The following Fedora EPEL 6 Security updates need testing:
Age URL
114 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6c663378c
unrtf-0.21.9-8.el6
52 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f21474267b
condor-8.6.11-1.el6
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-0d793474b0
mozilla-noscript-10.1.9.6-1.el6
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-8667fe68a8
lcms2-2.8-6.el6
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ca7fe27b10
mbedtls-2.7.6-1.el6
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ebecebaa67
python-marshmallow-2.0.0-0.7.gita8b3385.el6
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-56bfbe3964
php-tcpdf-6.2.25-1.el6
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-6bc3a525a2
libmad-0.15.1b-26.el6
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f08aaf7a38
php-horde-Horde-Core-2.31.6-1.el6
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f5ce55eadb
php-horde-horde-5.2.20-1.el6
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-8c57176049
php-horde-kronolith-4.2.25-1.el6
The following builds have been pushed to Fedora EPEL 6 updates-testing
davix-0.6.9-1.el6
gnutls30-3.5.19-1.el6
mozilla-https-everywhere-2018.9.19-1.el6
php-horde-nag-4.2.19-1.el6
Details about builds:
davix-0.6.9-1.el6 (FEDORA-EPEL-2018-5eb62e7502)
Toolkit for Http-based file management
Update Information:
* new upstream release
ChangeLog:
* Tue Oct 2 2018 Andrea Manzi - 0.6.9-1
- New upstream release
* Thu Jul 12 2018 Fedora Release Engineering -
0.6.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
gnutls30-3.5.19-1.el6 (FEDORA-EPEL-2018-83a8fcf606)
A TLS protocol implementation
Update Information:
Updated to 3.5.19 Updated to 3.5.18
ChangeLog:
* Mon Oct 1 2018 Nikos Mavrogiannopoulos 3.5.19-1
- Updated to 3.5.19
* Tue Sep 25 2018 Nikos Mavrogiannopoulos 3.5.18-1
- Updated to 3.5.18
References:
[ 1 ] Bug #1619524 - CVE-2018-10846 gnutls30: gnutls: "Just in Time" PRIME +
PROBE cache-based side channel attack can lead to plaintext recovery [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619524
[ 2 ] Bug #1619519 - CVE-2018-10845 gnutls30: gnutls: HMAC-SHA-384 vulnerable
to Lucky thirteen attack due to use of wrong constant [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619519
[ 3 ] Bug #1619512 - CVE-2018-10844 gnutls30: gnutls: HMAC-SHA-256 vulnerable
to Lucky thirteen attack due to not enough dummy function calls [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1619512
[ 4 ] Bug #1459797 - CVE-2017-7507 gnutls30: gnutls: Crash upon receiving
well-formed status_request extension [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1459797
mozilla-https-everywhere-2018.9.19-1.el6 (FEDORA-EPEL-2018-d61986c74e)
HTTPS enforcement extension for Mozilla Firefox
Update Information:
Lots o' updates. Does include a mark of shame for non-HTTPS websites
ChangeLog:
* Mon Oct 1 2018 Russell Golden - 2018.9.19-1
2018.9.19
- Ensure the 'Block all unencrypted requests' interstitial page catches more
HTTPS misconfigurations (#16418)
- Allow users to disable HTTPS Everywhere on specific sites. Add additional
UX controls in the options page for this. (#10041)
- Adding 'scope' to update channels, which defines regex limiting the URLs
an update channel is allowed to operate on (#16430)
- Adding a warning to pages which 'Block all unencrypted requests' is unable
to upgrade
- Adding a UX that enables users to add, delete, and edit update channels
- Reduces memory overhead by optimizing exclusion regex
- Block insecure FTP connections when 'Block all unencrypted requests'
is checked. This triggers a permissions dialogue in Firefox 57+, see
https://github.com/EFForg/https-everywhere/issues/16377#issuecomment-415492846
for more info.
- Bu
