Security fix for CVE-2019-1020014

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 5.10.6 stable kernel rebase contains new features, additional hardware support, and a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

AdPlug 2.3.3 ============

  - New RAD player replacing the old one

  - Bug fixes: (huge thanks to Alexander Miller for these)

  - CVE-2019-14690 - buffer overflow in `.bmf`

  - CVE-2019-14691 - buffer overflow in `.dtm`

  - CVE-2019-14692 - buffer overflow in `.mkj`

  - CVE-2019-14732 - buffer overflow in `.a2m`

  - CVE-2019-14733 - buffer overflow in `.rad`

  - CVE-2019-14734 - buffer overflow in `.mtk`

  - CVE-2019-15151 - double free and OOB reads in `.u6m`

  - OOB reads in `.xad`

  - OOB reads in `.rix`

AdPlug 2.3.2 ============

  - Bug fixes :

  - FMOPL: Fix global variable pointer double-free     (CVE-2018-17825)

  - HERAD: Fix compilation on GCC 4.2.1

  - ADL: Calling `rewind()` before `update()` causes access     violation

  - Move OPL reset/init code to `rewind()` for some players

AdPlug 2.3.1 ============

  - Fixed unconditional inclusion of 'sys/io.h' on Linux

  - Autotools improvement

  - Non-recursive Automake, improved parallelizability

  - Compatibility fixes for FreeBSD's pmake and OpenBSD's     make

  - Out-of-source building

AdPlug 2.3 ==========

  - Bug fixes :

  - CMF: Fix uninitialised variable use (thanks     binarymaster)

  - CMF: Handle invalid offsets without crashing

  - ROL: Prevent access beyond end of vector

  - MSC: Fix use of uninitialised variable

  - HSC: Handle out of range patterns more gracefully

  - MID: Fix out of range array read

  - LDS: Use the tempo stored inside the Loudness-File     instead of simply returning 70Hz

  - RIX: Fix several replay bugs (thanks to Palxex)

  - RIX: Big-endian fix by Wei Mingzhi

  - XAD: Tempo fix

  - Various other out of bounds array fixes, timing fixes,     etc.

  - New formats :

  - BMF: Easy AdLib 1.0

  - CMF: SoundFX Macs Opera

  - GOT: God of Thunder

  - HSQ/SQX/SDB/AGD/HA2: Herbulot AdLib System (HERAD)

  - MUS/IMS/MDI: AdLib Visual Composer ROL derivatives

  - SOP: sopepos' Note Player

  - VGM: Video Game Music

  - Allow compilation on platforms that don't support real     OPL hardware access

  - Add support for compiling on Appveyor and publishing a     NuGet package

  - Add Visual Studio 2015 projects

  - Add support for Travis CI builds

  - Add new CRC16 and CRC32 tests

  - Addition of WoodyOPL from DOSBox SVN (thanks to NY00123)

  - Addition of NukedOPL (thanks to loki666 and nukeykt)

  - Move from SourceForge to GitHub

  - DRO player refactored (thanks to Laurence Myers and     William Yates)

  - Add (mono) OPL3 support to the surround/harmonic-effect     OPL

  - Fix occasional random noise in right channel when using     surround OPL and Satoh synth

  - Add display for ROL comment and instrument names

  - Improve support for different Westwood ADL format     versions

  - Improve CMF transpose support (per-channel now)

  - Autotools build environment updated

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes mXSS security vulnerability due to the use of improper parser (CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

build: dmidecode - apply upstream patch & remove -Wno-format-security flag

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.1.0 Security fix for CVE-2020-15216

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.4.14** (07 Jan 2021)

**Core:**

  - Fixed bug php#74558 (Can't rebind closure returned by     Closure::fromCallable()). (cmb)

  - Fixed bug php#80345 (PHPIZE configuration has outdated     PHP_RELEASE_VERSION). (cmb)

  - Fixed bug php#72964 (White space not unfolded for CC/Bcc     headers). (cmb)

  - Fixed bug php#80362 (Running dtrace scripts can cause     php to crash). (al at coralnet dot name)

  - Fixed bug php#80393 (Build of PHP extension fails due to     configuration gap with libtool). (kir dot morozov at     gmail dot com)

  - Fixed bug php#80402 (configure filtering out -lpthread).
    (Nikita)

  - Fixed bug php#77069 (stream filter loses final block of     data). (cmb)

**Fileinfo:**

  - Fixed bug php#77961 (finfo_open crafted magic parsing     SIGABRT). (cmb)

**FPM:**

  - Fixed bug php#69625 (FPM returns 200 status on request     without SCRIPT_FILENAME env). (Jakub Zelenka)

**Intl:**

  - Fixed bug php#80425     (MessageFormatAdapter::getArgTypeList redefined).
    (Nikita)

**OpenSSL:**

  - Fixed bug php#80368 (OpenSSL extension fails to build     against LibreSSL due to lack of OCB support). (Nikita)

**Phar:**

  - Fixed bug php#73809 (Phar Zip parse crash - mmap fail).
    (cmb)

  - Fixed bug php#75102 (`PharData` says invalid checksum     for valid tar). (cmb)

  - Fixed bug php#77322 (PharData::addEmptyDir('/') Possible     integer overflow). (cmb)

**PDO MySQL:**

  - Fixed bug php#80458 (PDOStatement::fetchAll() throws for     upsert queries). (Kamil Tekiela)

  - Fixed bug php#63185 (nextRowset() ignores MySQL errors     with native prepared statements). (Nikita)

  - Fixed bug php#78152 (PDO::exec() - Bad error handling     with multiple commands). (Nikita)

  - Fixed bug php#70066 (Unexpected 'Cannot execute queries     while other unbuffered queries'). (Nikita)

  - Fixed bug php#71145 (Multiple statements in init command     triggers unbuffered query error). (Nikita)

  - Fixed bug php#76815 (PDOStatement cannot be     GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
    (Nikita)

**Standard:**

  - Fixed bug php#77423 (FILTER_VALIDATE_URL accepts URLs     with invalid userinfo). (**CVE-2020-7071**) (cmb)

  - Fixed bug php#80366 (Return Value of zend_fstat() not     Checked). (sagpant, cmb)

  - Fixed bug php#80411 (References to null-serialized     object break serialize()). (Nikita)

**Tidy:**

  - Fixed bug php#77594 (ob_tidyhandler is never reset).
    (cmb)

**Zlib:**

  - Fixed php#48725 (Support for flushing in zlib stream).
    (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**RELEASE 1.4.10**

  - Fix extra angle brackets in In-Reply-To header derived     from mailto: params (#7655)

  - Fix folder list issue whan special folder is a subfolder     (#7647)

  - Fix Elastic's folder subscription toggle in search     result (#7653)

  - Fix state of subscription toggle on folders list after     changing folder state from the search result (#7653)

  - **Security**: Fix cross-site scripting (XSS) via HTML or     Plain text messages with malicious content     [**CVE-2020-35730**]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 6.2.60 Fixes CVE-2020-29668

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-10749

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Node.js 14.15.4 security release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New Firefox version (84.0.2) which fixes security / stability issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Added upstream patch to avoid infinite loop on filenames     with invalid encoding (CVE-2019-19451, #1778767)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-13482.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-35176

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-13482

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to AWStats 7.8. Includes security fix for CVE-2020-29600 / CVE-2020-35176

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-0499

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to upstream 7.3.6

Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

#### 1.9.0 (2020-06-24) ####

  - Add type annotation stubs for the following modules :

  - ``py.error``

  - ``py.iniconfig``

  - ``py.path`` (not including SVN paths)

  - ``py.io``

  - ``py.xml``

    There are no plans to type other modules at this time.

    The type annotations are provided in external .pyi     files, not inline in the code, and may therefore contain     small errors or omissions. If you use ``py`` in     conjunction with a type checker, and encounter any type     errors you believe should be accepted, please report it     in an issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated SPEC file and rebuilt for new dependencies.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-15113, CVE-2020-15112, CVE-2020-15114, CVE-2020-15115, CVE-2020-15136, CVE-2020-15106

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ceph 15.2.8 GA

Security fix for CVE-2020-27781

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.1.9 Security fix for CVE-2020-26892 Security fix for CVE-2020-26521

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.4.0 Security fix for CVE-2020-12666

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December /000268.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version 1.4.3. Security fix for CVE-2020-28241.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) Xenstore:
guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup [XSA-325, CVE-2020-29483] (#1908087) oxenstored memory leak in reset_watches [XSA-330, CVE-2020-29485] (#1908000) undue recursion in x86 HVM context switch code [XSA-348, CVE-2020-29566] (#1908085) oxenstored:
node ownership can be changed by unprivileged clients [XSA-352, CVE-2020-29486] (#1908003) oxenstored: permissions not checked on root node [XSA-353, CVE-2020-29479] (#1908002) FIFO event channels control block related ordering [XSA-358, CVE-2020-29570] (#1907931) FIFO event channels control structure ordering [XSA-359, CVE-2020-29571] (#1908089)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport patches for CVE-2020-16592 and CVE-2020-16598

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xenstore watch notifications lacking permission checks [XSA-115, CVE-2020-29480] (#1908091) Xenstore: new domains inheriting existing node permissions [XSA-322, CVE-2020-29481] (#1908095) Xenstore: wrong path length check [XSA-323, CVE-2020-29482] (#1908096) Xenstore:
guests can crash xenstored via watchs [XSA-324, CVE-2020-29484] (#1908088) Xenstore: guests can disturb domain cleanup [XSA-325, CVE-2020-29483] (#1908087) oxenstored memory leak in reset_watches [XSA-330, CVE-2020-29485] (#1908000) undue recursion in x86 HVM context switch code [XSA-348, CVE-2020-29566] (#1908085) oxenstored:
node ownership can be changed by unprivileged clients [XSA-352, CVE-2020-29486] (#1908003) oxenstored: permissions not checked on root node [XSA-353, CVE-2020-29479] (#1908002) infinite loop when cleaning up IRQ vectors [XSA-356, CVE-2020-29567] (#1907932) FIFO event channels control block related ordering [XSA-358, CVE-2020-29570] (#1907931) FIFO event channels control structure ordering [XSA-359, CVE-2020-29571] (#1908089)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.16.9

Release notes: https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Previous fix for buffer overrun printing the contents of the sPLT chunk in certain malformed inputs (RHBZ#1905775) was incomplete; it should be properly fixed now.

----

Security fix for multiple buffer overflows from crafted file input (RHBZ#1902786,1902806,1902810: no CVE yet assigned), and for buffer overrun printing the contents of the sPLT chunk in certain malformed inputs (RHBZ#1905775: no tracking bug or CVE yet assigned); also, new eXIf support and assorted small bug fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gdm 3.38.2.1 release :

  - Address autologin unlock bug issue (CVE-2020-27837)

  - Translation updates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes 3 security issues in the RPC protocol which p11-kit server/remote commands use :

- https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x

- https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc

- https://github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update backports patches for CVE-2020-27841, CVE-2020-27842, CVE-2020-27843, CVE-2020-27845.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- curl: Inferior OCSP verification (CVE-2020-8286)

  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)

  - curl: trusting FTP PASV responses (CVE-2020-8284)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
144967	Fedora 32 : golang-github-docker-credential-helpers (2021-03bcfa3491)	Low
144966	Fedora 33 : kernel / kernel-headers (2021-3465ada1ca)	High
144965	Fedora 32 : adplug / audacious-plugins / ocp (2021-24ef21134b)	High
144964	Fedora 33 : adplug / audacious-plugins / ocp (2021-64168929e4)	High
144963	Fedora 33 : python-lxml (2020-0e055ea503)	Medium
144961	Fedora 33 : cpu-x (2021-9b7b3599be)	High
144958	Fedora 32 : golang-github-russellhaering-goxmldsig (2021-9316ee2948)	Medium
144957	Fedora 32 : python-lxml (2020-307946cfb6)	Medium
144955	Fedora 33 : php (2021-8dac5c39f3)	High
144954	Fedora 33 : golang-github-russellhaering-goxmldsig (2021-a2a7673da2)	Medium
144920	Fedora 32 : roundcubemail (2021-2cb0643316)	Medium
144919	Fedora 33 : sympa (2021-11cb6626e2)	Medium
144918	Fedora 33 : roundcubemail (2021-73359af51c)	Medium
144916	Fedora 32 : sympa (2021-a5570c5281)	Medium
144842	Fedora 32 : golang-github-containernetworking-plugins (2021-ccb8a9c403)	Medium
144840	Fedora 33 : 1:nodejs (2021-fb1a136393)	High
144838	Fedora 32 : firefox (2021-6eac5874a3)	High
144835	Fedora 32 : 1:dia (2020-cbc0754798)	Medium
144834	Fedora 32 : rubygem-em-http-request (2020-117f1b67fb)	Medium
144830	Fedora 33 : awstats (2020-4cba5f2846)	Medium
144828	Fedora 32 : mingw-binutils (2020-28c78a6ac3)	Medium
144827	Fedora 33 : rubygem-em-http-request (2020-8ccd750904)	Medium
144822	Fedora 32 : awstats (2020-d1aa0e030c)	High
144819	Fedora 33 : flac (2021-df42ebeac2)	Medium
144816	Fedora 33 : firefox (2021-944b551751)	High
144736	Fedora 32 : grafana (2020-968067abfa)	Critical
144730	Fedora 33 : python-py (2020-8371993b6b)	Medium
144729	Fedora 32 : python-py (2020-db0eb54982)	Medium
144717	Fedora 33 : grafana (2020-64e54abd9f)	Critical
144701	Fedora 33 : guacamole-server (2020-640645e518)	Medium
144696	Fedora 32 : etcd (2020-cd43b84c16)	Medium
144694	Fedora 33 : 2:ceph (2020-fcafbe7225)	Low
144669	Fedora 33 : nats-server (2020-2c8851d48b)	High
144654	Fedora 32 : golang-gopkg-macaron-1 (2020-66e6e8d027)	Medium
144652	Fedora 32 : guacamole-server (2020-bfde0ab889)	Medium
144618	Fedora 33 : mediawiki (2020-0be2d40e13)	Medium
144617	Fedora 33 : libmaxminddb (2020-8a8f8b244f)	Medium
144616	Fedora 32 : thunderbird (2020-b9644a6038)	High
144615	Fedora 32 : libmaxminddb (2020-1fb1785fa1)	Medium
144613	Fedora 32 : xen (2020-df772b417b)	High
144612	Fedora 33 : mingw-binutils (2020-18ec0bf4bb)	Medium
144611	Fedora 33 : xen (2020-64859a826b)	High
144606	Fedora 32 : mingw-binutils (2020-f903e139b1)	Medium
144583	Fedora 32 : mbedtls (2020-e2d7a16ae9)	High
144577	Fedora 32 : pngcheck (2020-daffd78c3d)	High
144572	Fedora 33 : pngcheck (2020-f3a397cbf8)	High
144546	Fedora 33 : 1:gdm (2020-1650d8012f)	Medium
144542	Fedora 32 : p11-kit (2020-edcc40be4b)	High
144536	Fedora 33 : mingw-openjpeg2 / openjpeg2 (2020-3e00413763)	High
144500	Fedora 32 : curl (2020-7ab62c73bc)	Medium

Fedora Local Security Checks Family for Nessus