The following Fedora 28 Security updates need testing:
Age URL
183
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d510cfd7eb
jgraphx-3.6.0.0-6.fc28
132
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d7aeaa74da
nodejs-brace-expansion-1.1.11-1.fc28
131
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc073fdc1a
nodejs-atob-2.1.1-1.fc28
124
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9dd3f7c013
unrtf-0.21.9-8.fc28
92
https://bodhi.fedoraproject.org/updates/FEDORA-2018-28e9841baf
docker-latest-1.13.1-37.git9cb56fd.fc28
9
https://bodhi.fedoraproject.org/updates/FEDORA-2018-5d6e80ab82
dislocker-0.7.1-10.fc28 dolphin-emu-5.0-25.fc28 nekovm-2.2.0-8.fc28 mbedtls-2.13.0-1.fc28
8
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bbbd8cc3a6
python33-3.3.7-6.fc28
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cc4b7af297
xerces-c27-2.7.0-28.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a71b957c50
mingw-openjpeg2-2.3.0-4.fc28 openjpeg2-2.3.0-9.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-61df554bb1
strongswan-5.7.1-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f76e6d17f1
chromium-69.0.3497.100-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d29be920dc
apache-commons-compress-1.16.1-2.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-42eab0f5b9
libgit2-0.26.7-1.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-3ff1cb628b
python-paramiko-2.4.2-1.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6ffb18592f
mod_http2-1.11.1-1.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-41626fa774
audiofile-0.3.6-21.fc28
The following Fedora 28 Critical Path updates have yet to be approved:
Age URL
19
https://bodhi.fedoraproject.org/updates/FEDORA-2018-fab540a5d2
libguestfs-1.38.6-1.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-0fd7ffe087
python-productmd-1.17-1.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cf9cc0a8f3
nfs-utils-2.3.3-0.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a71b957c50
mingw-openjpeg2-2.3.0-4.fc28 openjpeg2-2.3.0-9.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-362131002d
flatpak-builder-1.0.1-1.fc28 flatpak-1.0.3-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ba7b93ed7a
volume_key-0.3.12-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-55e6403eab
gnome-software-3.28.2-3.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-87feccbd96
appstream-data-28-10.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-19f6ce3a0c
pungi-4.1.29-2.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-64df58b1e6
fontconfig-2.13.0-5.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e2b9bccef0
krb5-1.16.1-21.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f096467bbc
webkit2gtk3-2.22.2-1.fc28 epiphany-3.28.5-1.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-61a5915189
mutter-3.28.3-4.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-138c055924 samba-4.8.6-0.fc28
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-fed31f6fbb
iio-sensor-proxy-2.5-1.fc28
The following builds have been pushed to Fedora 28 updates-testing
arc-kde-20180614-1.fc28
golang-github-git-lfs-wildmatch-1.0.0-1.fc28
googler-3.7.1-1.fc28
heimdall-1.4.2-6.fc28
hesiod-3.2.1-14.fc28
ibus-libpinyin-1.10.91-1.fc28
kernel-4.18.13-200.fc28
kernel-headers-4.18.13-200.fc28
kernel-tools-4.18.13-200.fc28
libpinyin-2.2.1-1.fc28
libtiff-4.0.9-13.fc28
osinfo-db-20181011-1.fc28
patch-2.7.6-5.fc28
pgRouting-2.5.4-1.fc28
python-stem-1.7.0-1.fc28
sos-collector-1.5-1.fc28
xdg-desktop-portal-kde-5.13.5-2.fc28
Details about builds:
================================================================================
arc-kde-20180614-1.fc28 (FEDORA-2018-2a88c9b5d8)
Port of the popular GTK theme Arc for the Plasma 5 desktop
--------------------------------------------------------------------------------
Update Information:
Initial release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1635422 - Review Request: arc-kde - Port of the popular GTK theme Arc for the
Plasma 5 desktop
https://bugzilla.redhat.com/show_bug.cgi?id=1635422
--------------------------------------------------------------------------------
================================================================================
golang-github-git-lfs-wildmatch-1.0.0-1.fc28 (FEDORA-2018-e5b03f723b)
Pattern matching language for filepaths compatible with Git
--------------------------------------------------------------------------------
Update Information:
Update to first tagged version
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 10 2018 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> - 1.0.0-1
- Update to first tagged version
--------------------------------------------------------------------------------
================================================================================
googler-3.7.1-1.fc28 (FEDORA-2018-768bfde60c)
Access google search, google site search, google news from the terminal
--------------------------------------------------------------------------------
Update Information:
Release 3.7.1
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Robert-Andr�� Mauchin <zebob.m(a)gmail.com> - 3.7.1-1
- Release 3.7.1
--------------------------------------------------------------------------------
================================================================================
heimdall-1.4.2-6.fc28 (FEDORA-2018-32666e7d26)
Flash firmware on to Samsung Galaxy S devices
--------------------------------------------------------------------------------
Update Information:
Add patch to support files bigger than 3.5 GB
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Juan Orti Alcaine <jorti(a)fedoraproject.org> - 1.4.2-6
- Add patch to support files bigger than 3.5 GB
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.4.2-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1612126 - Heimdall not being able to flash images bigger than 3.5GB
https://bugzilla.redhat.com/show_bug.cgi?id=1612126
--------------------------------------------------------------------------------
================================================================================
hesiod-3.2.1-14.fc28 (FEDORA-2018-2b274689e8)
Shared libraries for querying the Hesiod naming service
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2016-10152 (hardcoded DNS fallback) Fix CVE-2016-10151 (weak
SUID check) Move package to autosetup Resolves: #1332509
Resolves: #1332494
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Robbie Harwood <rharwood(a)redhat.com> - 3.2.1-14
- Fix CVE-2016-10152 (hardcoded DNS fallback)
- Fix CVE-2016-10151 (weak SUID check)
- Move package to autosetup
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.2.1-13
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri May 18 2018 Adam Williamson <awilliam(a)redhat.com> - 3.2.1-12
- Rebuild for new libidn
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1332509 - hesiod: Weak SUID check allowing privilege elevation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1332509
[ 2 ] Bug #1332494 - hesiod: Use of hard-coded unsafe configuration if configuration
file cannot be opened [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1332494
--------------------------------------------------------------------------------
================================================================================
ibus-libpinyin-1.10.91-1.fc28 (FEDORA-2018-fc7fa3adb5)
Intelligent Pinyin engine based on libpinyin for IBus
--------------------------------------------------------------------------------
Update Information:
- support ime.register_trigger in lua extension - support predicted candidates -
support emoji input
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Peng Wu <pwu(a)redhat.com> - 1.10.91-1
- Update to 1.10.91
- support ime.register_trigger in lua extension
- support predicted candidates
- support emoji input
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.0-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jun 19 2018 Miro Hron��ok <mhroncok(a)redhat.com> - 1.10.0-2
- Rebuilt for Python 3.7
--------------------------------------------------------------------------------
================================================================================
kernel-4.18.13-200.fc28 (FEDORA-2018-9f4381d8c4)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.18.13 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 10 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.13-300
- Linux v4.18.13
* Mon Oct 8 2018 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Revert drm/amd/pp: Send khz clock values to DC for smu7/8 (rhbz 1636249)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1636249 - After upgrading to latest kernel, GPU AMD RX580 changing performace
level doesn't affect it's behaviour
https://bugzilla.redhat.com/show_bug.cgi?id=1636249
[ 2 ] Bug #1637547 - Kernel 4.18 X230 Docked Blank Screen on Boot
https://bugzilla.redhat.com/show_bug.cgi?id=1637547
--------------------------------------------------------------------------------
================================================================================
kernel-headers-4.18.13-200.fc28 (FEDORA-2018-9f4381d8c4)
Header files for the Linux kernel for use by glibc
--------------------------------------------------------------------------------
Update Information:
The 4.18.13 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 10 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.13-200
- Linux v4.18.13
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1636249 - After upgrading to latest kernel, GPU AMD RX580 changing performace
level doesn't affect it's behaviour
https://bugzilla.redhat.com/show_bug.cgi?id=1636249
[ 2 ] Bug #1637547 - Kernel 4.18 X230 Docked Blank Screen on Boot
https://bugzilla.redhat.com/show_bug.cgi?id=1637547
--------------------------------------------------------------------------------
================================================================================
kernel-tools-4.18.13-200.fc28 (FEDORA-2018-9f4381d8c4)
Assortment of tools for the Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 4.18.13 update contains a number of important fixes across the tree
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 10 2018 Laura Abbott <labbott(a)redhat.com> - 4.18.13-200
- Linux v4.18.13
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1636249 - After upgrading to latest kernel, GPU AMD RX580 changing performace
level doesn't affect it's behaviour
https://bugzilla.redhat.com/show_bug.cgi?id=1636249
[ 2 ] Bug #1637547 - Kernel 4.18 X230 Docked Blank Screen on Boot
https://bugzilla.redhat.com/show_bug.cgi?id=1637547
--------------------------------------------------------------------------------
================================================================================
libpinyin-2.2.1-1.fc28 (FEDORA-2018-fc7fa3adb5)
Library to deal with pinyin
--------------------------------------------------------------------------------
Update Information:
- support ime.register_trigger in lua extension - support predicted candidates -
support emoji input
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 9 2018 Peng Wu <pwu(a)redhat.com> - 2.2.1-1
- Update to 2.2.1
- fixes predicted candidates
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.2.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
libtiff-4.0.9-13.fc28 (FEDORA-2018-48f74c8eb2)
Library of functions for manipulating TIFF format image files
--------------------------------------------------------------------------------
Update Information:
Fix for **CVE-2018-17100** and **CVE-2018-17101**. ---- Fix for
**CVE-2018-10779**.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Nikola Forr�� <nforro(a)redhat.com> - 4.0.9-13
- Fix CVE-2018-17100 (#1631070) and CVE-2018-17101 (#1631079)
* Thu Oct 11 2018 Nikola Forr�� <nforro(a)redhat.com> - 4.0.9-12
- Fix CVE-2018-10779 (#1577316)
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.0.9-11
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631070 - CVE-2018-17100 libtiff: Integer overflow in multiply_ms in
tools/ppm2tiff.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1631070
[ 2 ] Bug #1631079 - CVE-2018-17101 libtiff: Two out-of-bounds writes in cpTags in
tools/tiff2bw.c and tools/pal2rgb.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1631079
[ 3 ] Bug #1577316 - CVE-2018-10779 CVE-2018-10801 libtiff: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1577316
--------------------------------------------------------------------------------
================================================================================
osinfo-db-20181011-1.fc28 (FEDORA-2018-9ecbce8f98)
osinfo database files
--------------------------------------------------------------------------------
Update Information:
Update to new release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Fabiano Fid��ncio <fabiano(a)fidencio.org> - 20181011-1
- Update to new release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1627714 - libosinfo doesnt show Fedora 29
https://bugzilla.redhat.com/show_bug.cgi?id=1627714
--------------------------------------------------------------------------------
================================================================================
patch-2.7.6-5.fc28 (FEDORA-2018-c255f16bfe)
Utility for modifying/upgrading files
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2018-6951 and CVE-2018-6952
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Than Ngo <than(a)redhat.com> - 2.7.6-5
- Fixed CVE-2018-6952 - Double free of memory
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1545053 - CVE-2018-6952 patch: Double free of memory in pch.c:another_hunk()
causes a crash
https://bugzilla.redhat.com/show_bug.cgi?id=1545053
--------------------------------------------------------------------------------
================================================================================
pgRouting-2.5.4-1.fc28 (FEDORA-2018-4ac7d9101c)
Provides routing functionality to PostGIS/PostgreSQL
--------------------------------------------------------------------------------
Update Information:
https://github.com/pgRouting/pgrouting/releases/tag/v2.5.4
--------------------------------------------------------------------------------
ChangeLog:
* Mon Sep 24 2018 Volker Froehlich <volker27(a)gmx.at> - 2.5.4-1
- New upstream release
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.5.2-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
python-stem-1.7.0-1.fc28 (FEDORA-2018-39953134d9)
Python controller library for Tor
--------------------------------------------------------------------------------
Update Information:
Version 1.7.0
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 10 2018 Juan Orti Alcaine <jorti(a)fedoraproject.org> - 1.7.0-1
- Version 1.7.0
- Drop patch merged upstream
* Tue Jul 17 2018 mh <mh+fedora(a)scrit.ch> - 1.6.0-5
- Make it build on python 3.7
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.6.0-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jun 19 2018 Miro Hron��ok <mhroncok(a)redhat.com> - 1.6.0-3
- Rebuilt for Python 3.7
--------------------------------------------------------------------------------
================================================================================
sos-collector-1.5-1.fc28 (FEDORA-2018-1f3a47bfbb)
Capture sosreports from multiple nodes simultaneously
--------------------------------------------------------------------------------
Update Information:
Update to new 1.5 release. Resolves CVE-2018-14650
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Jake Hunsaker <jhunsake(a)redhat.com> - 1.5-1
- New upstream release
- Resolves CVE-2018-14650
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.4-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1633659 - CVE-2018-14650 sos-collector: incorrect permissions set on newly
created files [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1633659
--------------------------------------------------------------------------------
================================================================================
xdg-desktop-portal-kde-5.13.5-2.fc28 (FEDORA-2018-ca7c30512f)
Backend implementation for xdg-desktop-portal using Qt/KF5
--------------------------------------------------------------------------------
Update Information:
Make failed initialization of drm and egl non-fatal.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 11 2018 Jan Grulich <jgrulich(a)redhat.com> - 5.13.5-2
- Make initialization of drm and egl non-fatal
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1627935 - xdg-desktop-portal-kde dumped core several times when using
simple-scan
https://bugzilla.redhat.com/show_bug.cgi?id=1627935
--------------------------------------------------------------------------------