The following Fedora EPEL 6 Security updates need testing: Age URL 114 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6c663378c unrtf-0.21.9-8.el6 52 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f21474267b condor-8.6.11-1.el6 12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-0d793474b0 mozilla-noscript-10.1.9.6-1.el6 12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-8667fe68a8 lcms2-2.8-6.el6 11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ca7fe27b10 mbedtls-2.7.6-1.el6 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ebecebaa67 python-marshmallow-2.0.0-0.7.gita8b3385.el6 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-56bfbe3964 php-tcpdf-6.2.25-1.el6 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-6bc3a525a2 libmad-0.15.1b-26.el6 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f08aaf7a38 php-horde-Horde-Core-2.31.6-1.el6 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f5ce55eadb php-horde-horde-5.2.20-1.el6 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-8c57176049 php-horde-kronolith-4.2.25-1.el6 The following builds have been pushed to Fedora EPEL 6 updates-testing davix-0.6.9-1.el6 gnutls30-3.5.19-1.el6 mozilla-https-everywhere-2018.9.19-1.el6 php-horde-nag-4.2.19-1.el6 Details about builds: ================================================================================ davix-0.6.9-1.el6 (FEDORA-EPEL-2018-5eb62e7502) Toolkit for Http-based file management -------------------------------------------------------------------------------- Update Information: * new upstream release -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 2 2018 Andrea Manzi <andrea.manzi at cern.ch> - 0.6.9-1 - New upstream release * Thu Jul 12 2018 Fedora Release Engineering <releng@xxxxxxxxxxxxxxxxx> - 0.6.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ gnutls30-3.5.19-1.el6 (FEDORA-EPEL-2018-83a8fcf606) A TLS protocol implementation -------------------------------------------------------------------------------- Update Information: Updated to 3.5.19 ---- Updated to 3.5.18 -------------------------------------------------------------------------------- ChangeLog: * Mon Oct 1 2018 Nikos Mavrogiannopoulos <nmav@xxxxxxxxxx> 3.5.19-1 - Updated to 3.5.19 * Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@xxxxxxxxxx> 3.5.18-1 - Updated to 3.5.18 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1619524 - CVE-2018-10846 gnutls30: gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1619524 [ 2 ] Bug #1619519 - CVE-2018-10845 gnutls30: gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1619519 [ 3 ] Bug #1619512 - CVE-2018-10844 gnutls30: gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1619512 [ 4 ] Bug #1459797 - CVE-2017-7507 gnutls30: gnutls: Crash upon receiving well-formed status_request extension [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1459797 -------------------------------------------------------------------------------- ================================================================================ mozilla-https-everywhere-2018.9.19-1.el6 (FEDORA-EPEL-2018-d61986c74e) HTTPS enforcement extension for Mozilla Firefox -------------------------------------------------------------------------------- Update Information: Lots o' updates. Does include a mark of shame for non-HTTPS websites -------------------------------------------------------------------------------- ChangeLog: * Mon Oct 1 2018 Russell Golden <niveusluna@xxxxxxxxxxxxxx> - 2018.9.19-1 2018.9.19 - Ensure the 'Block all unencrypted requests' interstitial page catches more HTTPS misconfigurations (#16418) - Allow users to disable HTTPS Everywhere on specific sites. Add additional UX controls in the options page for this. (#10041) - Adding 'scope' to update channels, which defines regex limiting the URLs an update channel is allowed to operate on (#16430) - Adding a warning to pages which 'Block all unencrypted requests' is unable to upgrade - Adding a UX that enables users to add, delete, and edit update channels - Reduces memory overhead by optimizing exclusion regex - Block insecure FTP connections when 'Block all unencrypted requests' is checked. This triggers a permissions dialogue in Firefox 57+, see https://github.com/EFForg/https-everywhere/issues/16377#issuecomment-415492846 for more info. - Bundled ruleset updates * Fri Jul 13 2018 Fedora Release Engineering <releng@xxxxxxxxxxxxxxxxx> - 2018.6.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild -------------------------------------------------------------------------------- ================================================================================ php-horde-nag-4.2.19-1.el6 (FEDORA-EPEL-2018-972fa9738c) A web based task list manager -------------------------------------------------------------------------------- Update Information: **nag 4.2.19** * [mjr] SECURITY: Fix multiple XSS vulnerabilities when displaying and filtering task lists. -------------------------------------------------------------------------------- ChangeLog: * Sat Sep 29 2018 Remi Collet <remi@xxxxxxxxxxxx> - 4.2.19-1 - update to 4.2.19 -------------------------------------------------------------------------------- _______________________________________________ epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx
