CentOS Errata and Enhancement Advisory 2017:3052
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
x86_64:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
Source:
f3d624d4b5340378fb0eee2f99d9269c6847ff4487c4997afcb6e28c6a7b82be tzdata-2017c-1.el6.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Wednesday, October 25, 2017
Tuesday, October 24, 2017
[USN-3425-2] Apache HTTP Server vulnerability
==========================================================================
Ubuntu Security Notice USN-3425-2
October 24, 2017
apache2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Apache HTTP Server could be made to expose sensitive information over
the network.
Software Description:
- apache2: Apache HTTP server
Details:
USN-3425-1 fixed a vulnerability in Apache HTTP Server. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a
remote attacker could possibly use this issue to read arbitrary server
memory, including sensitive information. This issue is known as
Optionsbleed.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
apache2.2-bin 2.2.22-1ubuntu1.14
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3425-2
https://www.ubuntu.com/usn/usn-3425-1
CVE-2017-9798
Ubuntu Security Notice USN-3425-2
October 24, 2017
apache2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Apache HTTP Server could be made to expose sensitive information over
the network.
Software Description:
- apache2: Apache HTTP server
Details:
USN-3425-1 fixed a vulnerability in Apache HTTP Server. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a
remote attacker could possibly use this issue to read arbitrary server
memory, including sensitive information. This issue is known as
Optionsbleed.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
apache2.2-bin 2.2.22-1ubuntu1.14
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3425-2
https://www.ubuntu.com/usn/usn-3425-1
CVE-2017-9798
[USN-3388-2] Subversion vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3388-2
October 24, 2017
subversion vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Subversion.
Software Description:
- subversion: Advanced version control system
Details:
USN-3388-1 fixed several vulnerabilities in Subversion. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Ivan Zhakov discovered that Subversion did not properly handle
some requests. A remote attacker could use this to cause a
denial of service. (CVE-2016-2168)
Original advisory details:
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. (CVE-2016-2167)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libapache2-svn 1.6.17dfsg-3ubuntu3.7
libsvn1 1.6.17dfsg-3ubuntu3.7
subversion 1.6.17dfsg-3ubuntu3.7
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3388-2
https://www.ubuntu.com/usn/usn-3388-1
CVE-2016-2167, CVE-2016-2168, CVE-2017-9800
Ubuntu Security Notice USN-3388-2
October 24, 2017
subversion vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Subversion.
Software Description:
- subversion: Advanced version control system
Details:
USN-3388-1 fixed several vulnerabilities in Subversion. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Ivan Zhakov discovered that Subversion did not properly handle
some requests. A remote attacker could use this to cause a
denial of service. (CVE-2016-2168)
Original advisory details:
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. (CVE-2016-2167)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libapache2-svn 1.6.17dfsg-3ubuntu3.7
libsvn1 1.6.17dfsg-3ubuntu3.7
subversion 1.6.17dfsg-3ubuntu3.7
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3388-2
https://www.ubuntu.com/usn/usn-3388-1
CVE-2016-2167, CVE-2016-2168, CVE-2017-9800
[USN-3411-2] Bazaar vulnerability
==========================================================================
Ubuntu Security Notice USN-3411-2
October 24, 2017
bzr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Bazaar could be made run programs as your login if it opened a
specially crafted URL.
Software Description:
- bzr: easy to use distributed version control system
Details:
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
bzr 2.5.1-0ubuntu2.1
python-bzrlib 2.5.1-0ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3411-2
https://www.ubuntu.com/usn/usn-3411-1
CVE-2017-14176
Ubuntu Security Notice USN-3411-2
October 24, 2017
bzr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Bazaar could be made run programs as your login if it opened a
specially crafted URL.
Software Description:
- bzr: easy to use distributed version control system
Details:
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
bzr 2.5.1-0ubuntu2.1
python-bzrlib 2.5.1-0ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3411-2
https://www.ubuntu.com/usn/usn-3411-1
CVE-2017-14176
Heads Up - openssl makefile and scripts for creating self signed certificates
I was asked here to merge pull request that moves the openssl makefile
and scripts for creating self signed certificates to /usr/share/doc.
I am not sure this is the right thing to do as these are definitely
still used currently.
Although it is much easier now to set up proper certificates for your
servers with Let's Encrypt, it is still not fully automatable process
(it needs at least some set up at the beginning for the first issued
certificate). Thus it cannot be included for example in rpm packages
%post scripts, etc.
At least I would like to know from maintainers of packages that depend
on openssl whether they currently use the makefile or the scripts to
create self signed certificate for the service.
Tomas Mraz
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
and scripts for creating self signed certificates to /usr/share/doc.
I am not sure this is the right thing to do as these are definitely
still used currently.
Although it is much easier now to set up proper certificates for your
servers with Let's Encrypt, it is still not fully automatable process
(it needs at least some set up at the beginning for the first issued
certificate). Thus it cannot be included for example in rpm packages
%post scripts, etc.
At least I would like to know from maintainers of packages that depend
on openssl whether they currently use the makefile or the scripts to
create self signed certificate for the service.
Tomas Mraz
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3454-2] libffi vulnerability
==========================================================================
Ubuntu Security Notice USN-3454-2
October 24, 2017
libffi vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
A security issue was fixed in libffi.
Software Description:
- libffi: Foreign Function Interface library (development files, 32bit)
Details:
USN-3454-1 fixed a vulnerability in libffi. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that libffi incorrectly enforced an executable
stack. An attacker could possibly use this issue, in combination with
another vulnerability, to facilitate executing arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libffi6 3.0.11~rc1-5ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3454-2
https://www.ubuntu.com/usn/usn-3454-1
CVE-2017-1000376
Ubuntu Security Notice USN-3454-2
October 24, 2017
libffi vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
A security issue was fixed in libffi.
Software Description:
- libffi: Foreign Function Interface library (development files, 32bit)
Details:
USN-3454-1 fixed a vulnerability in libffi. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that libffi incorrectly enforced an executable
stack. An attacker could possibly use this issue, in combination with
another vulnerability, to facilitate executing arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libffi6 3.0.11~rc1-5ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3454-2
https://www.ubuntu.com/usn/usn-3454-1
CVE-2017-1000376
[USN-3462-1] Pacemaker vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ70GeAAoJEGVp2FWnRL6TI9EP/AmyKK9Dv4qOGmfSbZktuNWm
EMq9YVCJplABq1UDeW39SnqlXNBVibNyyR7r9pemBDmsAdk46NZy1yA8ZqRxGMC6
fRpnwNWkESbbOnXiQTeiQPm9qVXLUsUeDiAaaQIOKa+Cvjb+xuAt3BNQ5wbLvCce
fs9Hz5//95TOQhoJAZLi6BHqwfH7yogXYn1/+QYz80hScFJGOZRJU+lNQHtgwnCa
uQLYWHP230gpetldK9qbYZIUBmZ1KQnYtvC79rAqwOOlZpxMbMUc1S46hYpF0nqI
c5NRlCpZx3OAzuv/SM2CIMfSe3bQvIfOQTXt73q7onetTGM8pjaKXD18qLvKgzCs
OXuZyXPbfJ/i6ZDtxpbpGWVFuyVddN9vdjsRaWONdUVbbBAXS61XVHqe4D24jv7c
zGXfUJ57NM5q7KG01FOdI7sG2vZbZpcBu2Y5t2U28BfTlfprBxJMov7j148FFY9i
95sIxhEhclNTo3n/3DiQ2jjshOiTEt/+UyeNw+dBHY8KBMcs+uimucxtsm/dphRq
fgcmyvXXQSY6TZBViqY6aIrRHE4318G9PXJmf63bdxDZVBHH2LXZUjmzIyihqK3I
xp4je+ndteESqNk+H1m/Uj1TYmHp3+uMcgoCTO00bAWYcoQ7HMYFu8gnJECpkX7W
Hu5gF+2mDX9xCtTpxYDI
=DIWV
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3462-1
October 24, 2017
pacemaker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Pacemaker.
Software Description:
- pacemaker: Cluster resource manager
Details:
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled
the IPC interface. A local attacker could possibly use this issue to
execute arbitrary code with root privileges. (CVE-2016-7035)
Alain Moulle discovered that Pacemaker incorrectly handled authentication.
A remote attacker could possibly use this issue to shut down connections,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7797)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
pacemaker 1.1.14-2ubuntu1.2
Ubuntu 14.04 LTS:
pacemaker 1.1.10+git20130802-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3462-1
CVE-2016-7035, CVE-2016-7797
Package Information:
https://launchpad.net/ubuntu/+source/pacemaker/1.1.14-2ubuntu1.2
https://launchpad.net/ubuntu/+source/pacemaker/1.1.10+git20130802-1ubuntu2.4
Version: GnuPG v2
iQIcBAEBCgAGBQJZ70GeAAoJEGVp2FWnRL6TI9EP/AmyKK9Dv4qOGmfSbZktuNWm
EMq9YVCJplABq1UDeW39SnqlXNBVibNyyR7r9pemBDmsAdk46NZy1yA8ZqRxGMC6
fRpnwNWkESbbOnXiQTeiQPm9qVXLUsUeDiAaaQIOKa+Cvjb+xuAt3BNQ5wbLvCce
fs9Hz5//95TOQhoJAZLi6BHqwfH7yogXYn1/+QYz80hScFJGOZRJU+lNQHtgwnCa
uQLYWHP230gpetldK9qbYZIUBmZ1KQnYtvC79rAqwOOlZpxMbMUc1S46hYpF0nqI
c5NRlCpZx3OAzuv/SM2CIMfSe3bQvIfOQTXt73q7onetTGM8pjaKXD18qLvKgzCs
OXuZyXPbfJ/i6ZDtxpbpGWVFuyVddN9vdjsRaWONdUVbbBAXS61XVHqe4D24jv7c
zGXfUJ57NM5q7KG01FOdI7sG2vZbZpcBu2Y5t2U28BfTlfprBxJMov7j148FFY9i
95sIxhEhclNTo3n/3DiQ2jjshOiTEt/+UyeNw+dBHY8KBMcs+uimucxtsm/dphRq
fgcmyvXXQSY6TZBViqY6aIrRHE4318G9PXJmf63bdxDZVBHH2LXZUjmzIyihqK3I
xp4je+ndteESqNk+H1m/Uj1TYmHp3+uMcgoCTO00bAWYcoQ7HMYFu8gnJECpkX7W
Hu5gF+2mDX9xCtTpxYDI
=DIWV
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3462-1
October 24, 2017
pacemaker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Pacemaker.
Software Description:
- pacemaker: Cluster resource manager
Details:
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled
the IPC interface. A local attacker could possibly use this issue to
execute arbitrary code with root privileges. (CVE-2016-7035)
Alain Moulle discovered that Pacemaker incorrectly handled authentication.
A remote attacker could possibly use this issue to shut down connections,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7797)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
pacemaker 1.1.14-2ubuntu1.2
Ubuntu 14.04 LTS:
pacemaker 1.1.10+git20130802-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3462-1
CVE-2016-7035, CVE-2016-7797
Package Information:
https://launchpad.net/ubuntu/+source/pacemaker/1.1.14-2ubuntu1.2
https://launchpad.net/ubuntu/+source/pacemaker/1.1.10+git20130802-1ubuntu2.4
Fedora 27 Final Release Readiness Meeting on Thursday, October 26 @ 19:00 UTC
Join us on irc.freenode.net in #fedora-meeting-1 for the Fedora 27
Final Release Readiness Meeting meeting.
The meeting is going to be held on Thursday, Oct 26, 2017 at 19:00
UTC. Please check the [1] link for your time zone.
We will meet to make sure we are coordinated and ready for the Final
release of Fedora 27. Please note that this meeting is going to be
held even if the release is delayed at the Go/No-Go meeting on the
same day two hours earlier.
You may received this message several times, but it is by purpose to
open this meeting to the teams and to raise awareness, so hopefully
more team representatives will come to this meeting. This meeting
works best when we have representatives from all of the teams.
For more information please check the [2] link.
[1] https://apps.fedoraproject.org/calendar/meeting/7385/
[2] https://fedoraproject.org/wiki/Release_Readiness_Meetings
Thank you for your support,
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Final Release Readiness Meeting meeting.
The meeting is going to be held on Thursday, Oct 26, 2017 at 19:00
UTC. Please check the [1] link for your time zone.
We will meet to make sure we are coordinated and ready for the Final
release of Fedora 27. Please note that this meeting is going to be
held even if the release is delayed at the Go/No-Go meeting on the
same day two hours earlier.
You may received this message several times, but it is by purpose to
open this meeting to the teams and to raise awareness, so hopefully
more team representatives will come to this meeting. This meeting
works best when we have representatives from all of the teams.
For more information please check the [2] link.
[1] https://apps.fedoraproject.org/calendar/meeting/7385/
[2] https://fedoraproject.org/wiki/Release_Readiness_Meetings
Thank you for your support,
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
F27 Server Beta & F27 Final Go/No-Go Meeting on Thursday, October 26th @ 17:00 UTC
Join us on irc.freenode.net in #fedora-meeting-1 for this important
meeting, wherein we shall determine the readiness of the Fedora 27
Server Beta [1] as well as Fedora 27 Final [2] releases.
The meeting is going to be held on Thursday, October 26th, 2017 at
17:00 UTC. Please check the links [1] and [2] for your time zone.
[1] https://apps.fedoraproject.org/calendar/meeting/7520/
[2] https://apps.fedoraproject.org/calendar/meeting/7386/
[3] https://qa.fedoraproject.org/blockerbugs/milestone/27/server-beta/buglist
[4] https://qa.fedoraproject.org/blockerbugs/milestone/27/final/buglist
Thank you in advance for your support.
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
meeting, wherein we shall determine the readiness of the Fedora 27
Server Beta [1] as well as Fedora 27 Final [2] releases.
The meeting is going to be held on Thursday, October 26th, 2017 at
17:00 UTC. Please check the links [1] and [2] for your time zone.
[1] https://apps.fedoraproject.org/calendar/meeting/7520/
[2] https://apps.fedoraproject.org/calendar/meeting/7386/
[3] https://qa.fedoraproject.org/blockerbugs/milestone/27/server-beta/buglist
[4] https://qa.fedoraproject.org/blockerbugs/milestone/27/final/buglist
Thank you in advance for your support.
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Monday, October 23, 2017
Autumn Elections 2017: Collection of questions for Questionnaire has been started
For this Election cycle [1] we are going to follow a new way how
Elections are organized. It is an outcome of a discussion on Council
level [2] trying to improve participation of the Fedora Community in
the election process.
Today we are starting collection of questions for Election
Questionnaire [3]. The collection period ends one week after the F27
Final GA date, which means there is a time at least to November 6th to
collect these questions.
For the beginning I have copied the questions from previous Election
cycle. Feel free to add more questions or modify the current questions
of the Questionnaire [3].
The full schedule of the Autumn Elections 2017 is available on the
Elections wiki page [4] and on the detailed schedule for F27 [5].
[1] https://fedoraproject.org/wiki/Elections
[2] https://pagure.io/Fedora-Council/tickets/issue/135#comment-467523
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
[4] https://fedoraproject.org/wiki/Elections
[5] https://fedorapeople.org/groups/schedule/f-27/f-27-elections.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Elections are organized. It is an outcome of a discussion on Council
level [2] trying to improve participation of the Fedora Community in
the election process.
Today we are starting collection of questions for Election
Questionnaire [3]. The collection period ends one week after the F27
Final GA date, which means there is a time at least to November 6th to
collect these questions.
For the beginning I have copied the questions from previous Election
cycle. Feel free to add more questions or modify the current questions
of the Questionnaire [3].
The full schedule of the Autumn Elections 2017 is available on the
Elections wiki page [4] and on the detailed schedule for F27 [5].
[1] https://fedoraproject.org/wiki/Elections
[2] https://pagure.io/Fedora-Council/tickets/issue/135#comment-467523
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
[4] https://fedoraproject.org/wiki/Elections
[5] https://fedorapeople.org/groups/schedule/f-27/f-27-elections.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3434-2] Libidn vulnerability
==========================================================================
Ubuntu Security Notice USN-3434-2
October 23, 2017
libidn vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Libidn could be made to crash or run programs if it processed specially
crafted input.
Software Description:
- libidn: implementation of IETF IDN specifications
Details:
USN-3434-1 fixed a vulnerability in Libidn. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Libidn incorrectly handled decoding certain
digits. A remote attacker could use this issue to cause Libidn to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libidn11 1.23-2ubuntu0.2
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3434-2
https://www.ubuntu.com/usn/usn-3434-1
CVE-2017-14062
Ubuntu Security Notice USN-3434-2
October 23, 2017
libidn vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Libidn could be made to crash or run programs if it processed specially
crafted input.
Software Description:
- libidn: implementation of IETF IDN specifications
Details:
USN-3434-1 fixed a vulnerability in Libidn. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Libidn incorrectly handled decoding certain
digits. A remote attacker could use this issue to cause Libidn to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libidn11 1.23-2ubuntu0.2
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3434-2
https://www.ubuntu.com/usn/usn-3434-1
CVE-2017-14062
[USN-3441-2] curl vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3441-2
October 23, 2017
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large
floating point output. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names
when doing TFTP transfers. A remote attacker could use this issue to
cause curl to crash, resulting in a denial of service, or possibly
obtain sensitive memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly
handled numerical range globbing. A remote attacker could use this
issue to cause curl to crash, resulting in a denial of service, or
possibly obtain sensitive memory contents. (CVE-2017-1000101)
Max Dymond discovered that curl incorrectly handled FTP PWD responses.
A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service. (CVE-2017-1000254)
Brian Carpenter discovered that curl incorrectly handled IMAP FETCH
response lines. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly execute
arbitrary code.(CVE-2017-1000257)
Brian Carpenter discovered that curl incorrectly handled the --write-
out command line option. A local attacker could possibly use this
issue to obtain sensitive memory contents. (CVE-2017-7407)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
curl 7.22.0-3ubuntu4.18
libcurl3 7.22.0-3ubuntu4.18
libcurl3-gnutls 7.22.0-3ubuntu4.18
libcurl3-nss 7.22.0-3ubuntu4.18
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3441-2
https://www.ubuntu.com/usn/usn-3441-1
CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257,
CVE-2017-7407
Ubuntu Security Notice USN-3441-2
October 23, 2017
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large
floating point output. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names
when doing TFTP transfers. A remote attacker could use this issue to
cause curl to crash, resulting in a denial of service, or possibly
obtain sensitive memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly
handled numerical range globbing. A remote attacker could use this
issue to cause curl to crash, resulting in a denial of service, or
possibly obtain sensitive memory contents. (CVE-2017-1000101)
Max Dymond discovered that curl incorrectly handled FTP PWD responses.
A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service. (CVE-2017-1000254)
Brian Carpenter discovered that curl incorrectly handled IMAP FETCH
response lines. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly execute
arbitrary code.(CVE-2017-1000257)
Brian Carpenter discovered that curl incorrectly handled the --write-
out command line option. A local attacker could possibly use this
issue to obtain sensitive memory contents. (CVE-2017-7407)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
curl 7.22.0-3ubuntu4.18
libcurl3 7.22.0-3ubuntu4.18
libcurl3-gnutls 7.22.0-3ubuntu4.18
libcurl3-nss 7.22.0-3ubuntu4.18
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3441-2
https://www.ubuntu.com/usn/usn-3441-1
CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257,
CVE-2017-7407
Subscribe to:
Posts (Atom)