The following Fedora EPEL 8 Security updates need testing:
Age URL
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-a4cbda11c6
suricata-6.0.17-1.el8
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8f366635a6
seamonkey-2.53.18.2-1.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
chromium-123.0.6312.58-1.el8
netdata-1.45.1-1.el8
redict-7.3.0~rc1-1.el8
tinyxml-2.6.2-28.el8
Details about builds:
================================================================================
chromium-123.0.6312.58-1.el8 (FEDORA-EPEL-2024-fc233c6d2e)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
Update to 123.0.6312.58
* High CVE-2024-2625: Object lifecycle issue in V8
* Medium CVE-2024-2626: Out of bounds read in Swiftshader
* Medium CVE-2024-2627: Use after free in Canvas
* Medium CVE-2024-2628: Inappropriate implementation in Downloads
* Medium CVE-2024-2629: Incorrect security UI in iOS
* Medium CVE-2024-2630: Inappropriate implementation in iOS
* Low CVE-2024-2631: Inappropriate implementation in iOS
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 20 2024 Than Ngo <than(a)redhat.com> - 123.0.6312.58-1
- update to 123.0.6312.58
* High CVE-2024-2625: Object lifecycle issue in V8
* Medium CVE-2024-2626: Out of bounds read in Swiftshader
* Medium CVE-2024-2627: Use after free in Canvas
* Medium CVE-2024-2628: Inappropriate implementation in Downloads
* Medium CVE-2024-2629: Incorrect security UI in iOS
* Medium CVE-2024-2630: Inappropriate implementation in iOS
* Low CVE-2024-2631: Inappropriate implementation in iOS
* Fri Mar 15 2024 Than Ngo <than(a)redhat.com> - 123.0.6312.46-1
- update to 123.0.6312.46
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2269307 - CVE-2024-2400 chromium: chromium-browser: Use after free in
Performance Manager [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2269307
[ 2 ] Bug #2270390 - CVE-2024-2626 CVE-2024-2627 CVE-2024-2628 CVE-2024-2629
CVE-2024-2630 CVE-2024-2631 chromium: various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2270390
[ 3 ] Bug #2270392 - CVE-2024-2625 chromium: chromium-browser: Object lifecycle issue in
V8 [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2270392
--------------------------------------------------------------------------------
================================================================================
netdata-1.45.1-1.el8 (FEDORA-EPEL-2024-4e50496ed5)
Real-time performance monitoring
--------------------------------------------------------------------------------
Update Information:
Update from upstream
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 27 2024 Didier Fabert <didier.fabert(a)gmail.com> 1.45.1-1
- Update from upstream
* Thu Mar 21 2024 Didier Fabert <didier.fabert(a)gmail.com> 1.45.0-1
- Update from upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2270902 - netdata-1.45.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2270902
--------------------------------------------------------------------------------
================================================================================
redict-7.3.0~rc1-1.el8 (FEDORA-EPEL-2024-d9878ed2b4)
A persistent key-value database
--------------------------------------------------------------------------------
Update Information:
initial package build
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 24 2024 Jonathan Wright <jonathan(a)almalinux.org> - 7.3.0~rc1-1
- Initial package build, release candidate
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2271615 - Review Request: redict - A persistent key-value database
https://bugzilla.redhat.com/show_bug.cgi?id=2271615
--------------------------------------------------------------------------------
================================================================================
tinyxml-2.6.2-28.el8 (FEDORA-EPEL-2024-0ced8d6066)
A simple, small, C++ XML parser
--------------------------------------------------------------------------------
Update Information:
Security fixes for CVE-2021-42260, CVE-2023-34194 and its duplicate
CVE-2023-40462.
Fix incorrect text element encoding (upstream isssue #51).
Enable tests.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 3 2024 Dominik Mierzejewski <dominik(a)greysector.net> - 2.6.2-28
- apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
- apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
(rhbz#2254376, rhbz#2254381)
- fix incorrect text element encoding (upstream isssue #51)
- compile and run tests
* Sat Jul 22 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-27
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Sat Jan 21 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-26
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Sat Jul 23 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-25
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Sat Jan 22 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-24
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Fri Jul 23 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-23
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Wed Jan 27 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-22
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-21
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Fri Jan 31 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-20
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2253717 - CVE-2021-42260 tinyxml: infinite loop causes crash [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2253717
[ 2 ] Bug #2254380 - TRIAGE CVE-2023-34194 tinyxml: reachable assertion may lead to
denial of service [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2254380
--------------------------------------------------------------------------------