The following Fedora 14 Security updates need testing:
https://admin.fedoraproject.org/updates/rpm-4.8.1-7.fc14 https://admin.fedoraproject.org/updates/quagga-0.99.20-1.fc14 https://admin.fedoraproject.org/updates/NetworkManager-0.8.5.92-1.git2011092... https://admin.fedoraproject.org/updates/bcfg2-1.1.3-1.fc14 https://admin.fedoraproject.org/updates/tomcat6-6.0.26-27.fc14 https://admin.fedoraproject.org/updates/kernel-2.6.35.14-97.fc14 https://admin.fedoraproject.org/updates/php-5.3.8-3.fc14 https://admin.fedoraproject.org/updates/cyrus-imapd-2.3.17-1.fc14 https://admin.fedoraproject.org/updates/puppet-2.6.6-3.fc14 https://admin.fedoraproject.org/updates/thunderbird-3.1.15-1.fc14 https://admin.fedoraproject.org/updates/phpPgAdmin-5.0.3-1.fc14
The following Fedora 14 Critical Path updates have yet to be approved:
https://admin.fedoraproject.org/updates/rpm-4.8.1-7.fc14 https://admin.fedoraproject.org/updates/livecd-tools-14.5-1.fc14 https://admin.fedoraproject.org/updates/NetworkManager-0.8.5.92-1.git2011092... https://admin.fedoraproject.org/updates/lldpad-0.9.41-4.fc14 https://admin.fedoraproject.org/updates/ModemManager-0.4.998-1.git20110706.f... https://admin.fedoraproject.org/updates/mash-0.5.22-1.fc14 https://admin.fedoraproject.org/updates/policycoreutils-2.0.85-30.3.fc14 https://admin.fedoraproject.org/updates/xorg-x11-drv-openchrome-0.2.904-8.fc... https://admin.fedoraproject.org/updates/xorg-x11-drv-qxl-0.0.21-3.fc14 https://admin.fedoraproject.org/updates/xorg-x11-drv-nouveau-0.0.16-14.20101... https://admin.fedoraproject.org/updates/libconcord-0.23-5.fc14,udev-161-9.fc...
The following builds have been pushed to Fedora 14 updates-testing
check_postgres-2.18.0-1.fc14 freeradius-2.1.12-1.fc14 ghc-http-types-0.3.1-1.fc14 ghc-wai-0.3.2-2.fc14 ghc-xss-sanitize-0.2.6-1.fc14 hplip-3.11.10-1.fc14 perl-Test-Mojibake-0.3-3.fc14 phpPgAdmin-5.0.3-1.fc14 python-mako0.4-0.4.2-7.fc14 rpm-4.8.1-7.fc14 travelccm-0.5.0-2.fc14 xmlstarlet-1.3.0-1.fc14
Details about builds:
================================================================================ check_postgres-2.18.0-1.fc14 (FEDORA-2011-13814) PostgreSQL monitoring script -------------------------------------------------------------------------------- Update Information:
Update to 2.18.0, per changes described at https://mail.endcrypt.com/pipermail/check_postgres-announce/2011-October/000...
-------------------------------------------------------------------------------- ChangeLog:
* Mon Oct 3 2011 - Devrim GUNDUZ devrim@gunduz.org 2.18.0-1 - Update to 2.18.0, per changes described at https://mail.endcrypt.com/pipermail/check_postgres-announce/2011-October/000... --------------------------------------------------------------------------------
================================================================================ freeradius-2.1.12-1.fc14 (FEDORA-2011-13793) High-performance and highly configurable free RADIUS server -------------------------------------------------------------------------------- Update Information:
Upgrade to latest upstream release, 2.1.12. See RPM changelog for details. Upgrade to latest upstream release, 2.1.11 See changelog for details
-------------------------------------------------------------------------------- ChangeLog:
* Mon Oct 3 2011 John Dennis jdennis@redhat.com - 2.1.12-1 - Upgrade to latest upstream release: 2.1.12 - Upstream changelog for 2.1.12: Feature improvements * Updates to dictionary.erx, dictionary.siemens, dictionary.starent, dictionary.starent.vsa1, dictionary.zyxel, added dictionary.symbol * Added support for PCRE from Phil Mayers * Configurable file permission in rlm_linelog * Added "relaxed" option to rlm_attr_filter. This copies attributes if at least one match occurred. * Added documentation on dynamic clients. See raddb/modules/dynamic_clients. * Added support for elliptical curve cryptography. See ecdh_curve in raddb/eap.conf. * Added support for 802.1X MIBs in checkrad * Added support for %{rand:...}, which generates a uniformly distributed number between 0 and the number you specify. * Created "man" pages for all installed commands, and documented options for all commands. Patch from John Dennis. * Allow radsniff to decode encrypted VSAs and CoA packets. Patch from Bjorn Mork. * Always send Message-Authenticator in radtest. Patch from John Dennis. radclient continues to be more flexible. * Updated Oracle schema and queries * Added SecurID module. See src/modules/rlm_securid/README
Bug fixes * Fix memory leak in rlm_detail * Fix "failed to insert event" * Allow virtual servers to be reloaded on HUP. It no longer complains about duplicate virtual servers. * Fix %{string:...} expansion * Fix "server closed socket" loop in radmin * Set ownership of control socket when starting up * Always allow root to connect to control socket, even if "uid" is set. They're root. They can already do anything. * Save all attributes in Access-Accept when proxying inner-tunnel EAP-MSCHAPv2 * Fixes for DHCP relaying. * Check certificate validity when using OCSP. * Updated Oracle "configure" script * Fixed typos in dictionary.alvarion * WARNING on potential proxy loop. * Be more aggressive about clearing old requests from the internal queue * Don't open network sockets when using -C * Wed Sep 21 2011 Tom Callaway spot@fedoraproject.org - 2.1.11-7 - restore defattr customization in the main package * Fri Sep 9 2011 Tom Callaway spot@fedoraproject.org - 2.1.11-6 - add missing systemd scriptlets * Thu Sep 8 2011 Tom Callaway spot@fedoraproject.org - 2.1.11-5 - convert to systemd * Thu Jul 21 2011 Petr Sabata contyk@redhat.com - 2.1.11-4 - Perl mass rebuild * Wed Jul 20 2011 Petr Sabata contyk@redhat.com - 2.1.11-3 - Perl mass rebuild --------------------------------------------------------------------------------
================================================================================ ghc-http-types-0.3.1-1.fc14 (FEDORA-2011-13791) Generic HTTP types for Haskell -------------------------------------------------------------------------------- Update Information:
Generic HTTP types for Haskell -------------------------------------------------------------------------------- References:
[ 1 ] Bug #717867 - Review Request: ghc-http-types - Generic HTTP types for Haskell https://bugzilla.redhat.com/show_bug.cgi?id=717867 --------------------------------------------------------------------------------
================================================================================ ghc-wai-0.3.2-2.fc14 (FEDORA-2011-13800) Haskell Web Application Interface library -------------------------------------------------------------------------------- Update Information:
Haskell Web Application Interface library. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #736602 - Review Request: ghc-wai - Web Application Interface library https://bugzilla.redhat.com/show_bug.cgi?id=736602 --------------------------------------------------------------------------------
================================================================================ ghc-xss-sanitize-0.2.6-1.fc14 (FEDORA-2011-13808) Sanitize untrusted HTML to prevent XSS attacks -------------------------------------------------------------------------------- Update Information:
Sanitize untrusted HTML to prevent cross-site scripting attacks. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #648250 - Review Request: ghc-xss-sanitize - Sanitize untrusted HTML to prevent XSS attacks https://bugzilla.redhat.com/show_bug.cgi?id=648250 --------------------------------------------------------------------------------
================================================================================ hplip-3.11.10-1.fc14 (FEDORA-2011-13807) HP Linux Imaging and Printing Project -------------------------------------------------------------------------------- Update Information:
New upstream release that fixes several bugs and adds support for new printers. -------------------------------------------------------------------------------- ChangeLog:
* Tue Oct 4 2011 Jiri Popelka jpopelka@redhat.com 3.11.10-1 - 3.11.10 - Use _cups_serverbin macro from cups-devel for where to put driver executables. - No need to define BuildRoot and clean it in clean and install section anymore. - Corrected IEEE 1284 Device IDs: Officejet 6300 series (bug #689378) LaserJet Professional M1212nf MFP (bug #742490) * Fri Sep 23 2011 Tim Waugh twaugh@redhat.com 3.11.7-5 - Fixed broken patch for pstotiff. * Tue Sep 6 2011 Jiri Popelka jpopelka@redhat.com 3.11.7-4 - Fixed xsane crash when doing a multi-image scan (bug #725878) * Fri Sep 2 2011 Tim Waugh twaugh@redhat.com 3.11.7-3 - Fixed hpcups crash when required plugin missing (bug #733461). -------------------------------------------------------------------------------- References:
[ 1 ] Bug #742490 - Incorrect IEEE 1284 Device ID, HP LaserJet Professional M1212nf MFP https://bugzilla.redhat.com/show_bug.cgi?id=742490 [ 2 ] Bug #733461 - [abrt] hpijs-1:3.11.7-2.fc14: __libc_start_main: Process /usr/lib/cups/filter/hpcups was killed by signal 6 (SIGABRT) https://bugzilla.redhat.com/show_bug.cgi?id=733461 [ 3 ] Bug #725878 - [abrt] xsane-0.998-4.fc15: bb_start_scan: Process /usr/bin/xsane was killed by signal 11 (SIGSEGV) https://bugzilla.redhat.com/show_bug.cgi?id=725878 [ 4 ] Bug #689378 - Missing Device ID for HP Officejet 6300 series https://bugzilla.redhat.com/show_bug.cgi?id=689378 --------------------------------------------------------------------------------
================================================================================ perl-Test-Mojibake-0.3-3.fc14 (FEDORA-2011-13812) Check your source for encoding misbehavior -------------------------------------------------------------------------------- Update Information:
This update offers significantly improved performance by pulling in the Unicode::CheckUTF8 module as a requirement. -------------------------------------------------------------------------------- ChangeLog:
* Tue Oct 4 2011 Paul Howarth paul@city-fan.org - 0.3-3 - BR/R: perl(Unicode::CheckUTF8) for improved performance --------------------------------------------------------------------------------
================================================================================ phpPgAdmin-5.0.3-1.fc14 (FEDORA-2011-13805) Web-based PostgreSQL administration -------------------------------------------------------------------------------- Update Information:
* Update to 5.0.3, per changes described at: http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40fr...
which also fixes a security flaw: http://www.openwall.com/lists/oss-security/2011/10/04/1 -------------------------------------------------------------------------------- ChangeLog:
* Mon Oct 3 2011 Devrim Gunduz devrim@gunduz.org 5.0.3-1 - Update to 5.0.3, per changes described at: http://sourceforge.net/mailarchive/forum.php?thread_name=4E897F6C.90905%40fr... -------------------------------------------------------------------------------- References:
[ 1 ] Bug #743205 - CVE-2011-3598 phpPgAdmin: Multiple XSS flaws fixed in v5.0.3 https://bugzilla.redhat.com/show_bug.cgi?id=743205 --------------------------------------------------------------------------------
================================================================================ python-mako0.4-0.4.2-7.fc14 (FEDORA-2011-13789) Mako template library for Python -------------------------------------------------------------------------------- Update Information:
New mako templating forward compat package. --------------------------------------------------------------------------------
================================================================================ rpm-4.8.1-7.fc14 (FEDORA-2011-13795) The RPM package management system -------------------------------------------------------------------------------- Update Information:
This update fixes some crashes which can occur when reading malformed package headers. -------------------------------------------------------------------------------- ChangeLog:
* Tue Oct 4 2011 Panu Matilainen pmatilai@redhat.com - 4.8.1-7 - fix CVE-2011-3378 * Fri May 27 2011 Paul Whalen paul.whalen@senecac.on.ca - 4.8.1-6 - Added meego patch for ARM macros -------------------------------------------------------------------------------- References:
[ 1 ] Bug #741606 - CVE-2011-3378 rpm: crashes and overflows on malformed header https://bugzilla.redhat.com/show_bug.cgi?id=741606 --------------------------------------------------------------------------------
================================================================================ travelccm-0.5.0-2.fc14 (FEDORA-2011-13788) C++ Travel Customer Choice Model (CCM) Library -------------------------------------------------------------------------------- Update Information:
First RPM release on Fedora. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #732218 - Review Request: travelccm - C++ Travel Customer Choice Model Library https://bugzilla.redhat.com/show_bug.cgi?id=732218 --------------------------------------------------------------------------------
================================================================================ xmlstarlet-1.3.0-1.fc14 (FEDORA-2011-13821) Command Line XML Toolkit -------------------------------------------------------------------------------- Update Information:
This new upstream release fixes several issues: * avoid ASCII CRs in UTF-16/32 text (reported by Ming Chen) * --value-of outputs concat values of all nodes (Req #2563866) * encode special chars for ed -u -x * allow use of exslt functions in ed -u -x * add --var to select (allow --var <name>=<value> as well as --var <name> <value> --break) * work around libxml bug that passes bogus data to error handler (Bug #3362217)
-------------------------------------------------------------------------------- ChangeLog:
* Mon Oct 3 2011 Paul W. Frields stickster@gmail.com - 1.3.0-1 - Update to upstream 1.3.0 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #742908 - xmlstarlet-1.3.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=742908 --------------------------------------------------------------------------------