package-announce July 2017

package-announce@lists.fedoraproject.org

1 participants
2254 discussions

[SECURITY] Fedora 24 Update: xen-4.6.5-7.fc24
by updates＠fedoraproject.org 01 Jul '17

01 Jul '17

-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-b3bdaf58bc 2017-07-01 21:00:30.997417 -------------------------------------------------------------------------------- Name : xen Product : Fedora 24 Version : 4.6.5 Release : 7.fc24 URL : http://xen.org/ Summary : Xen is a virtual machine monitor Description : This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor -------------------------------------------------------------------------------- Update Information: xen: various flaws (#1463247) blkif responses leak backend stack data [XSA-216] page transfer may allow PV guest to elevate privilege [XSA-217] Races in the grant table unmap code [XSA-218] x86: insufficient reference counts during shadow emulation [XSA-219] x86: PKRU and BND* leakage between vCPU-s [XSA-220] stale P2M mappings due to insufficient error checking [XSA-222] ARM guest disabling interrupt may crash Xen [XSA-223] grant table operations mishandle reference counts [XSA-224] arm: vgic: Out-of-bound access when sending SGIs [XSA-225] NULL pointer deref in event channel poll [XSA-221] (#1463231) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1458870 - xsa216 xen: blkif responses leak backend stack data (XSA-216) https://bugzilla.redhat.com/show_bug.cgi?id=1458870 [ 2 ] Bug #1458871 - xsa217 xen: page transfer may allow PV guest to elevate privilege (XSA-217) https://bugzilla.redhat.com/show_bug.cgi?id=1458871 [ 3 ] Bug #1458872 - xsa218 xen: Races in the grant table unmap code (XSA-218) https://bugzilla.redhat.com/show_bug.cgi?id=1458872 [ 4 ] Bug #1458873 - xsa219 xen: x86: insufficient reference counts during shadow emulation (XSA-219) https://bugzilla.redhat.com/show_bug.cgi?id=1458873 [ 5 ] Bug #1458874 - xsa220 xen: x86: PKRU and BND* leakage between vCPU-s (XSA-220) https://bugzilla.redhat.com/show_bug.cgi?id=1458874 [ 6 ] Bug #1458876 - xsa222 xen: stale P2M mappings due to insufficient error checking (XSA-222) https://bugzilla.redhat.com/show_bug.cgi?id=1458876 [ 7 ] Bug #1458877 - xsa223 xen: ARM guest disabling interrupt may crash Xen (XSA-223) https://bugzilla.redhat.com/show_bug.cgi?id=1458877 [ 8 ] Bug #1458878 - xsa224 xen: grant table operations mishandle reference counts (XSA-224) https://bugzilla.redhat.com/show_bug.cgi?id=1458878 [ 9 ] Bug #1459515 - xsa225 xen: arm: vgic: Out-of-bound access when sending SGIs (XSA-225) https://bugzilla.redhat.com/show_bug.cgi?id=1459515 [ 10 ] Bug #1458875 - xsa221 xen: NULL pointer deref in event channel poll (XSA-221) https://bugzilla.redhat.com/show_bug.cgi?id=1458875 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade xen' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------

1 0

Fedora 24 Update: mozilla-https-everywhere-5.2.19-1.fc24
by updates＠fedoraproject.org 01 Jul '17

01 Jul '17

-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-3b53a573d0 2017-07-01 21:00:30.997352 -------------------------------------------------------------------------------- Name : mozilla-https-everywhere Product : Fedora 24 Version : 5.2.19 Release : 1.fc24 URL : https://eff.org/https-everywhere Summary : HTTPS/HSTS enforcement extension for Mozilla Firefox and SeaMonkey Description : HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to use. For instance, they may default to unencrypted HTTP, or fill encrypted pages with links that go back to the unencrypted site. The HTTPS Everywhere extension fixes these problems by rewriting all requests to these sites to HTTPS. -------------------------------------------------------------------------------- Update Information: Someone at my workplace decided the best place to put a switch was dangling off the back of a desk. Bad idea, people. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1463450 - mozilla-https-everywhere-5.2.19 is available https://bugzilla.redhat.com/show_bug.cgi?id=1463450 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade mozilla-https-everywhere' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------

1 0

Fedora 24 Update: sugar-speak-54-1.fc24
by updates＠fedoraproject.org 01 Jul '17

01 Jul '17

-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-ef95755ffc 2017-07-01 21:00:30.997286 -------------------------------------------------------------------------------- Name : sugar-speak Product : Fedora 24 Version : 54 Release : 1.fc24 URL : http://wiki.laptop.org/go/Speak Summary : Speak for Sugar Description : Speak is a talking face for the XO laptop. Anything you type will be spoken aloud using the XO's speech synthesizer, espeak. You can adjust the accent, rate and pitch of the voice as well as the shape of the eyes and mouth. This is a great way to experiment with the speech synthesizer, learn to type or just have fun making a funny face for your XO. -------------------------------------------------------------------------------- Update Information: Release version 54 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade sugar-speak' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------

1 0

Fedora 24 Update: meson-0.41.1-1.fc24
by updates＠fedoraproject.org 01 Jul '17

01 Jul '17

-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-74af926adb 2017-07-01 21:00:30.996914 -------------------------------------------------------------------------------- Name : meson Product : Fedora 24 Version : 0.41.1 Release : 1.fc24 URL : http://mesonbuild.com/ Summary : High productivity build system Description : Meson is a build system designed to optimize programmer productivity. It aims to do this by providing simple, out-of-the-box support for modern software development tools and practices, such as unit tests, coverage reports, Valgrind, CCache and the like. -------------------------------------------------------------------------------- Update Information: # New features ## Dependency Handler for LLVM Native support for linking against LLVM using the `dependency` function. ## vcs_tag keyword fallback is is now optional The `fallback` keyword in `vcs_tag` is now optional. If not given, its value defaults to the return value of `meson.project_version()`. ## Better quoting of special characters in ninja command invocations The ninja backend now quotes special characters that may be interpreted by ninja itself, providing better interoperability with custom commands. This support may not be perfect; please report any issues found with special characters to the issue tracker. ## Pkgconfig support for custom variables The Pkgconfig module object can add arbitrary variables to the generated .pc file with the new `variables` keyword: pkg.generate(libraries : libs, subdirs : h, version : '1.0', name : 'libsimple', filebase : 'simple', description : 'A simple demo library.', variables : ['datadir=${prefix}/data']) ## A target for creating tarballs Creating distribution tarballs is simple: ninja dist This will create a `.tar.xz` archive of the source code including submodules without any revision control information. This command also verifies that the resulting archive can be built, tested and installed. This is roughly equivalent to the distcheck target in other build systems. Currently this only works for projects using Git and only with the Ninja backend. ## Support for passing arguments to Rust compiler Targets for building rust now take a `rust_args` keyword. ## Code coverage export for tests Code coverage can be generated for tests by passing the `--cov` argument to the `run_tests.py` test runner. Note, since multiple processes are used, coverage must be combined before producing a report (`coverage3 combine`). ## Reproducible builds All known issues have been fixed and Meson can now build reproducible Debian packages out of the box. $$ Extended template substitution in configure_file The output argument of `configure_file()` is parsed for `@BASENAME@` and @PLAINNAME@` substitutions. ## Cross-config property for overriding whether an exe wrapper is needed The new `needs_exe_wrapper` property allows overriding auto-detection for cases where `build_machine` appears to be compatible with `host_machine`, but actually isn't. For example when: - `build_machine` is macOS and `host_machine` is the iOS Simulator - the `build_machine's libc is glibc but the `host_machine` libc is uClibc - code relies on kernel features not available on the `build_machine` ## Support for capturing stdout of a command in configure_file `configure_file()` now supports a new keyword - `capture`. When this argument is set to true, Meson captures `stdout` of the `command` and writes it to the target file specified as output. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1461420 - meson-0.41.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1461420 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade meson' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

package-announce July 2017