This update addresses the following vulnerabilities :

  -     [CVE-2017-13866](https://cve.mitre.org/cgi-bin/cvename.c     gi?name=CVE-2017-13866),     [CVE-2017-13870](https://cve.mitre.org/cgi-bin/cvename.c     gi?name=CVE-2017-13870),     [CVE-2017-7156](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2017-7156),     [CVE-2017-13856](https://cve.mitre.org/cgi-bin/cvename.c     gi?name=CVE-2017-13856)

Additional fixes :

  - Make WebDriver implementation more spec compliant.

  - Fix a bug when trying to remove cookies before a web     process is spawned.

  - WebKitWebDriver process no longer links to     libjavascriptcoregtk.

  - Fix several memory leaks in GStreamer media backend.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for possible buffer overrun in kodak_65000 decoder Fix for possible heap overrun in Canon makernotes parser Fix for CVE-2017-13735 CVE-2017-14265: Additional check for X-Trans CFA pattern data

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-14926, CVE-2017-14927 and CVE-2017-14928.

----

Security fix for CVE-2017-14617

----

Security fix for CVE-2017-14517, CVE-2017-14518, CVE-2017-14519 and CVE-2017-14929.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-15103 and CVE-2017-15104

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update fixing denial of service (CVE-2017-16944).

----

This is an update fixing use-after-free (CVE-2017-16943).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 57.0.4

  - Security fixes to address the Meltdown and Spectre     timing attacks -     https://blog.mozilla.org/security/2018/01/03/mitigations
    -landing-new-class-timing-attack/

  - Require new nss 3.34 (fixed #1531031)

  - Disabled ARM on all Fedoras due to #1523912

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Depend on https://bodhi.fedoraproject.org/updates/FEDORA-2018-92de33f3b9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Depenency for Electrum that have a security issue in all the releases.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Microcode update for AMD cpus

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to the latest upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-1000456.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch for CVE-2016-6328

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes

  - Fix local denial of service CVE-2017-16927 #958 #979     (fix already in 0.9.4-2)

New features

  - Add a new log level TRACE more verbose than DEBUG #835     #944

  - SSH agent forwarding via RDP #867 #868     FreeRDP/FreeRDP#4122

  - Support horizontal wheel properly #928

Bug fixes

  - Avoid use of hard-coded sesman port #895

  - Workaround for corrupted display with Windows Server     2008 using NeutrinoRDP #869

  - Fix glitch in audio redirection by AAC #910 #936

  - Implement vsock support #930 #935 #948

  - Avoid 100% CPU usage on SSL accept #956

Other changes

  - Add US Dvorak keyboard #929

  - Suppress some misleading logs #964

  - Add Finnish keyboard #972

  - Add more user-friendlier description about Xorg config     #974

  - Renew pulseaudio document #984 #985

  - Lots of cleanups and refactoring

Known issues

  - Audio redirection by MP3 codec doesn't sound with some     client, use AAC instead #965

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 7.5.0 GA release (CVE-2017-17439)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Adds support for early microcode for **AMD CPUs family >= 0x17**.

Note: Intel CPU support is fine.

To add the microcode to all your initramfs images: ``` # dracut
--regenerate-all --force ``` To only add it to the current kernel version: ``` # dracut --force ```

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.14.11 stable kernel update contains a number of important fixes across the tree. This also includes the KPTI patches to mitigate the Meltdown vulnerability for x86 architectures

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2017-1000158

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream announcement :

Welcome to **phpMyAdmin 4.7.7**, a regular maintenance release containing bug fixes and a security fix.

The security vulnerability is a XSRF/CSRF flaw; you can read more at https://www.phpmyadmin.net/security/PMASA-2017-9/ As a result of this, we recommend all users upgrade immediately. A CVE-ID has been requested but not yet assigned.

A complete list of new features and bugs that have been fixed is available in the ChangeLog file or changelog.php included with this release.

Notable changes since 4.7.6 :

  - Fixed displaying of formatted numeric values for some     locales

  - Fixed PHP error when browsing certain results

There are several more improvements; please refer to the ChangeLog for full details.

Thanks to our sponsors for helping to make this work possible!

The phpMyAdmin Team

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

another patch related to the [XSA-240, CVE-2017-15595] issue xen:
various flaws (#1525018) x86 PV guests may gain access to internally used page [XSA-248] broken x86 shadow mode refcount overflow check [XSA-249] improper x86 shadow mode refcount error handling [XSA-250] improper bug check in x86 log-dirty handling [XSA-251]

----

xen: various flaws (#1518214) x86: infinite loop due to missing PoD error checking [XSA-246] Missing p2m error checking in PoD code [XSA-247]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429

----

Security fix for CVE-2017-15398, CVE-2017-15399

----

Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.

Build switched to use gtk3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.9.9. This release addresses security vulnerabilities discovered by Cure53. Details can be found in the Security Audit Report:
https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%2 0Cure53%20-%20Excerpt.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-1000159 Command injection when exporting DVI to PDF

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update to the latest upstream pre-release (fixes     CVE-2017-1000211)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 0.0.11, see http://metadata.ftp-master.debian.org/changelogs/main/s/sensible-utils /sensible-utils_0.0.11_changelog for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.8.3, fixing CVE-2017-15612 and CVE-2017-16876

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream 13.18.4 release to address AST-2017-012/CVE-2017-17664 security issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Disable SSHv1 options.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.14.8 stable kernel update contains a number of important fixes across the tree.

----

The 4.14.7 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Patch :

  - Avoid invalid free and crash explicitly instead of     silently enabling the caller to commit undefined     behaviour.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://www.libraw.org/news/libraw-0-18-6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-1000158

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.14.6 update contains various fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for QDnsLookup crash on unix when DNS response is over 512 bytes, see also https://bugreports.qt.io/browse/QTBUG-64742

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a possible heap overflow when parsing malicious cursor files. See https://lists.freedesktop.org/archives/wayland-devel/2017-November/035 979.html for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch for CVE-2017-17440

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-1000229 and CVE-2017-16938

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to upstream release 0.3.1.9. Fixes :

  - CVE-2017-8819: Replay-cache ineffective for v2 onion     services

  - CVE-2017-8820: Remote DoS attack against directory     authorities

  - CVE-2017-8821: An attacker can make Tor ask for a     password

  - CVE-2017-8822: Relays can pick themselves in a circuit     path

  - CVE-2017-8823: Use-after-free in onion service v2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to xen-4.7.4 update Source0 location

----

fix an issue in patch for [XSA-240, CVE-2017-15595] that might be a security issue fix for [XSA-243, CVE-2017-15592] could cause hypervisor crash (DOS)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix to directory traversal attacks (CVE-2017-17042).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream announcement: [WordPress 4.9.1 Security and Maintenance Release](https://wordpress.org/news/2017/11/wordpress-4-9-1-security-a nd-maintenance-release/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Ver. 19.3.6.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest version. Contains security fixes for CVE-2017-15090, CVE-2017-15092, CVE-2017-15093 and CVE-2017-15094

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-15906: Improper write operations in readonly mode (#1506630)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.1

----

Update to 2.0, Initial support for aarch64 images and associated SBCs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to the latest upstream stable version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
105807	Fedora 27 : webkitgtk4 (2017-06b373d942)	high
105806	Fedora 27 : LibRaw (2017-0348398d64)	critical
105805	Fedora 27 : poppler (2017-025ff38ac9)	high
105804	Fedora 27 : heketi (2017-01ad8b3946)	high
105803	Fedora 27 : exim (2017-0053bb9719)	critical
105739	Fedora 26 : firefox (2018-fb582aabcc)	high
105738	Fedora 26 : electrum (2018-b7e606d011)	high
105737	Fedora 26 : python-jsonrpclib (2018-92de33f3b9)	high
105736	Fedora 26 : heketi (2017-f7cbe22fd8)	high
105711	Fedora 26 : linux-firmware (2018-c4670f2981)	high
105710	Fedora 26 : thunderbird (2018-3ec87df5ba)	high
105709	Fedora 26 : poppler (2018-20ba39cba9)	high
105708	Fedora 26 : libexif (2017-c28bfe0986)	high
105707	Fedora 26 : 1:xrdp (2017-4603342f9a)	high
105706	Fedora 26 : heimdal (2017-2962e58478)	high
105705	Fedora 26 : webkitgtk4 (2017-0ad0e2f390)	high
105624	Fedora 26 : dracut (2018-9bcc7b0b70)	high
105596	Fedora 26 : kernel (2018-8ed5eff2c0)	high
105519	Fedora 26 : python33 (2017-7fe2c4bc0e)	critical
105512	Fedora 26 : phpMyAdmin (2017-481515e199)	high
105511	Fedora 26 : xen (2017-16a414b3c5)	high
105501	Fedora 26 : chromium (2017-ea44f172e3)	critical
105500	Fedora 26 : thunderbird-enigmail (2017-856a149a4c)	high
105477	Fedora 26 : evince (2017-d6402c8005)	high
105476	Fedora 26 : lynx (2017-bf172b2035)	medium
105475	Fedora 26 : sensible-utils (2017-80c6b4d3be)	high
105474	Fedora 26 : python-mistune (2017-7b4149911a)	medium
105473	Fedora 26 : asterisk (2017-38fbcdffc3)	medium
105472	Fedora 26 : shellinabox (2017-1dc71e1acd)	high
105447	Fedora 26 : kernel (2017-7810b7c59f)	high
105446	Fedora 26 : json-c (2017-6d952bdc53)	high
105386	Fedora 26 : LibRaw (2017-e68e87955b)	medium
105385	Fedora 26 : python34 (2017-e0abe14016)	critical
105384	Fedora 26 : python35 (2017-cf8c62747a)	critical
105383	Fedora 26 : kernel (2017-ba6b6e71f7)	high
105382	Fedora 26 : qt5-qtbase (2017-aa4cc10bde)	high
105381	Fedora 26 : wayland (2017-26c3ab48e4)	high
105380	Fedora 26 : libextractor (2017-0f3270406c)	medium
105379	Fedora 26 : optipng (2017-018464cbf9)	high
105361	Fedora 26 : python26 (2017-2d441a1d98)	critical
105334	Fedora 26 : tor (2017-bce9e03721)	high
105208	Fedora 25 : xen (2017-f2577f2108)	high
105207	Fedora 25 : rubygem-yard (2017-ca05b30e86)	high
105206	Fedora 26 : rubygem-yard (2017-c6c6e9beae)	high
105205	Fedora 26 : wordpress (2017-994ff5ced8)	high
105204	Fedora 26 : erlang (2017-93b6236635) (ROBOT)	medium
105203	Fedora 25 : pdns-recursor (2017-81fe39ad9f)	medium
105202	Fedora 25 : openssh (2017-78f0991378)	medium
105201	Fedora 25 : fedora-arm-installer (2017-62f44716bb)	high
105200	Fedora 26 : thunderbird (2017-463cb2af78)	high

Detections

Analytics

Fedora Local Security Checks Family for Nessus

high

critical

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high

high

medium

high

medium

medium

high

high

high

medium

critical

critical

high

high

high

medium

high

critical

high

high

high

high

high

medium

medium

medium

high

high