Fedora EPEL 6 updates-testing report

The following Fedora EPEL 6 Security updates need testing:
 Age  URL
  11  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-658581cb5f   php-horde-Horde-Form-2.0.20-1.el6
   8  https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-81c37f8ff5   tomcat-7.0.100-2.el6

The following builds have been pushed to Fedora EPEL 6 updates-testing

ckeditor-4.14.0-1.el6
    php-theseer-autoload-1.25.9-1.el6

Details about builds:

================================================================================
 ckeditor-4.14.0-1.el6 (FEDORA-EPEL-2020-9190462510)
 WYSIWYG text editor to be used inside web pages
--------------------------------------------------------------------------------
Update Information:

## CKEditor 4.14  **Security Updates:**  *
[CVE-2020-9281](https://nvd.nist.gov/vuln/detail/CVE-2020-9281) Fixed XSS
vulnerability in the HTML data processor reported by [Micha��
Bentkowski](https://twitter.com/securitymb) of Securitum.          Issue
summary: It was possible to execute XSS inside CKEditor after persuading the
victim to: (i) switch CKEditor to source mode, then (ii) paste a specially
crafted HTML code, prepared by the attacker, into the opened CKEditor source
area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted
HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG
mode.  * [CVE-2020-9440](https://nvd.nist.gov/vuln/detail/CVE-2020-9440) Fixed
XSS vulnerability in the WebSpellChecker Dialog plugin reported by [Pham Van
Khanh](https://twitter.com/rskvp93) from Viettel Cyber Security.          Issue
summary: It was possible to execute XSS using CKEditor after persuading the
victim to: (i) switch CKEditor to source mode, then (ii) paste a specially
crafted HTML code, prepared by the attacker, into the opened CKEditor source
area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content
outside CKEditor editable area.  **An upgrade is highly recommended!**  New
features:  * [#2374](https://github.com/ckeditor/ckeditor4/issues/2374): Added
support for pasting rich content from LibreOffice Writer with the [Paste from
LibreOffice](https://ckeditor.com/cke4/addon/pastefromlibreoffice) plugin. *
[#2583](https://github.com/ckeditor/ckeditor4/issues/2583): Changed
[emoji](https://ckeditor.com/cke4/addon/emoji) suggestion box to show the
matched emoji name instead of an ID. *
[#3748](https://github.com/ckeditor/ckeditor4/issues/3748): Improved the [color
button](https://ckeditor.com/cke4/addon/colorbutton) state to reflect the
selected editor content colors. *
[#3661](https://github.com/ckeditor/ckeditor4/issues/3661): Improved the
[Print](https://ckeditor.com/cke4/addon/print) plugin to respect styling
rendered by the [Preview](https://ckeditor.com/cke4/addon/preview) plugin. *
[#3547](https://github.com/ckeditor/ckeditor4/issues/3547): Active
[dialog](https://ckeditor.com/cke4/addon/dialog) tab now has the `aria-
selected="true"` attribute. *
[#3441](https://github.com/ckeditor/ckeditor4/issues/3441): Improved [`widget.ge
tClipboardHtml()`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_plugi
ns_widget.html#method-getClipboardHtml) support for dragging and dropping
multiple [widgets](https://ckeditor.com/cke4/addon/widget).  Fixed Issues:  *
[#3587](https://github.com/ckeditor/ckeditor4/issues/3587): [Edge, IE] Fixed:
[Widget](https://ckeditor.com/cke4/addon/widget) with form input elements loses
focus during typing. *
[#3705](https://github.com/ckeditor/ckeditor4/issues/3705): [Safari] Fixed:
Safari incorrectly removes blocks with the [`editor.extractSelectedHtml()`](http
s://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_editor.html#method-
extractSelectedHtml) method after selecting all content. *
[#1306](https://github.com/ckeditor/ckeditor4/issues/1306): Fixed: The
[Font](https://ckeditor.com/cke4/addon/font) plugin creates nested HTML `<span>`
tags when reapplying the same font multiple times. *
[#3498](https://github.com/ckeditor/ckeditor4/issues/3498): Fixed: The editor
throws an error during the copy operation when a
[widget](https://ckeditor.com/cke4/addon/widget) is partially selected. *
[#2517](https://github.com/ckeditor/ckeditor4/issues/2517): [Chrome, Firefox,
Safari] Fixed: Inserting a new image when the selection partially covers an
existing [enhanced image](https://ckeditor.com/cke4/addon/image2) widget throws
an error. * [#3007](https://github.com/ckeditor/ckeditor4/issues/3007): [Chrome,
Firefox, Safari] Fixed: Cannot modify the editor content once the selection is
released over a [widget](https://ckeditor.com/cke4/addon/widget). *
[#3698](https://github.com/ckeditor/ckeditor4/issues/3698): Fixed: Cutting the
selected text when a [widget](https://ckeditor.com/cke4/addon/widget) is
partially selected merges paragraphs.  API Changes:  *
[#3387](https://github.com/ckeditor/ckeditor4/issues/3387): Added the [CKEDITOR.
ui.richCombo.select()](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_u
i_richCombo.html#method-select) method. *
[#3727](https://github.com/ckeditor/ckeditor4/issues/3727): Added new
`textColor` and `bgColor` commands that apply the selected color chosen by the
[Color Button](https://ckeditor.com/cke4/addon/colorbutton) plugin. *
[#3728](https://github.com/ckeditor/ckeditor4/issues/3728): Added new `font` and
`fontSize` commands that apply the selected font style chosen by the
[Font](https://ckeditor.com/cke4/addon/colorbutton) plugin. *
[#3842](https://github.com/ckeditor/ckeditor4/issues/3842): Added the [`editor.g
etSelectedRanges()`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_edi
tor.html#method-getSelectedRanges) alias. *
[#3775](https://github.com/ckeditor/ckeditor4/issues/3775): Widget [mask](https:
//ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_plugins_widget.html#property-
mask) and [parts](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_plugin
s_widget.html#property-parts) can now be refreshed dynamically via API calls.
--------------------------------------------------------------------------------
ChangeLog:

* Fri Mar 20 2020 Shawn Iwinski  - 4.14.0-1
- Update to 4.14.0 (RHBZ #1810020)
- CVE-2020-9281 (RHBZ #1814825,1814826,1814827)
- CVE-2020-9440
* Tue Jan 28 2020 Fedora Release Engineering  - 4.13.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #1814826 - CVE-2020-9281 ckeditor: XSS in the HTML Data Processor allows remote attackers to inject arbitrary web script through a crafted "protected" comment [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1814826
  [ 2 ] Bug #1814827 - CVE-2020-9281 ckeditor: XSS in the HTML Data Processor allows remote attackers to inject arbitrary web script through a crafted "protected" comment [epel-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1814827
  [ 3 ] Bug #1810020 - ckeditor-4.14.0 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=1810020
--------------------------------------------------------------------------------

================================================================================
 php-theseer-autoload-1.25.9-1.el6 (FEDORA-EPEL-2020-fc3f668790)
 A tool and library to generate autoload code
--------------------------------------------------------------------------------
Update Information:

**Release 1.25.9**  * Merge PR
[#89](https://github.com/theseer/Autoload/pull/89): Throw an exception if the
template file cannot be read * Update ConsoleTools, Fixes
[#91](https://github.com/theseer/Autoload/issues/91) - Zeta Components
ConsoleTools uses PHP syntax deprecated in PHP 7.4
--------------------------------------------------------------------------------
ChangeLog:

* Fri Mar 20 2020 Remi Collet  - 1.25.9-1
- update to 1.25.9
--------------------------------------------------------------------------------