The following Fedora 25 Security updates need testing:
Age URL
288
https://bodhi.fedoraproject.org/updates/FEDORA-2016-d79ba708cb exim-4.87.1-1.fc25
187
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e2d17af41e
python-XStatic-jquery-ui-1.12.0.1-4.fc25
126
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5d7498559f
nodejs-brace-expansion-1.1.7-1.fc25
80
https://bodhi.fedoraproject.org/updates/FEDORA-2017-99c0118c0c
memcached-1.4.39-1.fc25
76
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2232fe97b4
docker-distribution-2.6.2-1.git48294d9.fc25
27
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6e66393536
libwpd-0.10.2-1.fc25
19
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e3bf383b11
gnome-shell-3.22.3-2.fc25
19
https://bodhi.fedoraproject.org/updates/FEDORA-2017-01ab87482e
httpd-2.4.27-4.fc25
14
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f0f24bb2a9
chromium-61.0.3163.100-1.fc25
12
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2008fdd7e2
perl-5.24.3-389.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2aa4d11993
openvpn-2.4.4-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-89efe409a2
weechat-1.9.1-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ccb10391ad
mingw-poppler-0.45.0-4.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-7e5ac0896e
botan-1.10.17-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-515264ae24
dnsmasq-2.76-4.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-9d345f250a
nagios-4.3.4-3.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-99bcbc7bef xen-4.7.3-6.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-4dfebebd39 recode-3.6-43.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-6bbb922009
check-mk-1.2.8p26-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8f7bca960b
golang-1.7.6-3.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-caafcbd6b9 upx-3.94-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-042c59fab9
nodejs-forwarded-0.1.2-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-52f233a4f5
procmail-3.22-44.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-15987a1b7f
SDL2_image-2.0.1-8.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-805d9423f8
poppler-0.45.0-9.fc25
The following Fedora 25 Critical Path updates have yet to be approved:
Age URL
130
https://bodhi.fedoraproject.org/updates/FEDORA-2017-613a72e282 lorax-25.22-1.fc25
33
https://bodhi.fedoraproject.org/updates/FEDORA-2017-504aeb74ba
rpcbind-0.2.4-7.rc2.fc25
29
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a44008dd1d
python-pysocks-1.6.7-1.fc25
28
https://bodhi.fedoraproject.org/updates/FEDORA-2017-27ed767ca1
upower-0.99.6-1.fc25
27
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2802f82ef1
webkitgtk4-2.18.0-1.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2017-d2803ce4f5
linux-firmware-20170828-77.gitb78acc9.fc25
21
https://bodhi.fedoraproject.org/updates/FEDORA-2017-235298fa58
python-cryptography-2.0.2-2.fc25 python-cryptography-vectors-2.0.2-1.fc25
19
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e3bf383b11
gnome-shell-3.22.3-2.fc25
12
https://bodhi.fedoraproject.org/updates/FEDORA-2017-b78dd48284
dbus-1.11.18-1.fc25
12
https://bodhi.fedoraproject.org/updates/FEDORA-2017-2008fdd7e2
perl-5.24.3-389.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-655278f79b nspr-4.17.0-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-64612f6c45
vim-8.0.1171-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a45ef4d535
hwdata-0.305-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fc5429e7e
iproute-4.12.0-1.fc25
9
https://bodhi.fedoraproject.org/updates/FEDORA-2017-eb81135947
menu-cache-1.0.2-7.D20170914git8c8534159d.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-1391851bdb
vte291-0.46.3-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-8d6667b0ae
sudo-1.8.21p2-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-f36afbbe07
p11-kit-0.23.9-2.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ad5b0243eb
libguestfs-1.36.7-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0803060361 nss-3.33.0-1.0.fc25
nss-softokn-3.33.0-1.0.fc25 nss-util-3.33.0-1.0.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-5324f52b3d koji-1.14.0-1.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-99bcbc7bef xen-4.7.3-6.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-515264ae24
dnsmasq-2.76-4.fc25
5
https://bodhi.fedoraproject.org/updates/FEDORA-2017-00cfac3370
pungi-4.1.19-1.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-ae3e7ab916
glusterfs-3.10.6-3.fc25
3
https://bodhi.fedoraproject.org/updates/FEDORA-2017-0f7fefa567
firefox-56.0-5.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-805d9423f8
poppler-0.45.0-9.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-a2017ed263
python-productmd-1.8-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-e4f0577228 audit-2.8-1.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-41e6f8d803
breeze-icon-theme-5.38.0-2.fc25 extra-cmake-modules-5.38.0-2.fc25 kf5-5.38.0-1.fc25
kf5-attica-5.38.0-1.fc25 kf5-baloo-5.38.0-1.fc25 kf5-bluez-qt-5.38.0-1.fc25
kf5-frameworkintegration-5.38.0-1.fc25 kf5-kactivities-5.38.0-1.fc25
kf5-kactivities-stats-5.38.0-1.fc25 kf5-kapidox-5.38.0-1.fc25 kf5-karchive-5.38.0-1.fc25
kf5-kauth-5.38.0-1.fc25 kf5-kbookmarks-5.38.0-1.fc25 kf5-kcmutils-5.38.0-1.fc25
kf5-kcodecs-5.38.0-1.fc25 kf5-kcompletion-5.38.0-1.fc25 kf5-kconfig-5.38.0-5.fc25
kf5-kconfigwidgets-5.38.0-1.fc25 kf5-kcoreaddons-5.38.0-1.fc25 kf5-kcrash-5.38.0-1.fc25
kf5-kdbusaddons-5.38.0-1.fc25 kf5-kdeclarative-5.38.0-1.fc25 kf5-kded-5.38.0-1.fc25
kf5-kdelibs4support-5.38.0-1.fc25 kf5-kdesignerplugin-5.38.0-1.fc25
kf5-kdesu-5.38.0-1.fc25 kf5-kdewebkit-5.38.0-1.fc25 kf5-kdnssd-5.38.0-1.fc25
kf5-kdoctools-5.38.0-1.fc25 kf5-kemoticons-5.38.0-1.fc25 kf5-kfilemetadata-5.38.0-1.fc25
kf5-kglobalaccel-5.38.1-1.fc25 kf5-kguiad
dons-5.38.0-1.fc25 kf5-khtml-5.38.0-1.fc25 kf5-ki18n-5.38.0-1.fc25
kf5-kiconthemes-5.38.0-1.fc25 kf5-kidletime-5.38.0-1.fc25 kf5-kimageformats-5.38.0-1.fc25
kf5-kinit-5.38.0-1.fc25 kf5-kio-5.38.0-1.fc25 kf5-kitemmodels-5.38.0-1.fc25
kf5-kitemviews-5.38.0-1.fc25 kf5-kjobwidgets-5.38.0-1.fc25 kf5-kjs-5.38.0-1.fc25
kf5-kjsembed-5.38.0-1.fc25 kf5-kmediaplayer-5.38.0-1.fc25 kf5-knewstuff-5.38.0-1.fc25
kf5-knotifications-5.38.0-1.fc25 kf5-knotifyconfig-5.38.0-1.fc25
kf5-kpackage-5.38.0-1.fc25 kf5-kparts-5.38.0-1.fc25 kf5-kpeople-5.38.0-1.fc25
kf5-kplotting-5.38.0-1.fc25 kf5-kpty-5.38.0-1.fc25 kf5-kross-5.38.0-1.fc25
kf5-krunner-5.38.0-1.fc25 kf5-kservice-5.38.0-1.fc25 kf5-ktexteditor-5.38.0-2.fc25
kf5-ktextwidgets-5.38.0-1.fc25 kf5-kunitconversion-5.38.0-1.fc25 kf5-kwallet-5.38.0-1.fc25
kf5-kwayland-5.38.0-1.fc25 kf5-kwidgetsaddons-5.38.0-1.fc25
kf5-kwindowsystem-5.38.0-1.fc25 kf5-kxmlgui-5.38.0-1.fc25 kf5-kxmlrpcclient-5.38.0-1.fc25
kf5-modemmanager-qt-5.38.0-1.fc25 kf5-networkmanager-qt
-5.38.0-1.fc25 kf5-plasma-5.38.0-1.fc25 kf5-solid-5.38.0-1.fc25 kf5-sonnet-5.38.0-1.fc25
kf5-syntax-highlighting-5.38.0-1.fc25 kf5-threadweaver-5.38.0-1.fc25
oxygen-icon-theme-5.38.0-2.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-4d00e4db6a
selinux-policy-3.13.1-225.23.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-4d9b3c4003
ding-libs-0.6.1-34.fc25
0
https://bodhi.fedoraproject.org/updates/FEDORA-2017-48f0da57ca
python3-3.5.4-2.fc25
The following builds have been pushed to Fedora 25 updates-testing
SDL2_image-2.0.1-8.fc25
audit-2.8-1.fc25
distribution-gpg-keys-1.15-1.fc25
findbugs-contrib-7.0.5-1.fc25
gdouros-symbola-fonts-10.03-1.fc25
gsequencer-1.0.4-1.fc25
libstoragemgmt-1.5.0-2.fc25
manifest-tool-0.7.0-1.fc25
mate-themes-3.22.14-2.fc25
mock-core-configs-27.4-1.fc25
php-justinrainbow-json-schema5-5.2.5-1.fc25
php-phpmyadmin-sql-parser-4.2.3-1.fc25
poppler-0.45.0-9.fc25
procmail-3.22-44.fc25
python-productmd-1.8-1.fc25
python-streamlink-0.8.1-3.fc25
python3-bsddb3-6.2.5-3.fc25
pywbem-0.11.0-1.fc25
Details about builds:
================================================================================
SDL2_image-2.0.1-8.fc25 (FEDORA-2017-15987a1b7f)
Image loading library for SDL
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2017-2887
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1500455 - CVE-2017-2887 SDL_image: Multiple vulnerabilities [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1500455
--------------------------------------------------------------------------------
================================================================================
audit-2.8-1.fc25 (FEDORA-2017-e4f0577228)
User space tools for 2.6 kernel auditing
--------------------------------------------------------------------------------
Update Information:
Lots of updates for the auparse_normalizer to improve support on many events.
Remote logging now supports IPv6 and other remote logging improvements. Fix bugs
in auvirt that prevented locating AVC's for the VM. Add command line option to
auditd & audispd for config dir path. ---- This update fixes auditd for use in
mixed protocol environment to calculate the right one per event. This fixes a
remote logging bug. Audispd now strips out EOE events for syslog plugin. Fix a
python crash when passing a FILE * to auparse_init. In auparse-normalizer,
correct attr's collected for mount object.
--------------------------------------------------------------------------------
================================================================================
distribution-gpg-keys-1.15-1.fc25 (FEDORA-2017-85e1262c52)
GPG keys of various Linux distributions
--------------------------------------------------------------------------------
Update Information:
* use correct default on Mageia * require distribution-gpg-keys
--------------------------------------------------------------------------------
================================================================================
findbugs-contrib-7.0.5-1.fc25 (FEDORA-2017-5de63794ec)
Extra findbugs detectors
--------------------------------------------------------------------------------
Update Information:
Update to version 7.0.5. New detectors: * `LO_TOSTRING_PARAMETER` * Method
explicitly calls `toString()` on a logger parameter *
`OI_OPTIONAL_ISSUES_USES_ORELSEGET_WITH_NULL` * Method uses
`Optional.orElseGet(null)`
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1488265 - findbugs-contrib-7.0.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1488265
--------------------------------------------------------------------------------
================================================================================
gdouros-symbola-fonts-10.03-1.fc25 (FEDORA-2017-0d1a30de06)
A symbol font
--------------------------------------------------------------------------------
Update Information:
New upstream release, properly versioned and documented. ---- Fixes for the
following characters: ��� 1D3F MODIFIER LETTER CAPITAL R ���������
1DED COMBINING LATIN SMALL LETTER O WITH LIGHT CENTRALIZATION STROKE
��������� 1DF0 COMBINING LATIN SMALL LETTER U WITH LIGHT
CENTRALIZATION STROKE ��� 213A ROTATED CAPITAL Q ��� 2A52
LOGICAL OR WITH DOT ABOVE ��� 2AF2 PARALLEL WITH HORIZONTAL
STROKE ---- Minor edits to some glyphs. ---- Update to version 10.0
--------------------------------------------------------------------------------
================================================================================
gsequencer-1.0.4-1.fc25 (FEDORA-2017-0353f06843)
Audio processing engine
--------------------------------------------------------------------------------
Update Information:
updated gsequencer.0-makefile-am.patch to fix globbing issue
--------------------------------------------------------------------------------
================================================================================
libstoragemgmt-1.5.0-2.fc25 (FEDORA-2017-678e90ee15)
Storage array management library
--------------------------------------------------------------------------------
Update Information:
Fixed the multilib issue of NFS plugin. ---- Upgrade to 1.5.0: - New plugin
-- LibstorageMgmt NFS server plugin(`nfs://`). - New plugin -- LibstorageMgmt
Local Pseudo plugin(`local://`). - New plugin -- LibstorageMgmt Microsemi
storage plugin(`arcconf://`). - Removed support of lmiwbem due to missing self-
signed CA verification and inactive upstream of lmiwbem. - Support SES actions
on kernel `bsg` module(old code was using `sg` kernel module). - Add manpages
for every C API using kernel-doc. - Using docker of Fedora and Centos for Travis
CI test. - New URI parameter `ca_cert_file` for ONTAP, SMI-S, targetd plugin. -
Bug fixes: * Fix the ONTAP SSL connection. * Sim plugin: Fix sqlite3
transaction of fs_child_dependency_rm(). * MegaRAID: Handle when both
perccli and storcli are installed. * MegaRAID plugin: Support pool status
for rebuild and check. * Fixed C++ code compile warnings. - Library adds:
* Query health status of local disk:
lsm_local_disk_health_status_get()/lsm.LocalDisk.health_status_get()
--------------------------------------------------------------------------------
================================================================================
manifest-tool-0.7.0-1.fc25 (FEDORA-2017-4dd395487d)
A command line tool used for creating manifest list objects
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release
--------------------------------------------------------------------------------
================================================================================
mate-themes-3.22.14-2.fc25 (FEDORA-2017-819292dc85)
MATE Desktop themes
--------------------------------------------------------------------------------
Update Information:
- add some upstream patches
--------------------------------------------------------------------------------
================================================================================
mock-core-configs-27.4-1.fc25 (FEDORA-2017-85e1262c52)
Mock core config files basic chroots
--------------------------------------------------------------------------------
Update Information:
* use correct default on Mageia * require distribution-gpg-keys
--------------------------------------------------------------------------------
================================================================================
php-justinrainbow-json-schema5-5.2.5-1.fc25 (FEDORA-2017-8224c21013)
A library to validate a json schema
--------------------------------------------------------------------------------
Update Information:
**Version 5.2.5** * Backports for 5.2.5 * 452 (Don't add a file:// prefix
to URI that already have a scheme) ---- **Version 5.2.4** * Fresh tag to
rectify 5.2.3 mistag. ----- **Version 5.2.3** * 453 Backports for 5.2.3 *
452 (bugfix for id double-resolution introduced in 5.2.2) ---- **Version
5.2.2** * 431 Backports for 5.2.2 (Part 1) * 425 (bugfix for #424 - make
uri splitting reversable) * 429 (adjust hhvm platform for Travis, remove
phpdocumentor dependency) * 432 Added property name in draft-3 required error *
433 Backports for 5.2.2 (Part 2) * 432 (fix missing property in boolean
required error) * 450 Backports for 5.2.2 (Part 3) * 449 (Update config for
php-cs-fixer & travis) * 448 (add proper recursive handling for $ref - fixes
#447)
--------------------------------------------------------------------------------
================================================================================
php-phpmyadmin-sql-parser-4.2.3-1.fc25 (FEDORA-2017-67af644fdd)
A validating SQL lexer and parser with a focus on MySQL dialect
--------------------------------------------------------------------------------
Update Information:
**Version 4.2.3** - 2017-10-10 * Fixed build CREATE TABLE query with PARTITIONS
having ENGINE but not VALUES.
--------------------------------------------------------------------------------
================================================================================
poppler-0.45.0-9.fc25 (FEDORA-2017-805d9423f8)
PDF rendering library
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2017-14926, CVE-2017-14927 and CVE-2017-14928. ----
Security fix for CVE-2017-14617 ---- Security fix for CVE-2017-14517,
CVE-2017-14518, CVE-2017-14519 and CVE-2017-14929. ---- - CVE-2017-14520
Floating point exception in Splash::scaleImageYuXd
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1500322 - CVE-2017-14928 poppler: NULL pointer dereference in the
AnnotRichMedia::Configuration::Configuration
https://bugzilla.redhat.com/show_bug.cgi?id=1500322
[ 2 ] Bug #1500323 - CVE-2017-14926 poppler: NULL pointer dereference in the
AnnotRichMedia::Content::Content
https://bugzilla.redhat.com/show_bug.cgi?id=1500323
[ 3 ] Bug #1500324 - CVE-2017-14927 poppler: NULL pointer dereference in the
SplashOutputDev::type3D0() function
https://bugzilla.redhat.com/show_bug.cgi?id=1500324
[ 4 ] Bug #1499905 - CVE-2017-14617 poppler: Floating point exception in the ImageStream
class
https://bugzilla.redhat.com/show_bug.cgi?id=1499905
[ 5 ] Bug #1499162 - CVE-2017-14517 poppler: NULL pointer dereference in the
XRef::parseEntry() function
https://bugzilla.redhat.com/show_bug.cgi?id=1499162
[ 6 ] Bug #1499163 - CVE-2017-14518 poppler: Floating point exception in the
isImageInterpolationRequired() function
https://bugzilla.redhat.com/show_bug.cgi?id=1499163
[ 7 ] Bug #1499165 - CVE-2017-14519 poppler: Memory corruption via Gfx.cc infinite loop
https://bugzilla.redhat.com/show_bug.cgi?id=1499165
[ 8 ] Bug #1499167 - CVE-2017-14929 poppler: Memory corruption via Gfx.cc infinite loop
https://bugzilla.redhat.com/show_bug.cgi?id=1499167
--------------------------------------------------------------------------------
================================================================================
procmail-3.22-44.fc25 (FEDORA-2017-52f233a4f5)
Mail processing program
--------------------------------------------------------------------------------
Update Information:
This is security update fixing possible buffer overflow in loadbuf function.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1500070 - procmail: Heap-based buffer overflow in loadbuf function in
formisc.c
https://bugzilla.redhat.com/show_bug.cgi?id=1500070
--------------------------------------------------------------------------------
================================================================================
python-productmd-1.8-1.fc25 (FEDORA-2017-a2017ed263)
Library providing parsers for metadata related to OS installation
--------------------------------------------------------------------------------
Update Information:
Improved error reporting when encountering invalid metadata files.
--------------------------------------------------------------------------------
================================================================================
python-streamlink-0.8.1-3.fc25 (FEDORA-2017-baf2d84661)
Python library for extracting streams from various websites
--------------------------------------------------------------------------------
Update Information:
Fix missing dependency on python-websocket-client package
--------------------------------------------------------------------------------
================================================================================
python3-bsddb3-6.2.5-3.fc25 (FEDORA-2017-e89b0fa7a4)
Python 3 bindings for BerkleyDB
--------------------------------------------------------------------------------
Update Information:
Simplify the fix for shebangs and actually apply it to the right files. ----
Fix for ambiguous python shebangs (`#!/usr/bin/env python` and similar). ----
Update to the latest upstream version.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1489988 - python3-bsddb3-6.2.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1489988
--------------------------------------------------------------------------------
================================================================================
pywbem-0.11.0-1.fc25 (FEDORA-2017-089269f24b)
Python2 WBEM Client and Provider Interface
--------------------------------------------------------------------------------
Update Information:
Upgrade to 0.11.0.
--------------------------------------------------------------------------------