New upstream release with security fix for CVE-2017-5617

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes for CVE-2019-3816 and CVE-2019-3833

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport security fixes: CVE-2019-9199, CVE-2019-9687.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 4.1.7

Release notes:
https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.7

Security Advisory:
https://doc.powerdns.com/authoritative/security-advisories/powerdns-ad visory-2019-03.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fixed popup issues on Wayland (mozbz#1423598)

  - Fixed rendering artifacts on Wayland (mozbz#1468911)

----

  - New upstream version (66.0)

  - Details at     https://www.mozilla.org/en-US/firefox/66.0/releasenotes/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is new version of putty.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update backports security fixes from cfitsio 3.440

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version with Pwn2Own security fixes

  - Details at     https://www.mozilla.org/en-US/firefox/66.0.1/releasenote     s/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2018-19364: 9pfs: use-after-free (bz #1651359)

  - CVE-2018-19489: 9pfs: use-after-free renaming files (bz     #1653157)

  - CVE-2018-16867: usb-mtp: path traversal issue (bz     #1656746)

  - CVE-2018-16872: usb-mtp: path traversal issue (bz     #1659150)

  - CVE-2018-20191: pvrdma: uar_read leads to NULL deref (bz     #1660315)

  - CVE-2019-6778: slirp: heap buffer overflow (bz #1669072)

  - CVE-2019-3812: Out-of-bounds read in hw/i2c/i2c-ddc.c     allows for memory disclosure (bz #1678081)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 73.0.3683.75. Fixes large bucket of CVEs.

CVE-2019-5754 CVE-2019-5782 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5784 CVE-2019-5786 CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5802 CVE-2019-5803

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-9636

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for [CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000879 CVE-2018-1000880]

----

Applied various flaws from upsteam

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses various overflow conditions that could result in possible memory read/write out of bounds errors or zero byte allocations when connected to a malicious server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 2.7.2** (2019-03-12)

  - added TemplateWrapper::getTemplateName()

----

**Version 2.7.1** (2019-03-12)

  - fixed class aliases

----

**Version 2.7.0** (2019-03-12)

  - fixed sandbox security issue (under some circumstances,     calling the __toString() method on an object was     possible even if not allowed by the security policy)

  - fixed batch filter clobbers array keys when fill     parameter is used

  - added preserveKeys support for the batch filter

  - fixed 'embed' support when used from     'template_from_string'

  - deprecated passing a Twig\Template to     Twig\Environment::load()/Twig\Environment::resolveTempla     te()

  - added the possibility to pass a TemplateWrapper to     Twig\Environment::load()

  - marked Twig\Environment::getTemplateClass() as internal     (implementation detail)

  - improved the performance of the sandbox

  - deprecated the spaceless tag

  - added a spaceless filter

  - added max value to the 'random' function

  - deprecated Twig\Extension\InitRuntimeInterface

  - deprecated Twig\Loader\ExistsLoaderInterface

  - deprecated PSR-0 classes in favor of namespaced ones

  - made namespace classes the default classes (PSR-0 ones     are aliases now)

  - added Twig\Loader\ChainLoader::getLoaders()

  - removed duplicated directory separator in     FilesystemLoader

  - deprecated the 'base_template_class' option on     Twig\Environment

  - deprecated the Twig\Environment::getBaseTemplateClass()     and Twig\Environment::setBaseTemplateClass() methods

  - changed internal code to use the namespaced classes as     much as possible

  - deprecated Twig_Parser::isReservedMacroName()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch CVE-2019-8376, CVE-2019-8377 and CVE-2019-8381.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 3.0. License has changed to ASL 2.0 + exception. See https://github.com/michaelrsweet/mxml/releases/tag/v3.0 for more info.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 1.38.2** (2019-03-12)

  - added TemplateWrapper::getTemplateName()

----

**Version 1.38.1** (2019-03-12)

  - fixed class aliases

----

**Version 1.38.0** (2019-03-12)

  - fixed sandbox security issue (under some circumstances,     calling the __toString() method on an object was     possible even if not allowed by the security policy)

  - fixed batch filter clobbers array keys when fill     parameter is used

  - added preserveKeys support for the batch filter

  - fixed 'embed' support when used from     'template_from_string'

  - added the possibility to pass a TemplateWrapper to     Twig\Environment::load()

  - improved the performance of the sandbox

  - added a spaceless filter

  - added max value to the 'random' function

  - made namespace classes the default classes (PSR-0 ones     are aliases now)

  - removed duplicated directory separator in     FilesystemLoader

  - added Twig\Loader\ChainLoader::getLoaders()

  - changed internal code to use the namespaced classes as     much as possible

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream announcement: [WordPress 5.1.1 Security and Maintenance Release](https://wordpress.org/news/2019/03/wordpress-5-1-1-security-a nd-maintenance-release/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xen: various flaws (#1685577) grant table transfer issues on large hosts [XSA-284] race with pass-through device hotplug [XSA-285] x86:
steal_page violates page_struct access discipline [XSA-287] x86:
Inconsistent PV IOMMU discipline [XSA-288] missing preemption in x86 PV page table unvalidation [XSA-290] x86/PV: page type reference counting issue with failed IOMMU update [XSA-291] x86: insufficient TLB flushing when using PCID [XSA-292] x86: PV kernel context switch corruption [XSA-293] x86 shadow: Insufficient TLB flushing when using PCID [XSA-294]

----

update to xen-4.10.3

----

  - insufficient TLB flushing / improper large page mappings     with AMD IOMMUs [XSA-275] (#1651665)

  - x86: DoS from attempting to use INVPCID with a     non-canonical addresses [XSA-279]

  - Fix for XSA-240 conflicts with shadow paging [XSA-280]

----

guest use of HLE constructs may lock up host [XSA-282]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update tcpflow to 1.5.2 tag at github, fixing a security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release 5.1 (rhbz#1688414) Fixes CVE-2017-18342 (rhbz#1595744)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 1.5.2**

  - Fix bug in AES encryption affecting certain file sizes

  - Keep file permissions when modifying zip archives

  - Support systems with small stack size.

  - Add nullability annotations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to latest version (60.6.0)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds the `H2Padding` configuration directive and has various bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport a security fix from PuTTY 0.71 affecting SFTP connections:
Fix an integer overflow in the RSA key exchange preceeding host key verification

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bump to commit 16b79f2e4e95ea23b2bf9903c9809ff7b013ce85 Security fixes for CVE-2018-17143, CVE-2018-17142, CVE-2018-17075, CVE-2018-17846, CVE-2018-17847, CVE-2018-17848

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to the 1.11.20 security fix release

Fixes CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version (66.0)

  - Details at     https://www.mozilla.org/en-US/firefox/66.0/releasenotes/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes a buffer overflow when processing RIFF/WAV files with in invalid MS ADPCM predictor.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Security fix for CVE-2019-6116

  - Fix for bug #1687144 added

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Minor security and bugfix update to version 1.5.4.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-3498: Content spoofing possibility in the     default 404 page

  - CVE-2019-6975: Memory exhaustion in     django.utils.numberformat.format()

  - Fixed a race condition in QuerySet.update_or_create()     that could result in data loss

  - geo: Prevented repetitive calls to geos_version_tuple()     in the WKBWriter class

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- new upstream version (60.5.3)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.2.16** (07 Mar 2019)

**Core:**

  - Fixed bug php#77589 (Core dump using parse_ini_string     with numeric sections). (Laruence)

  - Fixed bug php#77630 (rename() across the device may     allow unwanted access during processing). (Stas)

**EXIF:**

  - Fixed bug php#77509 (Uninitialized read in     exif_process_IFD_in_TIFF). (Stas)

  - Fixed bug php#77540 (Invalid Read on exif_process_SOFn).
    (Stas)

  - Fixed bug php#77563 (Uninitialized read in     exif_process_IFD_in_MAKERNOTE). (Stas)

  - Fixed bug php#77659 (Uninitialized read in     exif_process_IFD_in_MAKERNOTE). (Stas)

**PHAR:**

  - Fixed bug php#77396 (NULL pointer Dereference in     phar_create_or_parse_filename). (bishop)

**SPL:**

  - Fixed bug php#51068 (DirectoryIterator glob:// don't     support current path relative queries). (Ahmed Abdou)

  - Fixed bug php#77431 (openFile() silently truncates after     a null byte). (cmb)

**Standard:**

  - Fixed bug php#77552 (Unintialized php_stream_statbuf in     stat functions). (John Stevenson)

**MySQL**

  - Disabled LOCAL INFILE by default, can be enabled using     php.ini directive mysqli.allow_local_infile for mysqli,     or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql.
    (Darek Slusarczyk)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix CVE-2019-9210

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Allow to install cri-o as alternative to docker

  - Allow to install moby-engine as alternative to docker

----

Update to v1.12.5 (Verify backend upgraded connection)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Updated to latest upstream (65.0.2)

  - Disabled Mozilla Crashreporter to get Wayland crashes by     ABRT

----

  - new upstream version with skia and other security fixes

  - details at     https://www.mozilla.org/en-US/security/advisories/mfsa20     19-05/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
123474	Fedora 29 : svgsalamander (2019-3cbce64a64)	high
123473	Fedora 28 : openwsman (2019-348166f7fd)	high
123472	Fedora 29 : mingw-podofo / podofo (2019-023ea18e20)	critical
123143	Fedora 28 : pdns (2019-b85d4171d4)	high
123142	Fedora 28 : firefox (2019-a0ccc78064)	high
123141	Fedora 29 : pdns (2019-9993d32c48)	high
123140	Fedora 29 : python35 (2019-6e1938a3c5)	critical
123139	Fedora 29 : putty (2019-5776dfe300)	critical
123138	Fedora 28 : cfitsio (2019-3c1aed2aa9)	high
123137	Fedora 29 : firefox (2019-0767b70f4a)	high
123101	Fedora 29 : 2:qemu (2019-88a98ce795)	high
123100	Fedora 29 : chromium (2019-561eae4626)	critical
123099	Fedora 29 : python3 (2019-243442e600)	critical
123098	Fedora 29 : libarchive (2019-0233ec0ff3)	high
123052	Fedora 29 : libssh2 (2019-f31c14682f)	critical
123051	Fedora 28 : php-twig2 (2019-e86155be6e)	high
123050	Fedora 29 : tcpreplay (2019-e40253f67e)	critical
123049	Fedora 28 : mxml (2019-d333d01e08)	high
123048	Fedora 29 : php-twig (2019-c8712a42dc)	high
123047	Fedora 29 : wordpress (2019-bf68d77a2c)	high
123046	Fedora 28 : xen (2019-bce6498890)	high
123045	Fedora 28 : tcpreplay (2019-a9c08d4b40)	critical
123044	Fedora 29 : php-twig2 (2019-a9a37fed18)	high
123043	Fedora 28 : tcpflow (2019-8cdd669aca)	medium
123042	Fedora 28 : wordpress (2019-8606c6da35)	high
123041	Fedora 28 : PyYAML (2019-779a9db46a)	critical
123040	Fedora 28 : php-twig (2019-64f6c399c9)	high
123039	Fedora 29 : libzip (2019-615e060d4e)	high
123038	Fedora 29 : thunderbird (2019-39213e0232)	high
123037	Fedora 29 : tcpflow (2019-2c020ccbd5)	medium
123036	Fedora 28 : mod_http2 (2019-133a8a7cb5)	medium
123035	Fedora 29 : filezilla (2019-10812c1db6)	high
123034	Fedora 28 : libzip (2019-0b73bd3e5d)	high
123033	Fedora 28 : golang-googlecode-net (2019-07d447a1d3)	high
122986	Fedora 29 : python2-django1.11 (2019-f528d75a69)	high
122985	Fedora 29 : firefox (2019-e96019b473)	high
122984	Fedora 29 : PyYAML (2019-bed9afe622)	critical
122983	Fedora 28 : SDL (2019-918aad6bd5)	high
122982	Fedora 28 : ghostscript (2019-7b9bb0e426)	high
122981	Fedora 29 : cronie (2019-7104a00054)	medium
122980	Fedora 28 : python2-django1.11 (2019-5ad2149e99)	medium
122979	Fedora 29 : ghostscript (2019-15d57af79a)	high
122978	Fedora 29 : mod_http2 (2019-0300c36537)	medium
122935	Fedora 29 : thunderbird (2019-d39d6cbd8d)	high
122934	Fedora 29 : SDL (2019-bf531902c8)	high
122882	Fedora 29 : php (2019-f187a4df7a)	high
122881	Fedora 29 : advancecomp (2019-74a285d0ad)	high
122880	Fedora 29 : kubernetes (2019-3ecff65275)	critical
122862	Fedora 28 : php (2019-efa799fd16)	high
122830	Fedora 28 : firefox (2019-0a381a82de)	high

Detections

Analytics

Fedora Local Security Checks Family for Nessus

high

high

critical

high

high

high

critical

critical

high

high

high

critical

critical

high

critical

high

critical

high

high

high

high

critical

high

medium

high

critical

high

high

high

medium

medium

high

high

high

high

high

critical

high

high

medium

medium

high

medium

high

high

high

high

critical

high

high