[SECURITY] Fedora 28 Update: cfitsio-3.430-2.fc28
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2019-3c1aed2aa9
2019-03-27 03:26:43.386641
--------------------------------------------------------------------------------
Name : cfitsio
Product : Fedora 28
Version : 3.430
Release : 2.fc28
URL : http://heasarc.gsfc.nasa.gov/fitsio/
Summary : Library for manipulating FITS data files
Description :
CFITSIO is a library of C and FORTRAN subroutines for reading and writing
data files in FITS (Flexible Image Transport System) data format. CFITSIO
simplifies the task of writing software that deals with FITS files by
providing an easy to use set of high-level routines that insulate the
programmer from the internal complexities of the FITS file format. At the
same time, CFITSIO provides many advanced features that have made it the
most widely used FITS file programming interface in the astronomical
community.
--------------------------------------------------------------------------------
Update Information:
This update backports security fixes from cfitsio 3.440
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 4 2019 Sergio Pascual <sergiopr(a)fedoraproject.org> - 3.430-2
- Backport security fixes from 3.440 (rhbz #1570484)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1570484 - Rebase cfitsio package to 3.44 upstream to resolve security
issues.
https://bugzilla.redhat.com/show_bug.cgi?id=1570484
[ 2 ] Bug #1568189 - CVE-2018-3849 cfitsio: Stack-based buffer overflow in ffghtb()
allows for potential code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1568189
[ 3 ] Bug #1568184 - CVE-2018-3848 cfitsio: Stack-based buffer overflow in ffghbn()
allows for potential code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1568184
[ 4 ] Bug #1563915 - CVE-2018-3846 cfitsio: Unsafe use of sprintf() can allow a remote
unauthenticated attacker to execute arbitrary code [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1563915
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-3c1aed2aa9' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------