mod_auth_openidc security update

1.8.8-5 - Resolves: rhbz1626297 - CVE-2017-6413 modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an 'AuthType oauth20' configuration rhel-7 1.8.8-4 - Resolves: rhbz1626299 - CVE-2017-6059 modauthopenidc: Shows user-supplied content on error pages rhel-7...

openssl security and bug fix update

1.0.2k-19.0.1 - Bump release for rebuild. 1.0.2k-19 - close the RSA decryption 9 lives of Bleichenbacher cat timing side channel 1649568 1.0.2k-18 - fix CVE-2018-0734 - DSA signature local timing side channel - fix CVE-2019-1559 - 0-byte record padding oracle - close the RSA decryption One & done...

opensc security, bug fix, and enhancement update

0.19.0-3 - Make OpenSC multilib also on s390 and ppc arches 0.19.0-2 - Make OpenSC multilib again by moving the conflicting files on ix86 arch 0.19.0-1 - Rebase to new upstream release 1656791 - Add Support for HID Crescendo 144K 1612372 - Add Support for CAC Alt tokens 1645581 - Fix usage...

keycloak-httpd-client-install security, bug fix, and enhancement update

0.8-1 - Resolves: rhbz1673716 - Rebase k-h-c-i to version 0.8 - The rebase also includes fixes for: - rhbz1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloakcli.py - rhbz1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe use of...

tomcat security, bug fix, and enhancement update

0:7.0.76-9 - Resolves: rhbz1641873 CVE-2018-11784 tomcat: Open redirect in default servlet - Resolves: rhbz1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended expo sure of resources - Resolves: rhbz1552374 CVE-2018-1305 tomcat: Late...

freerdp and vinagre security, bug fix, and enhancement update

freerdp 2.0.0-1.rc4 - Update to 2.0.0-rc4 1291254 vinagre 3.22.0-12 - Apply the patch - Resolves: 1569552 3.22.0-11 - Set maximum length of RDP password to 255 characters - Resolves: 1569552 3.22.0-10 - Make vinagre build with FreeRDP 2 library - Resolves: 1680229...

patch security and bug fix update

2.7.1-11 - Fixed CVE-2016-10713 - Out-of-bounds access in pchwriteline function - Fixed CVE-2018-6952 - Double free of memory - Resolves: 1626473, honor new file mode 100755 when applying patches - Resolves: 1653294, Added virtual provides for bundled gnulib library...

libarchive security update

3.1.2-12 - fixed use after free in RAR decoder 1700749 - fixed double free in RAR decoder 1700748 3.1.2-11 - fix out-of-bounds read within lhareaddatanone CVE-2017-14503 - fix crash on crafted 7zip archives CVE-2019-1000019 - fix infinite loop in ISO9660 CVE-2019-1000020...

libssh2 security, bug fix, and enhancement update

1.8.0-3 - sanitize public header file detected by rpmdiff 1.8.0-2 - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes CVE-2019-3863 - fix out-of-bounds memory comparison with specially crafted message channel request CVE-2019-3862 - fix out-of-bounds reads wit...

nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update

nspr 4.21.0-1 - Rebase to NSPR 4.21 nss 3.44.0-4 - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa 3.44.0-3 - Disable TLS 1.3 under FIPS mode - Disable RSASSA-PKCS1-v15 in TLS 1.3 - Fix post-handshake auth transcript calculation if SSLENABLESESSIONTICKET...

keepalived security and bug fix update

1.3.5-16 - Rework previous miscscript/vrrpscript patch 1667292 1.3.5-15 - Rework previous checker comparison patch 1715308 1.3.5-14 - Make checker variables non global 1715308 1.3.5-13 - Fix comparison of checkers on reload 1715308 1.3.5-12 - Fix build errors 1678480 1.3.5-11 - Fix problems with...

libvirt security, bug fix, and enhancement update

4.5.0-23 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections CVE-2019-10161 - api: disallow virDomainManagedSaveDefineXML on read-only connections CVE-2019-10166 - api: disallow virConnectGetDomainCapabilities on read-only connections CVE-2019-10167 - api: disallow...

python security and bug fix update

2.7.5-86.0.1 - Add Oracle Linux distribution in platform.py orabug 20812544 2.7.5-86 - Security fix for CVE-2019-10160 Resolves: rhbz1718388 2.7.5-85 - Security fix for CVE-2019-9948 Resolves: rhbz1704174 2.7.5-84 - Disallow control chars in http URLs - Fixes CVE-2019-9740 and CVE-2019-9947...

kernel security, bug fix, and enhancement update

3.10.0-1062.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1062 - fs revert 'xfs: disable copyfilerange to avoid broken splice copy' Eric...

libjpeg-turbo security update

1.2.90-8 - Fix CVE-2018-14498 1687475 1.2.90-7 - Fix CVE-2018-11212 1586062 - Fix CVE-2016-3616 1318509, CVE-2018-11213 1589091 and CVE-2018-11214 1589110 - Fix CVE-2018-11813 1591203...

exempi security update

2.2.0-9 - Fix CVE-2017-18233 resolves: 1574865 - Fix CVE-2017-18234 resolves: 1656011 - Fix CVE-2017-18236 resolves: 1574905 - Fix CVE-2017-18238 resolves: 1572270 - Fix CVE-2018-7730 resolves: 1572631...

binutils security and bug fix update

2.27-41.base.0.1 - Complete the backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598 Add a test for R386GOT32/R386GOT32X IFUNC reloc error Orabug 27930573 - Reviewed-by: Jose E. Marchesi 2.27-41.base - Fix up some linker tests that fail because of the Rx8664GOTPCRELX patch. 169974...

exiv2 security, bug fix, and enhancement update

0.27.0-2 - Minor improvements Resolves: bz1652637 0.27.0-1 - Exiv2 0.27.0 Resolves: bz1652637...

perl-Archive-Tar security update

1.92-3 - CVE-2018-12015 - Directory traversal in Archive::Tar bug 1592803...

blktrace security update

1.0.5-9 - Fix buffer overflow in the devmapread function 1580579 Fixes CVE-2018-10689...

openssh security, bug fix, and enhancement update

7.4p1-21 + 0.10.3-2 - Avoid double comma in the default cipher list in FIPS mode 1722446 7.4p1-20 + 0.10.3-2 - Revert the updating of cached passwd structure 1712053 7.4p1-19 + 0.10.3-2 - Update cached passwd structure after PAM authentication 1674541 7.4p1-18 + 0.10.3-2 - invalidate supplemental...

ruby security update

2.0.0.648-36 - Introduce 'Gem::UserInteractionverbose' method as precondition to fix CVE-2019-8321. rubygems-2.3.0-refactor-checking-reallyverbose.patch - Fix escape sequence injection vulnerability in verbose. - Fix escape sequence injection vulnerability in gem owner. Resolves: CVE-2019-8322 -...

spice-gtk security and bug fix update

libgovirt 0.3.4-2 - Parse XML nodes automatically Related: rhbz1427467 - Set detailed error message for async call Related: rhbz1427467 spice-gtk 0.35-4 - Fix bad channel-reset on usbredir Resolves: rhbz1625550 0.35-3 - Fix insufficient encoding checks for LZ Resolves: rhbz1598652 spice-vdagent...

Xorg security and bug fix update

gdm 3.28.2-16 - Dont bring up login screen if background session gets killed Related: 1680120 3.28.2-15 - sync AllowMultipleSessionsPerUser patch from 7.6 branch Resolves: 1664353 - Create dconf dirs by default Resolves: 1664284 3.28.2-14 - Fix unlock on XDMCP sessions Resolves: 1693060 3.28.2-13...

polkit security and bug fix update

0.112-22.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-22 - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled - Resolves: rhbz1325512 0.112-21 - Mitigation of regression caused by fix of CVE-2018-19788 - Resolves: rhbz1656377 0.112-20 - Fix of...

Unbreakable Enterprise kernel security update

2.6.39-400.313.1 - ACPI: sbshc: remove raw pointer from printk message Greg Kroah-Hartman Orabug: 27987133 CVE-2018-5750 - dm: fix race between dmgetfromkobject and dmdestroy Hou Tao Orabug: 27987143 CVE-2017-18203 - tcp: enforce tcpminsndmss in tcpmtuprobing Eric Dumazet Orabug: 29886601...

Unbreakable Enterprise kernel security update

4.1.12-124.30.1 - xen: let allocxenballoonedpages fail if not enough memory free Juergen Gross Orabug: 30073695 - mm/pagealloc.c: calculate 'available' memory in a separate function Igor Redko Orabug: 30073695 - Input: gtco - bounds check collection indent level Grant Hernandez Orabug: 30074413...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.37.1 - Input: gtco - bounds check collection indent level Grant Hernandez Orabug: 30074414 CVE-2019-13631...

Unbreakable Enterprise kernel security update

4.14.35-1902.3.2 - x86/speculation: Exclude ATOMs from speculation through SWAPGS Thomas Gleixner Orabug: 29967570 CVE-2019-1125 - x86/speculation: Enable Spectre v1 swapgs mitigations Josh Poimboeuf Orabug: 29967570 CVE-2019-1125 - x86/speculation: Prepare entry code for Spectre v1 swapgs...

Unbreakable Enterprise kernel security update

4.1.12-124.29.3.1 - x86/speculation: Exclude ATOMs from speculation through SWAPGS Thomas Gleixner Orabug: 29967571 CVE-2019-1125 - x86/speculation: Enable Spectre v1 swapgs mitigations Josh Poimboeuf Orabug: 29967571 CVE-2019-1125 - x86/speculation: Prepare entry code for Spectre v1 swapgs...

icedtea-web security update

1.7.1-16 - Added Patch5, testTuning.patch to make tests pass inclean envirnment - Resolves: rhbz1724958 1.7.1-16 - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-10185 - Resolves: rhbz1724958 - Resolves:...

ruby:2.5 security update

ruby 2.5.3-104 - Prohibit arbitrary code execution when installing a malicious gem. Resolves: CVE-2019-8324 rubygem-mongo 2.5.1-2 - Disable tests to fix FTBFS by dropped MongoDB module. Resolves: rhbz1710863 rubygem-pg 1.0.0-2 - Assign a random testing port...

nss and nspr security, bug fix, and enhancement update

nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS - fipstest: use CKMTLS12MASTERKEYDERIVE instead of vendor specific mechanism 3.44.0-5 - Rebuild with the correct build target 3.44.0-4.1 - rebuild t...

kernel security update

kernel - 2.6.18-419.0.0.0.14 - x86/speculation/mds: Conditionally clear CPU buffers on idle entry Thomas Gleixner orabug 29821515 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds: Call VERW on NMI path when returning to user Patrick Colp orabug 29821515...

kernel security update

kernel - 2.6.18-419.0.0.0.13 - x86/speculation/mds: Conditionally clear CPU buffers on idle entry Thomas Gleixner orabug 29821515 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 - x86/speculation/mds: Call VERW on NMI path when returning to user Patrick Colp orabug 29821515...

icedtea-web security update

1.7.2-16 - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-10185 - Resolves: rhbz1724958 - Resolves: rhbz1725928 - Resolves: rhbz1724989...

bind security update

32:9.11.4-17.P2.1 - Fix CVE-2019-6471...

python-jinja2 security update

2.10.1-2 - Rebuild of package to go through gating - Resolves: rhbz1701300 2.10.1-1 - Rebase to 2.10.1 security update to fix CVE-2019-10906 - Resolves: rhbz1701300 2.10-9 - Require platform-python-setuptools instead of python3-setuptools - Resolves: rhbz1650536 2.10-8 - Revert changes commited t...

java-1.8.0-openjdk security update

1:1.8.0.222.b10-0 - Update to aarch64-shenandoah-jdk8u222-b10. - Resolves: rhbz1724452 1:1.8.0.222.b09-0 - Update to aarch64-shenandoah-jdk8u222-b09. - Switch to GA mode for final release. - Resolves: rhbz1724452 1:1.8.0.222.b08-0.0.ea - Update to aarch64-shenandoah-jdk8u222-b08. - Adjust...

python27:2.7 security update

Cython 0.28.1-7 - Bumping due to problems with modular RPM upgrade path 1695587 - Related: rhbz1693974 PyYAML 3.12-16 - Bumping due to problems with modular RPM upgrade path 1695587 - Related: rhbz1693974 babel 2.5.1-9 - Bumping due to problems with modular RPM upgrade path 1695587 - Related:...

thunderbird security update

60.6.1-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 60.6.1-1 - Update to 60.6.1 60.6.0-1 - Update to 60.6.0...

systemd security and bug fix update

239-13.0.1.3 - fix netdev is missing for iscsi entry in /etc/fstab [email protected] Orabug: 25897792 - set RemoveIPC=no in logind.conf as default for OL7.2 Orabug: 22224874 - allow dm remove ioctl to co-operate with UEK3 Vaughan Cao Orabug: 18467469 - add hv dynamic memory support Jerry...

firefox security update

60.6.1-1.0.2 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 60.6.1-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Build with ol8 rust/llvm rather than scl 60.6.1-1 - Update to 60.6.1 ESR Build 1 60.6.0-3 - Added Google API keys mozbz1531176...

ghostscript security update

9.25-2.1 - Resolves: 1692798 - CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116 - Resolves: 1678170 - CVE-2019-3835 ghostscript: superexec operator is available 700585 - Resolves: 1691414 - CVE-2019-3838 ghostscript: forceput in DefineResource is still accessible...

thunderbird security update

60.7.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 60.7.0-1 - Update to 60.7.0...

thunderbird security and bug fix update

60.8.0-1.0.1 60.8.0-1 - Updated to 60.8.0 60.7.2-3 - Rebuild to fix rhbz1725919 - Thunderbird fails to authenticate with gmail with ssl/tls and OAuth2...

java-11-openjdk security update

1:11.0.4.11-0 - Update to shenandoah-jdk-11.0.4+11 GA - Switch to GA mode for final release. - Resolves: rhbz1724452 1:11.0.4.10-0.0.ea - Update to shenandoah-jdk-11.0.4+10 EA - Resolves: rhbz1724452 1:11.0.4.9-0.0.ea - Update to shenandoah-jdk-11.0.4+9 EA - Resolves: rhbz1724452 1:11.0.4.8-0.0.e...

WALinuxAgent security update

2.2.32-1.0.1.el80.1 - Add oracle support to fix waagent.service build issue 2.2.32-1.el80.1 - wla-Add-fixes-for-handling-swap-file-and-other-nit-fixes.patch bz1711338 - Resolves: bz1711338 CVE-2019-0804 WALinuxAgent: swapfile created with weak permissions rhel-8...

edk2 security update

20180508gitee3198e672e2-9.el80 - edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch bz1690501 - edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch bz1690501 - Resolves: bz1690501 CVE-2018-12180 edk2: Buffer Overflow in BlockIo service for RAM disk rhel-8.0.0.z...

firefox security update

60.7.2-3.0.2 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 60.7.2-3.0.1 Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 60.7.2-3 - Update to 60.7.2 ESR 60.7.1-1 - Updated to 60.7.1 ESR...