qemu-kvm security update

1.5.3-167.el77.1 - kvm-qxl-check-release-info-object.patch bz1732337 - kvm-Fix-heap-overflow-in-ipreass-on-big-packet-input.patch bz1734748 - Resolves: bz1732337 CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources rhel-7 rhel-7.7.z - Resolves: bz1734748...

kernel security and bug fix update

3.10.0-1062.1.1 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 3.10.0-1062.1.1 - fs nfsv4.1: Avoid false retries when RPC calls are interrupted Benjam...

kdelibs and kde-settings security and bug fix update

kdelibs 6:4.14.8-11 - KConfig: malicious .desktop files would execute code Resolves: bz1740736 kde-settings 19-23.10.0.1 - Change GreetString bug 11710280 19-23.10 - Use correct tcsh syntax for config scripts Resolves: bz1738491...

squid:4 security update

libecap 1.0.1-2 - Resolves: 1696354 - Ensure modular RPM upgrade path squid 7:4.4-5 - Resolves: 1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow in HttpHeader::getAuth...

ghostscript security update

9.25-2.2 - Resolves: 1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfhookDSCCreator 701445 - Resolves: 1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams 701444 - Resolves: 1744003 - CVE-2019-14813 ghostscript: Safer...

pango security update

1.42.4-5 - Fixes crash in pangofcfontkeygetvariations when key is null 1.42.4-4 - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: 1738461 1.42.4-3 - rebuild 1.42.4-2 - rebuild...

pango security update

1.42.4-4 - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: 1738459...

subversion:1.10 security update

libserf 1.3.9-9 - Resolves: 1696354 - Ensure modular RPM upgrade path subversion 1.10.2-2 - rebuild to ensure NVR ordering 1696354 1.10.2-1.1 - Resolves: 1733442 - CVE-2019-0203 subversion:1.10/subversion: remote unauthenticated denial-of-service in subversion svnserve utf8proc 2.1.1-5 - Resolves...

glibc security update

2.17-292.0.1.7 - Remove glibc-ora28641867.patch as duplicate of glibc-rh1705899-4.patch - Make IOfunlockfile match funlockfile and IOflockfile match flockfile Both should test if stream-flags & IOUSERLOCK == 0 IOlocklock stream-lock; OraBug 28481550. Reviewed-by: Jose E. Marchesi - Modify...

kernel security update

4.18.0-80.7.20.OL8 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 4.18.0-80.7.20 - x86 x86/entry/64: Use JMP instead of JMPQ Josh Poimboeuf...

docker-engine security update

18.03.1.ol-0.0.15 - cherry-picked fix for CVE-2018-15664 from upstream 18.03.1.ol-0.0.14 - rebuild 18.03.1.ol-0.0.13 - update for CVE-2018-20699 18.03.1.ol-0.0.12 - correct the version string of containerd 18.03.1.ol-0.0.11 - update runc for CVE-2019-5736 18.03.1.ol-0.0.10 - update Go to version...

kernel security, bug fix, and enhancement update

4.18.0-80.7.10.OL8 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 4.18.0-80.7.10 - x86 Update stepping values for Whiskey Lake U/Y David Arcari...

mysql:8.0 security update

mecab 0.996-1.9 - Release bump for rebuilding on new arches Related: 1518842 0.996-1.8 - skip %verify of /etc/opt/rh/rh-mysql57/mecabrc Resolves: 1382315 0.996-1.7 - Prefix library major number with SCL name in soname 0.996-1.6 - Require runtime package from the scl 0.996-1.5 - Convert to SCL...

redis:5 security update

5.0.3-2 - fix Heap buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10192 - fix Stack buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10193...

openssl security update

1.0.2k-19.0.1 - Bump release for rebuild. 1.0.2k-19 - close the RSA decryption 9 lives of Bleichenbacher cat timing side channel 1649568 1.0.2k-18 - fix CVE-2018-0734 - DSA signature local timing side channel - fix CVE-2019-1559 - 0-byte record padding oracle - close the RSA decryption One & done...

ghostscript security update

9.25-2.1 - Resolves: 1737338 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 701394...

openssl security update

1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.1e-58 - fi...

Unbreakable Enterprise kernel security update

4.14.35-1902.4.8 - x86/boot: Clear RSDP address in bootparams for broken loaders Juergen Gross Orabug: 30111373 4.14.35-1902.4.7 - rds: ib: Qualify CM REQ duplicate detection with connection being up Hakon Bugge Orabug: 30062149 - rds: Further prioritize local loop-back connections Hakon Bugge...

openssl security update

1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.1e-58 - fi...

kernel security and bug fix update

2.6.32-754.18.2.OL6 - Update genkey bug 25599697 2.6.32-754.18.2 - x86 x86/speculation: Enable Spectre v1 swapgs mitigations Waiman Long 1724512 CVE-2019-1125 - x86 x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations Waiman Long 1724512 CVE-2019-1125 2.6.32-754.18.1 - virt xenbu...

samba security, bug fix, and enhancement update

4.9.1-6 - related: 1703204 - Fix printing with smbspool as CUPS backend 4.9.1-5 - resolves: 1703204 - Fix smbspool krb5 authentication 4.9.1-4 - resolves: 1690222 - Fix --max-protocol documentation of smbclient - resolves: 1518353 - Fix 'net ads join -Uadmin@forestdomain' - resolves: 1696524 - Fi...

http-parser security update

2.7.1-8 - Backport needed test fixes - Related: rhbz1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser allowed for spaces inside Content-Length header values rhel-7 2.7.1-7 - Resolves: rhbz1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser allowed for spaces inside Content-Length head...

exempi security update

2.2.0-9 - Fix CVE-2017-18233 resolves: 1574865 - Fix CVE-2017-18234 resolves: 1656011 - Fix CVE-2017-18236 resolves: 1574905 - Fix CVE-2017-18238 resolves: 1572270 - Fix CVE-2018-7730 resolves: 1572631...

udisks2 security, bug fix, and enhancement update

2.7.3-9 - Build udisks2-lsm subpackage 1672664 - Fix sigint source removal on daemon exit 1643350 - CVE-2018-17336: Fix format string vulnerability in udiskslog 1637427 - Describe command options in the udisksctl man page 1568269...

qt5 security, bug fix, and enhancement update

qt5-qt3d 5.9.7-1 - Update to 5.9.7 Resolves: bz1564024 qt5-qtbase 5.9.7-1 - Enable -doc subpkg on PPC Resolves: bz1564000 5.9.7-1 - Update to 5.9.7 Resolves: bz1564000 qt5-qtcanvas3d 5.9.7-1 - Update to 5.9.7 Resolves: bz1564001 qt5-qtconnectivity 5.9.7-1 - Update to 5.9.7 Resolves: bz1564002...

qemu-kvm security, bug fix, and enhancement update

1.5.3-167.el7 - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads rhel-7 1.5.3-166.el7 - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kv...

binutils security and bug fix update

2.27-41.base.0.1 - Complete the backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598 Add a test for R386GOT32/R386GOT32X IFUNC reloc error Orabug 27930573 - Reviewed-by: Jose E. Marchesi 2.27-41.base - Fix up some linker tests that fail because of the Rx8664GOTPCRELX patch. 169974...

keepalived security and bug fix update

1.3.5-16 - Rework previous miscscript/vrrpscript patch 1667292 1.3.5-15 - Rework previous checker comparison patch 1715308 1.3.5-14 - Make checker variables non global 1715308 1.3.5-13 - Fix comparison of checkers on reload 1715308 1.3.5-12 - Fix build errors 1678480 1.3.5-11 - Fix problems with...

mod_auth_openidc security update

1.8.8-5 - Resolves: rhbz1626297 - CVE-2017-6413 modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an 'AuthType oauth20' configuration rhel-7 1.8.8-4 - Resolves: rhbz1626299 - CVE-2017-6059 modauthopenidc: Shows user-supplied content on error pages rhel-7...

libcgroup security update

0.41-21 - fix CVE-2018-14348 resolves: 1612122...

sox security update

14.4.1-7 - Fix CVE-2017-18189 Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/ Resolves: 1553590...

spice-gtk security and bug fix update

libgovirt 0.3.4-2 - Parse XML nodes automatically Related: rhbz1427467 - Set detailed error message for async call Related: rhbz1427467 spice-gtk 0.35-4 - Fix bad channel-reset on usbredir Resolves: rhbz1625550 0.35-3 - Fix insufficient encoding checks for LZ Resolves: rhbz1598652 spice-vdagent...

mercurial security update

2.6.2-10 - Add missing hunk for CVE-2018-13347 patch - Related: CVE-2018-13347 2.6.2-9 - Fix various CVEs - Resolves: CVE-2018-1000132 CVE-2018-13346 CVE-2018-13347...

compat-libtiff3 security update

3.9.4-12 - Fix CVE-2018-7456 - Resolves: 1561319...

Xorg security and bug fix update

gdm 3.28.2-16 - Dont bring up login screen if background session gets killed Related: 1680120 3.28.2-15 - sync AllowMultipleSessionsPerUser patch from 7.6 branch Resolves: 1664353 - Create dconf dirs by default Resolves: 1664284 3.28.2-14 - Fix unlock on XDMCP sessions Resolves: 1693060 3.28.2-13...

unzip security update

6.0-20 - Fix CVE-2018-18384 Resolves: CVE-2018-18384...

sssd security, bug fix, and enhancement update

1.16.4-21 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization - Rebuild japanese gmo file explicitly 1.16.4-20 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization 1.16.4-19 - Resolves: rhbz1707959 - sssd does not properly check GSS-SPNEGO 1.16.4-18 - Resolves: rhbz1710286 - The...

polkit security and bug fix update

0.112-22.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-22 - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled - Resolves: rhbz1325512 0.112-21 - Mitigation of regression caused by fix of CVE-2018-19788 - Resolves: rhbz1656377 0.112-20 - Fix of...

curl security and bug fix update

7.29.0-54.0.1 - Security Fixes OraBug: 28939992 - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison https://curl.haxx.se/docs/CVE-2016-8616.html - CVE-2016-8617 OOB write via unchecked multiplication...

httpd security and bug fix update

2.4.6-90.0.1 - replace index.html with Oracles index page oracleindex.html Resolves: 1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation in modauthdigest - Resolves: 1696141 - CVE-2019-0217 httpd: modauthdigest: access control bypass due to race condition - Resolves: 1696096 -...

nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update

nspr 4.21.0-1 - Rebase to NSPR 4.21 nss 3.44.0-4 - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa 3.44.0-3 - Disable TLS 1.3 under FIPS mode - Disable RSASSA-PKCS1-v15 in TLS 1.3 - Fix post-handshake auth transcript calculation if SSLENABLESESSIONTICKET...

gvfs security and bug fix update

1.36.2-3 - Force NT1 protocol version for workgroup support 1619719 1.36.2-2 - Prevent spawning new daemons if outgoing operation exists 1632960 - CVE-2019-3827: Prevent access if any authentication agent isnt available 1673887...

ghostscript security update

9.25-2.2 - Resolves: 1737336 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 701394...

glibc security and bug fix update

aarch64: 2.17-292.0.2 - CR29749550 armv5 build failure - Add 3 arm patches to aarch64 tree to avoid future build/merge failures. - Rebase aarch64 patches at 30000 to avoid future conflicts. - Reviewed-by: Jose E. Marchesi - EL Errata - Add BUSMCEERRAR, BUSMCEERRAO to...

blktrace security update

1.0.5-9 - Fix buffer overflow in the devmapread function 1580579 Fixes CVE-2018-10689...

unixODBC security update

2.3.1-14.0.1 - backport unchecked malloc memory references fix Orabug: 29684195 2.3.1-14 - fixed insecure buffer copy 1571530 - fixed possible buffer overflow 1571528 2.3.1-13 - revert: ltdl bundling 2.3.1-12 - fix the libtool-ltdl compatibility Resolves: rhbz1267438...

rsyslog security and bug fix update

8.24.0-38.0.2 - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler 8.24.0-38 RHEL 7.7 ERRATUM - added patch increasing max path size preventing buffer overflow with too long paths resolves: rhbz1656860 8.24.0-37 RHEL 7.7 ERRATUM - edited patch fixin...

uriparser security update

0.7.5-10 - Fix CVE-2018-19198, CVE-2018-19199 Fix unescaped % in a comment Resolves: 1652002, 1652001...

libsolv security and bug fix update

0.6.34-4 - Polish the changelog 0.6.34-3 - Make sure that targeted updates dont do reinstalls - Resolves: bug1668256 - Fix NULL pointer dereference CVE-2018-20532, CVE-2018-20533 - Resolves: bug1669562 - Resolves: bug1669576 - Fix illegal address access in poolwhatprovides CVE-2018-20534 -...

bind security, bug fix, and enhancement update

32:9.11.4-9.P2 - Fix CVE-2019-6471 32:9.11.4-8.P2 - Fix scriptlet errors when selinux-policy is not installed 1647659 32:9.11.4-7.P2 - Fix inefective limit of TCP clients CVE-2018-5743 32:9.11.4-6.P2 - Use /sbin/nologin again 1676661 32:9.11.4-5.P2 - Make sure selinux-policy is installed soon...