https://www.drupal.org/project/drupal/releases?version=8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- An exploitable heap overflow vulnerability exists in the     way CoTURN 4.5.1.1 web server parses POST requests. A     specially crafted HTTP POST request can lead to     information leaks and other misbehavior.

  - An exploitable denial-of-service vulnerability exists in     the way CoTURN 4.5.1.1 web server parses POST requests.
    A specially crafted HTTP POST request can lead to server     crash and denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The **phpMyAdmin** team announces the release of both **4.9.5** and
**5.0.2**.

Both versions contain several security fixes :

  - PMASA-2020-2 SQL injection vulnerability in the user     accounts page, particularly when changing a password

  - PMASA-2020-3 SQL injection vulnerability relating to the     search feature

  - PMASA-2020-4 SQL injection and XSS having to do with     displaying results

  - Removing of the 'options' field for the external     transformation.

There are many other bugs fixes, please see the ChangeLog file included with this release for full details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-9359

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix DoS vulnerability (CVE-2019-19886, RHBZ #1801720 / #1801719)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream release 5.3.1 (rhbz#1814882)

  - Fixes CVE-2020-1747 (rhbz#1807367,1809011)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

## CKEditor 4.14

**Security Updates:**

  -     [CVE-2020-9281](https://nvd.nist.gov/vuln/detail/CVE-202     0-9281) Fixed XSS vulnerability in the HTML data     processor reported by [Micha&#x142;
    Bentkowski](https://twitter.com/securitymb) of     Securitum.

&#9;Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG mode.

  -     [CVE-2020-9440](https://nvd.nist.gov/vuln/detail/CVE-202     0-9440) Fixed XSS vulnerability in the WebSpellChecker     Dialog plugin reported by [Pham Van     Khanh](https://twitter.com/rskvp93) from Viettel Cyber     Security.

&#9;Issue summary: It was possible to execute XSS using CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content outside CKEditor editable area.

**An upgrade is highly recommended!**

New features :

  -     [#2374](https://github.com/ckeditor/ckeditor4/issues/237     4): Added support for pasting rich content from     LibreOffice Writer with the [Paste from     LibreOffice](https://ckeditor.com/cke4/addon/pastefromli     breoffice) plugin.

  -     [#2583](https://github.com/ckeditor/ckeditor4/issues/258     3): Changed     [emoji](https://ckeditor.com/cke4/addon/emoji)     suggestion box to show the matched emoji name instead of     an ID.

  -     [#3748](https://github.com/ckeditor/ckeditor4/issues/374     8): Improved the [color     button](https://ckeditor.com/cke4/addon/colorbutton)     state to reflect the selected editor content colors.

  -     [#3661](https://github.com/ckeditor/ckeditor4/issues/366     1): Improved the     [Print](https://ckeditor.com/cke4/addon/print) plugin to     respect styling rendered by the     [Preview](https://ckeditor.com/cke4/addon/preview)     plugin.

  -     [#3547](https://github.com/ckeditor/ckeditor4/issues/354     7): Active     [dialog](https://ckeditor.com/cke4/addon/dialog) tab now     has the `aria-selected='true'` attribute.

  -     [#3441](https://github.com/ckeditor/ckeditor4/issues/344     1): Improved     [`widget.getClipboardHtml()`](https://ckeditor.com/docs/     ckeditor4/latest/api/CKEDITOR_plugins_widget.html#method
    -getClipboardHtml) support for dragging and dropping     multiple     [widgets](https://ckeditor.com/cke4/addon/widget).

Fixed Issues :

  -     [#3587](https://github.com/ckeditor/ckeditor4/issues/358     7): [Edge, IE] Fixed:
    [Widget](https://ckeditor.com/cke4/addon/widget) with     form input elements loses focus during typing.

  -     [#3705](https://github.com/ckeditor/ckeditor4/issues/370     5): [Safari] Fixed: Safari incorrectly removes blocks     with the     [`editor.extractSelectedHtml()`](https://ckeditor.com/do     cs/ckeditor4/latest/api/CKEDITOR_editor.html#method-extr     actSelectedHtml) method after selecting all content.

  -     [#1306](https://github.com/ckeditor/ckeditor4/issues/130     6): Fixed: The     [Font](https://ckeditor.com/cke4/addon/font) plugin     creates nested HTML `<span>` tags when reapplying the     same font multiple times.

  -     [#3498](https://github.com/ckeditor/ckeditor4/issues/349     8): Fixed: The editor throws an error during the copy     operation when a     [widget](https://ckeditor.com/cke4/addon/widget) is     partially selected.

  -     [#2517](https://github.com/ckeditor/ckeditor4/issues/251     7): [Chrome, Firefox, Safari] Fixed: Inserting a new     image when the selection partially covers an existing     [enhanced image](https://ckeditor.com/cke4/addon/image2)     widget throws an error.

  -     [#3007](https://github.com/ckeditor/ckeditor4/issues/300     7): [Chrome, Firefox, Safari] Fixed: Cannot modify the     editor content once the selection is released over a     [widget](https://ckeditor.com/cke4/addon/widget).

  -     [#3698](https://github.com/ckeditor/ckeditor4/issues/369     8): Fixed: Cutting the selected text when a     [widget](https://ckeditor.com/cke4/addon/widget) is     partially selected merges paragraphs.

API Changes :

  -     [#3387](https://github.com/ckeditor/ckeditor4/issues/338     7): Added the     [CKEDITOR.ui.richCombo.select()](https://ckeditor.com/do     cs/ckeditor4/latest/api/CKEDITOR_ui_richCombo.html#metho     d-select) method.

  -     [#3727](https://github.com/ckeditor/ckeditor4/issues/372     7): Added new `textColor` and `bgColor` commands that     apply the selected color chosen by the [Color     Button](https://ckeditor.com/cke4/addon/colorbutton)     plugin.

  -     [#3728](https://github.com/ckeditor/ckeditor4/issues/372     8): Added new `font` and `fontSize` commands that apply     the selected font style chosen by the     [Font](https://ckeditor.com/cke4/addon/colorbutton)     plugin.

  -     [#3842](https://github.com/ckeditor/ckeditor4/issues/384     2): Added the     [`editor.getSelectedRanges()`](https://ckeditor.com/docs     /ckeditor4/latest/api/CKEDITOR_editor.html#method-getSel     ectedRanges) alias.

  -     [#3775](https://github.com/ckeditor/ckeditor4/issues/377     5): Widget     [mask](https://ckeditor.com/docs/ckeditor4/latest/api/CK     EDITOR_plugins_widget.html#property-mask) and     [parts](https://ckeditor.com/docs/ckeditor4/latest/api/C     KEDITOR_plugins_widget.html#property-parts) can now be     refreshed dynamically via API calls.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to latest upstream release (bz#1814803)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 5.5.11 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2018-19655

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

----

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420 

----

Update to 79.0.3945.130. Fixes the following security issues :

  - CVE-2020-6378

  - CVE-2020-6379

  - CVE-2020-6380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to new upstream version light-1.2.2 https://github.com/haikarainen/light/releases/tag/v1.2.2

----

  - Fix RHBZ 1792875 - Escalation of Privileges via 'light'     SUID Binary

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest stable release to fix CVE-2019-14751.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.3.16** (19 Mar 2020)

**Core:**

  - Fixed bug php#63206 (restore_error_handler does not     restore previous errors mask). (Mark Plomer)

**DOM:**

  - Fixed bug php#77569: (Write Access Violation in     DomImplementation). (Nikita, cmb)

  - Fixed bug php#79271 (DOMDocumentType::$childNodes is     NULL). (cmb)

**Enchant:**

  - Fixed bug php#79311 (enchant_dict_suggest() fails on big     endian architecture). (cmb)

**EXIF:**

  - Fixed bug php#79282 (Use-of-uninitialized-value in     exif). (**CVE-2020-7064*) (Nikita)

**MBstring:**

  - Fixed bug php#79371 (mb_strtolower (UTF-32LE):
    stack-buffer-overflow at php_unicode_tolower_full).
    (**CVE-2020-7065**) (cmb)

**MySQLi:**

  - Fixed bug php#64032 (mysqli reports different     client_version). (cmb)

**PCRE:**

  - Fixed bug php#79188 (Memory corruption in     preg_replace/preg_replace_callback and unicode).
    (Nikita)

**PDO_ODBC:**

  - Fixed bug php#79038 (PDOStatement::nextRowset() leaks     column values). (cmb)

**Reflection:**

  - Fixed bug php#79062 (Property with heredoc default value     returns false for getDocComment). (Nikita)

**SQLite3:**

  - Fixed bug php#79294 (::columnType() may fail after     SQLite3Stmt::reset()). (cmb)

**Standard:**

  - Fixed bug php#79329 (get_headers() silently truncates     after a null byte). (**CVE-2020-7066**) (cmb)

  - Fixed bug php#79254 (getenv() w/o arguments not showing     changes). (cmb)

  - Fixed bug php#79265 (Improper injection of Host header     when using fopen for http requests). (Miguel Xavier     Penha Neto)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security and performance fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-10108 (#1813439, #1813441) Security fix for CVE-2020-10109 (#1813447, #1813449)

----

Own %{pythonX_sitelib}/twisted/plugins

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to WebKitGTK 2.28.0.

  - Add API to enable Process Swap on (Cross-site)     Navigation.

  - Add user messages API for the communication with the web     extension.

  - Add support for same-site cookies.

  - Service workers are enabled by default.

  - Add support for Pointer Lock API.

  - Add flatpak sandbox support.

  - Make ondemand hardware acceleration policy never leave     accelerated compositing mode.

  - Always use a light theme for rendering form controls.

  - Add about:gpu to show information about the graphics     stack.

  - CVE fixes: CVE-2020-10018

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release, a security release

  - Includes fix for VSV00005

  - Added new checkout of pkg-varnish

  - Temporarily disable haproxy unit tests, as haproxy seems     broken in rawhide

  - Added simple compilation fix for gcc-10.0.1/s390x

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-10174

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs :

  - CVE-2020-6422: Use after free in WebGL

  - CVE-2020-6424: Use after free in media

  - CVE-2020-6425: Insufficient policy enforcement in     extensions. 

  - CVE-2020-6426: Inappropriate implementation in V8

  - CVE-2020-6427: Use after free in audio

  - CVE-2020-6428: Use after free in audio

  - CVE-2020-6429: Use after free in audio.

  - CVE-2019-20503: Out of bounds read in usersctplib.

  - CVE-2020-6449: Use after free in audio

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA.

List of CVEs fixed (since last update) :

  - CVE-2019-20446

  - CVE-2020-6381 

  - CVE-2020-6382 

  - CVE-2020-6383 

  - CVE-2020-6384

  - CVE-2020-6385 

  - CVE-2020-6386

  - CVE-2020-6387 

  - CVE-2020-6388

  - CVE-2020-6389

  - CVE-2020-6390 

  - CVE-2020-6391

  - CVE-2020-6392 

  - CVE-2020-6393

  - CVE-2020-6394

  - CVE-2020-6395

  - CVE-2020-6396 

  - CVE-2020-6397 

  - CVE-2020-6398

  - CVE-2020-6399 

  - CVE-2020-6400 

  - CVE-2020-6401 

  - CVE-2020-6402 

  - CVE-2020-6403 

  - CVE-2020-6404 

  - CVE-2020-6405 

  - CVE-2020-6406 

  - CVE-2020-6407

  - CVE-2020-6408 

  - CVE-2020-6409 

  - CVE-2020-6410 

  - CVE-2020-6411 

  - CVE-2020-6412 

  - CVE-2020-6413 

  - CVE-2020-6414 

  - CVE-2020-6415 

  - CVE-2020-6416 

  - CVE-2020-6417

  - CVE-2020-6418

  - CVE-2020-6420

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to NetHack 3.6.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, fixes a lot of bugs (some of them security). In the same update, fixed up epel7 build to latest version as well.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Horde_Form 2.0.20**

  - [mjr] SECURITY: Prevent ability to specify temporary     filename (CVE-2020-8866, Reported By: Andrea Cardaci     working with Trend Micro Zero Day Initiative).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-December /000243.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.9.6 bugfix release and 2 CVE fixes: CVE-2020-1737, CVE-2020-1739

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes for CVE-2019-19274 and CVE-2019-19275

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CouchDB 3.0.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New Firefox version (74.0)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

8u242 update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 2.16.5

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.5-and-2.7.14-r eleased

Security Advisory:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2020-02

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
135109	Fedora 31 : drupal8 (2020-f82db72daf)	High
135108	Fedora 30 : coturn (2020-f3fcb1608a)	High
135107	Fedora 31 : phpMyAdmin (2020-d7b0a5a84a)	Medium
135106	Fedora 30 : drupal8 (2020-51637cf853)	High
135105	Fedora 31 : coturn (2020-305c173af8)	High
135104	Fedora 30 : phpMyAdmin (2020-25f3aea389)	Medium
135016	Fedora 30 : okular (2020-e35573f7df)	Medium
134998	Fedora 30 : libmodsecurity (2020-f7ba0ac7a4)	Medium
134997	Fedora 31 : libmodsecurity (2020-dc9aee5510)	Medium
134996	Fedora 31 : PyYAML (2020-bdb0bfa928)	Critical
134995	Fedora 31 : ckeditor (2020-a832c215bf)	Medium
134994	Fedora 31 : tor (2020-9e16f7f40c)	High
134993	Fedora 31 : kernel (2020-76966b3419)	Medium
134992	Fedora 30 : dcraw (2020-545493aa4b)	Medium
134991	Fedora 30 : PyYAML (2020-40c35d7b37)	Critical
134990	Fedora 30 : chromium (2020-39e0b8bd14)	High
134989	Fedora 30 : tor (2020-2a8c314816)	High
134988	Fedora 30 : ckeditor (2020-261449d821)	Medium
134987	Fedora 31 : dcraw (2020-19c7f8e25f)	Medium
134986	Fedora 31 : light (2020-0fe677e44f)	High
134985	Fedora 31 : 1:python-nltk (2020-0f785235bb)	Medium
134962	Fedora 30 : php (2020-ce5a2a7403)	Medium
134961	Fedora 30 : libxslt (2020-40fa1ae94b)	High
134920	Fedora 31 : python-twisted (2020-16dc0da400)	High
134919	Fedora 31 : php (2020-0bf228857a)	Medium
134885	Fedora 31 : webkit2gtk3 (2020-f25793aac4)	Medium
134884	Fedora 30 : varnish (2020-872ec29251)	High
134883	Fedora 31 : varnish (2020-71ca06dd55)	High
134882	Fedora 30 : timeshift (2020-1050d60507)	Medium
134842	Fedora 31 : chromium (2020-7fd051b378)	High
134841	Fedora 31 : okular (2020-7036f54316)	Medium
134840	Fedora 31 : timeshift (2020-6b3ae09449)	Medium
134718	Fedora 31 : chromium (2020-f6271d7afa)	High
134717	Fedora 30 : webkit2gtk3 (2020-f3fa778924)	Medium
134685	Fedora 30 : nethack (2020-4c3d74204a)	High
134684	Fedora 31 : nethack (2020-16268b450d)	High
134639	Fedora 31 : weechat (2020-db890b4800)	High
134638	Fedora 30 : php-horde-Horde-Form (2020-a69f99bc67)	Medium
134637	Fedora 31 : php-horde-Horde-Form (2020-a55b70b4ab)	Medium
134636	Fedora 31 : libxslt (2020-90c768a947)	High
134635	Fedora 30 : weechat (2020-4d232b48b8)	High
134584	Fedora 30 : mediawiki (2020-d24bd1cad3)	High
134583	Fedora 31 : mediawiki (2020-a8ac31fed0)	High
134582	Fedora 31 : ansible (2020-a3f12bcff4)	Medium
134581	Fedora 30 : python3-typed_ast (2020-9b3dabc21c)	Medium
134580	Fedora 31 : couchdb (2020-83f513fd7e)	High
134579	Fedora 30 : firefox (2020-4950a2c9c3)	High
134578	Fedora 30 : ansible (2020-0cab7041f7)	Medium
134465	Fedora 31 : 1:java-1.8.0-openjdk-aarch32 (2020-f43d9b394f)	High
134464	Fedora 30 : mbedtls (2020-e7f95c4df0)	High

Fedora Local Security Checks Family for Nessus