Resolved Bugs
1108639 – CVE-2014-3004 castor: XML External Entity (XXE) attacks via a crafted XML document
1108691 – CVE-2014-3004 castor: XML External Entity (XXE) attacks via a crafted XML document [fedora-all]<br
Update to latest upstream point release containing fix for CVE-2014-3004

Resolved Bugs
1170691 – CVE-2014-9090 kernel: local DoS via do_double_fault() due to improper handling of faults associated with SS segment register
1094048 – [abrt] WARNING: CPU: 4 PID: 0 at drivers/usb/core/urb.c:450 usb_submit_urb+0x1fd/0x5c0()<br
Small bugfix update. A few AArch64 fixes and a patch to quiet a common i915 warning.

Resolved Bugs
1113267 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler
1125170 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler [fedora-all]<br
Security fix for CVE-2014-3564

Resolved Bugs
1168146 – CVE-2014-9091 icecast: supplementary groups are not overriden
1168147 – CVE-2014-9091 icecast: supplementary groups are not overriden [fedora-all]
1168148 – CVE-2014-9091 icecast: supplementary groups are not overriden [epel-5]
1168149 – CVE-2014-9091 icecast: supplementary groups are not overriden [epel-6]
1165880 – CVE-2014-9018 icecast: possible leak of on-connect scripts
1165882 – icecast: possible leak of on-connect scripts [fedora-all]
1165883 – icecast: possible leak of on-connect scripts [epel-5]
1165885 – icecast: possible leak of on-connect scripts [epel-6]
954320 – icecast package should be built with PIE flags
1101950 – icecast-2.4.1 is available<br
**fix CVE-2014-9091 (#1168146, #1168147, #1168148, #1168149)**
**fix CVE-2014-9018 (#1165880, #1165882, #1165883, #1165885)**
**enabled fully hardened build (#954320)**
* update new to release v2.4.1 (#1101950)
* added doc-subpkg

Resolved Bugs
1112418 – CVE-2014-4607 lzo: lzo1x_decompress_safe() integer overflow
1131793 – CVE-2014-4607 grub2: lzo: lzo1x_decompress_safe() integer overflow [fedora-all]<br
Security fix for CVE-2014-4607

Resolved Bugs
1020220 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default
1020222 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default [fedora-all]
1020258 – CVE-2013-4442 pwgen: silent fallback to insecure entropy
1020259 – CVE-2013-4442 pwgen: silent fallback to insecure entropy [fedora-all]<br
Update to 2.07 (bug 1159526) fixes:
– CVE-2013-4440 (bug 1020222, 1020223)
– CVE-2013-4442 (bug 1020259, 1020261)