[SECURITY] Fedora 39 Update: chromium-127.0.6533.88-2.fc39
[SECURITY] Fedora 40 Update: chromium-127.0.6533.88-2.fc40
[SECURITY] Fedora 40 Update: bind-dyndb-ldap-11.10-29.fc40
[SECURITY] Fedora 40 Update: bind-9.18.28-2.fc40
[SECURITY] Fedora 40 Update: hostapd-2.11-1.fc40
[SECURITY] Fedora 40 Update: wpa_supplicant-2.11-1.fc40
[SECURITY] Fedora 39 Update: chromium-127.0.6533.88-2.fc39
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-ff743391c3
2024-08-03 02:28:31.955897
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 39
Version : 127.0.6533.88
Release : 2.fc39
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser that Google doesn't want you to use
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
update to 127.0.6533.88
Critical CVE-2024-6990: Uninitialized Use in Dawn
High CVE-2024-7255: Out of bounds read in WebTransport
High CVE-2024-7256: Insufficient data validation in Dawn
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 1 2024 Than Ngo [than@redhat.com] - 127.0.6533.88-2
- remove old patch that seems to be the cause of a crash
when the user set user.max_user_namespaces to 0
* Wed Jul 31 2024 Than Ngo [than@redhat.com] - 127.0.6533.88-1
- update to 127.0.6533.88
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2299576 - 127.0.6533.72 released, fixing many CVEs
https://bugzilla.redhat.com/show_bug.cgi?id=2299576
[ 2 ] Bug #2300183 - 127.0.6533.72 koji build crashes occasionally and consistently when usernamespaces are disabled
https://bugzilla.redhat.com/show_bug.cgi?id=2300183
[ 3 ] Bug #2301846 - 127.0.6533.88 released, fixing one Critical and two High CVEs
https://bugzilla.redhat.com/show_bug.cgi?id=2301846
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-ff743391c3' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 40 Update: chromium-127.0.6533.88-2.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-3a1a0a664e
2024-08-03 01:49:11.242020
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 40
Version : 127.0.6533.88
Release : 2.fc40
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser that Google doesn't want you to use
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
update to 127.0.6533.88
Critical CVE-2024-6990: Uninitialized Use in Dawn
High CVE-2024-7255: Out of bounds read in WebTransport
High CVE-2024-7256: Insufficient data validation in Dawn
update to 127.0.6533.72
* CVE-2024-6988: Use after free in Downloads
* CVE-2024-6989: Use after free in Loader
* CVE-2024-6991: Use after free in Dawn
* CVE-2024-6992: Out of bounds memory access in ANGLE
* CVE-2024-6993: Inappropriate implementation in Canvas
* CVE-2024-6994: Heap buffer overflow in Layout
* CVE-2024-6995: Inappropriate implementation in Fullscreen
* CVE-2024-6996: Race in Frames
* CVE-2024-6997: Use after free in Tabs
* CVE-2024-6998: Use after free in User Education
* CVE-2024-6999: Inappropriate implementation in FedCM
* CVE-2024-7000: Use after free in CSS. Reported by Anonymous
* CVE-2024-7001: Inappropriate implementation in HTML
* CVE-2024-7003: Inappropriate implementation in FedCM
* CVE-2024-7004: Insufficient validation of untrusted input in Safe
Browsing
* CVE-2024-7005: Insufficient validation of untrusted input in Safe
--------------------------------------------------------------------------------
ChangeLog:
* Thu Aug 1 2024 Than Ngo [than@redhat.com] - 127.0.6533.88-2
- remove old patch that seems to be the cause of a crash
when the user set user.max_user_namespaces to 0
* Wed Jul 31 2024 Than Ngo [than@redhat.com] - 127.0.6533.88-1
- update to 127.0.6533.88
* Wed Jul 24 2024 Than Ngo [than@redhat.com] - 127.0.6533.72-1
- update to 127.0.6533.72
* CVE-2024-6988: Use after free in Downloads
* CVE-2024-6989: Use after free in Loader
* CVE-2024-6991: Use after free in Dawn
* CVE-2024-6992: Out of bounds memory access in ANGLE
* CVE-2024-6993: Inappropriate implementation in Canvas
* CVE-2024-6994: Heap buffer overflow in Layout
* CVE-2024-6995: Inappropriate implementation in Fullscreen
* CVE-2024-6996: Race in Frames
* CVE-2024-6997: Use after free in Tabs
* CVE-2024-6998: Use after free in User Education
* CVE-2024-6999: Inappropriate implementation in FedCM
* CVE-2024-7000: Use after free in CSS. Reported by Anonymous
* CVE-2024-7001: Inappropriate implementation in HTML
* CVE-2024-7003: Inappropriate implementation in FedCM
* CVE-2024-7004: Insufficient validation of untrusted input in Safe Browsing
* CVE-2024-7005: Insufficient validation of untrusted input in Safe
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2299576 - 127.0.6533.72 released, fixing many CVEs
https://bugzilla.redhat.com/show_bug.cgi?id=2299576
[ 2 ] Bug #2299689 - Adopt the ppc64le patches from OpenPOWER patchset
https://bugzilla.redhat.com/show_bug.cgi?id=2299689
[ 3 ] Bug #2300183 - 127.0.6533.72 koji build crashes occasionally and consistently when usernamespaces are disabled
https://bugzilla.redhat.com/show_bug.cgi?id=2300183
[ 4 ] Bug #2301846 - 127.0.6533.88 released, fixing one Critical and two High CVEs
https://bugzilla.redhat.com/show_bug.cgi?id=2301846
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-3a1a0a664e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 40 Update: bind-dyndb-ldap-11.10-29.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-8af1780fdf
2024-08-03 01:49:11.241997
--------------------------------------------------------------------------------
Name : bind-dyndb-ldap
Product : Fedora 40
Version : 11.10
Release : 29.fc40
URL : https://releases.pagure.org/bind-dyndb-ldap
Summary : LDAP back-end plug-in for BIND
Description :
This package provides an LDAP back-end plug-in for BIND. It features
support for dynamic updates and internal caching, to lift the load
off of your LDAP server.
--------------------------------------------------------------------------------
Update Information:
Update to BIND 9.18.28
Security Fixes
A malicious DNS client that sent many queries over TCP but never read the
responses could cause a server to respond slowly or not at all for other
clients. This has been fixed. (CVE-2024-0760) [GL #4481]
It is possible to craft excessively large resource records sets, which have the
effect of slowing down database processing. This has been addressed by adding a
configurable limit to the number of records that can be stored per name and type
in a cache or zone database. The default is 100, which can be tuned with the new
max-records-per-type option. [GL #497] [GL #3405]
It is possible to craft excessively large numbers of resource record types for a
given owner name, which has the effect of slowing down database processing. This
has been addressed by adding a configurable limit to the number of records that
can be stored per name and type in a cache or zone database. The default is 100,
which can be tuned with the new max-types-per-name option. (CVE-2024-1737) [GL
#3403]
ISC would like to thank Toshifumi Sakaguchi who independently discovered and
responsibly reported the issue to ISC. [GL #4548]
Validating DNS messages signed using the SIG(0) protocol (RFC 2931) could cause
excessive CPU load, leading to a denial-of-service condition. Support for SIG(0)
message validation was removed from this version of named. (CVE-2024-1975) [GL
#4480]
Due to a logic error, lookups that triggered serving stale data and required
lookups in local authoritative zone data could have resulted in an assertion
failure. This has been fixed. (CVE-2024-4076) [GL #4507]
Potential data races were found in our DoH implementation, related to HTTP/2
session object management and endpoints set object management after
reconfiguration. These issues have been fixed. [GL #4473]
ISC would like to thank Dzintars and Ivo from nic.lv for bringing this to our
attention.
When looking up the NS records of parent zones as part of looking up DS records,
it was possible for named to trigger an assertion failure if serve-stale was
enabled. This has been fixed. [GL #4661]
Source: https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 31 2024 Petr Menšík - 11.10-29
- Rebuilt for BIND 9.18.28 (#2299467)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2299467 - bind-9.18.28 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299467
[ 2 ] Bug #2300837 - CVE-2024-4076 bind: Assertion failure when serving both stale cache data and authoritative zone content [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2300837
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-8af1780fdf' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 40 Update: bind-9.18.28-2.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-8af1780fdf
2024-08-03 01:49:11.241997
--------------------------------------------------------------------------------
Name : bind
Product : Fedora 40
Version : 9.18.28
Release : 2.fc40
URL : https://www.isc.org/downloads/bind/
Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
Description :
BIND (Berkeley Internet Name Domain) is an implementation of the DNS
(Domain Name System) protocols. BIND includes a DNS server (named),
which resolves host names to IP addresses; a resolver library
(routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating properly.
--------------------------------------------------------------------------------
Update Information:
Update to BIND 9.18.28
Security Fixes
A malicious DNS client that sent many queries over TCP but never read the
responses could cause a server to respond slowly or not at all for other
clients. This has been fixed. (CVE-2024-0760) [GL #4481]
It is possible to craft excessively large resource records sets, which have the
effect of slowing down database processing. This has been addressed by adding a
configurable limit to the number of records that can be stored per name and type
in a cache or zone database. The default is 100, which can be tuned with the new
max-records-per-type option. [GL #497] [GL #3405]
It is possible to craft excessively large numbers of resource record types for a
given owner name, which has the effect of slowing down database processing. This
has been addressed by adding a configurable limit to the number of records that
can be stored per name and type in a cache or zone database. The default is 100,
which can be tuned with the new max-types-per-name option. (CVE-2024-1737) [GL
#3403]
ISC would like to thank Toshifumi Sakaguchi who independently discovered and
responsibly reported the issue to ISC. [GL #4548]
Validating DNS messages signed using the SIG(0) protocol (RFC 2931) could cause
excessive CPU load, leading to a denial-of-service condition. Support for SIG(0)
message validation was removed from this version of named. (CVE-2024-1975) [GL
#4480]
Due to a logic error, lookups that triggered serving stale data and required
lookups in local authoritative zone data could have resulted in an assertion
failure. This has been fixed. (CVE-2024-4076) [GL #4507]
Potential data races were found in our DoH implementation, related to HTTP/2
session object management and endpoints set object management after
reconfiguration. These issues have been fixed. [GL #4473]
ISC would like to thank Dzintars and Ivo from nic.lv for bringing this to our
attention.
When looking up the NS records of parent zones as part of looking up DS records,
it was possible for named to trigger an assertion failure if serve-stale was
enabled. This has been fixed. [GL #4661]
Source: https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2
- Conflict explicitly with more bind subpackages
- Merge license subpackage into libs
- Add optional QUERYTRACE feature
- Make relative documentation links
* Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1
- update to 9.18.28 rhbz#2299467
- Fixes CVE-2024-4076
- Fixes CVE-2024-1975
- Fixes CVE-2024-1737
- Fixes CVE-2024-0760
* Wed Jul 17 2024 Fedora Release Engineering - 32:9.18.26-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Tue Jul 9 2024 Zbigniew Jędrzejewski-Szmek - 32:9.18.26-2
- Rebuilt for the bin-sbin merge
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2299467 - bind-9.18.28 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299467
[ 2 ] Bug #2300837 - CVE-2024-4076 bind: Assertion failure when serving both stale cache data and authoritative zone content [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2300837
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-8af1780fdf' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 40 Update: hostapd-2.11-1.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-73626281d8
2024-08-03 01:49:11.241974
--------------------------------------------------------------------------------
Name : hostapd
Product : Fedora 40
Version : 2.11
Release : 1.fc40
URL : http://w1.fi/hostapd
Summary : IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Description :
hostapd is a user space daemon for access point and authentication servers. It
implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP
Authenticators and RADIUS authentication server.
hostapd is designed to be a "daemon" program that runs in the back-ground and
acts as the backend component controlling authentication. hostapd supports
separate frontend programs and an example text-based frontend, hostapd_cli, is
included with hostapd.
--------------------------------------------------------------------------------
Update Information:
Update to upstream version 2.11.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 29 2024 Davide Caratti [dcaratti@redhat.com] - 1:2.11-1
- Update to version 2.11 (#2299039)
- Disable OpenSSL ENGINE API
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2293095 - CVE-2023-52424 wpa_supplicant: 802.11: SSID Confusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2293095
[ 2 ] Bug #2293097 - CVE-2023-52424 hostapd: 802.11: SSID Confusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2293097
[ 3 ] Bug #2299036 - wpa_supplicant-2.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299036
[ 4 ] Bug #2299039 - hostapd-2.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299039
[ 5 ] Bug #2301368 - wpa_supplicant: FTBFS in Fedora rawhide/f41
https://bugzilla.redhat.com/show_bug.cgi?id=2301368
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-73626281d8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 40 Update: wpa_supplicant-2.11-1.fc40
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-73626281d8
2024-08-03 01:49:11.241974
--------------------------------------------------------------------------------
Name : wpa_supplicant
Product : Fedora 40
Version : 2.11
Release : 1.fc40
URL : http://w1.fi/wpa_supplicant/
Summary : WPA/WPA2/IEEE 802.1X Supplicant
Description :
wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support
for WPA and WPA2 (IEEE 802.11i / RSN). Supplicant is the IEEE 802.1X/WPA
component that is used in the client stations. It implements key negotiation
with a WPA Authenticator and it controls the roaming and IEEE 802.11
authentication/association of the wlan driver.
--------------------------------------------------------------------------------
Update Information:
Update to upstream version 2.11.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 29 2024 Davide Caratti [dcaratti@redhat.com] - 1:2.11-1
- Update to version 2.11 (#2299036)
- Disable OpenSSL ENGINE API (#2301368)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2293095 - CVE-2023-52424 wpa_supplicant: 802.11: SSID Confusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2293095
[ 2 ] Bug #2293097 - CVE-2023-52424 hostapd: 802.11: SSID Confusion attack [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2293097
[ 3 ] Bug #2299036 - wpa_supplicant-2.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299036
[ 4 ] Bug #2299039 - hostapd-2.11 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2299039
[ 5 ] Bug #2301368 - wpa_supplicant: FTBFS in Fedora rawhide/f41
https://bugzilla.redhat.com/show_bug.cgi?id=2301368
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-73626281d8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
