- Update to 2.8 fixes rhbz#1581180 rhbz#1603993     rhbz#1674893 and rhbz#1524335

  - Removed upstreamed patch

  - Bug 1524335 - CVE-2017-17459 fossil: Command injection     via malicious ssh URLs [fedora-all]

  - Bug 1581180 - Update fossil version to 2.6 (currently is     2.2)

  - Bug 1603993 - fossil: FTBFS in Fedora rawhide

  - Bug 1674893 - fossil: FTBFS in Fedora rawhide/f30

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to 2.1.10, security fix for CVE-2019-12781

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### Update to v1.48

  - New API :

  - `snapd_client_get_connections_async`

  - `snapd_client_get_connections_finish`

  - `snapd_client_get_connections_sync`

  - `snapd_client_get_interfaces2_async`

  - `snapd_client_get_interfaces2_finish`

  - `snapd_client_get_interfaces2_sync`

  - `snapd_client_get_snap_conf_async`

  - `snapd_client_get_snap_conf_finish`

  - `snapd_client_get_snap_conf_sync`

  - `snapd_client_set_snap_conf_async`

  - `snapd_client_set_snap_conf_finish`

  - `snapd_client_set_snap_conf_sync`

  - `snapd_connection_get_gadget`

  - `snapd_connection_get_interface`

  - `snapd_connection_get_manual`

  - `snapd_connection_get_plug`

  - `snapd_connection_get_plug_attribute`

  - `snapd_connection_get_plug_attribute_names`

  - `snapd_connection_get_slot`

  - `snapd_connection_get_slot_attribute`

  - `snapd_connection_get_slot_attribute_names`

  - `snapd_connection_has_plug_attribute`

  - `snapd_connection_has_slot_attribute`

  - `snapd_interface_get_doc_url`

  - `snapd_interface_get_name`

  - `snapd_interface_get_plugs`

  - `snapd_interface_get_slots`

  - `snapd_interface_get_summary`

  - `snapd_markdown_node_get_children`

  - `snapd_markdown_node_get_node_type`

  - `snapd_markdown_node_get_text`

  - `snapd_markdown_parser_new`

  - `snapd_markdown_parser_get_combine_whitespace`

  - `snapd_markdown_parser_parse`

  - `snapd_markdown_parser_set_combine_whitespace`

  - `snapd_plug_get_connected_slots`

  - `snapd_plug_ref_get_plug`

  - `snapd_plug_ref_get_snap`

  - `snapd_slot_get_connected_plugs`

  - `snapd_slot_ref_get_slot`

  - `snapd_slot_ref_get_snap`

  - `SNAPD_ERROR_OPTION_NOT_FOUND`

  - Deprecated API :

  - `snapd_client_get_interfaces_async`

  - `snapd_client_get_interfaces_finish`

  - `snapd_client_get_interfaces_sync`

  - `snapd_connection_get_name`

  - `snapd_connection_get_snap`

  - `snapd_plug_get_connections`

  - `snapd_slot_get_connections`

  - Allow searching via common-id

  - Add a description markdown parser

  - Replace `SnapdConnection` with `SnapdPlugRef` and     `SnapdSlotRef`

  - Support updated connections API (`/v2/connections`)

  - Support updated `/v2/interfaces&select=` API

  - Support snap configuration API

  - Add Qt interface attribute API

  - Make `snapd_client_set_socket_path` revert to the     default when `NULL` passed.

  - Fix C99 mode not being enabled on older versions of GCC

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (68.0)

  - Release notes at     https://www.mozilla.org/en-US/firefox/68.0/releasenotes/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (60.8.0)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update Python 3.6 to [3.6.9](https://www.python.org/downloads/release/python-369/), the latest security release of the 3.6 branch. [Changelog for 3.6.9 final](https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6- 9-final) and [3.6.9 release candidate 1](https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-re lease-candidate-1). Includes security fixes for CVE-2019-9636, CVE-2019-9740, CVE-2019-10160.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes a fix for a security vulnerability, CVE_2018-20843 :

> Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks

For more information on the changes in 2.2.7, see the upstream release notes at:
https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes#L5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-12155: qxl: NULL pointer dereference while     releasing spice resources (bz #1712727, bz #1712670)

  - CVE-2019-5008: NULL pointer dereference in     hw/sparc64/sun4u.c leading to DoS (bz #1705916, bz     #1705915)

  - CVE-2018-20815: device_tree: heap buffer overflow while     loading device tree blob (bz #1693117, bz #1693101)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Cannot start VM with a CBR 2.0 TPM device (bz #1712556)

  - libvirtd does not update VM .xml configurations after     virsh snapshot/blockcommit (bz #1722348)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Failed to attache NEW rbd device to guest (bz #1672620)

  - PCI hostdev interface segfault (bz #1692053)

----

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-12155: qxl: NULL pointer dereference while     releasing spice resources (bz #1712727, bz #1712670)

  - CVE-2019-5008: NULL pointer dereference in     hw/sparc64/sun4u.c leading to DoS (bz #1705916, bz     #1705915)

  - CVE-2018-20815: device_tree: heap buffer overflow while     loading device tree blob (bz #1693117, bz #1693101)

  - CVE-2019-9824: Slirp: information leakage in tcp_emu()     due to uninitialized stack variables (bz #1689794, bz     #1678515)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix vfs_fruit, vfs_glusterfs and smbspool

----

Update to Samba 4.10.5 Security fixes for CVE-2019-12435 and CVE-2019-12436

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bugfixes, and a security fix: Fixed vulnerabilities :

Filenames containing double-quotation marks were not escaped correctly when selected for opening/editing. Depending on the associated program, parts of the filename could be interpreted as commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.74-3 (CVE-2019-7165 + CVE-2019-12594).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes a rebase from 9.0.13 up to 9.0.21 which resolves two CVEs along with various other bugs/features :

  - rhbz#1673856 tomcat-9.0.21 is available

  - rhbz#1713279 CVE-2019-0221 tomcat: XSS in SSI printenv

  - rhbz#1693326 CVE-2019-0199 tomcat: Apache Tomcat HTTP/2     DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to v5.1.15

----

Update to v5.1.14

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unlimited Arm Atomics Operations [XSA-295] (#1720760)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Includes security fix backported from 9.4.3

  - [security] Prevent execution of XSS on rich text,

  - [security] Prevent xss attack on user picture,

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for **CVE-2018-19210**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New bug and security fix release, see http://www.graphicsmagick.org/NEWS.html#june-15-2019

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 75.0.3770.100. The usual pile of bugs and CVE fixes. vaapi support disabled, just too broken. :(

Fixes CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5824 CVE-2019-5825 CVE-2019-5826 CVE-2019-5827 CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 CVE-2019-5842

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

http://www.graphicsmagick.org/NEWS.html#june-15-2019

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 4.1.10

Release notes:
https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.1 0

Security Advisory :

https://doc.powerdns.com/authoritative/security-advisories/powerdns-ad visory-2019-04.html

https://doc.powerdns.com/authoritative/security-advisories/powerdns-ad visory-2019-05.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 9.4.3**

**This is a security release, upgrading is highly recommended**

Non exhaustive list of changes :

  - [security] Prevent execution of XSS on rich text,

  - [security] Prevent xss attack on user picture,

  - Fix performance issues when using entities,

  - New &ldquo;Prevent take into account&rdquo; action on     tickets business rules,

  - New &ldquo;Status&rdquo; criterion on tickets business     rules,

  - Change and problem tasks can now be marked as private,

  - and more!

See [changelog](https://github.com/glpi-project/glpi/milestone/36?closed=1 ) for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security updates have been released for PharStreamWrapper.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/uuid/releases/7.x-1.3

    - https://www.drupal.org/sa-contrib-2019-052

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-11459.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.1.33 and fix CVE-2019-11068

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2019-11707 Fix CVE-2019-11708

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (67.0.4)

  - Fixes CVE-2019-11708: sandbox escape using Prompt:Open

  - Release notes are at     https://www.mozilla.org/en-US/firefox/67.0.4/releasenote     s/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-12293, CVE-2019-10872 and CVE-2019-10871.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (67.0.3)

  - Fixed CVE-2019-11707: Type confusion in Array.pop

----

  - New upstream version (67.0.2)

  - Release notes are available at     https://www.mozilla.org/en-US/firefox/67.0.2/releasenote     s/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release Fixes Debug file descriptor leak CVE-2019-1221 Fixes insecure debug file handling CVE-2019-1220

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (67.0.3)

  - Fixed CVE-2019-11707: Type confusion in Array.pop

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.12.16

Fix CVE-2019-12749

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to v5.1.11

  - Fixes CVE-2019-11477

  - Fixes CVE-2019-11479

  - Fixes CVE-2019-11478

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.1.33

Fix CVE-2016-1841, CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, CVE-2016-4609, CVE-2019-11068, CVE-2016-1684, CVE-2016-1683, CVE-2016-4738.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
126665	Fedora 30 : fossil (2019-f350634b40)	High
126664	Fedora 30 : python-django (2019-d9aa58d863)	Medium
126663	Fedora 29 : snapd-glib (2019-bc3dfb389f)	Medium
126662	Fedora 30 : snapd-glib (2019-b6612c5fe5)	Medium
126661	Fedora 30 : firefox (2019-a1b709fca0)	High
126660	Fedora 30 : thunderbird (2019-83c570c2eb)	High
126659	Fedora 29 : python36 (2019-7df59302e0)	Medium
126658	Fedora 30 : python36 (2019-7723d4774a)	Medium
126591	Fedora 30 : expat (2019-18868e1715)	High
126533	Fedora 29 : 2:qemu (2019-e9de40d53f)	High
126532	Fedora 30 : libvirt (2019-b2dfb13daf)	Medium
126531	Fedora 29 : libvirt (2019-9210998aaa)	Medium
126530	Fedora 30 : 2:qemu (2019-52a8f5468e)	High
126518	Fedora 30 : 2:samba (2019-8015e5dc40)	Medium
126517	Fedora 30 : filezilla / libfilezilla (2019-7b9af09b17)	High
126516	Fedora 29 : filezilla / libfilezilla (2019-6e77507660)	High
126515	Fedora 30 : dosbox (2019-6b86d0f1c0)	High
126483	Fedora 29 : 1:tomcat (2019-d66febb5df)	Medium
126449	Fedora 29 : kernel / kernel-headers (2019-69c132b061)	Medium
126412	Fedora 29 : xen (2019-899ef6056c)	High
126411	Fedora 29 : glpi (2019-169f1eec7c)	High
126362	Fedora 30 : libtiff (2019-fa3e40f00a)	Medium
126361	Fedora 30 : GraphicsMagick (2019-da4c20882c)	High
126360	Fedora 30 : xen (2019-aeda234b68)	High
126359	Fedora 30 : chromium (2019-8fb8240d14)	Medium
126358	Fedora 29 : libtiff (2019-70d89f8806)	Medium
126357	Fedora 30 : kernel / kernel-headers (2019-6817686c4d)	Medium
126356	Fedora 29 : GraphicsMagick (2019-425a1aa7c9)	High
126355	Fedora 30 : pdns (2019-2ed768623e)	High
126354	Fedora 30 : glpi (2019-2bad806189)	High
126353	Fedora 29 : pdns (2019-08b1477c9d)	High
126314	Fedora 29 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-af7bef7165)	High
126313	Fedora 29 : drupal7-uuid (2019-a872068cd3)	High
126265	Fedora 30 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-a8121923d5)	High
126264	Fedora 30 : drupal7-uuid (2019-9f613ab692)	High
126226	Fedora 30 : thunderbird (2019-fd116d3002)	High
126225	Fedora 30 : 1:tomcat (2019-1a3f878d27)	Medium
126135	Fedora 29 : evince (2019-ff2b5b5b47)	Medium
126134	Fedora 29 : libxslt (2019-e74d639587)	High
126133	Fedora 30 : gjs / mozjs60 (2019-c2ff49ef73)	High
126132	Fedora 29 : firefox (2019-53e4772bb8)	High
126131	Fedora 30 : firefox (2019-1ae01e6688)	High
126130	Fedora 29 : poppler (2019-0ea42f074e)	Medium
126080	Fedora 29 : firefox (2019-9d9ad2999e)	High
126056	Fedora 30 : pam-u2f (2019-b6d3c8b0a8)	Medium
126055	Fedora 30 : firefox (2019-2cac67b3bc)	High
126018	Fedora 30 : 1:dbus (2019-d5ded5326b)	Low
126017	Fedora 29 : kernel / kernel-headers (2019-914542e05c) (SACK Panic) (SACK Slowness)	High
126016	Fedora 30 : kernel / kernel-headers (2019-6c3d89b3d0) (SACK Panic) (SACK Slowness)	High
126015	Fedora 30 : mingw-libxslt (2019-320d5295fc)	High

Fedora Local Security Checks Family for Nessus