------------------------------------------------------
Update Information:
Minor bugfix update to version 2.2.5
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548213 - gnupg2-2.2.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1548213
--------------------------------------------------------------------------------
================================================================================
libtirpc-1.0.2-4.rc2.fc27 (FEDORA-2018-86582722ca)
Transport Independent RPC Library
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream RC release: libtirpc-1-0-3-rc2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1337142 - CVE-2016-4429 libtirpc: stack (frame) overflow in Sun RPC
clntudp_call() [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1337142
--------------------------------------------------------------------------------
================================================================================
m2crypto-0.28.2-2.fc27 (FEDORA-2018-c1039488d8)
Support for using OpenSSL in Python 2 scripts
--------------------------------------------------------------------------------
Update Information:
Updates M2Crypto to 0.28.2. Most importantly this adds Python 3 bindings.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #891283 - Port to python3?
https://bugzilla.redhat.com/show_bug.cgi?id=891283
--------------------------------------------------------------------------------
================================================================================
mariadb-10.2.13-1.fc27 (FEDORA-2018-4a4dc47afe)
A community developed branch of MySQL
--------------------------------------------------------------------------------
Update Information:
**MariaDB 10.2.13** Release notes:
https://mariadb.com/kb/en/library/mariadb-10213-release-notes/ CVEs fixed:
CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665
CVE-2018-2668
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1535519 - CVE-2018-2562 CVE-2018-2612 CVE-2018-2622 CVE-2018-2640
CVE-2018-2665 CVE-2018-2668 mariadb: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1535519
[ 2 ] Bug #1544986 - mariadb-10.2.13 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1544986
--------------------------------------------------------------------------------
================================================================================
open-eid-17.12-1.fc27 (FEDORA-2018-e84d057947)
Meta-package for Estonian Electronic Identity Software
--------------------------------------------------------------------------------
Update Information:
first release
--------------------------------------------------------------------------------
================================================================================
otter-browser-0.9.96-0.1.rc6git1b61eec.fc27 (FEDORA-2018-2c2d3f0804)
Web browser controlled by the user, not vice-versa
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.96-0.1.rc6git1b61eec
--------------------------------------------------------------------------------
================================================================================
php-7.1.15-1.fc27 (FEDORA-2018-a89ccf7133)
PHP scripting language for creating dynamic web sites
--------------------------------------------------------------------------------
Update Information:
**PHP version 7.1.15** (01 Mar 2018) **Apache2Handler:** * Fixed bug php#75882
(a simple way for segfaults in threadsafe php just with configuration). (Anatol)
**Date:** * Fixed bug php#75857 (Timezone gets truncated when formatted).
(carusogabriel) * Fixed bug php#75928 (Argument 2 for
`DateTimeZone::listIdentifiers()` should accept `null`). (Pedro Lacerda) * Fixed
bug php#68406 (calling var_dump on a DateTimeZone object modifies it). (jhdxr)
**PGSQL:** * Fixed php#75838 (Memory leak in pg_escape_bytea()). (ard_1 at mail
dot ru) **ODBC:** * Fixed bug php#73725 (Unable to retrieve value of
varchar(max) type). (Anatol) **LDAP:** * Fixed bug php#49876 (Fix LDAP path
lookup on 64-bit distros). (dzuelke) **libxml2:** * Fixed bug php#75871 (use
pkg-config where available). (pmmaga) **Phar:** * Fixed bug php#65414 (deal
with leading slash when adding files correctly). (bishopb) **SPL:** * Fixed
bug php#74519 (strange behavior of AppendIterator). (jhdxr) **Standard:** *
Fixed bug php#75916 (DNS_CAA record results contain garbage). (Mike, Philip
Sharp) * Fixed bug php#75981 (stack-buffer-overflow while parsing HTTP
response). (Stas)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1551039 - CVE-2018-7584 php: Stack-based buffer under-read in
ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex function when parsing HTTP
response allows denial of service
https://bugzilla.redhat.com/show_bug.cgi?id=1551039
--------------------------------------------------------------------------------
================================================================================
php-twig-1.35.1-2.fc27 (FEDORA-2018-23200da2cd)
The flexible, fast, and secure template engine for PHP
--------------------------------------------------------------------------------
Update Information:
**Version 1.35.1** (2018-03-02) * added an exception when using "==="
instead
of "same as" * fixed possible array to string conversion concealing actual
error * made variable names deterministic in compiled templates * fixed length
filter when passing an instance of IteratorAggregate * fixed
Environment::resolveTemplate to accept instances of TemplateWrapper
--------------------------------------------------------------------------------
================================================================================
php-twig2-2.4.5-1.fc27 (FEDORA-2018-5eb9b9d8d5)
The flexible, fast, and secure template engine for PHP
--------------------------------------------------------------------------------
Update Information:
**Version 2.4.5** (2018-03-02) * optimized the performance of calling an
extension method at runtime * optimized the performance of the dot operator for
array and method calls * added an exception when using "===" instead of
"same
as" * fixed possible array to string conversion concealing actual error * made
variable names deterministic in compiled templates * fixed length filter when
passing an instance of IteratorAggregate * fixed Environment::resolveTemplate
to accept instances of TemplateWrapper
--------------------------------------------------------------------------------
================================================================================
podman-0.3.1-1.gitc187538.fc27 (FEDORA-2018-45c398adcb)
Manage Pods, Containers and Container Images
--------------------------------------------------------------------------------
Update Information:
Release 0.3.1-1
--------------------------------------------------------------------------------
================================================================================
python-pytelegrambotapi-3.6.0-1.fc27 (FEDORA-2018-cdefc3dd30)
Python Telegram bot API
--------------------------------------------------------------------------------
Update Information:
Updated to upstream version 3.6.0 with new Telegram API features.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1550970 - python-pytelegrambotapi-3.6.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1550970
--------------------------------------------------------------------------------
================================================================================
siril-0.9.8.3-1.fc27 (FEDORA-2018-6613a6291c)
Astronomical image processing software
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.8.3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1550921 - New upstream version of Siril: 0.9.8.3
https://bugzilla.redhat.com/show_bug.cgi?id=1550921
--------------------------------------------------------------------------------
================================================================================
stunnel-5.44-5.fc27 (FEDORA-2018-6d8f240360)
A TLS-encrypting socket wrapper
--------------------------------------------------------------------------------
Update Information:
The update fixes failure when binding to localhost.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1542361 - stunnel: bind: Address already in use (98) when binding to
localhost
https://bugzilla.redhat.com/show_bug.cgi?id=1542361
--------------------------------------------------------------------------------
================================================================================
tor-0.3.1.10-1.fc27 (FEDORA-2018-8b33bd7abf)
Anonymizing overlay network for TCP
--------------------------------------------------------------------------------
Update Information:
Update to latest version. Security-Fixes TROVE-2018-001, TROVE-2018-002,
--------------------------------------------------------------------------------
================================================================================
vala-0.38.8-1.fc27 (FEDORA-2018-fdfb79dacb)
A modern programming language for GNOME
--------------------------------------------------------------------------------
Update Information:
Various bug fixes: - Fix GDestroyNotify of delegate parameters in delegate
declaration [#639059] - Avoid critical when connecting dynamic signals -
compiler: Prefix headers for set_cheader_override() if includedir is given
[#793299] - Don't warn about unused internal methods which are meant to be
visible on DBus [#593902] - libvaladoc: Prevent WITH_CGRAPH conditional
having an impact on generated sources Bindings: - gio-2.0: Cherry-pick
some DBusProxy fixes from 0.40 - gstreamer-1.0: Update from 1.13+ git master
- gdk-3.0,gtk+-3.0: Update to 3.22.27
--------------------------------------------------------------------------------
================================================================================
webextension-token-signing-1.0.6-1.fc27 (FEDORA-2018-2041f1244e)
Firefox extension for signing with your eID on the web
--------------------------------------------------------------------------------
Update Information:
first release
--------------------------------------------------------------------------------
================================================================================
wine-3.3-2.fc27 (FEDORA-2018-fa6f017315)
A compatibility layer for windows applications
--------------------------------------------------------------------------------
Update Information:
- Beginnings of Vulkan support. - Direct3D multi-threaded command stream
enabled by default. - Multisample textures enabled by default. - Support for
game controllers through SDL. - Support for loading CIL-only .Net binaries.
- Various bug fixes.
--------------------------------------------------------------------------------
================================================================================
xfig-3.2.6a-7.fc27 (FEDORA-2018-871ca0eb51)
An X Window System tool for drawing basic vector graphics
--------------------------------------------------------------------------------
Update Information:
- Fix font issues (rhbz#1523624) : - The new urw fonts are completely unusuable
as X11 core fonts, stop using them for now (see bug rhbz#1551219) - Add a patch
to deal with some fonts being scalable, while others are not - Add a patch to
use the fallback fonts for non-scalable fonts too, so that we at least show
something somewhat reasonable for Bookman, New Century Schoolbook and Palatino -
This means that display of Zapf Chancery and Zapf Dingbats currently falls back
to the "fixed" font, which is completely wrong for Dingbat - Remove obsolete
icon-cache and desktop-database scriptlets - Add a patch from Debian fixing some
issues with arrows
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1536581 - [specfile] Use correct requirements for Ghostscript's
(sub)packages
https://bugzilla.redhat.com/show_bug.cgi?id=1536581
[ 2 ] Bug #1523624 - xfig does not display X11 fonts -- fedora 27 / 32-bit / x11
https://bugzilla.redhat.com/show_bug.cgi?id=1523624
--------------------------------------------------------------------------------