The following Fedora EPEL 7 Security updates need testing:
Age URL
326 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087
dokuwiki-0-0.24.20140929c.el7
88 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f
mcollective-2.8.4-1.el7
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-043f77342d
cgit-0.12-1.el7
8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-418a480529
gsi-openssh-6.6.1p1-3.el7
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-fb26e5cd3c
privoxy-3.0.23-3.el7
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-fca17abc84
p7zip-15.09-9.el7
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-f17c082f00
nginx-1.6.3-8.el7
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-69b4d0e57c
prosody-0.9.10-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
R-3.2.3-4.el7
abduco-0.5-1.el7
abi-dumper-0.99.14-1.el7
cherrytree-0.36.4-2.el7
cmake-fedora-2.5.1-1.el7
cmark-0.23.0-3.el7
cmark-0.23.0-4.el7
drbdlinks-1.27-3.el7
globus-gssapi-gsi-11.26-1.el7
hitch-1.1.1-1.el7
letsencrypt-0.3.0-1.el7
libinput-1.1.5-1.el7
libsidplayfp-1.8.3-2.el7
nginx-1.6.3-8.el7
pdns-3.4.7-2.el7
perl-Email-Valid-1.198-1.el7
pki-usgov-dod-cacerts-0.0.6-4.el7
prosody-0.9.10-1.el7
python-acme-0.3.0-1.el7
python-elfdata-0.6-1.el7
python-polib-1.0.7-2.el7
python-productmd-1.0-9.el7
python-raven-5.10.2-1.el7
python-requests-toolbelt-0.6.0-1.el7
rpmorphan-1.15-1.el7
rubygem-activerecord-deprecated_finders-1.0.3-6.el7
rubygem-minitest5-5.8.4-1.el7
tito-0.6.4-1.el7
wildmidi-0.3.8-3.el7
yadifa-2.1.5-1.el7
Details about builds:
================================================================================
R-3.2.3-4.el7 (FEDORA-EPEL-2016-17ae3a01b5)
A language for data analysis and graphics
--------------------------------------------------------------------------------
Update Information:
Add pre-built copies of the R HTML manuals to the packages which cannot build
them due to an ancient texi2any (RHEL 5 & 6). RHEL 7 was updated to ensure clean
upgrade path. ---- Add Requires: redhat-rpm-config on targets that are
hardened, because R inherits the compiler flags that it was built with and
passes them to all modules built for it later.
--------------------------------------------------------------------------------
================================================================================
abduco-0.5-1.el7 (FEDORA-EPEL-2016-bab758e61a)
Session management in a clean and simple way
--------------------------------------------------------------------------------
Update Information:
Abduco 0.5 stable release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1298907 - abduco-0.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1298907
--------------------------------------------------------------------------------
================================================================================
abi-dumper-0.99.14-1.el7 (FEDORA-EPEL-2016-51c0ff0edf)
Tool to dump ABI of an ELF object containing DWARF debug info
--------------------------------------------------------------------------------
Update Information:
Detect private data types in the ABI, i.e. not defined in public header files.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1301789 - abi-dumper-0.99.14 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1301789
--------------------------------------------------------------------------------
================================================================================
cherrytree-0.36.4-2.el7 (FEDORA-EPEL-2016-b49173f74f)
Hierarchical note taking application
--------------------------------------------------------------------------------
Update Information:
Update to 0.36.4 ---- update to cherrytree 0.36.3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1160249 - cherrytree-0.36.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1160249
[ 2 ] Bug #1301941 - cherrytree-0.36.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1301941
--------------------------------------------------------------------------------
================================================================================
cmake-fedora-2.5.1-1.el7 (FEDORA-EPEL-2016-571c25a5ff)
CMake helper modules for fedora developers
--------------------------------------------------------------------------------
Update Information:
- Fixed: * Out-of-the-source build for ibus-chewing
--------------------------------------------------------------------------------
================================================================================
cmark-0.23.0-3.el7 (FEDORA-EPEL-2016-65d6af6d87)
CommonMark parsing and rendering
--------------------------------------------------------------------------------
Update Information:
CommonMark parsing and rendering
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1266429 - Review Request: cmark - CommonMark parsing and rendering
https://bugzilla.redhat.com/show_bug.cgi?id=1266429
--------------------------------------------------------------------------------
================================================================================
cmark-0.23.0-4.el7 (FEDORA-EPEL-2016-b3f7cd8978)
CommonMark parsing and rendering
--------------------------------------------------------------------------------
Update Information:
CommonMark parsing and rendering (http://commonmark.org/)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1266429 - Review Request: cmark - CommonMark parsing and rendering
https://bugzilla.redhat.com/show_bug.cgi?id=1266429
--------------------------------------------------------------------------------
================================================================================
drbdlinks-1.27-3.el7 (FEDORA-EPEL-2016-8b5788b3e9)
A program for managing links into a DRBD shared partition
--------------------------------------------------------------------------------
Update Information:
Provide native systemd service
--------------------------------------------------------------------------------
================================================================================
globus-gssapi-gsi-11.26-1.el7 (FEDORA-EPEL-2016-f2e8fc5635)
Globus Toolkit - GSSAPI library
--------------------------------------------------------------------------------
Update Information:
ix FORCE_TLS setting to allow TLSv1.1 and TLS1.2, not just TLSv1.0
--------------------------------------------------------------------------------
================================================================================
hitch-1.1.1-1.el7 (FEDORA-EPEL-2016-41a21534e9)
Network proxy that terminates TLS/SSL connections
--------------------------------------------------------------------------------
Update Information:
New upstream release. A bugfix relase.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302474 - hitch-1.1.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1302474
--------------------------------------------------------------------------------
================================================================================
letsencrypt-0.3.0-1.el7 (FEDORA-EPEL-2016-e38556f243)
A free, automated certificate authority client
--------------------------------------------------------------------------------
Update Information:
Updated to 0.3.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302701 - letsencrypt-0.3.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1302701
--------------------------------------------------------------------------------
================================================================================
libinput-1.1.5-1.el7 (FEDORA-EPEL-2016-c64c3afa71)
Input device library
--------------------------------------------------------------------------------
Update Information:
Upstream update to 1.1.5
--------------------------------------------------------------------------------
================================================================================
libsidplayfp-1.8.3-2.el7 (FEDORA-EPEL-2016-386eead9f4)
SID chip music module playing library
--------------------------------------------------------------------------------
Update Information:
Import to EPEL to satisfy QMMP dependency (rhbz#1242361#c3)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1242361 - [RFE] Please provide qmmp EPEL7 build
https://bugzilla.redhat.com/show_bug.cgi?id=1242361
--------------------------------------------------------------------------------
================================================================================
nginx-1.6.3-8.el7 (FEDORA-EPEL-2016-f17c082f00)
A high performance web server and reverse proxy server
--------------------------------------------------------------------------------
Update Information:
- CVE-2016-0747: Insufficient limits of CNAME resolution in resolver -
CVE-2016-0746: Use-after-free during CNAME response processing in resolver -
CVE-2016-0742: Invalid pointer dereference in resolver
--------------------------------------------------------------------------------
================================================================================
pdns-3.4.7-2.el7 (FEDORA-EPEL-2016-c3fc50614c)
A modern, advanced and high performance authoritative-only nameserver
--------------------------------------------------------------------------------
Update Information:
- Remove old PolarSSL dependency
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302464 - Update to mbedtls causes a dependency issue with pdns
https://bugzilla.redhat.com/show_bug.cgi?id=1302464
--------------------------------------------------------------------------------
================================================================================
perl-Email-Valid-1.198-1.el7 (FEDORA-EPEL-2016-efed433f78)
Check validity of internet email address
--------------------------------------------------------------------------------
Update Information:
Update to 1.198 to fix "multiple MX detection errors".
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1301214 - perl-Email-Valid: please update in epel7
https://bugzilla.redhat.com/show_bug.cgi?id=1301214
--------------------------------------------------------------------------------
================================================================================
pki-usgov-dod-cacerts-0.0.6-4.el7 (FEDORA-EPEL-2016-9eb4a82253)
A collection of U.S. Government CA Certs that the DOD uses
--------------------------------------------------------------------------------
Update Information:
A collection of U.S. Government CA Certs that the DOD uses
https://bodhi.fedoraproject.org/updates/FEDORA-2016-1a87db5f8e recently added to
fc23 https://bugzilla.redhat.com/show_bug.cgi?id=1274948
--------------------------------------------------------------------------------
================================================================================
prosody-0.9.10-1.el7 (FEDORA-EPEL-2016-69b4d0e57c)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 0.9.10 ============== A summary of changes in this release: Security
-------- * mod_dialback: Adopt key generation algorithm from XEP-0185, to
prevent impersonation attacks (CVE-2016-0756) Fixes and improvements
---------------------- * Startup: Open /dev/urandom read-only, to fix a
failure to start on some systems (fixes #585) * Networking: Improve handling of
the 'select' network backend running out of file descriptors Minor changes
------------- * Networking: Increase default internal read size to prevent
connections stalling with LuaEvent (see #583) * DNS: Discard queries that
failed to send due to connection errors (fixes #598) * c2s, s2s: Lower priority
of shutdown handler, so that modules such as MUC can always send shutdown
notifications to (remote) users (fixes #601)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302463 - CVE-2016-0756 prosody: mod_dialback allows impersonation
attacks
https://bugzilla.redhat.com/show_bug.cgi?id=1302463
--------------------------------------------------------------------------------
================================================================================
python-acme-0.3.0-1.el7 (FEDORA-EPEL-2016-e38556f243)
Python library for the ACME protocol
--------------------------------------------------------------------------------
Update Information:
Updated to 0.3.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302701 - letsencrypt-0.3.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1302701
--------------------------------------------------------------------------------
================================================================================
python-elfdata-0.6-1.el7 (FEDORA-EPEL-2016-4bf0014108)
Python wrapper to get ELF data
--------------------------------------------------------------------------------
Update Information:
Updated elfdata module which can extract GNU_BUILD_ID from the ELF files.
--------------------------------------------------------------------------------
================================================================================
python-polib-1.0.7-2.el7 (FEDORA-EPEL-2016-8ec371628d)
A library to parse and manage gettext catalogs
--------------------------------------------------------------------------------
Update Information:
Upstream update to 1.0.7
--------------------------------------------------------------------------------
================================================================================
python-productmd-1.0-9.el7 (FEDORA-EPEL-2016-090ce4d02f)
Library providing parsers for metadata related to OS installation
--------------------------------------------------------------------------------
Update Information:
add python-productmd to epel7 ---- adding python-productmd to epel
--------------------------------------------------------------------------------
================================================================================
python-raven-5.10.2-1.el7 (FEDORA-EPEL-2016-536e3ccb2c)
Python client for Sentry
--------------------------------------------------------------------------------
Update Information:
Update to python-raven-5.10.2 ---- First EPEL release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1234950 - Package python-raven in EPEL
https://bugzilla.redhat.com/show_bug.cgi?id=1234950
[ 2 ] Bug #1298402 - python-raven-5.10.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1298402
--------------------------------------------------------------------------------
================================================================================
python-requests-toolbelt-0.6.0-1.el7 (FEDORA-EPEL-2016-2c85206fce)
A utility belt for advanced users of python-requests
--------------------------------------------------------------------------------
Update Information:
update to 0.6.0 release
--------------------------------------------------------------------------------
================================================================================
rpmorphan-1.15-1.el7 (FEDORA-EPEL-2016-6410427984)
List packages that have no dependencies (like deborphan)
--------------------------------------------------------------------------------
Update Information:
Adding rpmorphan to EPEL
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #860433 - RFE - please maintain rpmorphan for EPEL
https://bugzilla.redhat.com/show_bug.cgi?id=860433
--------------------------------------------------------------------------------
================================================================================
rubygem-activerecord-deprecated_finders-1.0.3-6.el7
(FEDORA-EPEL-2016-e52a4ce8de)
This gem contains deprecated finder APIs extracted from Active Record
--------------------------------------------------------------------------------
Update Information:
Bring package to EPEL7
--------------------------------------------------------------------------------
================================================================================
rubygem-minitest5-5.8.4-1.el7 (FEDORA-EPEL-2016-e9edb7ff2c)
minitest provides a complete suite of testing facilities
--------------------------------------------------------------------------------
Update Information:
Updated to new upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1298622 - Review Request: rubygem-minitest5 - minitest provides a
complete suite of testing facilities
https://bugzilla.redhat.com/show_bug.cgi?id=1298622
--------------------------------------------------------------------------------
================================================================================
tito-0.6.4-1.el7 (FEDORA-EPEL-2016-ed4568b9bf)
A tool for managing rpm based git projects
--------------------------------------------------------------------------------
Update Information:
Fix tagging with --use-version on MEAD projects. Fix git annex builder cleanup
returning to proper directory. Fix issue with .spec file basename in some
situations.
--------------------------------------------------------------------------------
================================================================================
wildmidi-0.3.8-3.el7 (FEDORA-EPEL-2016-3f3fffda5a)
Softsynth midi player
--------------------------------------------------------------------------------
Update Information:
Import to EPEL to satisfy QMMP dependency (rhbz#1242361#c3)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1242361 - [RFE] Please provide qmmp EPEL7 build
https://bugzilla.redhat.com/show_bug.cgi?id=1242361
--------------------------------------------------------------------------------
================================================================================
yadifa-2.1.5-1.el7 (FEDORA-EPEL-2016-42474ec730)
Lightweight authoritative Name Server with DNSSEC capabilities
--------------------------------------------------------------------------------
Update Information:
20160108: YADIFA 2.1.5 - Dynamic updates do not use temporary files anymore
which improves their general performance. - The statistics now shows the
referrals. Fixes: - fixed an issue where getting a huge incremental transfer
would prevent the server from answering queries while applying the changes. -
fixed an issue serving IXFR that would occur when a incremental change step was
bigger than 64KB - fixed an issue for Solaris with the memory aligment fix not
active everywhere - fixed an issue on the Solaris build settings - fixed an
issue where sometimes yadifad would not find a configuration file given as a
parameter with a relative path - fixed an issue where a wild-card would not be
properly returned with an AXFR - fixed an issue where dynamically updating a
zone at a speed such that the zone file would need to be written multiple times
on disk before finishing the previous write could lead to a deadlock 20151026:
YADIFA 2.1.4 - The zone reader error reporting has been improved. - Stacktrace
support added for Solaris. Known issue: - Adding and or removing NSEC3PARAM
dynamically is not properly handled. Fixes: - fixed an issue where an NSEC3
answer proving a * query would lead to a crash - fixed an issue where a private
key may be not recognised as such - fixed an issue where dynamic update
prerequisite check would fail a valid match - fixed an issue where zone
signature maintenance would only start if all private keys were available.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302113 - yadifa: 2.1.5 release available
https://bugzilla.redhat.com/show_bug.cgi?id=1302113
--------------------------------------------------------------------------------
_______________________________________________
epel-devel mailing list
epel-devel@lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/epel-devel@lists.fedoraproject.org
