The following Fedora 26 Security updates need testing:
Age URL
266
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb5c8d1e7
docker-distribution-2.6.2-1.git48294d9.fc26
97
https://bodhi.fedoraproject.org/updates/FEDORA-2018-66b885ae3c
keycloak-httpd-client-install-0.8-1.fc26
85
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f8a78a5ef
squid-4.0.23-1.fc26
60
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db5041e661 bro-2.5.3-1.fc26
43
https://bodhi.fedoraproject.org/updates/FEDORA-2018-122ea355a7
memcached-1.4.39-2.fc26
26
https://bodhi.fedoraproject.org/updates/FEDORA-2018-010396b4a2
chromium-65.0.3325.181-1.fc26
21
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
20
https://bodhi.fedoraproject.org/updates/FEDORA-2018-922cc2fbaa
drupal8-8.3.9-1.fc26
17
https://bodhi.fedoraproject.org/updates/FEDORA-2018-22b25bab31
httpd-2.4.33-2.fc26
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b3f8bee2e0
jgraphx-3.6.0.0-3.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f6dc921a19
roundcubemail-1.3.6-1.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ac348a00ef
opencv-3.2.0-15.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d87e29047d
corosync-2.4.4-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-58b0c6a60e anki-2.0.50-1.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3622f44a12
scummvm-2.0.0-1.fc26 scummvm-tools-2.0.0-1.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8b35c531db
composer-1.6.4-1.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0050f7c0d1
perl-Module-CoreList-5.20180414-1.fc26 perl-5.24.4-397.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8ba4601398
dovecot-2.2.35-1.fc26
The following Fedora 26 Critical Path updates have yet to be approved:
Age URL
63
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ddd1e5c30a
iproute-4.14.1-5.fc26
21
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7649fef814
thunderbird-52.7.0-1.fc26
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0787a0a775
python-productmd-1.11-2.fc26
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d87e29047d
corosync-2.4.4-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6804e5d47a
ethtool-4.16-1.fc26
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-65aa477eb7
samba-4.6.15-0.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e6920f0a1f
libcgroup-0.41-17.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-58d5da4dde
osinfo-db-20180416-1.fc26
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0050f7c0d1
perl-Module-CoreList-5.20180414-1.fc26 perl-5.24.4-397.fc26
The following builds have been pushed to Fedora 26 updates-testing
datagrepper-0.9.4-1.fc26
fedora-upgrade-28.2-1.fc26
git-subrepo-0.3.1-1.20170206gita7ee886.fc26
gnome-software-3.24.3-6.fc26
gsoap-2.8.43-3.fc26
hplip-3.18.3-2.fc26
mod_http2-1.10.18-1.fc26
perl-File-Copy-Recursive-Reduced-0.003-1.fc26
perl-IPC-System-Simple-1.25-13.fc26
perl-Math-BigRat-0.2614-1.fc26
rocksndiamonds-4.1.0.0-1.fc26
task-spooler-1.0-1.fc26
xca-1.4.1-1.fc26
Details about builds:
================================================================================
datagrepper-0.9.4-1.fc26 (FEDORA-2018-118eb0e479)
A webapp to query fedmsg history
--------------------------------------------------------------------------------
Update Information:
https://github.com/fedora-infra/datagrepper/pull/207
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Ralph Bean <rbean(a)redhat.com> - 0.9.4-1
- new version
--------------------------------------------------------------------------------
================================================================================
fedora-upgrade-28.2-1.fc26 (FEDORA-2018-a815ddfc9d)
Upgrade Fedora to next version using dnf upgrade (unofficial tool)
--------------------------------------------------------------------------------
Update Information:
- remove --distro-sync for dnf system-upgrade - be more verbose so we have some
progress
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Miroslav Such�� <msuchy(a)redhat.com> 28.2-1
- remove --distro-sync for dnf system-upgrade
- do not check for dnf-plugins-core, it has been installed by check_dnf_deps()
- be more verbose so we have some progress
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568484 - Upgrade cannot be achieved when relying on current unofficial
tool.
https://bugzilla.redhat.com/show_bug.cgi?id=1568484
--------------------------------------------------------------------------------
================================================================================
git-subrepo-0.3.1-1.20170206gita7ee886.fc26 (FEDORA-2018-893e972151)
Git Submodule Alternative
--------------------------------------------------------------------------------
Update Information:
Initial upload.
--------------------------------------------------------------------------------
================================================================================
gnome-software-3.24.3-6.fc26 (FEDORA-2018-32e6a673f0)
A software center for GNOME
--------------------------------------------------------------------------------
Update Information:
Sync F28 distro upgrade background image with final F28 artwork
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Kalev Lember <klember(a)redhat.com> - 3.24.3-6
- Sync F28 upgrade background image with final F28 artwork
--------------------------------------------------------------------------------
================================================================================
gsoap-2.8.43-3.fc26 (FEDORA-2018-a9615e2a1e)
Generator Tools for Coding SOAP/XML Web Services in C and C++
--------------------------------------------------------------------------------
Update Information:
This patch addresses a critical issue with the DIME protocol receiver that may
cause the receiver to become unresponsive when a malformed DIME protocol message
is received. --
https://www.genivia.com/advisory.html
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 2.8.43-3
- Fix issue with DIME protocol receiver and malformed DIME headers
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568930 - gsoap: Infinite loop on malformed DIME protocol messages
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1568930
--------------------------------------------------------------------------------
================================================================================
hplip-3.18.3-2.fc26 (FEDORA-2018-0f9ab5c998)
HP Linux Imaging and Printing Project
--------------------------------------------------------------------------------
Update Information:
set dependency to /usr/bin/gpg
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Zdenek Dohnal <zdohnal(a)redhat.com> - 3.18.3-2
- set dependency directly to /usr/bin/gpg
--------------------------------------------------------------------------------
================================================================================
mod_http2-1.10.18-1.fc26 (FEDORA-2018-63de5f3f6b)
module implementing HTTP/2 for Apache 2
--------------------------------------------------------------------------------
Update Information:
This release includes the latest stable upstream release of mod_http2. The
changes since the last update are: * fixes a race condition where aborting
streams triggers an unnecessary timeout. * accurate reporting of h2 data
input/output per request via mod_logio. Fixes an issue where output sizes where
counted n-times on reused slave connections. See [issue
#158](https://github.com/icing/mod_h2/issues/158). * normalized connection
prefix logging when trace2 is enabled for direct h2 connection detection. ----
This update includes the latest upstream release of mod_http2, version 1.10.16.
This includes a security fix (CVE-2018-1302): When an HTTP/2 stream was
destroyed after being handled, mod_http2 could have written a NULL pointer
potentially to an already freed memory. The memory pools maintained by the
server make this vulnerabilty hard to trigger in usual configurations, the
reporter and the team could not reproduce it outside debug builds, so it is
classified as low risk.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Joe Orton <jorton(a)redhat.com> - 1.10.18-1
- update to 1.10.18
* Thu Mar 29 2018 Joe Orton <jorton(a)redhat.com> - 1.10.16-1
- update to 1.10.16 (CVE-2018-1302)
* Thu Feb 8 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.13-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1561570 - CVE-2018-1302 mod_http2: httpd: Use-after-free on HTTP/2 stream
shutdown [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1561570
[ 2 ] Bug #1560627 - CVE-2018-1302 httpd: Use-after-free on HTTP/2 stream shutdown
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1560627
--------------------------------------------------------------------------------
================================================================================
perl-File-Copy-Recursive-Reduced-0.003-1.fc26 (FEDORA-2018-f42567ed36)
Recursive copying of files and directories within Perl 5 toolchain
--------------------------------------------------------------------------------
Update Information:
This is the first Fedora/EPEL build of perl-File-Copy-Recursive-Reduced.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568877 - Review Request: perl-File-Copy-Recursive-Reduced - Recursive
copying of files and directories within Perl 5 toolchain
https://bugzilla.redhat.com/show_bug.cgi?id=1568877
--------------------------------------------------------------------------------
================================================================================
perl-IPC-System-Simple-1.25-13.fc26 (FEDORA-2018-c650a6e535)
Run commands simply, with detailed diagnostics
--------------------------------------------------------------------------------
Update Information:
This release fixes tests to work with Test-Simple 1.302065.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 2 2017 Petr Pisar <ppisar(a)redhat.com> - 1.25-13
- Fix random test failures with Test-Simple 1.302065
--------------------------------------------------------------------------------
================================================================================
perl-Math-BigRat-0.2614-1.fc26 (FEDORA-2018-f66594083f)
Arbitrary big rational numbers
--------------------------------------------------------------------------------
Update Information:
This release fixes an operand corruption on multiplication.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Petr Pisar <ppisar(a)redhat.com> - 0.2614-1
- 0.2614 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568637 - perl-Math-BigRat-0.2614 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1568637
--------------------------------------------------------------------------------
================================================================================
rocksndiamonds-4.1.0.0-1.fc26 (FEDORA-2018-e7a51c0dcf)
Underground digging game
--------------------------------------------------------------------------------
Update Information:
Update to 4.1.0.0.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Apr 17 2018 Tom Callaway <spot(a)fedoraproject.org> - 4.1.0.0-1
- update to 4.1.0.0
--------------------------------------------------------------------------------
================================================================================
task-spooler-1.0-1.fc26 (FEDORA-2018-4863674aff)
Personal job scheduler
--------------------------------------------------------------------------------
Update Information:
First release of package.
--------------------------------------------------------------------------------
================================================================================
xca-1.4.1-1.fc26 (FEDORA-2018-4d81f344e3)
Graphical X.509 certificate management tool
--------------------------------------------------------------------------------
Update Information:
New upstream release. New URL and source location. Fixes BZ #1568760.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Apr 18 2018 Patrick Monnerat <patrick(a)monnerat.net> 1.4.1-1
- New upstream release.
- New URL and source location.
- "Modernize" spec file.
- BR gcc-g++.
Fixes BZ #1568760.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568760 - Upgarade to version 1.4.1 so that old XCA files could be opened
https://bugzilla.redhat.com/show_bug.cgi?id=1568760
--------------------------------------------------------------------------------