The following Fedora 19 Security updates need testing:
Age URL
385
https://admin.fedoraproject.org/updates/FEDORA-2013-19963/openstack-glanc...
197
https://admin.fedoraproject.org/updates/FEDORA-2014-5896/nrpe-2.15-2.fc19
148
https://admin.fedoraproject.org/updates/FEDORA-2014-7496/readline-6.2-8.fc19
66
https://admin.fedoraproject.org/updates/FEDORA-2014-10366/icecream-1.0.1-...
65
https://admin.fedoraproject.org/updates/FEDORA-2014-10640/libreoffice-4.1...
50
https://admin.fedoraproject.org/updates/FEDORA-2014-11544/drupal6-6.33-1....
43
https://admin.fedoraproject.org/updates/FEDORA-2014-12057/krb5-1.11.3-29....
29
https://admin.fedoraproject.org/updates/FEDORA-2014-13047/libxml2-2.9.1-2...
29
https://admin.fedoraproject.org/updates/FEDORA-2014-13018/deluge-1.3.10-1...
19
https://admin.fedoraproject.org/updates/FEDORA-2014-13551/wpa_supplicant-...
14
https://admin.fedoraproject.org/updates/FEDORA-2014-14066/php-sabredav-Sa...
10
https://admin.fedoraproject.org/updates/FEDORA-2014-14266/python-2.7.5-15...
10
https://admin.fedoraproject.org/updates/FEDORA-2014-14237/claws-mail-plug...
8
https://admin.fedoraproject.org/updates/FEDORA-2014-14359/curl-7.29.0-25....
5
https://admin.fedoraproject.org/updates/FEDORA-2014-14498/python-requests...
5
https://admin.fedoraproject.org/updates/FEDORA-2014-14564/qpid-cpp-0.26-1...
4
https://admin.fedoraproject.org/updates/FEDORA-2014-14699/drupal7-ckedito...
3
https://admin.fedoraproject.org/updates/FEDORA-2014-14738/gnutls-3.1.20-6...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14865/kde-workspace-4...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14912/polarssl-1.2.12...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14980/python-pillow-2...
0
https://admin.fedoraproject.org/updates/FEDORA-2014-15079/mantis-1.2.17-4...
0
https://admin.fedoraproject.org/updates/FEDORA-2014-14874/arm-none-eabi-b...
0
https://admin.fedoraproject.org/updates/FEDORA-2014-12407/sddm-0.10.0-2.fc19
0
https://admin.fedoraproject.org/updates/FEDORA-2014-14838/avr-binutils-2....
0
https://admin.fedoraproject.org/updates/FEDORA-2014-15124/kwebkitpart-1.3...
The following Fedora 19 Critical Path updates have yet to be approved:
Age URL
333
https://admin.fedoraproject.org/updates/FEDORA-2013-22326/fedora-bookmark...
259
https://admin.fedoraproject.org/updates/FEDORA-2014-3245/testdisk-6.14-2....
10
https://admin.fedoraproject.org/updates/FEDORA-2014-14266/python-2.7.5-15...
8
https://admin.fedoraproject.org/updates/FEDORA-2014-14359/curl-7.29.0-25....
5
https://admin.fedoraproject.org/updates/FEDORA-2014-14516/pcre-8.32-11.fc19
5
https://admin.fedoraproject.org/updates/FEDORA-2014-14505/unzip-6.0-12.fc19
3
https://admin.fedoraproject.org/updates/FEDORA-2014-14738/gnutls-3.1.20-6...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14807/device-mapper-p...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14846/pciutils-3.3.0-...
1
https://admin.fedoraproject.org/updates/FEDORA-2014-14865/kde-workspace-4...
0
https://admin.fedoraproject.org/updates/FEDORA-2014-15022/firefox-33.1-2....
0
https://admin.fedoraproject.org/updates/FEDORA-2014-15032/man-db-2.6.3-9....
0
https://admin.fedoraproject.org/updates/FEDORA-2014-15027/evolution-data-...
The following builds have been pushed to Fedora 19 updates-testing
RBTools-0.6.3-1.fc19
arm-none-eabi-binutils-cs-2014.05.28-3.fc19
armadillo-4.500.0-1.fc19
avr-binutils-2.24-3.fc19
berusky-1.7-4.fc19
berusky2-0.10-5.fc19
gfal2-2.7.7-1.fc19
kwebkitpart-1.3.4-5.fc19
lz4-r124-1.fc19
mantis-1.2.17-4.fc19
nx-libs-3.5.0.28-1.fc19
perl-Sub-Exporter-GlobExporter-0.004-1.fc19
perl-Test-LongString-0.17-1.fc19
php-SymfonyCmfRouting-1.3.0-1.fc19
rubygem-pkg-config-1.1.6-1.fc19
Details about builds:
================================================================================
RBTools-0.6.3-1.fc19 (FEDORA-2014-15133)
Tools for use with ReviewBoard
--------------------------------------------------------------------------------
Update Information:
- New upstream release 0.6.3
-
http://www.reviewboard.org/docs/releasenotes/rbtools/0.6.3/
- Include upstream patch adding 'rbt patch -C' to automatically commit a patch to
a local git repository.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 Stephen Gallagher <sgallagh(a)redhat.com> 0.6.3-1
- New upstream release 0.6.3
-
http://www.reviewboard.org/docs/releasenotes/rbtools/0.6.3/
- Include upstream patch adding 'rbt patch -C' to automatically commit a patch
to a local git repository.
--------------------------------------------------------------------------------
================================================================================
arm-none-eabi-binutils-cs-2014.05.28-3.fc19 (FEDORA-2014-14874)
GNU Binutils for cross-compilation for arm-none-eabi target
--------------------------------------------------------------------------------
Update Information:
- fix directory traversal vulnerability (#1162657)
- fix CVE-2014-8501: out-of-bounds write when parsing specially crafted PE executable
- fix CVE-2014-8502: heap overflow in objdump
- fix CVE-2014-8503: stack overflow in objdump when parsing specially crafted ihex file
- fix CVE-2014-8504: stack overflow in the SREC parser
- fix out of bounds memory write
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 2014.05.28-3
- fix CVE-2014-8738: out of bounds memory write
* Wed Nov 12 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 2014.05.28-2
- fix directory traversal vulnerability (#1162657)
- fix CVE-2014-8501: out-of-bounds write when parsing specially crafted PE executable
- fix CVE-2014-8502: heap overflow in objdump
- fix CVE-2014-8503: stack overflow in objdump when parsing specially crafted ihex file
- fix CVE-2014-8504: stack overflow in the SREC parser
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1162655 - CVE-2014-8737 binutils: directory traversal vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=1162655
[ 2 ] Bug #1162594 - CVE-2014-8502 binutils: heap overflow in objdump
https://bugzilla.redhat.com/show_bug.cgi?id=1162594
[ 3 ] Bug #1162621 - CVE-2014-8504 binutils: stack overflow in the SREC parser
https://bugzilla.redhat.com/show_bug.cgi?id=1162621
[ 4 ] Bug #1162570 - CVE-2014-8501 binutils: out-of-bounds write when parsing specially
crafted PE executable
https://bugzilla.redhat.com/show_bug.cgi?id=1162570
[ 5 ] Bug #1162666 - CVE-2014-8738 binutils: out of bounds memory write
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--------------------------------------------------------------------------------
================================================================================
armadillo-4.500.0-1.fc19 (FEDORA-2014-15138)
Fast C++ matrix library with interfaces to LAPACK and ATLAS
--------------------------------------------------------------------------------
Update Information:
Update to version 4.500 (Singapore Sling)
* faster handling of complex vectors by norm()
* expanded chol() to optionally specify output matrix as upper or lower triangular
* better handling of non-finite values when saving matrices as text files
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 José Matos <jamatos(a)fedoraproject.org> - 4.500.0-1
- update to 4.500.0
--------------------------------------------------------------------------------
================================================================================
avr-binutils-2.24-3.fc19 (FEDORA-2014-14838)
Cross Compiling GNU binutils targeted at avr
--------------------------------------------------------------------------------
Update Information:
- fix directory traversal vulnerability
- fix CVE-2014-8501: out-of-bounds write when parsing specially crafted PE executable
- fix CVE-2014-8502: heap overflow in objdump
- fix CVE-2014-8503: stack overflow in objdump when parsing specially crafted ihex file
- fix CVE-2014-8504: stack overflow in the SREC parser
- fix out of bounds memory write
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.24-3
- fix CVE-2014-8738: out of bounds memory write
* Wed Nov 12 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.24-2
- fix directory traversal vulnerability (#1162657)
- fix CVE-2014-8501: out-of-bounds write when parsing specially crafted PE executable
- fix CVE-2014-8502: heap overflow in objdump
- fix CVE-2014-8503: stack overflow in objdump when parsing specially crafted ihex file
- fix CVE-2014-8504: stack overflow in the SREC parser
* Wed Aug 13 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.24-1
- updated to 2.24
* Mon Feb 3 2014 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.23.2-4
- avr-binutils may be affected by libiberty CVE (#1059362)
* Tue Aug 13 2013 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.23.2-3
- fix tex again
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1:2.23.2-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Mon Jun 24 2013 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.23.2-1
- updated to 2.23.2
* Tue Jun 18 2013 Jaromir Capik <jcapik(a)redhat.com> - 1:2.23.1-4
- autoreconf -vif doesn't work -> patching for aarch64 support (#925061)
* Fri Apr 19 2013 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.23.1-3
- fix aarch64 support (#925061)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1162655 - CVE-2014-8737 binutils: directory traversal vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=1162655
[ 2 ] Bug #1162594 - CVE-2014-8502 binutils: heap overflow in objdump
https://bugzilla.redhat.com/show_bug.cgi?id=1162594
[ 3 ] Bug #1162570 - CVE-2014-8501 binutils: out-of-bounds write when parsing specially
crafted PE executable
https://bugzilla.redhat.com/show_bug.cgi?id=1162570
[ 4 ] Bug #1162621 - CVE-2014-8504 binutils: stack overflow in the SREC parser
https://bugzilla.redhat.com/show_bug.cgi?id=1162621
[ 5 ] Bug #1162666 - CVE-2014-8738 binutils: out of bounds memory write
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--------------------------------------------------------------------------------
================================================================================
berusky-1.7-4.fc19 (FEDORA-2014-15128)
Sokoban clone
--------------------------------------------------------------------------------
Update Information:
Updated app file.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 25 2014 Martin Stransky <stransky(a)redhat.com> 1.7-4
- Added appdata file
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.7-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.7-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sat Feb 8 2014 Martin Stransky <stransky(a)redhat.com> 1.7-1
- New upstream version (1.7)
* Thu Dec 12 2013 Ville Skyttä <ville.skytta(a)iki.fi> - 1.6-4
- Install docs to %{_pkgdocdir} where available (#993683).
- Fix bogus dates in %changelog.
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.6-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
berusky2-0.10-5.fc19 (FEDORA-2014-15117)
Sokoban clone
--------------------------------------------------------------------------------
Update Information:
Updated icon and app file.
Update to latest upstream.
Update to latest upstream.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 7 2014 Martin Stransky <stransky(a)redhat.com> 0.10-5
- Added appdata file
* Fri Aug 15 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.10-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Thu Jun 19 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 0.10-3
- Build on aarch64
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.10-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sat Jan 18 2014 Martin Stransky <stransky(a)redhat.com> 0.10-1
- Updated to 0.10
* Sat Aug 3 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
0.9-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
gfal2-2.7.7-1.fc19 (FEDORA-2014-14534)
Grid file access library 2.0
--------------------------------------------------------------------------------
Update Information:
Update for gfal2 2.7.7 release
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 10 2014 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 2.7.7-1
- Upgraded to upstream release 2.7.7
* Fri Nov 7 2014 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 2.7.6-1
- New upstream release
* Mon Sep 8 2014 Alejandro Alvarez Ayllon <aalvarez at cern.ch> - 2.6.8-6
- Patch to use lseek64 instead of lseek in the http plugin
* Thu Sep 4 2014 Orion Poplawski <orion(a)cora.nwra.com> - 2.6.8-5
- Rebuild for pugixml 1.4
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
2.6.8-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
kwebkitpart-1.3.4-5.fc19 (FEDORA-2014-15124)
A KPart based on QtWebKit
--------------------------------------------------------------------------------
Update Information:
Sanitize input to disallow javascript being executed in the context of the referenced
hostname.
See also
https://www.kde.org/info/security/advisory-20141113-1.txt
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 Rex Dieter <rdieter(a)fedoraproject.org> 1.3.4-5
- CVE-2014-8600 Insufficient Input Validation (#1164293)
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.3.4-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Mon Jul 21 2014 Rex Dieter <rdieter(a)fedoraproject.org> 1.3.4-3
- keep khtml default on rhel
* Thu Jun 19 2014 Rex Dieter <rdieter(a)fedoraproject.org> 1.3.4-2
- BR: kdelibs4-webkit-devel
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1164293 - CVE-2014-8600 kwebkitpart, kde-runtime: Insufficient Input
Validation By IO Slaves and Webkit Part
https://bugzilla.redhat.com/show_bug.cgi?id=1164293
--------------------------------------------------------------------------------
================================================================================
lz4-r124-1.fc19 (FEDORA-2014-15096)
Extremely fast compression algorithm
--------------------------------------------------------------------------------
Update Information:
- New LZ4 HC Streaming mode
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 pjp <pjp(a)fedoraproject.org> - r124-1
- New LZ4 HC Streaming mode
--------------------------------------------------------------------------------
================================================================================
mantis-1.2.17-4.fc19 (FEDORA-2014-15079)
Web-based issue tracking system
--------------------------------------------------------------------------------
Update Information:
fix CVE-2014-7146, CVE-2014-8598 (#1162046)
fix CVE-2014-8554 (#1159295)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 Gianluca Sforna <giallu(a)gmail.com> - 1.2.17-4
- fix CVE-2014-7146, CVE-2014-8598 (#1162046)
- fix CVE-2014-8554 (#1159295)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1162046 - CVE-2014-7146 CVE-2014-8598 mantis: issues in the XML Import/Export
plug-in to be fixed in the upcoming 1.2.18 release
https://bugzilla.redhat.com/show_bug.cgi?id=1162046
[ 2 ] Bug #1159295 - CVE-2014-8554 mantis: incomplete fix for CVE-2014-1609
https://bugzilla.redhat.com/show_bug.cgi?id=1159295
--------------------------------------------------------------------------------
================================================================================
nx-libs-3.5.0.28-1.fc19 (FEDORA-2014-15089)
NX X11 protocol compression libraries
--------------------------------------------------------------------------------
Update Information:
Update to 3.5.0.28:
o Fix non-working Copy+Paste into some rootless Qt applications when Xfixes extension is
enabled in NX. Thanks to Ulrich Sibiller!
o Adapt X11 launchd socket path for recent Mac OS X versions.
o Fix Xinerama on Debian/Ubuntu installation (only worked on systems that had dpkg-dev
installed) and all RPM based distros.
o Partly make nxcomp aware of nx-libs's four-digit version string. Thanks to Nito
Martinez from TheQVD project!
- Fix unowned directories
- Minor cleanup
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 Orion Poplawski <orion(a)cora.nwra.com> - 3.5.0.28-1
- Update to 3.5.0.28
- Fix unowned directories
- Minor cleanup
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
3.5.0.27-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
perl-Sub-Exporter-GlobExporter-0.004-1.fc19 (FEDORA-2014-15078)
Export shared globs with Sub::Exporter collectors
--------------------------------------------------------------------------------
Update Information:
This release corrects documentation.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 Petr Pisar <ppisar(a)redhat.com> - 0.004-1
- 0.004 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1163305 - perl-Sub-Exporter-GlobExporter-0.004 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1163305
--------------------------------------------------------------------------------
================================================================================
perl-Test-LongString-0.17-1.fc19 (FEDORA-2014-15127)
Perl module to test long strings
--------------------------------------------------------------------------------
Update Information:
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 Ralf Corsépius <corsepiu(a)fedoraproject.org> - 0.17-1
- Upstream update.
--------------------------------------------------------------------------------
================================================================================
php-SymfonyCmfRouting-1.3.0-1.fc19 (FEDORA-2014-15135)
Extends the Symfony2 routing component for dynamic routes and chaining
--------------------------------------------------------------------------------
Update Information:
1.3.0
-----
* **2014-09-29**: ChainRouter does not require a RouterInterface, as a RequestMatcher and
UrlGenerator is fine too. Fixed chain router interface to not force a RouterInterface.
* **2014-09-29**: Deprecated DynamicRouter::match in favor of matchRequest.
1.3.0-RC1
---------
* **2014-08-20**: Added an interface for the ChainRouter
* **2014-06-06**: Updated to PSR-4 autoloading
--------------------------------------------------------------------------------
ChangeLog:
* Thu Nov 13 2014 Shawn Iwinski <shawn.iwinski(a)gmail.com> - 1.3.0-1
- Updated to 1.3.0 (BZ #1096125)
* Mon Oct 20 2014 Shawn Iwinski <shawn.iwinski(a)gmail.com> - 1.2.0-1
- Updated to 1.2.0 (BZ #1096125)
- Enabled tests by default
- Updated URL, description, dependencies, %check, and %files
- Added "php-composer(symfony-cmf/routing)" virtual provide
- %license usage
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.1.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1096125 - php-SymfonyCmfRouting-1.3.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1096125
--------------------------------------------------------------------------------
================================================================================
rubygem-pkg-config-1.1.6-1.fc19 (FEDORA-2014-15107)
A pkg-config implementation by Ruby
--------------------------------------------------------------------------------
Update Information:
New version 1.1.6 is released.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Nov 14 2014 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1.1.6-1
- 1.1.6
* Thu Jun 26 2014 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 1.1.5-3
- Fix build failure
* Sun Jun 8 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> -
1.1.5-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
--------------------------------------------------------------------------------