[USN-4662-1] OpenSSL vulnerability

==========================================================================
Ubuntu Security Notice USN-4662-1
December 08, 2020

openssl, openssl1.0 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

OpenSSL could be made to crash if it processed specially crafted input.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

David Benjamin discovered that OpenSSL incorrectly handled comparing
certificates containing a EDIPartyName name type. A remote attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial of
service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libssl1.1 1.1.1f-1ubuntu4.1

Ubuntu 20.04 LTS:
libssl1.1 1.1.1f-1ubuntu2.1

Ubuntu 18.04 LTS:
libssl1.0.0 1.0.2n-1ubuntu5.5
libssl1.1 1.1.1-1ubuntu2.1~18.04.7

Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.18

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://usn.ubuntu.com/4662-1
CVE-2020-1971

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu4.1
https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.1
https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.1~18.04.7
https://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu5.5
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.18

[USN-4663-1] GDK-PixBuf vulnerability

==========================================================================
Ubuntu Security Notice USN-4663-1
December 08, 2020

gdk-pixbuf vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS

Summary:

GDK-PixBuf could be made to hang if it opened a specially crafted file.

Software Description:
- gdk-pixbuf: GDK Pixbuf library

Details:

Melvin Kool discovered that the GDK-PixBuf library did not properly handle
certain GIF images. If an user or automated system were tricked into
opening a specially crafted GIF file, a remote attacker could use this flaw
to cause GDK-PixBuf to hang, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libgdk-pixbuf2.0-0 2.40.0+dfsg-5ubuntu0.1

Ubuntu 20.04 LTS:
libgdk-pixbuf2.0-0 2.40.0+dfsg-3ubuntu0.1

After a standard system update you need to restart your session to make all
the necessary changes.

References:
https://usn.ubuntu.com/4663-1
CVE-2020-29385

Package Information:
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.40.0+dfsg-5ubuntu0.1
https://launchpad.net/ubuntu/+source/gdk-pixbuf/2.40.0+dfsg-3ubuntu0.1

OpenBSD Errata: December 8th, 2020 (exit)

Errata patches for the kernel have been released for OpenBSD 6.7 and 6.8.

Process exit in multithreaded programs could result in the wrong exit
code being reported.

Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:

https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html

As these affect the kernel, a reboot will be needed after patching.

OpenBSD Errata: December 8th, 2020 (asn1)

Errata patches for LibreSSL have been released for OpenBSD 6.7 and 6.8.

Malformed ASN.1 in a certificate revocation list or a timestamp
response token can lead to a NULL pointer dereference.

Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:

https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html

[CentOS-announce] CentOS Project shifts focus to CentOS Stream

The future of the CentOS Project is CentOS Stream, and over the next
year we'll be shifting focus from CentOS Linux, the rebuild of Red Hat
Enterprise Linux (RHEL), to CentOS Stream, which tracks just ahead of a
current RHEL release. CentOS Linux 8, as a rebuild of RHEL 8, will end
at the end of 2021. CentOS Stream continues after that date, serving as
the upstream (development) branch of Red Hat Enterprise Linux.

Meanwhile, we understand many of you are deeply invested in CentOS Linux
7, and we'll continue to produce that version through the remainder of
the RHEL 7 life cycle.
https://access.redhat.com/support/policy/updates/errata/#Life_Cycle_Dates

CentOS Stream will also be the centerpiece of a major shift in
collaboration among the CentOS Special Interest Groups (SIGs). This
ensures SIGs are developing and testing against what becomes the next
version of RHEL. This also provides SIGs a clear single goal, rather
than having to build and test for two releases. It gives the CentOS
contributor community a great deal of influence in the future of RHEL.
And it removes confusion around what "CentOS" means in the Linux
distribution ecosystem.

When CentOS Linux 8 (the rebuild of RHEL8) ends, your best option will
be to migrate to CentOS Stream 8, which is a small delta from CentOS
Linux 8, and has regular updates like traditional CentOS Linux releases.
If you are using CentOS Linux 8 in a production environment, and are
concerned that CentOS Stream will not meet your needs, we encourage you
to contact Red Hat about options.

We have an FAQ - https://centos.org/distro-faq/ - to help with your
information and planning needs, as you figure out how this shift of
project focus might affect you.

[See also: Red Hat's perspective on this.
https://www.redhat.com/en/blog/centos-stream-building-innovative-future-enterprise-linux]

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

[CentOS-announce] Release for CentOS Linux 8 (2011)

Release for CentOS Linux 8 (2011)

We are pleased to announce the general availability of CentOS Linux 8.
Effectively immediately, this is the current release for CentOS Linux 8
and is tagged as 2011, derived from Red Hat Enterprise Linux 8.3 Source
Code.

As always, read through the Release Notes at:
http://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2011 - these notes
contain important information about the release and details about some
of the content inside the release from the CentOS QA team. These notes
are updated constantly to include issues and incorporate feedback from
users.

----------
Updates, Sources, and DebugInfos

Updates released since the upstream release are all posted, across all
architectures. We strongly recommend every user apply all updates,
including the content released today, on your existing CentOS Linux 8
machine by just running 'dnf update'.

As with all CentOS Linux 8 components, this release was built from
sources hosted at git.centos.org. Sources will be available from
vault.centos.org in their own dedicated directories to match the
corresponding binary RPMs.

Since there is far less traffic to the CentOS source RPMs compared with
the binary RPMs, we are not putting this content on the main mirror
network. If users wish to mirror this content they can do so using the
reposync command available in the yum/dnf-utils package. All CentOS
source RPMs are signed with the same key used to sign their binary
counterparts. Developers and end users looking at inspecting and
contributing patches to the CentOS Linux distro will find the
code hosted at git.centos.org far simpler to work against. Details on
how to best consume those are documented along with a quick start at:
http://wiki.centos.org/Sources

Debuginfo packages have been signed and pushed. Yum configs
shipped in the new release file will have all the context required for
debuginfo to be available on every CentOS Linux install.

This release supersedes all previously released content for CentOS
Linux 8, and therefore we highly encourage all users to upgrade their
machines. Information on different upgrade strategies and how to
handle stale content is included in the Release Notes.

Note that older content, obsoleted by newer versions of the same
applications are trim'd off from repos like extras/ and centosplus/

----------
Download

We produced the following installer images for CentOS Linux 8

# CentOS-8.3.2011-x86_64-boot.iso: 716177408 bytes
SHA256 (CentOS-8.3.2011-x86_64-boot.iso) =
2b801bc5801816d0cf27fc74552cf058951c42c7b72b1fe313429b1070c3876c
# CentOS-8.3.2011-x86_64-dvd1.iso: 9264168960 bytes
SHA256 (CentOS-8.3.2011-x86_64-dvd1.iso) =
aaf9d4b3071c16dbbda01dfe06085e5d0fdac76df323e3bbe87cce4318052247

# CentOS-8.3.2011-aarch64-boot.iso: 636792832 bytes
SHA256 (CentOS-8.3.2011-aarch64-boot.iso) =
b87fc578c53b541229883d391d1299b9d2a051c1f33dc15052dc42ed941600a9
# CentOS-8.3.2011-aarch64-dvd1.iso: 6792984576 bytes
SHA256 (CentOS-8.3.2011-aarch64-dvd1.iso) =
ecf586b30fa16b28a33b2fb4ffadd8801201608f9755c94da1212876d32fba92

# CentOS-8.3.2011-ppc64le-boot.iso: 686874624 bytes
SHA256 (CentOS-8.3.2011-ppc64le-boot.iso) =
13ebdc5ecdfc316fa4528f3bc4d896ca32745af65766bd84ece37e10d87f8e9e
# CentOS-8.3.2011-ppc64le-dvd1.iso: 7887482880 bytes
SHA256 (CentOS-8.3.2011-ppc64le-dvd1.iso) =
a56fc1039534155253ca412fcd8e0293e6f67fd92c526a8b754309578140dff6

Information for the torrent files and sums are available at
http://mirror.centos.org/centos/8/isos/

--------
Additional Images

Vagrant and Generic Cloud images are available at:

http://cloud.centos.org/centos/8/

Amazon Machine Images for Amazon Web Services are published by ID into a
number of regions. A table of AMI IDs can be found here:

https://wiki.centos.org/Cloud/AWS

----------
Getting Help

The CentOS ecosystem is sustained by community driven help and
guidance. The best place to start for new users is at
http://wiki.centos.org/GettingHelp

We are also on social media, you can find the project:
on Twitter at :http://twitter.com/CentOSProject
on Facebook at :https://www.facebook.com/groups/centosproject/
on LinkedIn at :https://www.linkedin.com/groups/22405

And you will find the core team and a majority of the contributors on
irc, on freenode.net in #centos ; talking about the finer points of
distribution engineering and platform enablement.

----------
Contributors

This release was made possible due to the hard work of many people,
foremost on that list are the Red Hat Engineers for producing a great
distribution and the CentOS QA team, without them CentOS Linux would
look very different. Many of the team went further and beyond
expectations to bring this release to you, and I would like to thank
everyone for their help.

We are also looking for people to get involved with the QA process in
CentOS, if you would like to join this please introduce yourself on
the centos-devel list
(http://lists.centos.org/mailman/listinfo/centos-devel).

Finally, please join me in thanking the donors who all make this
possible for us.

Enjoy the fresh new release!

Thanks,
Brian Stinson
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

Fedora 34 Change: Stratis 2.3.0 (Self-Contained Change)

https://fedoraproject.org/wiki/Changes/Stratis_2.3.0

== Summary ==
Stratis 2.3.0 adds additional flexibility to its encryption support via Clevis.

== Owner ==

* Name: [[User:dkeefe|Dennis Keefe]], [[User:mulhern|Anne Mulhern]], [[User:jbaublitz|John Baublitz]]

* Email: dkeefe@redhat.com, amulhern@redhat.com, jbaublitz@redhat.com

== Detailed Description ==
=== Stratis 2.3.0 ===
This release extends the pool unlock command, and adds two new commands, pool bind and pool unbind.

The pool bind command establishes an alternative mechanism for unlocking a pool. The user may select either the "tang" mechanism, which implements NBDE (Network-bound Disc Encryption) by means of a Tang server, or the "tpm2" mechanism, which uses TPM 2.0 (Trusted Platform Module) encryption. Binding the devices in a pool to a supplementary Clevis encryption policy does not remove the primary encryption mechanism, which uses a key in the kernel keyring.

The pool unbind command simply unbinds a previously added encryption policy from all the devices in the specified pool.

In the pool unlock command it is now necessary to specify the mechanism. Use clevis to make use of the Clevis unlocking policy previously specified for the devices in the pool. Use keyring, to make use of the mechanism that uses a key in the kernel keyring, which was introduced in Stratis 2.1.0. Note that the pool unlock command unlocks all currently locked pools.

== Detailed Description ==
=== stratisd 2.3.0 ===
This release introduces two D-Bus interface revisions, which differ in the following way from the previous revisions.

org.storage.stratis2.Manager.r3 modifies the UnlockPool method to take an additional parameter, unlock_method, which may be keyring or clevis.

org.storage.stratis2.pool.r3 adds two new method: Bind and Unbind. The Bind method takes two arguments, pin and json. The pin argument designates the Clevis pin as a string, and the json argument encodes a Clevis configuration appropriate to the designated pin. The configuration is a JSON object. Besides Clevis information, it may include Stratis-specific keys that encode configuration decisions that Stratis may implement. At present there is just one such key: stratis:tang:trust_url. The Unbind method reverses a Bind action.

== Remarks ==
The Bind method may be called with any Clevis pin and configuration; we expect that any valid Clevis pin and configuration can be used to bind the devices in a pool. However the Stratis project officially supports only the "tang" and "tpm2" pins as those are the pins that may be designated via stratis. Support for additional Clevis policies may be introduced into stratis in later releases.

When binding a supplementary encryption policy to the devices in a pool using Clevis, the primary key, which is the key in the kernel keyring which was originally used to encrypt each device, must be supplied. stratisd obtains the appropriate key from the kernel keyring in order to provide it to the Clevis binding mechanism. The correct key must be present in the keyring for the bind operation to succeed. It is not necessary for the user to specify the key, stratisd obtains the necessary information from the LUKS2 metadata on the devices in the pool.

In general, it is unwise to write a key consisting of arbitrary binary data to a keyfile. An accidental newline character in the data may cause the contents of the file to be truncated at the newline when read in one context while all the data may be read from the file in some other context.

We are not aware that such a mistake would result in any error in Stratis's operation when Stratis is used in the way that we recommend. We explicitly acknowledge that it might be possible, through some direct interaction with the stratisd D-Bus API, or by, e.g., setting a key in the kernel keyring without using stratis, to manufacture a situation where stratisd could not bind the devices in a pool, even when the correct key is set in the kernel keyring. We would not treat such a situation as evidence of a bug in Stratis.

== Feedback ==

== Benefits to Fedora ==
Users of Fedora will now benefit from Stratis 2.3.0 by:
* Multiple methods of unlocking Stratis pools using
  - Kernel keyring
  - Tang server
  - TPM2 Device

== Scope ==
* Proposal owners:
** Update existing stratis-cli package to specify new release
** Update existing stratisd package to specify new release
* Other developers: N/A
* Release engineering: Self Contained
* Policies guidelines:  N/A
* Trademark approval: N/A

== Upgrade/compatibility impact ==
There is no know impact when upgrading from Stratis 2.2.0 to 2.3.0

== How To Test ==
* Bind using Tang server
  echo "secret" > /tmp/testkey
  stratis key set --keyfile-path /tmp/testkey testkey
  stratis pool create --key-desc testkey testpool /dev/vdb
  stratis pool bind tang --trust-url testpool testkey tang.yourdomain.org
* Bind using TPM2
  echo "secret" > /tmp/testkey
  stratis key set --keyfile-path /tmp/testkey testkey
  stratis pool create --key-desc testkey testpool /dev/vdb
  stratis pool bind tpm2 testpool testkey
* Unlock encrypted pool using Clevis (after reboot)
  stratis pool unlock clevis
  stratis pool list

== User Experience ==
This latest release add a feature enhancement that will provide users with multiple unlock methods for encrypted Stratis pools

== Dependencies ==

Two new dependencies have been added for clevis and clevis-luks

== Contingency Plan ==
* Contingency mechanism:
* Contingency deadline: N/A
* Blocks release? No
* Blocks product? No

== Documentation ==
Please see https://stratis-storage.github.io/ for design documents and API reference.
Development and issue tracking is at https://github.com/stratis-storage/

== Release Notes ==
Includes recent version of Stratis

--

Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis

[USN-4656-2] X.Org X Server vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4656-2
December 07, 2020

xorg-server vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in X.Org X Server.

Software Description:
- xorg-server: X.Org X11 server

Details:

USN-4656-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Jan-Niklas Sohn discovered that the X.Org X Server XKB extension
incorrectly handled certain inputs. A local attacker could possibly use
this issue to escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
xserver-xorg-core 2:1.15.1-0ubuntu2.11+esm3

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://usn.ubuntu.com/4656-2
https://usn.ubuntu.com/4656-1
CVE-2020-14360, CVE-2020-25712

Fedora 34 Change: Ignore Anaconda kernel boot parameters without 'inst.' prefix (System-Wide change)

https://fedoraproject.org/wiki/Changes/Ignore_Anaconda_kernel_boot_parameters_without_inst_prefix

== Summary ==
Right now Anaconda allows usage of boot options both with the 'inst' prefix (inst.stage2=) and without (stage2=). We would like to ignore the use of Anaconda kernel boot parameters which do not contain the 'inst.' prefix.

== Owner ==
* Name: [[User:jkonecny| Jiří Konečný]]
* Email: <jkonecny@redhat.com>


== Detailed Description ==
Anaconda allows you to use kernel boot parameters with and without the 'inst.' prefix right now (e.g. inst.repo= / repo=). However, specifying boot parameters without the 'inst' prefix has not been recommended for years and has been deprecated since Fedora 33. We (Anaconda team) would like to make it an official requirement now that users must specify the 'inst.' prefix all the time.

The reason for this is frequent parameter conflicts with other projects. We already had a few issues with conflicts in the past, such as if the user ran an installation with `debug`. In that case the installation boot would enable debug mode for the kernel and also for Anaconda which is probably not what the user intended.
Another reason is to make it readable at first glance what belongs to Dracut (rd.), kernel (no prefix) or Anaconda (inst.).

== Feedback ==
We have sent mail about doing the deprecation on Fedora 33. The only issue there was why the prefix is 'inst.' and not 'anaconda.'. https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/43LKTJOUO5TB7LGFWPRNXOYLEQF3KLGG/#ENTHA45Y6VO45FAD4ULPSHCTOXPML3PA

== Benefit to Fedora ==
This change should make crystal clear what kernel boot parameters are processed by the Anaconda installer.
It will also avoid conflicts with other kernel boot parameters.

== Scope ==
* Proposal owners: Remove support to process arguments without the 'inst.' prefix and require the 'inst.' prefix for kernel boot parameters consumed by Anaconda.

* Other developers:
All configurations using the not-recommended solution without prefix will have to change the invocation of the kernel boot options consumed by Anaconda. These users are already warned since Fedora 33 after boot.
This should not be a problem for ISOs we ship because they already use the recommended 'inst.' prefix everywhere. However, it will probably touch some custom PXE configurations and other custom ISO configurations which are prone to this, because users often want to save typing and not explicitly write the 'inst.' prefix. Fortunately, most of these configuration changes shouldn't be that hard to change.

* Release engineering: [https://pagure.io/releng/issue/9889 #9889] 
* Policies and guidelines: This should not be required. All the documentation should use the recommended 'inst.' prefix already.
* Trademark approval: No (not needed for this Change)
* Alignment with Objectives: No


== Upgrade/compatibility impact ==
If your custom infra configuration is not updated then new Fedora installations could not install correctly. Most probably the ISO will not boot (use of 'stage2=') or your repositories won't be used (use of 'repo=').


== How To Test ==
# You need a Virtual Machine and ISO for testing.
# Boot the installation using the ISO and try Anaconda specific kernel boot parameters. See here to find out the list https://anaconda-installer.readthedocs.io/en/latest/boot-options.html.
# Parameters without the prefix should be ignored and with the prefix should be used.


== User Experience ==
Users of Fedora official ISOs should not be impacted because all the Fedora official ISOs should already use the recommended prefix.

== Dependencies ==
Don't know about any packages impacted by this change.


== Contingency Plan ==
* Contingency mechanism: The Anaconda team will revert code changes and get back support for boot parameters without the 'inst.' prefix. 
* Contingency deadline: Final Freeze  
* Blocks release? No 
* Blocks product? This won't require changes for any specific product. 

== Documentation ==
I don't think we need to document this change other than in Release Notes. As mentioned before, the solution without 'inst.' prefix has not been recommended for years and it should not be used anywhere in the official documentation.

--

Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis

Re: Fedora 34 Change proposal: Remove and deprecate nscd in favour of sssd and systemd-resolved (Self-Contained Change)

FESCo's approval[1] of this proposal was contingent on splitting it into two phases. For Fedora 34, nscd will be deprecated[2]. For Fedora 35, nscd will be removed[3]. 

[1] https://pagure.io/fesco/issue/2501#comment-704653

[2] https://fedoraproject.org/wiki/Changes/DeprecateNSCD

[3] https://fedoraproject.org/wiki/Changes/RemoveNSCD

--

Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis

Updated Debian 10: 10.7 released

------------------------------------------------------------------------
The Debian Project https://www.debian.org/
Updated Debian 10: 10.7 released press@debian.org
December 5th, 2020 https://www.debian.org/News/2020/20201205
------------------------------------------------------------------------


The Debian project is pleased to announce the seventh update of its
stable distribution Debian 10 (codename "buster"). This point release
mainly adds corrections for security issues, along with a few
adjustments for serious problems. Security advisories have already been
published separately and are referenced where available.

Please note that the point release does not constitute a new version of
Debian 10 but only updates some of the packages included. There is no
need to throw away old "buster" media. After installation, packages can
be upgraded to the current versions using an up-to-date Debian mirror.

Those who frequently install updates from security.debian.org won't have
to update many packages, and most such updates are included in the point
release.

New installation images will be available soon at the regular locations.

Upgrading an existing installation to this revision can be achieved by
pointing the package management system at one of Debian's many HTTP
mirrors. A comprehensive list of mirrors is available at:

https://www.debian.org/mirror/list



Miscellaneous Bugfixes
----------------------

This stable update adds a few important corrections to the following
packages:

+-------------------------+-------------------------------------------+
| Package | Reason |
+-------------------------+-------------------------------------------+
| base-files [1] | Update for the point release |
| | |
| choose-mirror [2] | Update mirror list |
| | |
| cups [3] | Fix 'printer-alert' invalid free |
| | |
| dav4tbsync [4] | New upstream release, compatible with |
| | newer Thunderbird versions |
| | |
| debian-installer [5] | Use 4.19.0-13 Linux kernel ABI; add grub2 |
| | to Built-Using |
| | |
| debian-installer- | Rebuild against proposed-updates |
| netboot-images [6] | |
| | |
| distro-info-data [7] | Add Ubuntu 21.04, Hirsute Hippo |
| | |
| dpdk [8] | New upstream stable release; fix remote |
| | code execution issue [CVE-2020-14374], |
| | TOCTOU issues [CVE-2020-14375], buffer |
| | overflow [CVE-2020-14376], buffer over |
| | read [CVE-2020-14377] and integer |
| | underflow [CVE-2020-14377]; fix armhf |
| | build with NEON |
| | |
| eas4tbsync [9] | New upstream release, compatible with |
| | newer Thunderbird versions |
| | |
| edk2 [10] | Fix integer overflow in |
| | DxeImageVerificationHandler [CVE-2019- |
| | 14562] |
| | |
| efivar [11] | Add support for nvme-fabrics and nvme- |
| | subsystem devices; fix uninitialized |
| | variable in parse_acpi_root, avoiding |
| | possible segfault |
| | |
| enigmail [12] | Introduce migration assistant to |
| | Thunderbird's built-in GPG support |
| | |
| espeak [13] | Fix using espeak with mbrola-fr4 when |
| | mbrola-fr1 is not installed |
| | |
| fastd [14] | Fix memory leak when receiving too many |
| | invalid packets [CVE-2020-27638] |
| | |
| fish [15] | Ensure TTY options are restored on exit |
| | |
| freecol [16] | Fix XML External Entity vulnerability |
| | [CVE-2018-1000825] |
| | |
| gajim-omemo [17] | Use 12-byte IV, for better compatibility |
| | with iOS clients |
| | |
| glances [18] | Listen only on localhost by default |
| | |
| iptables- | Don't force-load kernel modules; improve |
| persistent [19] | rule flushing logic |
| | |
| lacme [20] | Use upstream certificate chain instead of |
| | an hardcoded one, easing support for new |
| | Let's Encrypt root and intermediate |
| | certificates |
| | |
| libdatetime-timezone- | Update included data to tzdata 2020d |
| perl [21] | |
| | |
| libimobiledevice [22] | Add partial support for iOS 14 |
| | |
| libjpeg-turbo [23] | Fix denial of service [CVE-2018-1152], |
| | buffer over read [CVE-2018-14498], |
| | possible remote code execution [CVE-2019- |
| | 2201], buffer over read [CVE-2020-13790] |
| | |
| libxml2 [24] | Fix denial of service [CVE-2017-18258], |
| | NULL pointer dereference [CVE-2018- |
| | 14404], infinite loop [CVE-2018-14567], |
| | memory leak [CVE-2019-19956 CVE-2019- |
| | 20388], infinite loop [CVE-2020-7595] |
| | |
| linux [25] | New upstream stable release |
| | |
| linux-latest [26] | Update for 4.19.0-13 kernel ABI |
| | |
| linux-signed-amd64 [27] | New upstream stable release |
| | |
| linux-signed-arm64 [28] | New upstream stable release |
| | |
| linux-signed-i386 [29] | New upstream stable release |
| | |
| lmod [30] | Change architecture to "any" - required |
| | due to LUA_PATH and LUA_CPATH being |
| | determined at build time |
| | |
| mariadb-10.3 [31] | New upstream stable release; security |
| | fixes [CVE-2020-14765 CVE-2020-14776 |
| | CVE-2020-14789 CVE-2020-14812 CVE-2020- |
| | 28912] |
| | |
| mutt [32] | Ensure IMAP connection is closed after a |
| | connection error [CVE-2020-28896] |
| | |
| neomutt [33] | Ensure IMAP connection is closed after a |
| | connection error [CVE-2020-28896] |
| | |
| node-object-path [34] | Fix prototype pollution in set() |
| | [CVE-2020-15256] |
| | |
| node-pathval [35] | Fix prototype pollution [CVE-2020-7751] |
| | |
| okular [36] | Fix code execution via action link |
| | [CVE-2020-9359] |
| | |
| openjdk-11 [37] | New upstream release; fix JVM crash |
| | |
| partman-auto [38] | Increase /boot sizes in most recipes to |
| | between 512 and 768M, to better handle |
| | kernel ABI changes and larger |
| | initramfses; cap RAM size as used for |
| | swap partition calculations, resolving |
| | issues on machines with more RAM than |
| | disk space |
| | |
| pcaudiolib [39] | Cap cancellation latency to 10ms |
| | |
| plinth [40] | Apache: Disable mod_status [CVE-2020- |
| | 25073] |
| | |
| puma [41] | Fix HTTP injection and HTTP smuggling |
| | issues [CVE-2020-5247 CVE-2020-5249 |
| | CVE-2020-11076 CVE-2020-11077] |
| | |
| ros-ros-comm [42] | Fix integer overflow [CVE-2020-16124] |
| | |
| ruby2.5 [43] | Fix potential HTTP request smuggling |
| | vulnerability in WEBrick [CVE-2020-25613] |
| | |
| sleuthkit [44] | Fix stack buffer overflow in |
| | yaffsfs_istat [CVE-2020-10232] |
| | |
| sqlite3 [45] | Fix division by zero [CVE-2019-16168], |
| | NULL pointer dereference [CVE-2019- |
| | 19923], mishandling of NULL pathname |
| | during an update of a ZIP archive |
| | [CVE-2019-19925], mishandling of embedded |
| | NULs in filenames [CVE-2019-19959], |
| | possible crash (unwinding WITH stack) |
| | [CVE-2019-20218], integer overflow |
| | [CVE-2020-13434], segmentation fault |
| | [CVE-2020-13435], use-after-free issue |
| | [CVE-2020-13630], NULL pointer |
| | dereference [CVE-2020-13632], heap |
| | overflow [CVE-2020-15358] |
| | |
| systemd [46] | Basic/cap-list: parse/print numerical |
| | capabilities; recognise new capabilities |
| | from Linux kernel 5.8; networkd: do not |
| | generate MAC for bridge device |
| | |
| tbsync [47] | New upstream release, compatible with |
| | newer Thunderbird versions |
| | |
| tcpdump [48] | Fix untrusted input issue in the PPP |
| | printer [CVE-2020-8037] |
| | |
| tigervnc [49] | Properly store certificate exceptions in |
| | native and java VNC viewer [CVE-2020- |
| | 26117] |
| | |
| tor [50] | New upstream stable release; multiple |
| | security, usability, portability, and |
| | reliability fixes |
| | |
| transmission [51] | Fix memory leak |
| | |
| tzdata [52] | New upstream release |
| | |
| ublock-origin [53] | New upstream version; split plugin to |
| | browser-specific packages |
| | |
| vips [54] | Fix use of uninitialised variable |
| | [CVE-2020-20739] |
| | |
+-------------------------+-------------------------------------------+

1: https://packages.debian.org/src:base-files
2: https://packages.debian.org/src:choose-mirror
3: https://packages.debian.org/src:cups
4: https://packages.debian.org/src:dav4tbsync
5: https://packages.debian.org/src:debian-installer
6: https://packages.debian.org/src:debian-installer-netboot-images
7: https://packages.debian.org/src:distro-info-data
8: https://packages.debian.org/src:dpdk
9: https://packages.debian.org/src:eas4tbsync
10: https://packages.debian.org/src:edk2
11: https://packages.debian.org/src:efivar
12: https://packages.debian.org/src:enigmail
13: https://packages.debian.org/src:espeak
14: https://packages.debian.org/src:fastd
15: https://packages.debian.org/src:fish
16: https://packages.debian.org/src:freecol
17: https://packages.debian.org/src:gajim-omemo
18: https://packages.debian.org/src:glances
19: https://packages.debian.org/src:iptables-persistent
20: https://packages.debian.org/src:lacme
21: https://packages.debian.org/src:libdatetime-timezone-perl
22: https://packages.debian.org/src:libimobiledevice
23: https://packages.debian.org/src:libjpeg-turbo
24: https://packages.debian.org/src:libxml2
25: https://packages.debian.org/src:linux
26: https://packages.debian.org/src:linux-latest
27: https://packages.debian.org/src:linux-signed-amd64
28: https://packages.debian.org/src:linux-signed-arm64
29: https://packages.debian.org/src:linux-signed-i386
30: https://packages.debian.org/src:lmod
31: https://packages.debian.org/src:mariadb-10.3
32: https://packages.debian.org/src:mutt
33: https://packages.debian.org/src:neomutt
34: https://packages.debian.org/src:node-object-path
35: https://packages.debian.org/src:node-pathval
36: https://packages.debian.org/src:okular
37: https://packages.debian.org/src:openjdk-11
38: https://packages.debian.org/src:partman-auto
39: https://packages.debian.org/src:pcaudiolib
40: https://packages.debian.org/src:plinth
41: https://packages.debian.org/src:puma
42: https://packages.debian.org/src:ros-ros-comm
43: https://packages.debian.org/src:ruby2.5
44: https://packages.debian.org/src:sleuthkit
45: https://packages.debian.org/src:sqlite3
46: https://packages.debian.org/src:systemd
47: https://packages.debian.org/src:tbsync
48: https://packages.debian.org/src:tcpdump
49: https://packages.debian.org/src:tigervnc
50: https://packages.debian.org/src:tor
51: https://packages.debian.org/src:transmission
52: https://packages.debian.org/src:tzdata
53: https://packages.debian.org/src:ublock-origin
54: https://packages.debian.org/src:vips

Security Updates
----------------

This revision adds the following security updates to the stable release.
The Security Team has already released an advisory for each of these
updates:

+----------------+----------------------------+
| Advisory ID | Package |
+----------------+----------------------------+
| DSA-4766 [55] | rails [56] |
| | |
| DSA-4767 [57] | mediawiki [58] |
| | |
| DSA-4768 [59] | firefox-esr [60] |
| | |
| DSA-4769 [61] | xen [62] |
| | |
| DSA-4770 [63] | thunderbird [64] |
| | |
| DSA-4771 [65] | spice [66] |
| | |
| DSA-4772 [67] | httpcomponents-client [68] |
| | |
| DSA-4773 [69] | yaws [70] |
| | |
| DSA-4774 [71] | linux-latest [72] |
| | |
| DSA-4774 [73] | linux-signed-amd64 [74] |
| | |
| DSA-4774 [75] | linux-signed-arm64 [76] |
| | |
| DSA-4774 [77] | linux-signed-i386 [78] |
| | |
| DSA-4774 [79] | linux [80] |
| | |
| DSA-4775 [81] | python-flask-cors [82] |
| | |
| DSA-4776 [83] | mariadb-10.3 [84] |
| | |
| DSA-4777 [85] | freetype [86] |
| | |
| DSA-4778 [87] | firefox-esr [88] |
| | |
| DSA-4779 [89] | openjdk-11 [90] |
| | |
| DSA-4780 [91] | thunderbird [92] |
| | |
| DSA-4781 [93] | blueman [94] |
| | |
| DSA-4782 [95] | openldap [96] |
| | |
| DSA-4783 [97] | sddm [98] |
| | |
| DSA-4784 [99] | wordpress [100] |
| | |
| DSA-4785 [101] | raptor2 [102] |
| | |
| DSA-4786 [103] | libexif [104] |
| | |
| DSA-4787 [105] | moin [106] |
| | |
| DSA-4788 [107] | firefox-esr [108] |
| | |
| DSA-4789 [109] | codemirror-js [110] |
| | |
| DSA-4790 [111] | thunderbird [112] |
| | |
| DSA-4791 [113] | pacemaker [114] |
| | |
| DSA-4792 [115] | openldap [116] |
| | |
| DSA-4793 [117] | firefox-esr [118] |
| | |
| DSA-4794 [119] | mupdf [120] |
| | |
| DSA-4795 [121] | krb5 [122] |
| | |
| DSA-4796 [123] | thunderbird [124] |
| | |
| DSA-4798 [125] | spip [126] |
| | |
| DSA-4799 [127] | x11vnc [128] |
| | |
| DSA-4800 [129] | libproxy [130] |
| | |
+----------------+----------------------------+

55: https://www.debian.org/security/2020/dsa-4766
56: https://packages.debian.org/src:rails
57: https://www.debian.org/security/2020/dsa-4767
58: https://packages.debian.org/src:mediawiki
59: https://www.debian.org/security/2020/dsa-4768
60: https://packages.debian.org/src:firefox-esr
61: https://www.debian.org/security/2020/dsa-4769
62: https://packages.debian.org/src:xen
63: https://www.debian.org/security/2020/dsa-4770
64: https://packages.debian.org/src:thunderbird
65: https://www.debian.org/security/2020/dsa-4771
66: https://packages.debian.org/src:spice
67: https://www.debian.org/security/2020/dsa-4772
68: https://packages.debian.org/src:httpcomponents-client
69: https://www.debian.org/security/2020/dsa-4773
70: https://packages.debian.org/src:yaws
71: https://www.debian.org/security/2020/dsa-4774
72: https://packages.debian.org/src:linux-latest
73: https://www.debian.org/security/2020/dsa-4774
74: https://packages.debian.org/src:linux-signed-amd64
75: https://www.debian.org/security/2020/dsa-4774
76: https://packages.debian.org/src:linux-signed-arm64
77: https://www.debian.org/security/2020/dsa-4774
78: https://packages.debian.org/src:linux-signed-i386
79: https://www.debian.org/security/2020/dsa-4774
80: https://packages.debian.org/src:linux
81: https://www.debian.org/security/2020/dsa-4775
82: https://packages.debian.org/src:python-flask-cors
83: https://www.debian.org/security/2020/dsa-4776
84: https://packages.debian.org/src:mariadb-10.3
85: https://www.debian.org/security/2020/dsa-4777
86: https://packages.debian.org/src:freetype
87: https://www.debian.org/security/2020/dsa-4778
88: https://packages.debian.org/src:firefox-esr
89: https://www.debian.org/security/2020/dsa-4779
90: https://packages.debian.org/src:openjdk-11
91: https://www.debian.org/security/2020/dsa-4780
92: https://packages.debian.org/src:thunderbird
93: https://www.debian.org/security/2020/dsa-4781
94: https://packages.debian.org/src:blueman
95: https://www.debian.org/security/2020/dsa-4782
96: https://packages.debian.org/src:openldap
97: https://www.debian.org/security/2020/dsa-4783
98: https://packages.debian.org/src:sddm
99: https://www.debian.org/security/2020/dsa-4784
100: https://packages.debian.org/src:wordpress
101: https://www.debian.org/security/2020/dsa-4785
102: https://packages.debian.org/src:raptor2
103: https://www.debian.org/security/2020/dsa-4786
104: https://packages.debian.org/src:libexif
105: https://www.debian.org/security/2020/dsa-4787
106: https://packages.debian.org/src:moin
107: https://www.debian.org/security/2020/dsa-4788
108: https://packages.debian.org/src:firefox-esr
109: https://www.debian.org/security/2020/dsa-4789
110: https://packages.debian.org/src:codemirror-js
111: https://www.debian.org/security/2020/dsa-4790
112: https://packages.debian.org/src:thunderbird
113: https://www.debian.org/security/2020/dsa-4791
114: https://packages.debian.org/src:pacemaker
115: https://www.debian.org/security/2020/dsa-4792
116: https://packages.debian.org/src:openldap
117: https://www.debian.org/security/2020/dsa-4793
118: https://packages.debian.org/src:firefox-esr
119: https://www.debian.org/security/2020/dsa-4794
120: https://packages.debian.org/src:mupdf
121: https://www.debian.org/security/2020/dsa-4795
122: https://packages.debian.org/src:krb5
123: https://www.debian.org/security/2020/dsa-4796
124: https://packages.debian.org/src:thunderbird
125: https://www.debian.org/security/2020/dsa-4798
126: https://packages.debian.org/src:spip
127: https://www.debian.org/security/2020/dsa-4799
128: https://packages.debian.org/src:x11vnc
129: https://www.debian.org/security/2020/dsa-4800
130: https://packages.debian.org/src:libproxy

Removed packages
----------------

The following packages were removed due to circumstances beyond our
control:

+-------------------------+--------------------------------------------+
| Package | Reason |
+-------------------------+--------------------------------------------+
| freshplayerplugin [131] | Unsupported by browsers; discontinued |
| | upstream |
| | |
| nostalgy [132] | Incompatible with newer Thunderbird |
| | versions |
| | |
| sieve-extension [133] | Incompatible with newer Thunderbird |
| | versions |
| | |
+-------------------------+--------------------------------------------+

131: https://packages.debian.org/src:freshplayerplugin
132: https://packages.debian.org/src:nostalgy
133: https://packages.debian.org/src:sieve-extension

Debian Installer
----------------

The installer has been updated to include the fixes incorporated into
stable by the point release.


URLs
----

The complete lists of packages that have changed with this revision:

http://ftp.debian.org/debian/dists/buster/ChangeLog


The current stable distribution:

http://ftp.debian.org/debian/dists/stable/


Proposed updates to the stable distribution:

http://ftp.debian.org/debian/dists/proposed-updates


stable distribution information (release notes, errata etc.):

https://www.debian.org/releases/stable/


Security announcements and information:

https://www.debian.org/security/



About Debian
------------

The Debian Project is an association of Free Software developers who
volunteer their time and effort in order to produce the completely free
operating system Debian.


Contact Information
-------------------

For further information, please visit the Debian web pages at
https://www.debian.org/, send mail to <press@debian.org>, or contact the
stable release team at <debian-release@lists.debian.org>.

Fedora 33 election results

Greetings, all!

The Fedora 33 elections have completed.

## Fedora Council

Tom Callaway is elected to the Fedora Council.

## Fedora Engineering Steering Committee (FESCo)

The following candidates are elected to FESCo:

* Miro Hrončok
* Kevin Fenzi
* Zbigniew Jędrzejewski-Szmek
* Fabio Valentini
* David Cantrell

## Fedora Mindshare Committee

Till Maas is elected to the Fedora Mindshare Committee.

For more details, visit the Community Blog post:
https://communityblog.fedoraproject.org/fedora-33-elections-results/

--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
announce mailing list -- announce@lists.fedoraproject.org
To unsubscribe send an email to announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/announce@lists.fedoraproject.org