The following Fedora EPEL 7 Security updates need testing: Age URL 13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-93d78fa1a6 perl-Net-CIDR-Lite-0.22-1.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-f08dc6b4c1 gnuchess-6.2.7-5.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3f9b6786f4 clamav-0.103.2-1.el7 10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-13ed778e19 singularity-3.7.3-1.el7 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-9daa9fc0b1 seamonkey-2.53.7-3.el7 4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-fe3075d537 wordpress-5.1.9-1.el7 The following builds have been pushed to Fedora EPEL 7 updates-testing libjwt-1.12.1-7.el7 rust-1.51.0-3.el7 Details about builds: ================================================================================ libjwt-1.12.1-7.el7 (FEDORA-EPEL-2021-b8c4714317) A Javascript Web Token library in C -------------------------------------------------------------------------------- Update Information: Same version, 1.12.1, but removed example programs ---- Add libjwt to EPEL7 -------------------------------------------------------------------------------- ChangeLog: -------------------------------------------------------------------------------- References: [ 1 ] Bug #1940198 - Request to add libjwt to epel7 https://bugzilla.redhat.com/show_bug.cgi?id=1940198 -------------------------------------------------------------------------------- ================================================================================ rust-1.51.0-3.el7 (FEDORA-EPEL-2021-044df87bd4) The Rust Programming Language -------------------------------------------------------------------------------- Update Information: Security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162. These are memory safety bugs in the Rust standard library. Because it is statically linked, affected applications will need to be rebuilt to benefit from the fixes. The actual security implications will depend on how these APIs are used in each particular case. -------------------------------------------------------------------------------- ChangeLog: * Fri Apr 16 2021 Josh Stone <jistone@xxxxxxxxxx> - 1.51.0-3 - Security fixes for CVE-2020-36323, CVE-2021-31162 * Wed Apr 14 2021 Josh Stone <jistone@xxxxxxxxxx> - 1.51.0-2 - Security fixes for CVE-2021-28876, CVE-2021-28878, CVE-2021-28879 - Fix bootstrap for stage0 rust 1.51 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1949198 - CVE-2021-28876 rust: panic safety issue in Zip implementation https://bugzilla.redhat.com/show_bug.cgi?id=1949198 [ 2 ] Bug #1949207 - CVE-2021-28878 rust: memory safety violation in Zip implementation when next_back() and next() are used together https://bugzilla.redhat.com/show_bug.cgi?id=1949207 [ 3 ] Bug #1949211 - CVE-2021-28879 rust: integer overflow in the Zip implementation can lead to a buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=1949211 [ 4 ] Bug #1950396 - CVE-2020-36323 rust: optimization for joining strings can cause uninitialized bytes to be exposed https://bugzilla.redhat.com/show_bug.cgi?id=1950396 [ 5 ] Bug #1950398 - CVE-2021-31162 rust: double free in Vec::from_iter function if freeing the element panics https://bugzilla.redhat.com/show_bug.cgi?id=1950398 -------------------------------------------------------------------------------- _______________________________________________ epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
