The following Fedora 26 Security updates need testing:
Age URL
144
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb5c8d1e7
docker-distribution-2.6.2-1.git48294d9.fc26
72
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e6f4f95e6 ruby-2.4.2-84.fc26
36
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3915878e18 ldns-1.7.0-4.fc26
36
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f87ce166c5
chromium-62.0.3202.89-1.fc26
19
https://bodhi.fedoraproject.org/updates/FEDORA-2017-774e7863a4
mongodb-3.4.10-1.fc26
15
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7bac3ba7c3
qpid-cpp-1.37.0-1.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5cdad4163
libvirt-3.2.1-7.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d6402c8005
evince-3.24.2-2.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2d441a1d98
python26-2.6.9-7.fc26
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-1dc71e1acd
shellinabox-2.20-5.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-bf172b2035
lynx-2.8.9-0.20.dev16.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7fe2c4bc0e
python33-3.3.7-2.fc26
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0f3270406c
libextractor-1.6-2.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-26c3ab48e4
wayland-1.13.0-3.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-38fbcdffc3
asterisk-13.18.4-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-80c6b4d3be
sensible-utils-0.0.11-1.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-aa4cc10bde
qt5-qtbase-5.9.2-6.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-16a414b3c5 xen-4.8.2-9.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2962e58478
heimdal-7.5.0-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ba6b6e71f7
kernel-4.14.6-200.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d952bdc53
json-c-0.12.1-5.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-c28bfe0986
libexif-0.6.21-14.fc26
The following Fedora 26 Critical Path updates have yet to be approved:
Age URL
8
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5cdad4163
libvirt-3.2.1-7.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8d2a756133
libsmbios-2.3.3-2.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b5ac57e518
selinux-policy-3.13.1-260.18.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-26c3ab48e4
wayland-1.13.0-3.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-16a414b3c5 xen-4.8.2-9.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b1ce6bb43a audit-2.8.2-1.fc26
2
https://bodhi.fedoraproject.org/updates/FEDORA-2017-aa4cc10bde
qt5-qtbase-5.9.2-6.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-05db2de66b
nfs-utils-2.2.1-1.rc2.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ba6b6e71f7
kernel-4.14.6-200.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b79deedf43
linux-firmware-20171215-81.git2451bb22.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d57a06cda1
flatpak-0.10.2-1.fc26 flatpak-builder-0.10.6-1.fc26
1
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8b51db595f
tigervnc-1.8.0-5.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-c28bfe0986
libexif-0.6.21-14.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6d952bdc53
json-c-0.12.1-5.fc26
The following builds have been pushed to Fedora 26 updates-testing
borgbackup-1.1.3-2.fc26
cmake-3.10.1-1.fc26
debian-keyring-2017.7-1.fc26
json-c-0.12.1-5.fc26
kapow-1.5.4-1.fc26
libexif-0.6.21-14.fc26
mozilla-noscript-10.1.5.8-1.fc26
perl-Crypt-UnixCrypt_XS-0.11-1.fc26
python-catkin_lint-1.4.17-1.fc26
python-catkin_pkg-0.3.9-2.fc26
translate-shell-0.9.6.6-1.fc26
Details about builds:
================================================================================
borgbackup-1.1.3-2.fc26 (FEDORA-2017-f91e26f757)
A deduplicating backup program with compression and authenticated encryption
--------------------------------------------------------------------------------
Update Information:
fix borg check --repair malfunction (upstream pull #3444)
--------------------------------------------------------------------------------
================================================================================
cmake-3.10.1-1.fc26 (FEDORA-2017-5e144d356e)
Cross-platform make system
--------------------------------------------------------------------------------
Update Information:
* New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1526648 - cmake-3.10.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1526648
--------------------------------------------------------------------------------
================================================================================
debian-keyring-2017.7-1.fc26 (FEDORA-2017-af58669d12)
GnuPG archive keys of the Debian archive
--------------------------------------------------------------------------------
Update Information:
Update to 2017.7, see
http://metadata.ftp-master.debian.org/changelogs/main/d
/debian-archive-keyring/debian-archive-keyring_2017.7_changelog for details.
--------------------------------------------------------------------------------
================================================================================
json-c-0.12.1-5.fc26 (FEDORA-2017-6d952bdc53)
JSON implementation in C
--------------------------------------------------------------------------------
Update Information:
- Patch: - Avoid invalid free and crash explicitly instead of silently
enabling the caller to commit undefined behaviour.
--------------------------------------------------------------------------------
================================================================================
kapow-1.5.4-1.fc26 (FEDORA-2017-76ba705462)
A punch clock program
--------------------------------------------------------------------------------
Update Information:
Update to latest release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1508412 - kapow-1.5.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1508412
--------------------------------------------------------------------------------
================================================================================
libexif-0.6.21-14.fc26 (FEDORA-2017-c28bfe0986)
Library for extracting extra information from image files
--------------------------------------------------------------------------------
Update Information:
Patch for CVE-2016-6328
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1484032 - CVE-2016-6328 libexif: Integer overflow in parsing MNOTE entry data
of the input file [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1484032
--------------------------------------------------------------------------------
================================================================================
mozilla-noscript-10.1.5.8-1.fc26 (FEDORA-2017-8ee9e1dc42)
JavaScript white list extension for Mozilla Firefox
--------------------------------------------------------------------------------
Update Information:
NOTE: all packaged Firefox add-ons are affected by bug fedora#1508827 , please
don't give negative karma here, but add yourself to the bug instead. This
update brings back the SeaMonkey support with version 5.1.8.3, which is still
maintained until June 2018. Changes since 10.1.2: * Fix for linux rendering
performance issues * First "Quantum" release candidate with Android support *
Inverted order of domains vs full sites in popup * Settings import
functionality, backward compatible with NoScript 5 formats * Settings export
functionality * [XSS] The filter now automatically skips embedded documents
which would normally be blocked * Base domain matching now uses a single dot
rule for unknown, private or "fake" TLDs (e.g.
www.acme.corp ��� acme.corp) *
[XSS] Fixed regression from 10.1.5.6rc2 (thanks Masato Kinugava for reporting) *
Better feedback for errors in the policy's debug JSON view (thanks E-Raser for
RFE) * removed yandex.st from default whitelist (see
https://forums.informaction.com/viewtopic.php?t=23655) * [XSS] Streamlined
multiple unescaping standards handling * [XSS] Generalized work-around for
browser's URL parsing oddities (thanks Masato Kinugava for reporting) *
"Temporarily set top-level sites to TRUSTED" option * [XSS] Fixed user choices
forgot across browser sessions * [UI] Clicking on the domain label now opens the
"Security and privacy info" webpage (like middle click on "Classic").
* "Reset
to Defaults" button in the options window * Improved content script
initialization logic (thanks Rob Wu for suggestions) * [XSS] Fixed 2nd level
interactive bypass (thanks Masato Kinugava for reporting) * Fixed sites manually
added from the Options textbox don't stick (thanks Just_Golem for reporting) *
[UI] Clicking on the domain label now opens the "Security and privacy info"
webpage (like middle click on "Classic"). * "Reset to Defaults" button
in the
options window * Improved content script initialization logic (thanks Rob Wu for
suggestions) * [XSS] Fixed 2nd level interactive bypass (thanks Masato Kinugava
for reporting) * Fixed sites manually added from the Options textbox don't stick
(thanks Just_Golem for reporting) * Fixed regression causing NoScript to ask to
reload pages in order to show permissions more than once upon installation *
Removed most animations causing older system to lag when large permissions lists
are displayed in Options * Improved work-around for blank windows on Linux
Firefox bug * Fixed XSS false positives on POST requests without data * Fixed
regression from new "fail fast" XSS filter main loop, causing cross-site
requests to Google to trigger false positives (thanks Steve M for reporting) *
[XSS] Added "Always block requests from ... to ..." in XSS warning prompt *
[XSS] Fixed url decoding bug (thanks Masato Kinugawa for reporting) * Fixed some
blocked items not reported in the UI (thanks Bo Elam for reporting) * Changed
the CSP internal report URI to noscript-csp.invalid (thanks Tom Schuster Mario
Heiderich for RFE) * Removed unused MSE detection code (thanks Rob Wu for
reporting) * Fixed script enablement feedback dependant on page's own CSP
(thanks Rob Wu for reporting) * Fixed MSE detection injection using window.eval
(thanks Rob Wu for reporting) * Fixed window being resized and NoScript UI shown
in a separate popup when triggered on a maximized window * General performance
improvement by removing unnecessary asynchronous webRequest listeners * Hotfix
for wiped TRUSTED permissions * Hotfix for NoScript failing to load if XSS was
disabled in previous session * Fixed immutable permissions for TRUSTED and
UNTRUSTED presets negating all the others (thanks Stefan Scholl for reporting) *
Work-around for Moz Bug #1402110 (thanks David Ross for reporting) * Fixed XSS
whitelist not being cleared from Options * Fixed XSS whitelist trying to using
sync even if disabled (thanks Rob Wu for reporting) * Work-around for Firefox
not displaying NOSCRIPT elements on pages where scripts are blocked by CSP * The
Alt+Shift+N shortcut now opens the NoScript UI also on windows with no toolbars
containing NoScript's icon * "unsafe" (non-HTTPS) matching is now
automatically
selected on non-HTTPS pages (fixes the perception that you set a site to TRUSTED
and it reverted to DEFAULT) * Full addresses are shown again to be choosen in
UI, together with base domains * Better auto-reload logic * Fixed NoScript back-
end to work also if sync storage is disabled (thanks Rob Wu for reporting) *
Fixed potential fingerprinting through placeholder icon (thanks Rob Wu for
reporting) Changes since 5.1.7: * [XSS] Fixed regression (thanks Masato
Kinugava for report) * [ABE] Restored Palemoon compatibility (thanks barbaz for
patch) * [ABE] Fixed ruleset persistence (thanks barbaz for patch) * removed
yandex.st from default whitelist (see
https://forums.informaction.com/viewtopic.php?t=23655) * [XSS] Streamlined
multiple unescaping standards handling * [XSS] Fixed 2nd level interactive
bypass (thanks Masato Kinugava for reporting)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1526199 - User experience changed - No longer present for SeaMonkey users
https://bugzilla.redhat.com/show_bug.cgi?id=1526199
[ 2 ] Bug #1524389 - mozilla-noscript-10.1.5.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1524389
--------------------------------------------------------------------------------
================================================================================
perl-Crypt-UnixCrypt_XS-0.11-1.fc26 (FEDORA-2017-b4c81d8665)
Perl xs interface for a portable traditional crypt function
--------------------------------------------------------------------------------
Update Information:
Specfile autogenerated by cpanspec 1.78.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1520569 - Review Request: perl-Crypt-UnixCrypt_XS - Perl xs interface for a
portable traditional crypt function
https://bugzilla.redhat.com/show_bug.cgi?id=1520569
--------------------------------------------------------------------------------
================================================================================
python-catkin_lint-1.4.17-1.fc26 (FEDORA-2017-3f8a593c4a)
Check catkin packages for common errors
--------------------------------------------------------------------------------
Update Information:
Update to release 1.4.17 (rhbz#1509944)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1509944 - python-catkin_lint-1.4.17 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1509944
--------------------------------------------------------------------------------
================================================================================
python-catkin_pkg-0.3.9-2.fc26 (FEDORA-2017-aed24a125d)
Library for retrieving information about catkin packages
--------------------------------------------------------------------------------
Update Information:
Update to latest release 0.3.9 ---- Add patch to remove argparse from the
requirements
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1508241 - python-catkin_pkg-0.3.9 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1508241
[ 2 ] Bug #1526466 - The 'argparse' distribution was not found and is required
by catkin-pkg
https://bugzilla.redhat.com/show_bug.cgi?id=1526466
--------------------------------------------------------------------------------
================================================================================
translate-shell-0.9.6.6-1.fc26 (FEDORA-2017-2d1aaca3b8)
A command-line online translator
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.6.6.
--------------------------------------------------------------------------------