The following Fedora EPEL 6 Security updates need testing:
Age URL
109
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6c663378c
unrtf-0.21.9-8.el6
47
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f21474267b
condor-8.6.11-1.el6
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-130324cf61
gitolite3-3.6.9-1.el6
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-51146daa45
hylafax+-5.6.1-1.el6
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-0d793474b0
mozilla-noscript-10.1.9.6-1.el6
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-8667fe68a8
lcms2-2.8-6.el6
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ca7fe27b10
mbedtls-2.7.6-1.el6
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ebecebaa67
python-marshmallow-2.0.0-0.7.gita8b3385.el6
The following builds have been pushed to Fedora EPEL 6 updates-testing
gnutls30-3.5.18-1.el6
libmad-0.15.1b-26.el6
php-tcpdf-6.2.25-1.el6
remctl-3.15-1.el6
Details about builds:
================================================================================
gnutls30-3.5.18-1.el6 (FEDORA-EPEL-2018-b4c337857d)
A TLS protocol implementation
--------------------------------------------------------------------------------
Update Information:
Updated to 3.5.18
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav(a)redhat.com> 3.5.18-1
- Updated to 3.5.18
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1619524 - CVE-2018-10846 gnutls30: gnutls: "Just in Time" PRIME +
PROBE cache-based side channel attack can lead to plaintext recovery [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619524
[ 2 ] Bug #1619519 - CVE-2018-10845 gnutls30: gnutls: HMAC-SHA-384 vulnerable to Lucky
thirteen attack due to use of wrong constant [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619519
[ 3 ] Bug #1619512 - CVE-2018-10844 gnutls30: gnutls: HMAC-SHA-256 vulnerable to Lucky
thirteen attack due to not enough dummy function calls [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619512
[ 4 ] Bug #1459797 - CVE-2017-7507 gnutls30: gnutls: Crash upon receiving well-formed
status_request extension [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1459797
--------------------------------------------------------------------------------
================================================================================
libmad-0.15.1b-26.el6 (FEDORA-EPEL-2018-6bc3a525a2)
MPEG audio decoder library
--------------------------------------------------------------------------------
Update Information:
Add patches from Kurt Roeckx
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 24 2018 Nicolas Chauvet <kwizart(a)gmail.com> - 0.15.1b-26
- Add patches from debian
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
0.15.1b-25
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Feb 7 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
0.15.1b-24
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
0.15.1b-23
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
0.15.1b-22
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Fri Feb 10 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
0.15.1b-21
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1477498 - CVE-2017-11552 CVE-2018-7263 libmad: various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1477498
[ 2 ] Bug #1447358 - CVE-2017-8372 CVE-2017-8373 CVE-2017-8374 libmad: Multiple
vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1447358
--------------------------------------------------------------------------------
================================================================================
php-tcpdf-6.2.25-1.el6 (FEDORA-EPEL-2018-56bfbe3964)
PHP class for generating PDF documents and barcodes
--------------------------------------------------------------------------------
Update Information:
**Version 6.2.25** - Fix support for image URLs. ---- **Version 6.2.24** -
Support remote urls when checking if file exists. ---- **Version 6.2.23** -
Simplify file_exists function. ---- **Version 6.2.20** - Fix for security
vulnerability: Using the phar:// wrapper it was possible to trigger the
unserialization of user provided data. ---- **Version 6.2.19** - Merge
various fixes for PHP 7.3 compatibility and security.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 24 2018 Remi Collet <remi(a)remirepo.net> - 6.2.25-1
- update to 6.2.25
* Sat Sep 15 2018 Remi Collet <remi(a)remirepo.net> - 6.2.22-1
- update to 6.2.22
* Fri Sep 14 2018 Remi Collet <remi(a)remirepo.net> - 6.2.21-1
- update to 6.2.21
* Fri Sep 14 2018 Remi Collet <remi(a)remirepo.net> - 6.2.19-1
- update to 6.2.19
--------------------------------------------------------------------------------
================================================================================
remctl-3.15-1.el6 (FEDORA-EPEL-2018-8ce2266111)
Client/server for Kerberos-authenticated command execution
--------------------------------------------------------------------------------
Update Information:
Update to the latest upstream release (3.15). Please see the [upstream
changelog](https://www.eyrie.org/~eagle/software/remctl/news.html) for details
--------------------------------------------------------------------------------
ChangeLog:
* Fri Sep 21 2018 Ken Dreyer <ktdreyer(a)ktdreyer.com> - 3.15-1
- Update to 3.15
- Use HTTPS URLs
- Remove Group tag
- Enable parallel make with smpflags
- Switch to %autosetup
- cherry-pick "Fix passing CFLAGS to PHP configure" from upstream
- set REMCTL_PYTHON_VERSIONS=python2 (rhbz#1606109)
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.14-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Jun 29 2018 Jitka Plesnikova <jplesnik(a)redhat.com> - 3.14-2
- Perl 5.28 rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1606109 - remctl: FTBFS in F29: /bin/sh: line 2: python: command not found
https://bugzilla.redhat.com/show_bug.cgi?id=1606109
--------------------------------------------------------------------------------