The following Fedora 24 Security updates need testing:
Age URL
171
https://bodhi.fedoraproject.org/updates/FEDORA-2016-26f9817b08
squid-3.5.23-1.fc24
165
https://bodhi.fedoraproject.org/updates/FEDORA-2016-eaaa9c4a08 exim-4.87.1-1.fc24
127
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ece16ba6ba
runc-1.0.0-5.rc2.gitc91b5be.fc24
107
https://bodhi.fedoraproject.org/updates/FEDORA-2017-4b176c1694 redis-3.2.8-1.fc24
63
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8330a48ca2
python-XStatic-jquery-ui-1.12.0.1-1.fc24
35
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7a0e2d58f8
thunderbird-52.1.0-1.fc24
28
https://bodhi.fedoraproject.org/updates/FEDORA-2017-4de07172f4
postgresql-9.5.7-1.fc24
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0a1b2d495a
systemd-229-20.fc24
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d39099ea6a
webkitgtk4-2.16.3-1.fc24
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f942f19ff4 picocom-2.2-2.fc24
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5c55ef46ee yara-3.6.0-1.fc24
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-486a536b62
mosquitto-1.4.12-1.fc24
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7e6f5f6957
poppler-0.41.0-4.fc24
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3258a7e433
dolphin-emu-5.0-14.fc24
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-212f07c853
perl-File-Path-2.12-3.fc24
7
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6aff7475b7
ansible-2.3.1.0-1.fc24
7
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7e0ff7f73a
log4j12-1.2.17-19.fc24
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-36c7e7ef06
ettercap-0.8.2-4.2.fc24
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a3d6e1a7bf
libsndfile-1.0.28-2.fc24
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5f1006afb1
libstaroffice-0.0.3-3.fc24
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-62547837ba
gajim-0.16.8-1.fc24
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a1f4c48c68
nodejs-brace-expansion-1.1.7-1.fc24
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6554692044
kernel-4.11.4-100.fc24
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8425f676f2
mariadb-10.1.24-3.fc24
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-adc3d69650
capnproto-0.5.3.1-1.fc24
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e4638a345c
tomcat-8.0.44-1.fc24
The following Fedora 24 Critical Path updates have yet to be approved:
Age URL
50
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e1905fd566 koji-1.12.0-2.fc24
35
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7a0e2d58f8
thunderbird-52.1.0-1.fc24
17
https://bodhi.fedoraproject.org/updates/FEDORA-2017-c54e3353b6
p11-kit-0.23.2-4.fc24
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d39099ea6a
webkitgtk4-2.16.3-1.fc24
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0a1b2d495a
systemd-229-20.fc24
10
https://bodhi.fedoraproject.org/updates/FEDORA-2017-dc75cff415
firefox-53.0.3-1.fc24
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-09ed8ebe2c sssd-1.15.2-5.fc24
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-fabdb3303a testdisk-7.0-9.fc24
ntfs-3g-2017.3.23-1.fc24
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7e6f5f6957
poppler-0.41.0-4.fc24
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-212f07c853
perl-File-Path-2.12-3.fc24
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a3d6e1a7bf
libsndfile-1.0.28-2.fc24
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-41792497d9 vim-8.0.617-1.fc24
4
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2f817084d3
hwdata-0.301-1.fc24
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6554692044
kernel-4.11.4-100.fc24
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-852b6ec264
linux-firmware-20170605-74.git37857004.fc24
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8425f676f2
mariadb-10.1.24-3.fc24
The following builds have been pushed to Fedora 24 updates-testing
atomic-reactor-1.6.23.2-1.fc24
capnproto-0.5.3.1-1.fc24
copr-backend-1.100-1.fc24
copr-dist-git-0.30-1.fc24
dovecot-2.2.30.2-1.fc24
intel-cmt-cat-1.0.1-1.fc24
java-1.8.0-openjdk-1.8.0.131-3.b12.fc24
koji-containerbuild-0.7.2-1.fc24
mariadb-10.1.24-3.fc24
osbs-client-0.39.1-1.fc24
python-fedimg-0.7.1-1.fc24
python-moksha-hub-1.5.1-1.fc24
python-msrest-0.4.9-1.fc24
rubygem-glut-8.3.0-1.fc24
sugar-imageviewer-63-1.fc24
sugar-physics-32.1-1.fc24
sugar-terminal-45.1-1.fc24
sugar-words-22-1.fc24
tomcat-8.0.44-1.fc24
wordpress-4.8-1.fc24
Details about builds:
================================================================================
atomic-reactor-1.6.23.2-1.fc24 (FEDORA-2017-f18c56cd8a)
Improved builder for Docker images
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream - 1.6.23.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1304907 - atomic-reactor-1.6.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1304907
[ 2 ] Bug #1420728 - atomic-reactor-1.6.23.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1420728
--------------------------------------------------------------------------------
================================================================================
capnproto-0.5.3.1-1.fc24 (FEDORA-2017-adc3d69650)
A data interchange format and capability-based RPC system
--------------------------------------------------------------------------------
Update Information:
Update to 0.5.3.1 to fix CVE-2017-7892.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1443629 - CVE-2017-7892 capnproto: Integer overflow due to a malicious
message [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1443629
--------------------------------------------------------------------------------
================================================================================
copr-backend-1.100-1.fc24 (FEDORA-2017-4b334a8189)
Backend for Copr
--------------------------------------------------------------------------------
Update Information:
- extend check for a builder package present on a builder machine - arbitrary
dist-git branching - remove --add-cache-id from appstream-builder call, see Bug
1426166 - change to using a standalone builder package ---- Fixes downloading
logs for failed builds. ---- - do not condrestart optional logstash service -
standalone builder option - build reattaching after copr-backend(-build) service
restart - live mockchain log - use openssh instead of paramiko - update
cleanup_vm_nova script - remove buggy logging - removed Sphinx as a
dependency... - verbose log everything we have about failed playbook - replace
fedorahosted links - make systemd services out of ActionDispatcher and
BuildDispatcher ---- - Fixes for building COPR Backend and Dist-git on EL7 -
simplified/improved logging of exceptions mainly - don't use sha256 checksum for
rhel-5* repos, too - drop mentions of the max_builds_per_vm optoin - switched
usage of deprecated ansible Runner for python-paramiko module - os_nova filter
plugin fixed for python-novaclient 3 - support for STOMP msg buses - fix Bug
1402689 regarding job cancellation - jobgrab service is no more - respect
'do_sign' option when forking - fix buildroot_cmd for rhel mock profiles
--------------------------------------------------------------------------------
================================================================================
copr-dist-git-0.30-1.fc24 (FEDORA-2017-355d44afda)
Copr services for Dist Git server
--------------------------------------------------------------------------------
Update Information:
- import build task only once - remove unsupported --depth from git svn command
- add dep on git-svn - better exception handling in MockScmProvider - fix 'git
svn clone' and add exception handling for clone part in MockScm provider ----
- add --depth 1 for git clone in GitProvider - add missing 'which' for tito
&&
git-annex builds - arbitrary dist-git branching support - use MockScmProvider
without mock-scm to solve performance problems - add "powerpc64le" into list of
archs to allow building for - Bug 1457888 - Mock SCM method fails to build a
package - increase depth for git clone so that required tags that tito needs are
downloaded ---- Fixes problem with fedpkg builds, see
https://bugzilla.redhat.com/show_bug.cgi?id=1447102
--------------------------------------------------------------------------------
================================================================================
dovecot-2.2.30.2-1.fc24 (FEDORA-2017-869b346ea8)
Secure imap and pop3 server
--------------------------------------------------------------------------------
Update Information:
- auth: Multiple failed authentications within short time caused crashes - push-
notification: OX driver crashed at deinit ---- - auth: Use timing safe
comparisons for everything related to passwords. It's unlikely that these
could have been used for practical attacks, especially because Dovecot delays
and flushes all failed authentications in 2 second intervals. Also it could
have worked only when passwords were stored in plaintext in the passdb. -
master process sends SIGQUIT to all running children at shutdown, which
instructs them to close all the socket listeners immediately. This way
restarting Dovecot should no longer fail due to some processes keeping the
listeners open for a long time. - auth: Add passdb { mechanisms=none } to match
separate passdb lookup - auth: Add passdb { username_filter } to use passdb only
if user matches the filter. See
https://wiki2.dovecot.org/PasswordDatabase -
dsync: Add dsync_commit_msgs_interval setting. It attempts to commit the
transaction after saving this many new messages. Because of the way dsync
works, it may not always be possible if mails are copied or UIDs need to
change. - imapc: Support imapc_features=search without ESEARCH extension. -
imapc: Add imapc_features=fetch-bodystructure to pass through remote server's
FETCH BODY and BODYSTRUCTURE. - imapc: Add quota=imapc backend to use
GETQUOTA/GETQUOTAROOT on the remote server. - passdb imap: Add
allow_invalid_cert and ssl_ca_file parameters. - If dovecot.index.cache
corruption is detected, reset only the one corrupted mail instead of the
whole file. - doveadm mailbox status: Add "firstsaved" field. -
director_flush_socket: Add old host's up/down and vhost count as parameters -
More fixes to automatically fix corruption in dovecot.list.index - dsync-server:
Fix support for dsync_features=empty-header-workaround - imapc: Various
bugfixes, including infinite loops on some errors - IMAP NOTIFY wasn't working
for non-INBOX if IMAP client hadn't enabled modseq tracking via
CONDSTORE/QRESYNC. - fts-lucene: Fix it to work again with mbox format - Some
internal error messages may have contained garbage in v2.2.29 - mail-crypt: Re-
encrypt when copying/moving mails and per-mailbox keys are used. Otherwise the
copied mails can't be opened.
--------------------------------------------------------------------------------
================================================================================
intel-cmt-cat-1.0.1-1.fc24 (FEDORA-2017-116c900d72)
Provides command line interface to CMT, MBM, CAT, CDP and MBA technologies
--------------------------------------------------------------------------------
Update Information:
Minor update Bug fixes ---- 1. Added OS interface to support L3/L2 CAT & CDP
2. Updated support for CMT & MBM per task 3. Added pqos-os & pqos-msr wrapper
scripts 4. Added option to select OS interface to utilities ---- L2 Cache
Allocation Technology and Memory Bandwidth Allocation features enabled - part of
Intel(R) Resource Director Technology. Shared libpqos version 0.1.6 used. 'pqos'
tool updated to version 0.1.5. New 'rdtset' tool added.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1415656 - Please update to latest version
https://bugzilla.redhat.com/show_bug.cgi?id=1415656
--------------------------------------------------------------------------------
================================================================================
java-1.8.0-openjdk-1.8.0.131-3.b12.fc24 (FEDORA-2017-cab02b9eb2)
OpenJDK Runtime Environment
--------------------------------------------------------------------------------
Update Information:
enabled commented out system nss
--------------------------------------------------------------------------------
================================================================================
koji-containerbuild-0.7.2-1.fc24 (FEDORA-2017-dc81e276e7)
Koji support for building layered container images
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release - 0.7.2
--------------------------------------------------------------------------------
================================================================================
mariadb-10.1.24-3.fc24 (FEDORA-2017-8425f676f2)
A community developed branch of MySQL
--------------------------------------------------------------------------------
Update Information:
**Rebase to 10.1.24** Plugin oqgraph enabled Plugin jemalloc enabled
Sphinx engine enabled Build dependecies Bison and Libarchive added, others
corrected Disabling Mroonga engine for i686 architecture, as it is not
supported by MariaDB **Removed patches: (fixed by upstream)** Patch5:
%{pkgnamepatch}-file-contents.patch Patch14: %{pkgnamepatch}-example-config-
files.patch Patch31: %{pkgnamepatch}-string-overflow.patch Patch32:
%{pkgnamepatch}-basedir.patch Patch41: %{pkgnamepatch}-galera-new-cluster-
help.patch **CVEs fix** CVE-2017-3313 CVE-2017-3308 CVE-2017-3309
CVE-2017-3453 CVE-2017-3456 CVE-2017-3464 **Testsuite** Enabled
'--big-test' option for the testsuite Disabled '--skip-rpl' option for
the
testsuite = replication tests enabled **Warning** Some Spider tests
started to fail, the engine can be probabbly unsafe now. **Aditional bugs
solved:** #1459671: mariadb fails to start with tokudb; jemalloc not
correctly enabled ---- **Rebase to 10.1.24** Plugin oqgraph enabled
Plugin jemalloc enabled Sphinx engine enabled Build dependecies Bison
and Libarchive added, others corrected Disabling Mroonga engine for i686
architecture, as it is not supported by MariaDB **Removed patches: (fixed by
upstream)** Patch5: %{pkgnamepatch}-file-contents.patch Patch14:
%{pkgnamepatch}-example-config-files.patch Patch31: %{pkgnamepatch}-string-
overflow.patch Patch32: %{pkgnamepatch}-basedir.patch Patch41:
%{pkgnamepatch}-galera-new-cluster-help.patch **CVEs fix** CVE-2017-3313
CVE-2017-3308 CVE-2017-3309 CVE-2017-3453 CVE-2017-3456
CVE-2017-3464 **Testsuite** Enabled '--big-test' option for the testsuite
Disabled '--skip-rpl' option for the testsuite = replication tests enabled
**Warning** Some Spider tests started to fail, the engine can be probabbly
unsafe now. **Aditional bugs solved:** #1459671: mariadb fails to start
with tokudb; jemalloc not correctly enabled ---- **Rebase to 10.1.24**
Plugin oqgraph enabled Plugin jemalloc enabled Sphinx engine enabled
Build dependecies Bison and Libarchive added, others corrected Disabling
Mroonga engine for i686 architecture, as it is not supported by MariaDB
**Removed patches: (fixed by upstream)** Patch5: %{pkgnamepatch}-file-
contents.patch Patch14: %{pkgnamepatch}-example-config-files.patch
Patch31: %{pkgnamepatch}-string-overflow.patch Patch32:
%{pkgnamepatch}-basedir.patch Patch41: %{pkgnamepatch}-galera-new-
cluster-help.patch **CVEs fix** CVE-2017-3313 CVE-2017-3308
CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464
**Testsuite** Enabled '--big-test' option for the testsuite Disabled
'--skip-rpl' option for the testsuite = replication tests enabled **Warning**
Some Spider tests started to fail, the engine can be probabbly unsafe now.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1414387 - CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3257
CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317
CVE-2017-3318 mariadb: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1414387
[ 2 ] Bug #1459671 - mariadb fails to start with tokudb; jemalloc not correctly enabled
https://bugzilla.redhat.com/show_bug.cgi?id=1459671
--------------------------------------------------------------------------------
================================================================================
osbs-client-0.39.1-1.fc24 (FEDORA-2017-02bcd74e52)
Python command line client for OpenShift Build Service
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release - 0.39.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1412405 - osbs-client-0.39.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1412405
--------------------------------------------------------------------------------
================================================================================
python-fedimg-0.7.1-1.fc24 (FEDORA-2017-f828046aa2)
Automatically upload Fedora Cloud images to cloud providers
--------------------------------------------------------------------------------
Update Information:
Updates to 0.7.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1423753 - Cloud images on AWS account 125523088429 cannot be copied
https://bugzilla.redhat.com/show_bug.cgi?id=1423753
[ 2 ] Bug #1459576 - python-fedimg-0.7.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1459576
--------------------------------------------------------------------------------
================================================================================
python-moksha-hub-1.5.1-1.fc24 (FEDORA-2017-dd44862d64)
Hub components for Moksha
--------------------------------------------------------------------------------
Update Information:
Small bugfix:
https://github.com/mokshaproject/moksha/pull/43 ---- Latest
upstream. - One bugfix:
https://github.com/mokshaproject/moksha/pull/41 - And
one feature:
https://github.com/mokshaproject/moksha/pull/42 The feature
enables STOMP consumers to switch from 'auto' ack mode to 'client' ack
mode.
ACKs will be automatically sent to the broker if the consumer does not raise an
Exception. Exceptions raised by consumers will result in a NACK. Please test
with care. ---- One bugfix for STOMP users, which unescapes headers:
https://github.com/mokshaproject/moksha/pull/40 One new feature to properly
support users interacting with durable broker queues:
https://github.com/mokshaproject/moksha/pull/39
--------------------------------------------------------------------------------
================================================================================
python-msrest-0.4.9-1.fc24 (FEDORA-2017-a026d61ee3)
AutoRest swagger generator Python client runtime
--------------------------------------------------------------------------------
Update Information:
Accept "null" value for paging array as an empty list and do not raise
([#30](https://github.com/Azure/msrest-for-python/pull/30))
--------------------------------------------------------------------------------
================================================================================
rubygem-glut-8.3.0-1.fc24 (FEDORA-2017-b4087a1bb0)
Glut bindings for the OpenGL gem
--------------------------------------------------------------------------------
Update Information:
New version 8.3.0 is released
--------------------------------------------------------------------------------
================================================================================
sugar-imageviewer-63-1.fc24 (FEDORA-2017-a70479b70e)
Simple Image viewer for Sugar
--------------------------------------------------------------------------------
Update Information:
Release v63.
--------------------------------------------------------------------------------
================================================================================
sugar-physics-32.1-1.fc24 (FEDORA-2017-a7c86466ee)
A physical world simulator and playground for Sugar
--------------------------------------------------------------------------------
Update Information:
Release v32.1
--------------------------------------------------------------------------------
================================================================================
sugar-terminal-45.1-1.fc24 (FEDORA-2017-b90768161d)
Terminal for Sugar
--------------------------------------------------------------------------------
Update Information:
Release v45.1
--------------------------------------------------------------------------------
================================================================================
sugar-words-22-1.fc24 (FEDORA-2017-d8ca89ea64)
A multi lingual dictionary with speech synthesis
--------------------------------------------------------------------------------
Update Information:
Release v22.
--------------------------------------------------------------------------------
================================================================================
tomcat-8.0.44-1.fc24 (FEDORA-2017-e4638a345c)
Apache Servlet/JSP Engine, RI for Servlet 3.1/JSP 2.3 API
--------------------------------------------------------------------------------
Update Information:
This update includes a rebase from 8.0.43 up to 8.0.44 which resolves a single
CVE along with various other bugs/features: * rhbz#1459160 CVE-2017-5664
tomcat: Security constrained bypass in error page mechanism
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1459160 - CVE-2017-5664 tomcat: Security constrained bypass in error page
mechanism [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1459160
--------------------------------------------------------------------------------
================================================================================
wordpress-4.8-1.fc24 (FEDORA-2017-57803bc834)
Blog tool and publishing platform
--------------------------------------------------------------------------------
Update Information:
See upstream announcement: [WordPress 4.8
���Evans���](https://wordpress.org/news/2017/06/evans/)
--------------------------------------------------------------------------------