Fedora 39 Update: glibc-2.38-16.fc39
Fedora 39 Update: thunderbird-115.7.0-1.fc39
Fedora 38 Update: glibc-2.37-18.fc38
Fedora 38 Update: xorg-x11-server-Xwayland-22.1.9-5.fc38
Fedora 38 Update: python-templated-dictionary-1.4-1.fc38
Fedora 39 Update: glibc-2.38-16.fc39
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-aec80d6e8a
2024-02-01 01:54:16.777372
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 39
Version : 2.38
Release : 16.fc39
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780.
CVE-2023-6246: __vsyslog_internal did not handle a case where printing a
SYSLOG_HEADER containing a long program name failed to update the required
buffer size, leading to the allocation and overflow of a too-small buffer on the
heap. CVE-2023-6779: __vsyslog_internal used the return value of
snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these
functions (for any reason) failed and returned -1, the resulting buffer would be
too small to hold output. CVE-2023-6780: __vsyslog_internal calculated a buffer
size by adding two integers, but did not first check if the addition would
overflow.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 30 2024 Patsy Griffin [patsy@redhat.com] - 2.38-16
- Auto-sync with upstream branch release/2.38/master,
commit d37c2b20a4787463d192b32041c3406c2bd91de0:
- syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
* Mon Jan 29 2024 Arjun Shankar [arjun@redhat.com] - 2.38-15
- Adjust glibc-implicit-object-deps-3.patch; and
- Auto-sync with upstream branch release/2.38/master,
commit cfe121910013a46e2477562282c56ae8062089aa:
- libio: Check remaining buffer size in _IO_wdo_write (bug 31183)
- getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163)
- NEWS: Mention bug fixes for 30745/30843
- NEWS: Mention bug fixes for 29039/30694/30709/30721
- x86-64: Fix the tcb field load for x32 [BZ #31185]
- x86-64: Fix the dtv field load for x32 [BZ #31184]
- elf: Add TLS modid reuse test for bug 29039
- elf: Fix TLS modid reuse generation assignment (BZ 29039)
- LoongArch: Delete excessively allocated memory.
- elf: Fix wrong break removal from 8ee878592c
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2249053 - CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2249053
[ 2 ] Bug #2254395 - CVE-2023-6779 glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2254395
[ 3 ] Bug #2254396 - CVE-2023-6780 glibc: integer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2254396
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-aec80d6e8a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
Fedora 39 Update: thunderbird-115.7.0-1.fc39
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-c8c2a52fb8
2024-02-01 01:54:16.777244
--------------------------------------------------------------------------------
Name : thunderbird
Product : Fedora 39
Version : 115.7.0
Release : 1.fc39
URL : http://www.mozilla.org/projects/thunderbird/
Summary : Mozilla Thunderbird mail/newsgroup client
Description :
Mozilla Thunderbird is a standalone mail and newsgroup client.
--------------------------------------------------------------------------------
Update Information:
Update to 115.7.0 * https://www.mozilla.org/en-
US/security/advisories/mfsa2024-04/ * https://www.thunderbird.net/en-
US/thunderbird/115.7.0/releasenotes/
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 24 2024 Eike Rathke [erack@redhat.com] - 115.7.0-1
- Update to 115.7.0
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-c8c2a52fb8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
Fedora 38 Update: glibc-2.37-18.fc38
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-07597a0fb3
2024-02-01 01:23:37.270537
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 38
Version : 2.37
Release : 18.fc38
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2023-6246, CVE-2023-6779, and CVE-2023-6780.
CVE-2023-6246: __vsyslog_internal did not handle a case where printing a
SYSLOG_HEADER containing a long program name failed to update the required
buffer size, leading to the allocation and overflow of a too-small buffer on the
heap. CVE-2023-6779: __vsyslog_internal used the return value of
snprintf/vsnprintf to calculate buffer sizes for memory allocation. If these
functions (for any reason) failed and returned -1, the resulting buffer would be
too small to hold output. CVE-2023-6780: __vsyslog_internal calculated a buffer
size by adding two integers, but did not first check if the addition would
overflow.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 30 2024 Patsy Griffin [patsy@redhat.com] - 2.37-18
- Auto-sync with upstream branch release/2.37/master,
commit 2b58cba076e912961ceaa5fa58588e4b10f791c0:
- syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
- sunrpc: Fix netname build with older gcc
* Mon Jan 29 2024 Arjun Shankar [arjun@redhat.com] - 2.37-17
- Auto-sync with upstream branch release/2.37/master,
commit bd9f194c34333c0148fc0a793b8e68e2399f27cb:
- libio: Check remaining buffer size in _IO_wdo_write (bug 31183)
- getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163)
- NEWS: Mention bug fixes for 29039/30745/30843
- x86-64: Fix the tcb field load for x32 [BZ #31185]
- x86-64: Fix the dtv field load for x32 [BZ #31184]
- elf: Fix TLS modid reuse generation assignment (BZ 29039)
- elf: Fix wrong break removal from 8ee878592c
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2249053 - CVE-2023-6246 glibc: heap-based buffer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2249053
[ 2 ] Bug #2254395 - CVE-2023-6779 glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2254395
[ 3 ] Bug #2254396 - CVE-2023-6780 glibc: integer overflow in __vsyslog_internal()
https://bugzilla.redhat.com/show_bug.cgi?id=2254396
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-07597a0fb3' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
Fedora 38 Update: xorg-x11-server-Xwayland-22.1.9-5.fc38
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-05db4bcbec
2024-02-01 01:23:37.270214
--------------------------------------------------------------------------------
Name : xorg-x11-server-Xwayland
Product : Fedora 38
Version : 22.1.9
Release : 5.fc38
URL : http://www.x.org
Summary : Xwayland
Description :
Xwayland is an X server for running X clients under Wayland.
--------------------------------------------------------------------------------
Update Information:
CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
CVE-2024-0408, CVE-2024-0409
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 16 2024 Olivier Fourdan [ofourdan@redhat.com] - 22.1.9-5
CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
CVE-2024-0408, CVE-2024-0409
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-05db4bcbec' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
Fedora 38 Update: python-templated-dictionary-1.4-1.fc38
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-4bd03c989b
2024-02-01 01:23:37.270297
--------------------------------------------------------------------------------
Name : python-templated-dictionary
Product : Fedora 38
Version : 1.4
Release : 1.fc38
URL : https://github.com/xsuchy/templated-dictionary
Summary : Dictionary with Jinja2 expansion
Description :
Dictionary where __getitem__() is run through Jinja2 template.
--------------------------------------------------------------------------------
Update Information:
Fixing CVE-2023-6395
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 16 2024 Pavel Raiskup [praiskup@redhat.com]
- make the TemplatedDictionary objects picklable
- use a sandboxed jinja2 environment, fixes CVE-2023-6395
* Tue Jan 16 2024 Pavel Raiskup [praiskup@redhat.com]
- make the TemplatedDictionary objects picklable
- Use a sandboxed jinja2 environment, CVE-2023-6395
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2258607 - CVE-2023-6395 mock: Privilege escalation for users that can access mock configuration [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2258607
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-4bd03c989b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
