The following Fedora EPEL 7 Security updates need testing: Age URL 457 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d condor-8.6.11-1.el7 199 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80 python-gnupg-0.4.4-1.el7 197 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b bubblewrap-0.3.3-2.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-50f0062140 golang-1.13.3-1.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-1946200e23 putty-0.73-1.el7 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-2d77bb9597 python3-requests-2.14.2-1.el7 python3-urllib3-1.25.1-1.el7 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-72f653ef17 php-robrichards-xmlseclibs3-3.0.4-1.el7 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-927a9446df php-robrichards-xmlseclibs-2.1.1-1.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-ba474a8841 freetds-1.1.20-1.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-25eb663796 libmp4v2-2.1.0-0.19.trunkREV507.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-540c6a4e1d djvulibre-3.5.25.3-18.el7 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-136fa99185 limnoria-20191109-2.el7 1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-5fecd4c331 libmodbus-3.0.8-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
ansible-2.9.1-1.el7 chromium-78.0.3904.97-1.el7 fetch-crl-3.0.19-2.el7 gv-3.7.4-8.el7 python-humanize-0.5.1-8.el7 rpkg-1.59-3.el7 sentencepiece-0.1.84-1.el7 thunderbird-enigmail-2.1.3-1.el7 trader-7.13-1.el7
Details about builds:
================================================================================ ansible-2.9.1-1.el7 (FEDORA-EPEL-2019-b34b3f67f6) SSH-based configuration management, deployment, and task execution system -------------------------------------------------------------------------------- Update Information:
Update to 2.9.1, bugfix release. -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 13 2019 Kevin Fenzi kevin@scrye.com - 2.9.1-1 - Update to 2.9.1. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1772285 - ansible-2.9.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1772285 --------------------------------------------------------------------------------
================================================================================ chromium-78.0.3904.97-1.el7 (FEDORA-EPEL-2019-d8f3c6a443) A WebKit (Blink) powered web browser -------------------------------------------------------------------------------- Update Information:
Update to latest stable (78.0.3904.97). This build contains a number of bug fixes and security updates. Changes can be viewed here: https://chromium.googles ource.com/chromium/src/+log/78.0.3904.86..78.0.3904.92?n=10000 ---- Update to chromium 78.0.3904.87, fixes CVE-2019-13720 & CVE-2019-13721. Also fixes zip compression support in EL8 builds. ---- Chromium 78. Fixes these: CVE-2019-5870 CVE-2019-5871 CVE-2019-5872 CVE-2019-5874 CVE-2019-5875 CVE-2019-13691 CVE-2019-13692 CVE-2019-5876 CVE-2019-5877 CVE-2019-5878 CVE-2019-5879 CVE-2019-5880 CVE-2019-5881 CVE-2019-13659 CVE-2019-13660 CVE-2019-13661 CVE-2019-13662 CVE-2019-13663 CVE-2019-13664 CVE-2019-13665 CVE-2019-13666 CVE-2019-13667 CVE-2019-13668 CVE-2019-13669 CVE-2019-13670 CVE-2019-13671 CVE-2019-13673 CVE-2019-13674 CVE-2019-13675 CVE-2019-13676 CVE-2019-13677 CVE-2019-13678 CVE-2019-13679 CVE-2019-13680 CVE-2019-13681 CVE-2019-13682 CVE-2019-13683 -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 7 2019 Tom Callaway spot@fedoraproject.org - 78.0.3904.97-1 - update to 78.0.3904.97 * Fri Nov 1 2019 Tom Callaway spot@fedoraproject.org - 78.0.3904.87-1 - update to 78.0.3904.87 - apply most of the freeworld changes in PR 23/24/25 * Wed Oct 23 2019 Tom Callaway spot@fedoraproject.org - 78.0.3904.80-1 - update to 78.0.3904.80 * Wed Oct 16 2019 Tom Callaway spot@fedoraproject.org - 77.0.3865.120-4 - upstream fix for zlib symbol exports with gcc * Wed Oct 16 2019 Tom Callaway spot@fedoraproject.org - 77.0.3865.120-3 - silence outdated build noise (bz1745745) * Tue Oct 15 2019 Tom Callaway spot@fedoraproject.org - 77.0.3865.120-2 - fix node handling for EPEL-8 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1768578 - CVE-2019-13721 chromium-browser: use-after-free in PDFium https://bugzilla.redhat.com/show_bug.cgi?id=1768578 [ 2 ] Bug #1768586 - CVE-2019-13720 chromium-browser: use-after-free in audio https://bugzilla.redhat.com/show_bug.cgi?id=1768586 [ 3 ] Bug #1762402 - CVE-2019-13682 chromium-browser: Site isolation bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762402 [ 4 ] Bug #1762401 - CVE-2019-13681 chromium-browser: Bypass on download restrictions https://bugzilla.redhat.com/show_bug.cgi?id=1762401 [ 5 ] Bug #1762400 - CVE-2019-13680 chromium-browser: IP address spoofing to servers https://bugzilla.redhat.com/show_bug.cgi?id=1762400 [ 6 ] Bug #1762399 - CVE-2019-13679 chromium-browser: User gesture needed for printing https://bugzilla.redhat.com/show_bug.cgi?id=1762399 [ 7 ] Bug #1762398 - CVE-2019-13678 chromium-browser: Download dialog spoofing https://bugzilla.redhat.com/show_bug.cgi?id=1762398 [ 8 ] Bug #1762397 - CVE-2019-13677 chromium-browser: Chrome web store origin needs to be isolated https://bugzilla.redhat.com/show_bug.cgi?id=1762397 [ 9 ] Bug #1762396 - CVE-2019-13676 chromium-browser: Google URI shown for certificate warning https://bugzilla.redhat.com/show_bug.cgi?id=1762396 [ 10 ] Bug #1762395 - CVE-2019-13675 chromium-browser: Extensions can be disabled by trailing slash https://bugzilla.redhat.com/show_bug.cgi?id=1762395 [ 11 ] Bug #1762394 - CVE-2019-13674 chromium-browser: IDN spoofing https://bugzilla.redhat.com/show_bug.cgi?id=1762394 [ 12 ] Bug #1762393 - CVE-2019-13673 chromium-browser: Cross-origin information leak using devtools https://bugzilla.redhat.com/show_bug.cgi?id=1762393 [ 13 ] Bug #1762392 - CVE-2019-13671 chromium-browser: Dialog box fails to show origin https://bugzilla.redhat.com/show_bug.cgi?id=1762392 [ 14 ] Bug #1762391 - CVE-2019-13670 chromium-browser: V8 memory corruption in regex https://bugzilla.redhat.com/show_bug.cgi?id=1762391 [ 15 ] Bug #1762390 - CVE-2019-13669 chromium-browser: HTTP authentication spoof https://bugzilla.redhat.com/show_bug.cgi?id=1762390 [ 16 ] Bug #1762389 - CVE-2019-13668 chromium-browser: Global window leak via console https://bugzilla.redhat.com/show_bug.cgi?id=1762389 [ 17 ] Bug #1762388 - CVE-2019-13667 chromium-browser: URI bar spoof when using external app URIs https://bugzilla.redhat.com/show_bug.cgi?id=1762388 [ 18 ] Bug #1762387 - CVE-2019-13666 chromium-browser: Side channel using storage size estimate https://bugzilla.redhat.com/show_bug.cgi?id=1762387 [ 19 ] Bug #1762386 - CVE-2019-13665 chromium-browser: Multiple file download protection bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762386 [ 20 ] Bug #1762385 - CVE-2019-13664 chromium-browser: CSRF bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762385 [ 21 ] Bug #1762384 - CVE-2019-13663 chromium-browser: IDN spoof https://bugzilla.redhat.com/show_bug.cgi?id=1762384 [ 22 ] Bug #1762383 - CVE-2019-13662 chromium-browser: CSP bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762383 [ 23 ] Bug #1762382 - CVE-2019-13661 chromium-browser: Full screen notification spoof https://bugzilla.redhat.com/show_bug.cgi?id=1762382 [ 24 ] Bug #1762381 - CVE-2019-13660 chromium-browser: Full screen notification overlap https://bugzilla.redhat.com/show_bug.cgi?id=1762381 [ 25 ] Bug #1762380 - CVE-2019-13659 chromium-browser: URL spoof https://bugzilla.redhat.com/show_bug.cgi?id=1762380 [ 26 ] Bug #1762379 - CVE-2019-5881 chromium-browser: Arbitrary read in SwiftShader https://bugzilla.redhat.com/show_bug.cgi?id=1762379 [ 27 ] Bug #1762378 - CVE-2019-5880 chromium-browser: SameSite cookie bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762378 [ 28 ] Bug #1762377 - CVE-2019-5879 chromium-browser: Extensions can read some local files https://bugzilla.redhat.com/show_bug.cgi?id=1762377 [ 29 ] Bug #1762376 - CVE-2019-5878 chromium-browser: Use-after-free in V8 https://bugzilla.redhat.com/show_bug.cgi?id=1762376 [ 30 ] Bug #1762375 - CVE-2019-5877 chromium-browser: Out-of-bounds access in V8 https://bugzilla.redhat.com/show_bug.cgi?id=1762375 [ 31 ] Bug #1762374 - CVE-2019-5876 chromium-browser: Use-after-free in media https://bugzilla.redhat.com/show_bug.cgi?id=1762374 [ 32 ] Bug #1762373 - CVE-2019-13692 chromium-browser: SOP bypass https://bugzilla.redhat.com/show_bug.cgi?id=1762373 [ 33 ] Bug #1762372 - CVE-2019-13691 chromium-browser: Omnibox spoof https://bugzilla.redhat.com/show_bug.cgi?id=1762372 [ 34 ] Bug #1762371 - CVE-2019-5875 chromium-browser: URL bar spoof via download redirect https://bugzilla.redhat.com/show_bug.cgi?id=1762371 [ 35 ] Bug #1762370 - CVE-2019-5874 chromium-browser: External URIs may trigger other browsers https://bugzilla.redhat.com/show_bug.cgi?id=1762370 [ 36 ] Bug #1762368 - CVE-2019-5872 chromium-browser: Use-after-free in Mojo https://bugzilla.redhat.com/show_bug.cgi?id=1762368 [ 37 ] Bug #1762367 - CVE-2019-5871 chromium-browser: Heap overflow in Skia https://bugzilla.redhat.com/show_bug.cgi?id=1762367 [ 38 ] Bug #1762366 - CVE-2019-5870 chromium-browser: Use-after-free in media https://bugzilla.redhat.com/show_bug.cgi?id=1762366 --------------------------------------------------------------------------------
================================================================================ fetch-crl-3.0.19-2.el7 (FEDORA-EPEL-2019-91801d0de3) Downloads Certificate Revocation Lists -------------------------------------------------------------------------------- Update Information:
fetch-crl-boot service is now marked as RemainAfterExit=yes -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Steve Traylen steve.traylen@cern.ch - 3.0.19-2 - Mark boot service as remain after exit true (#1630027) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1630027 - fetch-crl-boot service config should include RemainAfterExit=yes https://bugzilla.redhat.com/show_bug.cgi?id=1630027 --------------------------------------------------------------------------------
================================================================================ gv-3.7.4-8.el7 (FEDORA-EPEL-2019-c3f4072b37) A X front-end for the Ghostscript PostScript(TM) interpreter -------------------------------------------------------------------------------- Update Information:
Add patch to fix PDF printing -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Orion Poplawski orion@nwra.com - 3.7.4-8 - Add patch to fix PDF printing (bz#1536211) - Modernize spec * Mon Mar 3 2014 Orion Poplawski orion@cora.nwra.com - 3.7.4-7 - Update to upstream's fix for zoom segfault (bug #1071238) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1536211 - gv attempts to print with a non-existent DEVICE=pswrite https://bugzilla.redhat.com/show_bug.cgi?id=1536211 --------------------------------------------------------------------------------
================================================================================ python-humanize-0.5.1-8.el7 (FEDORA-EPEL-2019-7e1bdbab9b) Turns dates in to human readable format, e.g '3 minutes ago' -------------------------------------------------------------------------------- Update Information:
Addition of a python36-humanize package. -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Steve Traylen steve.traylen@cern.ch - 0.5.1-8 - Add python3 packages to epel7 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1733017 - Support for python3 https://bugzilla.redhat.com/show_bug.cgi?id=1733017 --------------------------------------------------------------------------------
================================================================================ rpkg-1.59-3.el7 (FEDORA-EPEL-2019-c5cc5582d0) Python library for interacting with rpm+git -------------------------------------------------------------------------------- Update Information:
Backport: Isolated container-build should allow arches override -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Ond��ej Nosek onosek@redhat.com - 1.59-3 - Backport: Isolated container-build should allow arches override --------------------------------------------------------------------------------
================================================================================ sentencepiece-0.1.84-1.el7 (FEDORA-EPEL-2019-0418e59c4b) An unsupervised text tokenizer for Neural Network-based text generation -------------------------------------------------------------------------------- Update Information:
New upstream release -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Kentaro Hayashi hayashi@clear-code.com - 0.1.84-1 - New upstream release --------------------------------------------------------------------------------
================================================================================ thunderbird-enigmail-2.1.3-1.el7 (FEDORA-EPEL-2019-58be818bb4) Authentication and encryption extension for Mozilla Thunderbird -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2019-14664 and CVE-2019-12269. -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 Felix Schwarz fschwarz@fedoraproject.org - 2.1.3-1 - update to 2.1.3 as Red Hat updated Thunderbird to v68 * Mon Nov 11 2019 Felix Schwarz fschwarz@fedoraproject.org - 2.0.12-1 - update to 2.0.12 (fixes CVE-2019-12269, CVE-2019-14664) - enable GPG-based source file verification - package license file -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1660479 - thunderbird-enigmail: HTTP authentication dialog may be triggered [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1660479 [ 2 ] Bug #1749213 - CVE-2019-14664 thunderbird-enigmail: information leak in response to encrypted mail [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1749213 [ 3 ] Bug #1712724 - CVE-2019-12269 thunderbird-enigmail: signature spoofing in inline PGP message [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1712724 --------------------------------------------------------------------------------
================================================================================ trader-7.13-1.el7 (FEDORA-EPEL-2019-f9d611a3c4) Star Traders, a simple game of interstellar trading -------------------------------------------------------------------------------- Update Information:
Update to Star Traders v7.13, mainly an update to translated strings, no breakage for existing users. -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 14 2019 John Zaitseff J.Zaitseff@zap.org.au - 7.13-1 - Updated the RPM package for a new release of Star Traders: version 7.13. - This version of the SPEC file is for CentOS 7. * Wed Aug 30 2017 John Zaitseff J.Zaitseff@zap.org.au - 7.12-1 - Updated the RPM package for a new release of Star Traders: version 7.12. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1484864 - trader-7.13 is available https://bugzilla.redhat.com/show_bug.cgi?id=1484864 --------------------------------------------------------------------------------
epel-devel@lists.fedoraproject.org
-
updates＠fedoraproject.org