The following Fedora 21 Security updates need testing: Age URL 108 https://admin.fedoraproject.org/updates/FEDORA-2014-17139/aeskulap-0.2.2-0.20beta1.fc21,orthanc-0.8.5-2.fc21,dcmtk-3.6.1-1.fc21 92 https://admin.fedoraproject.org/updates/FEDORA-2015-0264/gcab-0.4-7.fc21 68 https://admin.fedoraproject.org/updates/FEDORA-2015-1467/openstack-glance-2014.1.3-4.fc21 61 https://admin.fedoraproject.org/updates/FEDORA-2015-1803/fcgi-2.4.0-26.fc21 53 https://admin.fedoraproject.org/updates/FEDORA-2015-2055/openldap-2.4.40-3.fc21 40 https://admin.fedoraproject.org/updates/FEDORA-2015-2729/qpid-cpp-0.30-12.fc21 31 https://admin.fedoraproject.org/updates/FEDORA-2015-3505/389-ds-base-1.3.3.9-1.fc21 26 https://admin.fedoraproject.org/updates/FEDORA-2015-3612/ImageMagick-6.8.8.10-6.fc21 21 https://admin.fedoraproject.org/updates/FEDORA-2015-4079/varnish-4.0.3-3.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4742/qtwebkit-2.3.4-6.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4689/quassel-0.11.0-2.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4711/ca-certificates-2015.2.3-1.0.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4716/qt5-qtwebkit-5.4.1-4.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4596/rest-0.7.93-1.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4699/libzip-0.11.2-5.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4476/owncloud-7.0.5-2.fc21 8 https://admin.fedoraproject.org/updates/FEDORA-2015-5114/libtasn1-4.4-1.fc21 7 https://admin.fedoraproject.org/updates/FEDORA-2015-5216/mailman-2.1.20-1.fc21 7 https://admin.fedoraproject.org/updates/FEDORA-2015-5208/xen-4.4.2-2.fc21 6 https://admin.fedoraproject.org/updates/FEDORA-2015-5245/mingw-gnutls-3.3.14-1.fc21,mingw-libtasn1-4.4-1.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5466/jenkins-1.590-3.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5457/php-symfony-2.5.11-1.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5468/asterisk-11.17.0-1.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5482/qemu-2.1.3-5.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5575/postgis-2.1.7-1.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5552/perl-DBD-Firebird-1.19-1.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5570/mediawiki-1.24.2-1.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5637/groovy-sandbox-1.8-1.fc21,jenkins-script-security-plugin-1.13-2.fc21,jenkins-matrix-project-plugin-1.4-3.fc21 1 https://admin.fedoraproject.org/updates/FEDORA-2015-5729/tor-0.2.5.12-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5823/zarafa-7.1.12-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5833/perl-Test-Signature-1.11-1.fc21,perl-Module-Signature-0.77-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5830/ntp-4.2.6p5-29.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5816/chrony-1.31.1-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5813/knot-1.6.3-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5872/netcf-0.2.8-1.fc21 The following Fedora 21 Critical Path updates have yet to be approved: Age URL 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4711/ca-certificates-2015.2.3-1.0.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4742/qtwebkit-2.3.4-6.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4629/libXdmcp-1.1.2-1.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4596/rest-0.7.93-1.fc21 13 https://admin.fedoraproject.org/updates/FEDORA-2015-4638/lcms2-2.7-1.fc21 11 https://admin.fedoraproject.org/updates/FEDORA-2015-4789/librsvg2-2.40.9-1.fc21 11 https://admin.fedoraproject.org/updates/FEDORA-2015-4776/libpcap-1.7.2-1.fc21 10 https://admin.fedoraproject.org/updates/FEDORA-2015-4992/libwebp-0.4.3-2.fc21 8 https://admin.fedoraproject.org/updates/FEDORA-2015-5108/gnutls-3.3.14-1.fc21 8 https://admin.fedoraproject.org/updates/FEDORA-2015-5114/libtasn1-4.4-1.fc21 7 https://admin.fedoraproject.org/updates/FEDORA-2015-5246/libcdio-0.92-4.fc21 7 https://admin.fedoraproject.org/updates/FEDORA-2015-5236/libidn-1.28-6.fc21 6 https://admin.fedoraproject.org/updates/FEDORA-2015-5386/geoclue2-2.1.10-1.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5451/perl-5.18.4-308.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5472/gmp-6.0.0-9.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5443/libteam-1.17-1.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5478/selinux-policy-3.13.1-105.11.fc21 5 https://admin.fedoraproject.org/updates/FEDORA-2015-5469/ibus-1.5.10-2.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5629/cryptsetup-1.6.7-1.fc21 3 https://admin.fedoraproject.org/updates/FEDORA-2015-5582/libgcrypt-1.6.3-4.fc21 1 https://admin.fedoraproject.org/updates/FEDORA-2015-5725/emacs-24.4-6.fc21 1 https://admin.fedoraproject.org/updates/FEDORA-2015-5716/grep-2.21-3.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5846/testdisk-6.14-6.fc21,ntfs-3g-2015.3.14-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5816/chrony-1.31.1-1.fc21 0 https://admin.fedoraproject.org/updates/FEDORA-2015-5808/lz4-r128-2.fc21 The following builds have been pushed to Fedora 21 updates-testing NetworkManager-openvpn-1.0.0-2.fc21 bpython-0.14.1-1.fc21 chrony-1.31.1-1.fc21 clufter-0.10.4-1.fc21 cppmyth-1.1.10-1.fc21 cross-binutils-2.25-4.fc21 cross-gcc-4.9.2-4.fc21 dcraw-9.24.4-1.fc21 digikam-4.9.0-1.fc21 dnssec-trigger-0.12-20.fc21 drupal6-ctools-1.12-1.fc21 drupal7-crumbs-2.3-1.fc21 drupal7-jquery_update-2.5-1.fc21 drupal7-l10n_update-2.0-1.fc21 eclipse-mdt-ocl-5.0.4-2.fc21 eclipse-mdt-uml2-5.0.2-2.fc21 fail2ban-0.9.1-4.fc21 gfs2-utils-3.1.8-1.fc21 globus-common-15.29-1.fc21 globus-gatekeeper-10.10-1.fc21 globus-gridftp-server-7.25-1.fc21 globus-scheduler-event-generator-5.11-1.fc21 globus-simple-ca-4.19-1.fc21 globus-xio-5.8-1.fc21 hedgewars-0.9.21.1-4.fc21 isync-1.2.0-2.fc21 kde-plasma-nm-0.9.3.6-1.fc21 knot-1.6.3-1.fc21 kosmtik-0.0.9-3.fc21 libkpeople-0.3.0-3.fc21 libnm-qt-0.9.8.4-1.fc21 libspf2-1.2.10-5.20150405gitd57d79fd.fc21 libxmp-4.3.8-1.fc21 ltrace-0.7.91-15.fc21 lz4-r128-2.fc21 mkvtoolnix-7.8.0-1.fc21 myproxy-6.1.13-1.fc21 netcf-0.2.8-1.fc21 ntfs-3g-2015.3.14-1.fc21 ntp-4.2.6p5-29.fc21 orthanc-0.8.6-1.fc21 osbs-0.2-2.c1216ba.fc21 perl-License-Syntax-0.13-1.fc21 perl-MCE-1.605-1.fc21 perl-Module-Signature-0.77-1.fc21 perl-Test-Signature-1.11-1.fc21 php-pear-DB-DataObject-1.11.4-1.fc21 php-phpunit-PHP-TokenStream-1.4.1-1.fc21 publicsuffix-list-20150407-1.fc21 recoll-1.20.5-1.fc21 rubygem-byebug-4.0.5-1.fc21 rubygem-gtksourceview3-2.2.4-1.fc21 rubygem-nenv-0.2.0-2.fc21 springlobby-0.195-2.fc21 testdisk-6.14-6.fc21 xforms-1.2.4-2.fc21 zarafa-7.1.12-1.fc21 Details about builds: ================================================================================ NetworkManager-openvpn-1.0.0-2.fc21 (FEDORA-2015-5847) NetworkManager VPN plugin for OpenVPN -------------------------------------------------------------------------------- Update Information: This update disables client renegotiation by default, leaving the value up to the server or user override. This fixes frequent renegotiation failures when using two-factor authentication when the client has a much lower value than the server. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Dan Williams <dcbw@xxxxxxxxxx> - 1:1.0.0-2 - Default client renegotiation interval to zero (rh #969433) -------------------------------------------------------------------------------- References: [ 1 ] Bug #969433 - OpenVPN frequently disconnects https://bugzilla.redhat.com/show_bug.cgi?id=969433 -------------------------------------------------------------------------------- ================================================================================ bpython-0.14.1-1.fc21 (FEDORA-2015-5838) Fancy curses interface to the Python interactive interpreter -------------------------------------------------------------------------------- Update Information: Update to latest upstream release bpython 0.14.1. With this release gtk frontend is gone, while curtsies frontend is new default version. Old default is now known as bpython-cures. -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 26 2015 Terje Rosten <terje.rosten@xxxxxxx> - 0.14.1-1 - 0.14.1 - gtk gone upstream, remove sub package and add obsolete - appdata, desktop file and png upstream - new deps - curtsies now default * Thu Mar 26 2015 Richard Hughes <rhughes@xxxxxxxxxx> - 0.13.2-2 - Add an AppData file for the software center -------------------------------------------------------------------------------- ================================================================================ chrony-1.31.1-1.fc21 (FEDORA-2015-5816) An NTP client/server -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-1853, CVE-2015-1821, CVE-2015-1822 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Miroslav Lichvar <mlichvar@xxxxxxxxxx> 1.31.1-1 - update to 1.31.1 (CVE-2015-1853 CVE-2015-1821 CVE-2015-1822) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1209631 - CVE-2015-1821 chrony: Heap out of bound write in address filter https://bugzilla.redhat.com/show_bug.cgi?id=1209631 [ 2 ] Bug #1209572 - CVE-2015-1853 chrony: authentication doesn't protect symmetric associations against DoS attacks https://bugzilla.redhat.com/show_bug.cgi?id=1209572 [ 3 ] Bug #1209632 - CVE-2015-1822 chrony: uninitialized pointer in cmdmon reply slots https://bugzilla.redhat.com/show_bug.cgi?id=1209632 -------------------------------------------------------------------------------- ================================================================================ clufter-0.10.4-1.fc21 (FEDORA-2015-5828) Tool/library for transforming/analyzing cluster configuration formats -------------------------------------------------------------------------------- Update Information: bump upstream package (incl. several bugfixes, e.g., rhbz#1207345) -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Jan Pokorný <jpokorny+rpm-clufter@xxxxxxxxxxxxxxxxx> - 0.10.4-1 - bump upstream package -------------------------------------------------------------------------------- ================================================================================ cppmyth-1.1.10-1.fc21 (FEDORA-2015-5849) Client interface for the MythTV backend -------------------------------------------------------------------------------- Update Information: * Add support for API version 5.0 * SAJSON is used to parse JSON content * Removing JANSSON dependency * Fix atomic operations for new architecture ARMv6, ARMv7 * Fix memory leak on thread exit * Some typo -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mohamed El Morabity <melmorabity@xxxxxxxxxxxxxxxxx> - 1.1.10-1 - Update to 1.1.10 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1204484 - Linking issues with jansson and kodi in cppmyth https://bugzilla.redhat.com/show_bug.cgi?id=1204484 -------------------------------------------------------------------------------- ================================================================================ cross-binutils-2.25-4.fc21 (FEDORA-2015-5807) A GNU collection of cross-compilation binary utilities -------------------------------------------------------------------------------- Update Information: Fix microblaze extra-large constant handling [binutils bz 18189] -------------------------------------------------------------------------------- ChangeLog: * Mon Apr 6 2015 David Howells <dhowells@xxxxxxxxxx> - 2.25-4 - Microblaze: Fix extra-large constant handling [binutils bz 18189]. -------------------------------------------------------------------------------- ================================================================================ cross-gcc-4.9.2-4.fc21 (FEDORA-2015-5868) Cross C compiler -------------------------------------------------------------------------------- Update Information: Rebase on gcc-4.9.2-6 Use cross-binutils-2.25, move to gcc-4.9.2, import fixes from gcc rpm and fix sh64 and openrisc target tuples -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 David Howells <dhowells@xxxxxxxxxx> - 4.9.2-4 - Rebase on gcc-4.9.2-6 [BZ 1183401]. * Mon Feb 9 2015 David Howells <dhowells@xxxxxxxxxx> - 4.9.2-3 - Need to build-depend on isl-devel and cloog-devel. * Tue Jan 13 2015 David Howells <dhowells@xxxxxxxxxx> - 4.9.2-2 - Rebase on gcc-4.9.2-5. - Use binutils-2.25. * Fri Dec 12 2014 David Howells <dhowells@xxxxxxxxxx> - 4.9.2-1 - Rebase on gcc-4.9.2-2. * Fri Dec 12 2014 David Howells <dhowells@xxxxxxxxxx> - 4.9.1-3 - Enable libgcc building on sh64 [gcc BZ 61844]. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1183401 - gcc-x86_64-linux-gnu out of date https://bugzilla.redhat.com/show_bug.cgi?id=1183401 -------------------------------------------------------------------------------- ================================================================================ dcraw-9.24.4-1.fc21 (FEDORA-2015-5863) Tool for decoding raw image data from digital cameras -------------------------------------------------------------------------------- Update Information: Upstream bugfix and enhancement release with these changes: * Added Romanian manpage and message table. * Support all format options of the Nikon D4S and D810. * Guess which filter pattern OmniVision cameras use. * Canon multi-exposure files are already white-balanced. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Nils Philippsen <nils@xxxxxxxxxx> - 9.24.4-1 - version 9.24.4 -------------------------------------------------------------------------------- ================================================================================ digikam-4.9.0-1.fc21 (FEDORA-2015-5804) A digital camera accessing & photo management application -------------------------------------------------------------------------------- Update Information: digiKam 4.9.0 See release notes https://www.digikam.org/node/735 -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Alexey Kurov <nucleo@xxxxxxxxxxxxxxxxx> - 4.9.0-1 - digikam-4.9.0 - removed libkgeomap translations -------------------------------------------------------------------------------- ================================================================================ dnssec-trigger-0.12-20.fc21 (FEDORA-2015-5821) NetworkManager plugin to update/reconfigure DNSSEC resolving -------------------------------------------------------------------------------- Update Information: two issues fixed -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Tomas Hozza <thozza@xxxxxxxxxx> - 0.12-20 - Fix issue when installing private address range zone without global forwarders (#1205864) - Fix configuration of private address range zones (#1128310#c20) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1205864 - [abrt] dnssec-trigger: dnssec-trigger-script:278:_commit:KeyError: 'c.f.ip6.arpa' https://bugzilla.redhat.com/show_bug.cgi?id=1205864 [ 2 ] Bug #1128310 - in-addr.arpa queries for private IP ranges doesn't work if fallback servers are used https://bugzilla.redhat.com/show_bug.cgi?id=1128310 -------------------------------------------------------------------------------- ================================================================================ drupal6-ctools-1.12-1.fc21 (FEDORA-2015-5825) Primarily a set of APIs and tools to improve the developer experience -------------------------------------------------------------------------------- Update Information: - Updated to 1.12 (BZ #1203478) - Removed RPM README b/c it only explained common Drupal workflow -------------------------------------------------------------------------------- ChangeLog: * Sat Apr 4 2015 Shawn Iwinski <shawn.iwinski@xxxxxxxxx> - 1.12-1 - Updated to 1.12 (BZ #1203478) - Removed RPM README b/c it only explained common Drupal workflow -------------------------------------------------------------------------------- References: [ 1 ] Bug #1203478 - drupal6-ctools-1.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=1203478 -------------------------------------------------------------------------------- ================================================================================ drupal7-crumbs-2.3-1.fc21 (FEDORA-2015-5870) The ultimate breadcrumbs module -------------------------------------------------------------------------------- Update Information: - Updated to 2.3 (SA-CONTRIB-2015-082 / BZ #1205941) -------------------------------------------------------------------------------- ChangeLog: * Sat Apr 4 2015 Shawn Iwinski <shawn.iwinski@xxxxxxxxx> - 2.3-1 - Updated to 2.3 (SA-CONTRIB-2015-082 / BZ #1205941) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1205941 - drupal7-crumbs-2.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1205941 -------------------------------------------------------------------------------- ================================================================================ drupal7-jquery_update-2.5-1.fc21 (FEDORA-2015-5805) Upgrades the version of jQuery in Drupal core to a newer version of jQuery -------------------------------------------------------------------------------- Update Information: - Update to 2.5 (BZ 1186191) -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Peter Borsa <peter.borsa@xxxxxxxxx> - 2.5-1 - Update to 2.5 (BZ 1186191) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1186191 - drupal7-jquery_update-2.5 is available https://bugzilla.redhat.com/show_bug.cgi?id=1186191 -------------------------------------------------------------------------------- ================================================================================ drupal7-l10n_update-2.0-1.fc21 (FEDORA-2015-5819) Provides automatic downloads and updates for translations -------------------------------------------------------------------------------- Update Information: - Updated to 2.0 (BZ #1198580) -------------------------------------------------------------------------------- ChangeLog: * Sat Apr 4 2015 Shawn Iwinski <shawn.iwinski@xxxxxxxxx> - 2.0-1 - Updated to 2.0 (BZ #1198580) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1198580 - drupal7-l10n_update-2.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1198580 -------------------------------------------------------------------------------- ================================================================================ eclipse-mdt-ocl-5.0.4-2.fc21 (FEDORA-2015-5818) Implementation of the OCL OMG meta-model for Eclipse -------------------------------------------------------------------------------- Update Information: Updates to Luna SR2 versions. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mat Booth <mat.booth@xxxxxxxxxx> - 5.0.4-2 - Fix context qualifiers * Tue Apr 7 2015 Mat Booth <mat.booth@xxxxxxxxxx> - 5.0.4-1 - Update to latest upstream release * Thu Oct 2 2014 Mat Booth <mat.booth@xxxxxxxxxx> - 5.0.2-1 - Update to latest upstream release - Drop no longer needed patch, BR eclipse-license -------------------------------------------------------------------------------- ================================================================================ eclipse-mdt-uml2-5.0.2-2.fc21 (FEDORA-2015-5818) Implementation of the UML2 OMG meta-model for Eclipse -------------------------------------------------------------------------------- Update Information: Updates to Luna SR2 versions. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mat Booth <mat.booth@xxxxxxxxxx> - 5.0.2-2 - Fix context qualifiers * Tue Apr 7 2015 Mat Booth <mat.booth@xxxxxxxxxx> - 5.0.2-1 - Update to latest upstream release -------------------------------------------------------------------------------- ================================================================================ fail2ban-0.9.1-4.fc21 (FEDORA-2015-5851) Daemon to ban hosts that cause multiple authentication errors -------------------------------------------------------------------------------- Update Information: Do not load user paths for fail2ban-{client,server} -------------------------------------------------------------------------------- ChangeLog: * Mon Mar 16 2015 Orion Poplawski <orion@xxxxxxxxxxxxx> - 0.9.1-4 - Do not load user paths for fail2ban-{client,server} (bug #1202151) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1202151 - SELinux is preventing /usr/bin/python2.7 from 'read' accesses on the directory /root/.local/lib/python2.7/site-packages. https://bugzilla.redhat.com/show_bug.cgi?id=1202151 -------------------------------------------------------------------------------- ================================================================================ gfs2-utils-3.1.8-1.fc21 (FEDORA-2015-5836) Utilities for managing the global file system (GFS2) -------------------------------------------------------------------------------- Update Information: This updates gfs2-utils to version 3.1.8 which includes the following changes: - Performance improvements in fsck.gfs2, mkfs.gfs2 and gfs2_edit savemeta. - Better checking of journals, the jindex, system inodes and inode 'goal' values in fsck.gfs2 - gfs2_jadd and gfs2_grow are now separate programs instead of symlinks to mkfs.gfs2. - Improved test suite and related documentation. - No longer clobbers the configure script's --sbindir option. - No longer depends on perl. - Various minor bug fixes and enhancements. -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Andrew Price <anprice@xxxxxxxxxx> - 3.1.8-1 - New upstream release - Remove perl dependency - Update spec per the latest packaging guidelines -------------------------------------------------------------------------------- ================================================================================ globus-common-15.29-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Common Library -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 15.29-1 - GT6 update - Drop patch globus-common-disable-network-tests.patch Use NO_EXTERNAL_NET environment variable implemented upstream instead -------------------------------------------------------------------------------- ================================================================================ globus-gatekeeper-10.10-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Globus Gatekeeper -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 10.10-1 - GT6 update -------------------------------------------------------------------------------- ================================================================================ globus-gridftp-server-7.25-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Globus GridFTP Server -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 7.25-1 - GT6 update (Fix order of drivers when using netmgr) -------------------------------------------------------------------------------- ================================================================================ globus-scheduler-event-generator-5.11-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Scheduler Event Generator -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 5.11-1 - GT6 update -------------------------------------------------------------------------------- ================================================================================ globus-simple-ca-4.19-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Simple CA Utility -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 4.19-1 - GT6 update (Add support for additional DN components) -------------------------------------------------------------------------------- ================================================================================ globus-xio-5.8-1.fc21 (FEDORA-2015-5866) Globus Toolkit - Globus XIO Framework -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 5.8-1 - GT6 update (Check push result in globus_xio_driver_list_to_stack_attr) -------------------------------------------------------------------------------- ================================================================================ hedgewars-0.9.21.1-4.fc21 (FEDORA-2015-5858) Funny turn-based artillery game, featuring fighting Hedgehogs! -------------------------------------------------------------------------------- Update Information: Fixes rpath issue -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Bruno Wolff III <bruno@xxxxxxxx> - 0.9.21.1-4 - Fix rpath issue - Fix appdata issues -------------------------------------------------------------------------------- References: [ 1 ] Bug #1200193 - Hedgewars - Error The game engine died unexpectedly! https://bugzilla.redhat.com/show_bug.cgi?id=1200193 -------------------------------------------------------------------------------- ================================================================================ isync-1.2.0-2.fc21 (FEDORA-2015-5842) A tool to synchronize IMAP4 and Maildir mailboxes -------------------------------------------------------------------------------- Update Information: Build against cyrus-sasl-devel Update to new upstream version 1.2.0 (rhbz#1208851, rhbz#1193063) -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Ralph Bean <rbean@xxxxxxxxxx> - 1.2.0-2 - Build against cyrus-sasl-devel * Sun Apr 5 2015 Fabian Affolter <mail@xxxxxxxxxxxxxxxxxx> - 1.2.0-1 - Update to new upstream version 1.2.0 (rhbz#1208851, rhbz#1193063) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1209597 - [PATCH] Needs to be built against sasl https://bugzilla.redhat.com/show_bug.cgi?id=1209597 [ 2 ] Bug #1208851 - isync-1.2.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1208851 [ 3 ] Bug #1193063 - mbsync no longer syncs old Maildir after updating to 1.1.2 https://bugzilla.redhat.com/show_bug.cgi?id=1193063 -------------------------------------------------------------------------------- ================================================================================ kde-plasma-nm-0.9.3.6-1.fc21 (FEDORA-2015-5800) Plasma applet written in QML for managing network connections -------------------------------------------------------------------------------- Update Information: Plasma-nm 0.9.3.6 release. See https://grulja.wordpress.com/2015/04/08/plasma-nm-0-9-3-6-release/. Networkmanager-qt 0.9.8.4 release. See http://lamarque-lvs.blogspot.cz/2015/04/networkmanagerqt-0984-is-out.html. -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Jan Grulich <jgrulich@xxxxxxxxxx> - 0.9.3.6-1 - Update to 0.9.3.6 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1206449 - Openconnect dialog log does not display log correctly https://bugzilla.redhat.com/show_bug.cgi?id=1206449 -------------------------------------------------------------------------------- ================================================================================ knot-1.6.3-1.fc21 (FEDORA-2015-5813) An authoritative DNS daemon -------------------------------------------------------------------------------- Update Information: new upstream release -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Jan Vcelak <jvcelak@xxxxxxxxxxxxxxxxx> 1.6.3-1 - new upstream release: + fix: performance drop for NSEC-signed zones + fix: proper handling of TCP short-writes + fix: possible out-of-bound reads in zone parser and packet parser + feature: CDS and CDNSKEY support in zone parser + improvement: add defaults for TCP config options into documentation + improvement: detailed error message if zone reload fails -------------------------------------------------------------------------------- ================================================================================ kosmtik-0.0.9-3.fc21 (FEDORA-2015-5806) Make maps with OpenStreetMap and Mapnik -------------------------------------------------------------------------------- Update Information: Update to fix dependency breakage caused by update to new major version of mozilla-fira-fonts. -------------------------------------------------------------------------------- ChangeLog: * Tue Dec 9 2014 Tom Hughes <tom@xxxxxxxxxx> - 0.0.9-3 - Update for mozilla-fira-sans 3.111 -------------------------------------------------------------------------------- ================================================================================ libkpeople-0.3.0-3.fc21 (FEDORA-2015-5815) Meta-contact aggregation library -------------------------------------------------------------------------------- Update Information: Use non-conflicting libkpeople4 translation catalog. -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Rex Dieter <rdieter@xxxxxxxxxxxxxxxxx> - 0.3.0-3 - use non-conflicting libkpeople4 translation catalog (#1208946) - minor .spec cleanup * Fri Nov 14 2014 Rex Dieter <rdieter@xxxxxxxxxxxxxxxxx> 0.3.0-2 - -devel: own %{_kde4_libdir}/cmake/KPeople/ -------------------------------------------------------------------------------- References: [ 1 ] Bug #1208946 - libkpeople.mo from install of kf5-kpeople-5.8.0-1.fc21.x86_64 conflicts with file from package libkpeople-0.3.0-1.fc21.x86_64 https://bugzilla.redhat.com/show_bug.cgi?id=1208946 -------------------------------------------------------------------------------- ================================================================================ libnm-qt-0.9.8.4-1.fc21 (FEDORA-2015-5800) Qt-only wrapper for NetworkManager DBus API -------------------------------------------------------------------------------- Update Information: Plasma-nm 0.9.3.6 release. See https://grulja.wordpress.com/2015/04/08/plasma-nm-0-9-3-6-release/. Networkmanager-qt 0.9.8.4 release. See http://lamarque-lvs.blogspot.cz/2015/04/networkmanagerqt-0984-is-out.html. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Jan Grulich <jgrulich@xxxxxxxxxx> - 2:0.9.8.4-1 - Update to 0.9.8.4 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1206449 - Openconnect dialog log does not display log correctly https://bugzilla.redhat.com/show_bug.cgi?id=1206449 -------------------------------------------------------------------------------- ================================================================================ libspf2-1.2.10-5.20150405gitd57d79fd.fc21 (FEDORA-2015-5860) An implementation of the SPF specification -------------------------------------------------------------------------------- Update Information: initial release for Fedora and EPEL -------------------------------------------------------------------------------- References: [ 1 ] Bug #1057874 - Review Request: libspf2 - Implementation of the Sender Policy Framework for SMTP authorization https://bugzilla.redhat.com/show_bug.cgi?id=1057874 -------------------------------------------------------------------------------- ================================================================================ libxmp-4.3.8-1.fc21 (FEDORA-2015-5873) A multi-format module playback library -------------------------------------------------------------------------------- Update Information: Numerous bugfixes. Upstream changelog: https://sourceforge.net/projects/xmp/files/libxmp/4.3.8/Changelog/view -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Dominik Mierzejewski <rpm@xxxxxxxxxxxxxx> - 4.3.8-1 - update to 4.3.8 (http://sourceforge.net/projects/xmp/files/libxmp/4.3.8/Changelog/view) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1205001 - libxmp-4.3.8 is available https://bugzilla.redhat.com/show_bug.cgi?id=1205001 -------------------------------------------------------------------------------- ================================================================================ ltrace-0.7.91-15.fc21 (FEDORA-2015-5862) Tracks runtime library calls from dynamically linked executables -------------------------------------------------------------------------------- Update Information: - Fix tracing of multi-threaded processes when -f command line flag is not given. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Petr Machata <pmachata@xxxxxxxxxx> - 0.7.91-15 - Add upstream fixes for compilation of test cases (ltrace-0.7.91-testsuite-includes.patch, ltrace-0.7.91-testsuite-includes-2.patch) * Wed Apr 8 2015 Petr Machata <pmachata@xxxxxxxxxx> - 0.7.91-14 - Add upstream fixes for tracing multi-threaded processes without -f (ltrace-0.7.91-multithread-no-f-1.patch, ltrace-0.7.91-multithread-no-f-2.patch) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1208351 - ltrace: handle_event.c:623: handle_x_sysret: Assertion `d > 0' failed. https://bugzilla.redhat.com/show_bug.cgi?id=1208351 -------------------------------------------------------------------------------- ================================================================================ lz4-r128-2.fc21 (FEDORA-2015-5808) Extremely fast compression algorithm -------------------------------------------------------------------------------- Update Information: - New release - New -static sub package - Fixed missing debuginfo for liblz4 -------------------------------------------------------------------------------- ChangeLog: * Mon Apr 6 2015 pjp <pjp@xxxxxxxxxxxxxxxxx> - r128-2 - Update files section to install unlz4 & its manual * Wed Apr 1 2015 pjp <pjp@xxxxxxxxxxxxxxxxx> - r128-1 - lz4cli sparse file support - Restored lz4hc compression ratio - lz4 cli supports long commands - Introduced lz4-static sub package BZ#1208203 * Thu Jan 8 2015 pjp <pjp@xxxxxxxxxxxxxxxxx> - r127-2 - Bump dist to override an earlier build. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1204611 - liblz4 missing valid debuginfo https://bugzilla.redhat.com/show_bug.cgi?id=1204611 [ 2 ] Bug #1207664 - lz4-r128 is available https://bugzilla.redhat.com/show_bug.cgi?id=1207664 [ 3 ] Bug #1208203 - RFE: Add lz4-static subpackage build to 'Everything' to allow for zlib-static migration https://bugzilla.redhat.com/show_bug.cgi?id=1208203 -------------------------------------------------------------------------------- ================================================================================ mkvtoolnix-7.8.0-1.fc21 (FEDORA-2015-5835) Matroska container manipulation utilities -------------------------------------------------------------------------------- Update Information: >From upstream changelog (https://www.bunkus.org/videotools/mkvtoolnix/doc/ChangeLog): * build system: Boost's »Math« library is now required. * mkvmerge: bug fix: HEVC tracks which did not have an aspect ratio present in their sequence parameter set were copied incorrectly; the resulting sequence parameter set was invalid. Fixes #1081. * mkvextract: bug fix: When extracting HEVC tracks mkvextract will use the same start code lengths that x265 uses (four bytes 0x00000001 for the first and video/picture/sequence parameter set NALs and three bytes 0x000001 for all others). * mkvmerge: enhancement: File type identification will output a more detailed description of the DTS type for DTS audio tracks (DTS-HD Master Audio, DTS-HD High Resolution, DTS Express or just plain DTS). Implements #1109. * mkvmerge: new feature: Implemented support for DTS Express. * mkvmerge: bug fix: The number of channels in DTS tracks with more than six channels is now recognized correctly by parsing the DTS HD extensions, too. Fixes #1139. * all: new feature: added a Swedish translation of the programs by Kristoffer Grundström (see AUTHORS). * mkvmerge: bug fix: Fixed handling of the BITIMAPINFOHEADER extra data size handling during merging and extraction for codecs like HuffYUV. * mkvmerge: bug fix: When appending unframed HEVC/h.265 tracks and setting the default duration the second and all following source parts will use the same default duration as set for the first part. Fixes #1147. * mkvmerge: bug fix: enabled the use of tags in WebM files. Tagging elements not supported by the WebM specs are removed. Fixes #1143. * mkvmerge: bug fix: fixed detection of audio tracks in QuickTime files whose FourCC code is unknown to mkvmerge. * mkvmerge: bug fix: fixed detection of video tracks in QuickTime files whose FourCC code is unknown to mkvmerge. * mkvextract: bug fix: Fixed VobSub file naming when mkvextract is built against Boost::Filesystem older than 1.50.0. Fixes #1140. * mkvmerge: bug fix: fixed detection of Cinepak video tracks in QuickTime files. * mkvmerge: bug fix: fixed detection of PCM audio tracks in QuickTime files using the »raw « FourCC. * mkvmerge: bug fix: fixed detection of tracks in Flash Video files for which the headers do not signal a track. * mkvmerge: bug fix: fixed a segfault in the Flash Video file format reader. * mmg: The change making the window wider by default has been reverted. * mkvmerge: bug fix: Fixed file type detection for MP3 files with big ID3 tags at the start of the file (e.g. if they contain cover images). * mkvinfo (Qt interface): enhancement: implemented support for opening files via drag & drop. * mkvmerge: enhancement: added an option (--engage no_delay_for_garbage_in_avi) for disabling deriving a delay from garbage in audio tracks in AVI files. Requested in #1137. * mkvmerge: bug fix: The formula used for calculating the audio delay for garbage data at the start of tracks in AVI files has been fixed. Fixes #1137. -------------------------------------------------------------------------------- ChangeLog: * Mon Mar 30 2015 Dominik Mierzejewski <rpm@xxxxxxxxxxxxxx> 7.8.0-1 - update to 7.8.0 - fix building tools - unbundle utf8cpp -------------------------------------------------------------------------------- References: [ 1 ] Bug #1206858 - mkvtoolnix-7.8.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1206858 -------------------------------------------------------------------------------- ================================================================================ myproxy-6.1.13-1.fc21 (FEDORA-2015-5866) Manage X.509 Public Key Infrastructure (PKI) security credentials -------------------------------------------------------------------------------- Update Information: Globus Toolkit updates: * myproxy 6.1.13 * globus-xio 5.8 * globus-simple-ca 4.19 * globus-scheduler-event-generator 5.11 * globus-gridftp-server 7.25 * globus-gatekeeper 10.10 * globus-common 15.29 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mattias Ellert <mattias.ellert@xxxxxxxxxxxx> - 6.1.13-1 - Update to 6.1.13 -------------------------------------------------------------------------------- ================================================================================ netcf-0.2.8-1.fc21 (FEDORA-2015-5872) Cross-platform network configuration library -------------------------------------------------------------------------------- Update Information: Security fix for CVE 2014-8119, as well as adding a few other minor bugfixes and enhancements (support for multiple IPv4 addresses, simultaneous static & dhcp for IPv4) -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Laine Stump <laine@xxxxxxxxxx> - 0.2.8-1 - rebase to netcf-0.2.8 - resolve CVE-2014-8119 - Fix build on systems with newer libnl3 that doesn't - support multiple IPv4 addresses in interface config (redhat driver) - allow static IPv4 config simultaneous with DHCPv4 (redhat driver) - recognize IPADDR0/NETMASK0/PREFIX0 - remove extra quotes from IPV6ADDR_SECONDARIES (redhat+suse drivers) - miscellaneous systemd service fixes - use git to apply patches in rpm specfile - revert the 0.2.6-2 specfile patch mentioned below (now fixed properly) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1172176 - CVE-2014-8119 netcf: augeas path expression injection via interface name https://bugzilla.redhat.com/show_bug.cgi?id=1172176 -------------------------------------------------------------------------------- ================================================================================ ntfs-3g-2015.3.14-1.fc21 (FEDORA-2015-5846) Linux NTFS userspace driver -------------------------------------------------------------------------------- Update Information: Update ntfs-3g to 2015.3.14. Rebuild testdisk against it. -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Tom Callaway <spot@xxxxxxxxxxxxxxxxx> 2:2015.3.14-1 - update to 2015.3.14 * Sat Feb 21 2015 Till Maas <opensource@xxxxxxxxx> - 2:2014.2.15-8 - Rebuilt for Fedora 23 Change https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code -------------------------------------------------------------------------------- ================================================================================ ntp-4.2.6p5-29.fc21 (FEDORA-2015-5830) The NTP daemon and utilities -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-1799, CVE-2015-1798 -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Miroslav Lichvar <mlichvar@xxxxxxxxxx> 4.2.6p5-29 - reject packets without MAC when authentication is enabled (CVE-2015-1798) - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799) * Thu Feb 26 2015 Miroslav Lichvar <mlichvar@xxxxxxxxxx> 4.2.6p5-28 - don't step clock for leap second with -x option (#1196635) - allow creating all SHM segments with owner-only access - allow symmetric keys up to 32 bytes again - use larger RSA exponent in ntp-keygen - fix crash in ntpq mreadvar command - don't drop packets with source port below 123 - increase memlock limit again - fix typos in ntpd man page - improve documentation of restrict command -------------------------------------------------------------------------------- References: [ 1 ] Bug #1199435 - CVE-2015-1799 ntp: authentication doesn't protect symmetric associations against DoS attacks https://bugzilla.redhat.com/show_bug.cgi?id=1199435 [ 2 ] Bug #1199430 - CVE-2015-1798 ntp: ntpd accepts unauthenticated packets with symmetric key crypto https://bugzilla.redhat.com/show_bug.cgi?id=1199430 -------------------------------------------------------------------------------- ================================================================================ orthanc-0.8.6-1.fc21 (FEDORA-2015-5850) RESTful DICOM server for healthcare and medical research -------------------------------------------------------------------------------- Update Information: This version of orthanc introduces initial supports of plugins such as the PostgreSQL backend. This is a major feature that allows Orthanc to be used in a medium/large hospital setting. There are no ABI/API changes nor need to upgrade the db schema. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Mario Ceresa <mrceresa@xxxxxxxxx> 0.8.6-1 - New upstrean version * Mon Jan 26 2015 Petr Machata <pmachata@xxxxxxxxxx> - 0.8.5-3 - Rebuild for boost 1.57.0 * Tue Dec 16 2014 Mario Ceresa <mrceresa@xxxxxxxxx> 0.8.5-2 - Rebuild for dcmtk update -------------------------------------------------------------------------------- ================================================================================ osbs-0.2-2.c1216ba.fc21 (FEDORA-2015-5871) Python module and command line client for OpenShift Build Service -------------------------------------------------------------------------------- Update Information: Update to latest git version. New package: Python module and command line client for OpenShift Build Service. new upstream release: 0.2 new upstream release: 0.2 New package: Python module and command line client for OpenShift Build Service. new upstream release: 0.2 New package: Python module and command line client for OpenShift Build Service. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1205201 - [abrt] osbs: __init__.py:2320:resolve:ImportError: 'module' object has no attribute 'run' https://bugzilla.redhat.com/show_bug.cgi?id=1205201 [ 2 ] Bug #1203801 - Review Request: osbs - Python module and command line client for OpenShift Build Service https://bugzilla.redhat.com/show_bug.cgi?id=1203801 -------------------------------------------------------------------------------- ================================================================================ perl-License-Syntax-0.13-1.fc21 (FEDORA-2015-5826) Coding and decoding of license strings using SPDX and SUSE syntax -------------------------------------------------------------------------------- Update Information: License::Syntax is an object oriented module. When constructing new License::Syntax objects, you can provide a mapping table for license names. The table is used for recognizing alternate alias names for the licenses (left hand side) and also defines the canonical short names of the licenses (right hand side). The mapping table is consulted twice, before and after decoding the syntax, thus non-terminal mappings may actually be followed. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1208509 - Review Request: perl-License-Syntax - Coding and decoding of license strings using SPDX and SUSE syntax https://bugzilla.redhat.com/show_bug.cgi?id=1208509 -------------------------------------------------------------------------------- ================================================================================ perl-MCE-1.605-1.fc21 (FEDORA-2015-5856) Many-core Engine for Perl providing parallel processing capabilities -------------------------------------------------------------------------------- Update Information: A new version of MCE is available. See http://cpansearch.perl.org/src/MARIOROY/MCE-1.605/CHANGES for details on changes in this release. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Petr Šabata <contyk@xxxxxxxxxx> - 1.605-1 - 1.605 bump -------------------------------------------------------------------------------- References: [ 1 ] Bug #1209148 - perl-MCE-1.605 is available https://bugzilla.redhat.com/show_bug.cgi?id=1209148 -------------------------------------------------------------------------------- ================================================================================ perl-Module-Signature-0.77-1.fc21 (FEDORA-2015-5833) CPAN signature management utilities and modules -------------------------------------------------------------------------------- Update Information: This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behaviour is included in this update. Security issues: * Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries. * When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during "make test". * Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process. * Module::Signature before version 0.75 has been loading several modules at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in @INC. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Paul Howarth <paul@xxxxxxxxxxxx> - 0.77-1 - Update to 0.77 - Include the latest public keys of PAUSE, ANDK and AUDREYT - Clarify scripts/cpansign copyright to CC0 (#965126, CPAN RT#85466) * Wed Apr 8 2015 Paul Howarth <paul@xxxxxxxxxxxx> - 0.76-1 - Update to 0.76 - Fix signature tests by defaulting to verify(skip=>1) when $ENV{TEST_SIGNATURE} is true * Tue Apr 7 2015 Paul Howarth <paul@xxxxxxxxxxxx> - 0.75-1 - Update to 0.75 - Fix GPG signature parsing logic - MANIFEST.SKIP is no longer consulted unless --skip is given - Properly use open() modes to avoid injection attacks - More protection of @INC from relative paths - Don't try to run the signature test, which needs the network * Wed Aug 27 2014 Jitka Plesnikova <jplesnik@xxxxxxxxxx> - 0.73-5 - Perl 5.20 rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #1209911 - perl-Module-Signature: unsigned files interpreted as signed in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209911 [ 2 ] Bug #1209915 - perl-Module-Signature: arbitrary code execution during test phase https://bugzilla.redhat.com/show_bug.cgi?id=1209915 [ 3 ] Bug #1209917 - perl-Module-Signature: arbitrary code execution when verifying module signatures https://bugzilla.redhat.com/show_bug.cgi?id=1209917 [ 4 ] Bug #1209918 - perl-Module-Signature: arbitrary modules loading in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209918 -------------------------------------------------------------------------------- ================================================================================ perl-Test-Signature-1.11-1.fc21 (FEDORA-2015-5833) Automated SIGNATURE testing -------------------------------------------------------------------------------- Update Information: This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behaviour is included in this update. Security issues: * Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries. * When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during "make test". * Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process. * Module::Signature before version 0.75 has been loading several modules at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in @INC. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Paul Howarth <paul@xxxxxxxxxxxx> - 1.11-1 - Update to 1.11 - Compatibility with Module::Signature 0.75+ - Classify buildreqs by usage - Don't use macros for commands - Avoid clobbering ~/.gnupg for local builds - Make %files list more explicit - Drop %defattr, redundant since rpm 4.4 - Import upstream's GPG key in %prep so we don't need to fetch it from a keyserver when running the signature test * Tue Aug 26 2014 Jitka Plesnikova <jplesnik@xxxxxxxxxx> - 1.10-18 - Perl 5.20 rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #1209911 - perl-Module-Signature: unsigned files interpreted as signed in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209911 [ 2 ] Bug #1209915 - perl-Module-Signature: arbitrary code execution during test phase https://bugzilla.redhat.com/show_bug.cgi?id=1209915 [ 3 ] Bug #1209917 - perl-Module-Signature: arbitrary code execution when verifying module signatures https://bugzilla.redhat.com/show_bug.cgi?id=1209917 [ 4 ] Bug #1209918 - perl-Module-Signature: arbitrary modules loading in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209918 -------------------------------------------------------------------------------- ================================================================================ php-pear-DB-DataObject-1.11.4-1.fc21 (FEDORA-2015-5854) An SQL Builder, Object Interface to Database Tables -------------------------------------------------------------------------------- Update Information: Minor feature and fix release. (Basically a yearly release now..) * #20291 Ignored in update $dao->field = 0 (fix bad check for null) * #20149 - correct free for linked objects / more detailed error reporting on update error * #19962 - Cannot insert or update when part of a reference in multi-key case is NULL by vtamma * #19973 - accept START TRANSACTION as an alias for BEGIN * suuport for useindex (mysql only) and * #19922 - pear error not being set in static property. * fix static infront of depricated staticget() method and fix call to PEAR:: static calls. * Fix some static errors that are now fatal unfortunatly... * fix building of autojoin when using distinct columns -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Remi Collet <remi@xxxxxxxxxxxxxxxxx> - 1.11.4 - update to 1.11.3 -------------------------------------------------------------------------------- ================================================================================ php-phpunit-PHP-TokenStream-1.4.1-1.fc21 (FEDORA-2015-5801) Wrapper around PHP tokenizer extension -------------------------------------------------------------------------------- Update Information: * Add PHP_Token_IN and PHP_Token_JOIN to the list of tokens introduced in HackLang -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Remi Collet <remi@xxxxxxxxxxxxxxxxx> - 1.4.1-1 - Update to 1.4.1 -------------------------------------------------------------------------------- ================================================================================ publicsuffix-list-20150407-1.fc21 (FEDORA-2015-5861) Cross-vendor public domain suffix database -------------------------------------------------------------------------------- Update Information: The latest revision - 20150407 The latest revision - 20150404 -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Yanko Kaneti <yaneti@xxxxxxxxxxx> - 20150407-1 - The latest revision - 20150407 * Sat Apr 4 2015 Yanko Kaneti <yaneti@xxxxxxxxxxx> - 20150404-1 - The latest revision - 20150404 -------------------------------------------------------------------------------- ================================================================================ recoll-1.20.5-1.fc21 (FEDORA-2015-5844) Desktop full text search tool with Qt GUI -------------------------------------------------------------------------------- Update Information: Add kio support and update to latest upstream release recoll 1.20.5. -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Terje Rosten <terje.rosten@xxxxxxx> - 1.20.5-1 - 1.20.5 - Include kio support (bz#1203257) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1203257 - build recoll kio slave for kde? https://bugzilla.redhat.com/show_bug.cgi?id=1203257 -------------------------------------------------------------------------------- ================================================================================ rubygem-byebug-4.0.5-1.fc21 (FEDORA-2015-5820) Ruby 2.0 fast debugger - base + CLI -------------------------------------------------------------------------------- Update Information: New version 4.0.5 is released. -------------------------------------------------------------------------------- ChangeLog: * Fri Apr 3 2015 Mamoru TASAKA <mtasaka@xxxxxxxxxxxxxxxxx> - 4.0.5-1 - 4.0.5 -------------------------------------------------------------------------------- ================================================================================ rubygem-gtksourceview3-2.2.4-1.fc21 (FEDORA-2015-5802) Ruby binding of gtksourceview-3.x -------------------------------------------------------------------------------- Update Information: This is a new package. -------------------------------------------------------------------------------- ================================================================================ rubygem-nenv-0.2.0-2.fc21 (FEDORA-2015-5832) Convenience wrapper for Ruby's ENV -------------------------------------------------------------------------------- Update Information: Convenience wrapper for Ruby's ENV. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1200157 - Review Request: rubygem-nenv - Convenience wrapper for Ruby's ENV https://bugzilla.redhat.com/show_bug.cgi?id=1200157 -------------------------------------------------------------------------------- ================================================================================ springlobby-0.195-2.fc21 (FEDORA-2015-5827) A lobby client for the spring RTS game engine -------------------------------------------------------------------------------- Update Information: -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Ralf Corsépius <corsepiu@xxxxxxxxxxxxxxxxx> - 0.195-2 - Update to 0.195 (Merger from f20). - Fix FTBFS. - spec-file cleanup. - Drop springlobby-dso.patch, springlobby-gtkfix.patch. * Thu Mar 26 2015 Richard Hughes <rhughes@xxxxxxxxxx> - 0.169-12 - Add an AppData file for the software center -------------------------------------------------------------------------------- ================================================================================ testdisk-6.14-6.fc21 (FEDORA-2015-5846) Tool to check and undelete partition, PhotoRec recovers lost files -------------------------------------------------------------------------------- Update Information: Update ntfs-3g to 2015.3.14. Rebuild testdisk against it. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Tom Callaway <spot@xxxxxxxxxxxxxxxxx> - 6.14-6 - rebuild for new ntfs-3g -------------------------------------------------------------------------------- ================================================================================ xforms-1.2.4-2.fc21 (FEDORA-2015-5845) XForms toolkit library -------------------------------------------------------------------------------- Update Information: XForms 1.2.4 ============ * lib/forms.c: an object that isn't visible could become the focus object, which was an insidious bug :-( * Lots of minor corrections * lib/input.c: some more corrections. * lib/input.c: Attempt to fix bugs and inconsistencies reported by Lucas Sköldqvist. * lib.bitmaps/colorwheel.xpm: number of colors reduced since this bitmap alone was resposible for over a third of the size of the tar ball. * lib/goodie_colchooser.c: new goodie for picking arbitrary colors interactively added. * lib/positioner.c: major changes: range of values can now be controlled via a validation function. New functions for setting both alues at once and getting the current boundary settings. Drawing now is done differently (instead of XOR current background is stored and redrawn). Mouse is hidden while over positioner and active. * lib/positioner.c: step values are now also factored in when a new x- or y-value gets set by the user. * lib/spinner.c: Bug in handling of FL_FLOAT_SPINNER fixed. * lib/xyplot.c: fl_set_xyplot_mouse_buttons() and fl_get_xyplot_mouse_buttons() added and clean-up of code to fix memory leaks. * lib/slider.c: Function for selecting mouse buttons added. * lib/input.c: Validator for dates improved+ * lib/input.c: Further bug fixes and code simplifications * lib/input.c: Bugs found by Lucas Sköldqvist in input objects (hopefully) fixed. * lib/fonts.c: Bug in font caching code, found by "Sunny", that could result in crashes fixed. * Some minor fixes for object label alignment * */Makefile.am: Removed '-Wl,--no-undefined' since this linker flag is not available everywhere * lib/flinternal.h: Removed stupid definition of variables - thanks go to André Ludwig for noticing the problem. * lib/objects.c: Another attempt at speeding-up redraws * lib/objects.c: Speed-up for redraws * lib/menu.c: Fix by Lothar Esser added for bug in menu handling. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 8 2015 Robert Scheck <robert@xxxxxxxxxxxxxxxxx> - 1.2.4-2 - Some minor spec file tweaks * Wed Apr 8 2015 Robert Scheck <robert@xxxxxxxxxxxxxxxxx> - 1.2.4-1 - Upgrade to 1.2.4 -------------------------------------------------------------------------------- ================================================================================ zarafa-7.1.12-1.fc21 (FEDORA-2015-5823) Open Source Edition of the Zarafa Collaboration Platform -------------------------------------------------------------------------------- Update Information: Zarafa Collaboration Platform 7.1.12 final [48726] ================================================== * ZCP-10149: Include Documentation hint for usage of NFS and -o nolock option * ZCP-10233: Zarafa-mr-accept script complains in certain cases about php timezone functions * ZCP-10578: missing prerequisites for the reverse proxy in the administrator manual * ZCP-10639: Incorrect message when trying to add an archive * ZCP-10919: a remote admin in multi tenant mode cannot resolve users * ZCP-11061: Bandwidth requirement documentation * ZCP-11413: Monitor complains on unused config options. * ZCP-11418: Compat features do not work with outlook 2010 and windows 8 * ZCP-11468: Document for a user who wants to use webapp, but is experiencing problems by using an unsupported browser, an easier area to locate the list of supported browsers * ZCP-11664: Remove "you" wording from the WebApp User Manual * ZCP-11713: Japanese e-mail breaks the body text * ZCP-11744: zarafa-restore error in documentation * ZCP-11786: zarafa-ws is trying to put files in /usr/share/doc/zarafa * ZCP-11869: Documentation is not clear about Multitenant Public Folder attribute * ZCP-11929: differences between "Managing tenant (company) spaces" and zarafa-admin * ZCP-11931: Outlook Client: synchronisation of an offline profile makes zarafa-server unresponsive * ZCP-11937: Setting out of office for the first time sets language to Catalan * ZCP-11949: Update documentation to stress that one server must have one database. * ZCP-12081: AB Provider UID is defined multiple times and may cause the server to read invalid memory * ZCP-12110: Segfault zarafa-server 7.1.8 R1 * ZCP-12257: include location of the ads plugin in the manual * ZCP-12371: Add additional LDAP logging when using extended log level * ZCP-12409: zarafa-search crashes with ssl * ZCP-12424: Dagent in LMTP mode violates RFC5321 * ZCP-12461: ECDatabaseMySQL defined twice * ZCP-12488: storing attachments in files on disk is not optimal implemented * ZCP-12491: Last date of a serial MR is ignored * ZCP-12492: Private mails sent from Exchange are not marked private. * ZCP-12501: Component documentation * ZCP-12534: Sending a mail to a group: The receivers do not see the group correctly. * ZCP-12549: remove mail subject from spooler.log * ZCP-12550: Zarafa-hidden does not work for cached outlook in ZCP 7.1.10 * ZCP-12566: gsoap code gets our license attached in community distribution of zcp * ZCP-12568: ldap_uri slows down webapp and server after switching the LDAP-Server * ZCP-12574: meeting request copy to delegate - german umlauts broken * ZCP-12592: Update unsecure swfupload.swf * ZCP-12596: senddocument.php allows unauthorized upload of files * ZCP-12597: OL2013 15.0.4641.1001 shows private appointments * ZCP-12600: Sync seems to fail for larger objects * ZCP-12608: Compatibility package does not install correctly with OEM version of Outlook 2013 in every case * ZCP-12611: Cannot move appointment to different calendar * ZCP-12618: Move temporary patch definitions file to systemwide central location * ZCP-12629: zarafa-server binary does not check for existence of sockets and pids when started manually * ZCP-12657: Optimization of dagent incoming e-mail processing * ZCP-12660: Change runlevel of zarafa-licensed to start before zarafa-server * ZCP-12671: Add new OL2013 version 15.0.4659.1000 client to compatibility component * ZCP-12676: IMAP Failed to read line: Interrupted system call * ZCP-12692: Stores should not be orphaned when user_safe_mode is active, even if they are back when correcting backend * ZCP-12696: SMTP RFC store violation * ZCP-12698: compile fail with recent g++ (4.9) * ZCP-12716: mails send with x-mailer "CDO for windows 2000" loses attachments. * ZCP-12720: SMTP RFC store violation * ZCP-12754: Document that its a bad idea to switch the connection type inside a profile * ZCP-12755: Add new OL2013 version 15.0.4667.1000 client to compatibility component * ZCP-12762: remove userquota_soft_template & userquota_hard_template from documentation * ZCP-12766: zarafa-mailbox-permissions doesn't remove rules for --remove-all-permissions * ZCP-12788: Updating the name of a non-active user will change it to a active user * ZCP-12790: Message with attachments converted from uuencoded to attachments with uudecode.py * ZCP-12791: zarafa-server crashing due to ldap.cfg error * ZCP-12801: Attachments aren't written into the database * ZCP-12824: zarafa server still logs indexer instead of search. * ZCP-12845: storing attachments in files on disk is not optimal implemented * ZCP-12847: Change changelog author for debian/rhel packages * ZCP-12850: ECDatabaseMySQL defined twice * ZCP-12851: zarafa-gateway: NOOP returns with wrong return code * ZCP-12852: Reading an encypted or signed email will change the receive date of the email to server time * ZCP-12865: zarafa-gateway.cfg man page missing description of imap_max_fail_commands. * ZCP-12877: meeting request copy to delegate - german umlauts broken * ZCP-12889: Segfault zarafa-server 7.1.8 R1 * ZCP-12892: Last date of a serial MR is ignored * ZCP-12898: zarafa-webaccess no login after update to 7.1.10 on Ubuntu 10.04 * ZCP-12901: mails send with x-mailer "CDO for windows 2000" loses attachments. * ZCP-12908: zarafa-server crashing due to ldap.cfg error * ZCP-12910: Monitor complains on unused config options. * ZCP-12914: Add comment in monitor.cfg for companyquota_warning_template * ZCP-12918: zarafa spooler queues mails forever if smtpd rejects the mail * ZCP-12920: As a user I want to be able to sort the global addresses book by Chinese character * ZCP-12921: Chinese character broken once received * ZCP-12922: remove userquota_soft_template & userquota_hard_template from documentation * ZCP-12923: Building from source fails when xmlto / libical / bison is missing * ZCP-12926: ECChannel::HrSelect doesn't handle EINTR as it should * ZCP-12930: zarafa-dagent segfault when deliver special mail * ZCP-12934: When reporting this traceback, please include Linux distribution name, system architecture and Zarafa version. * ZCP-12944: another chinese decode issue * ZCP-12945: Add new OL2013 version 15.0.4675.1003 client to compatibility component * ZCP-12949: Update documentation for unsupported Oracle Packages * ZCP-12950: zarafa-dagent segfault when deliver special mail * ZCP-12968: ECChannel::HrSelect doesn't handle EINTR as it should * ZCP-12994: Disabling imap on a pop3 users breaks certain mail. * ZCP-12995: Example command given in "Out of office management" is incomplete * ZCP-13015: add SSL settings for zcp 7.1 * ZCP-13019: Update documentation for Debian language pack installation * ZCP-13020: zarafa-admin tool mismatch password gives wrong notification * ZCP-13024: allowed to create SYSTEM user * ZCP-13026: Add new OL2013 version 15.0.4693.1000 client to compatibility component * ZCP-13030: Add new OL2010 version 14.0.7143.5000 client to compatibility component * ZCP-13035: Rather use SSLCERT_FILE & SSLCERT_PASS when setting up SSO for WebApp/WebAccess * ZCP-13039: Add comment in monitor.cfg for companyquota_warning_template * ZCP-13046: Improve z-push documentation in admin manual * ZCP-13047: man page zarafa-admin --hook-store --copyto-public could use some extra information * ZCP-13055: Zarafa outlook client 7.1.11-48011 does not work well with zarafa auto updater * ZCP-13060: zarafa server still logs indexer instead of search. * ZCP-13061: Sync seems to fail for larger objects * ZCP-13062: Merge the compatibility package installation into the MSI typical install mode * ZCP-13082: patch: wrong charset in HTML * ZCP-13120: Add new OL2013 version 15.0.4701.1000 client to compatibility component * ZCP-13123: Simplification of installation targets of compat package for manifest and c2r installations * ZCP-13143: Spooler.log gives wrong messages notifications * ZCP-13153: Outlook: answering on a message in 'send items' results in a message with empty Reply-To: header. * ZCP-13154: it would be helpful if phpmapi would produce a logfile * ZCP-13155: WebAccess /etc/zarafa/webaccess/config.php is not a symlink * ZCP-13158: Upgrade OpenSSL to 1.0.1m on Win32 * ZCP-13176: zarafa-server binary does not check for existence of sockets and pids when started manually * ZCP-13177: patch: wrong charset in HTML * ZCP-13179: it would be helpful if phpmapi would produce a logfile * ZCP-13180: Spooler.log gives wrong messages notifications * ZCP-13187: Message with attachments converted from uuencoded to attachments with uudecode.py * ZCP-13190: Setting out of office for the first time sets language to Catalan * ZCP-13191: When reporting this traceback, please include Linux distribution name, system architecture and Zarafa version. * ZCP-13192: Incorrect message when trying to add an archive * ZCP-13194: remove mail subject from spooler.log * ZCP-6294: allowed to create SYSTEM user * ZCP-6443: zarafa-admin tool mismatch password gives wrong notification * ZCP-7085: Updating the name of a non-active user will change it to an active user * ZCP-7296: Extension on the administrator manual -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2015 Robert Scheck <robert@xxxxxxxxxxxxxxxxx> 7.1.12-1 - Upgrade to 7.1.12 - Added multiple minor enhancement and bugfix patches - Added patch to fix CVE-2014-0103 for PHP < 5.3 (#1073618) - Handle "su" option in logrotate >= 3.8.0 to avoid errors -------------------------------------------------------------------------------- References: [ 1 ] Bug #1139442 - CVE-2014-9465 zarafa: unauthenticated denial of service flaw https://bugzilla.redhat.com/show_bug.cgi?id=1139442 -------------------------------------------------------------------------------- -- test mailing list test@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe: https://admin.fedoraproject.org/mailman/listinfo/test
