Fedora 13 updates-testing report
updates at fedoraproject.org
updates at fedoraproject.org
Thu May 26 21:58:06 UTC 2011
The following Fedora 13 Security updates need testing:
https://admin.fedoraproject.org/updates/php-ZendFramework-1.11.6-1.fc13
https://admin.fedoraproject.org/updates/gimp-2.6.11-14.fc13
https://admin.fedoraproject.org/updates/tor-0.2.1.29-1300.fc13
https://admin.fedoraproject.org/updates/rssh-2.3.3-1.fc13
https://admin.fedoraproject.org/updates/viewvc-1.1.11-1.fc13
https://admin.fedoraproject.org/updates/libmodplug-0.8.7-3.fc13
https://admin.fedoraproject.org/updates/openldap-2.4.21-12.fc13
https://admin.fedoraproject.org/updates/polkit-0.96-2.fc13
https://admin.fedoraproject.org/updates/xorg-x11-server-utils-7.4-17.fc13
https://admin.fedoraproject.org/updates/kernel-2.6.34.9-69.fc13
https://admin.fedoraproject.org/updates/drupal-6.22-1.fc13
https://admin.fedoraproject.org/updates/cyrus-imapd-2.3.16-5.fc13
https://admin.fedoraproject.org/updates/xen-3.4.3-3.fc13
https://admin.fedoraproject.org/updates/libtiff-3.9.5-1.fc13
https://admin.fedoraproject.org/updates/apr-1.4.5-1.fc13
The following Fedora 13 Critical Path updates have yet to be approved:
https://admin.fedoraproject.org/updates/kernel-2.6.34.9-69.fc13
https://admin.fedoraproject.org/updates/polkit-0.96-2.fc13
https://admin.fedoraproject.org/updates/python-ethtool-0.7-2.fc13
https://admin.fedoraproject.org/updates/libtiff-3.9.5-1.fc13
https://admin.fedoraproject.org/updates/pygtk2-2.17.0-9.fc13
https://admin.fedoraproject.org/updates/dosfstools-3.0.9-5.fc13
https://admin.fedoraproject.org/updates/libimobiledevice-1.0.6-1.fc13
https://admin.fedoraproject.org/updates/usbmuxd-1.0.7-1.fc13
https://admin.fedoraproject.org/updates/fuse-2.8.5-5.fc13
https://admin.fedoraproject.org/updates/openldap-2.4.21-12.fc13
https://admin.fedoraproject.org/updates/livecd-tools-13.2-1.fc13
https://admin.fedoraproject.org/updates/lua-5.1.4-7.fc13
https://admin.fedoraproject.org/updates/xorg-x11-drv-openchrome-0.2.904-7.fc13
https://admin.fedoraproject.org/updates/lldpad-0.9.26-2.fc13
The following builds have been pushed to Fedora 13 updates-testing
autoconf-archive-2011.04.12-1.fc13
drupal-6.22-1.fc13
facter-1.5.9-1.fc13
fence-agents-3.1.4-1.fc13
pyrenamer-0.6.0-7.fc13
systemtap-1.5-1.fc13
Details about builds:
================================================================================
autoconf-archive-2011.04.12-1.fc13 (FEDORA-2011-7579)
The Autoconf Macro Archive
--------------------------------------------------------------------------------
Update Information:
The GNU Autoconf Archive is a collection of more than 450 macros for GNU Autoconf that have been contributed as free software by friendly supporters of the cause from all over the Internet.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #663925 - Review Request: autoconf-archive - The Autoconf Macro Archive
https://bugzilla.redhat.com/show_bug.cgi?id=663925
--------------------------------------------------------------------------------
================================================================================
drupal-6.22-1.fc13 (FEDORA-2011-7546)
An open-source content-management platform
--------------------------------------------------------------------------------
Update Information:
* Advisory ID: DRUPAL-SA-CORE-2011-001
* Project: Drupal core [1]
* Version: 6.x, 7.x
* Date: 2011-May-25
* Security risk: Critical [2]
* Exploitable from: Remote
* Vulnerability: Access bypass, Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
Multiple vulnerabilities and weaknesses were discovered in Drupal.
.... Reflected cross site scripting vulnerability in error handler
A reflected cross site scripting vulnerability was discovered in Drupal's
error handler. Drupal displays PHP errors in the messages area, and a
specially crafted URL can cause malicious scripts to be injected into the
message. The issue can be mitigated by disabling on-screen error display at
admin/settings/error-reporting. This is the recommended setting for
production sites.
This issue affects Drupal 6.x only.
.... Cross site scripting vulnerability in Color module
When using re-colorable themes, color inputs are not sanitized. Malicious
color values can be used to insert arbitrary CSS and script code. Successful
exploitation requires the "Administer themes" permission.
This issue affects Drupal 6.x and 7.x.
.... Access bypass in File module
When using private files in combination with a node access module, the File
module allows unrestricted access to private files.
This issue affects Drupal 7.x only.
-------- VERSIONS AFFECTED
---------------------------------------------------
* Drupal 7.x before version 7.1.
* Drupal 6.x before version 6.21.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you are running Drupal 7.x then upgrade to Drupal 7.1 [3] or 7.2 [4].
* If you are running Drupal 6.x then upgrade to Drupal 6.21 [5] or 6.22. [6]
The Security Team has released both a pure security update without other bug
fixes and a security update combined with other bug fixes and improvements.
You can choose to either only include the security update for an immediate
fix (which might require less quality assurance and testing) or more fixes
and improvements alongside the security fixes by choosing between Drupal 7.1
[7] and Drupal 7.2 [8] or Drupal 6.21 [9] and Drupal 6.22 [10].
See the release announcement [11] for more information.
See also the Drupal core [12] project page.
-------- REPORTED BY
---------------------------------------------------------
* The reflected cross site scripting vulnerability was reported by Heine
Deelstra [13] (*).
* The Color module cross site scripting vulnerability was reported by Kasper
Lindgaard, Secunia Research.
* The File access bypass was reported by Hubert Lecorche, and Peter Bex
[14].
-------- FIXED BY
------------------------------------------------------------
* The reflected cross site scripting vulnerability was fixed by Alan
Smithee.
* The Color module cross site scripting vulnerability was fixed by Stéphane
Corlosquet [15] (*), Heine Deelstra [16] (*), and Peter Wolanin [17] (*).
* The File access bypass was fixed by Heine Deelstra [18] (*).
(*) Member of the Drupal security team.
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [19].
Learn more about the Drupal Security team and their policies [20], writing
secure code for Drupal [21], and securing your site [22].
[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/1168910
[4] http://drupal.org/node/1168946
[5] http://drupal.org/node/1168908
[6] http://drupal.org/node/1168950
[7] http://drupal.org/node/1168910
[8] http://drupal.org/node/1168946
[9] http://drupal.org/node/1168908
[10] http://drupal.org/node/1168950
[11] http://drupal.org/drupal-7.2
[12] http://drupal.org/project/drupal
[13] http://drupal.org/user/17943
[14] https://drupal.org/user/309898
[15] http://drupal.org/user/52142
[16] http://drupal.org/user/17943
[17] http://drupal.org/user/49851
[18] http://drupal.org/user/17943
[19] http://drupal.org/contact
[20] http://drupal.org/security-team
[21] http://drupal.org/writing-secure-code
[22] http://drupal.org/security/secure-configuration
_______________________________________________
Security-news mailing list
Security-news at drupal.org
http://lists.drupal.org/mailman/listinfo/security-news
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 26 2011 Jon Ciesla <limb at jcomserv.net> - 6.22-1
- New upstream, SA-CORE-2011-001.
--------------------------------------------------------------------------------
================================================================================
facter-1.5.9-1.fc13 (FEDORA-2011-7557)
Ruby module for collecting simple facts about a host operating system
--------------------------------------------------------------------------------
Update Information:
Facter 1.5.9 is a maintenance release containing fixes and updates.
This release contains several fixes, and updated facts, as well as adding some new facts. These include enhancements with Facter & EC2, additional memory facts for OS X, and better Ruby 1.9 support.
A patch from Orion Poplawski to address upstream issue 7682 (http://projects.puppetlabs.com/issues/7682) has been applied. This should improve support for EPEL users on Scientific Linux.
For the full list of changes refer to the upstream release announcement:
http://groups.google.com/group/puppet-announce/browse_thread/thread/b4eb40fa248d7b9b
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 26 2011 Todd Zullinger <tmz at pobox.com> - 1.5.9-1
- Update to 1.5.9
- Improve Scientific Linux support, courtesy of Orion Poplawski (upstream #7682)
* Tue Feb 8 2011 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.5.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
fence-agents-3.1.4-1.fc13 (FEDORA-2011-7574)
Fence Agents for Red Hat Cluster
--------------------------------------------------------------------------------
Update Information:
This update fixes a few minor bugs and adds support for Citrix XenServer and XCP.
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 26 2011 Fabio M. Di Nitto <fdinitto at redhat.com> - 3.1.4-1
- new upstream release
--------------------------------------------------------------------------------
================================================================================
pyrenamer-0.6.0-7.fc13 (FEDORA-2011-7533)
A mass file renamer
--------------------------------------------------------------------------------
Update Information:
Un-orphaned.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #697976 - Review Request: pyrenamer - A mass file renamer
https://bugzilla.redhat.com/show_bug.cgi?id=697976
--------------------------------------------------------------------------------
================================================================================
systemtap-1.5-1.fc13 (FEDORA-2011-7549)
Instrumentation System
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 23 2011 Stan Cox <scox at redhat.com> - 1.5-1
- Upstream release.
--------------------------------------------------------------------------------
More information about the test
mailing list