Resolved Bugs
1179813 – CVE-2014-9529 kernel: memory corruption or panic during key garbage collection
1179853 – CVE-2014-9529 kernel: memory corruption or panic during key garbage collection [fedora-all]
1177260 – CVE-2014-9419 kernel: partial ASLR bypass through TLS base addresses leak
1177263 – CVE-2014-9419 kernel: partial ASLR bypass through TLS base addresses leak [fedora-all]
1178826 – CVE-2014-9428 kernel: remote denial of service via batman-adv module
1178833 – CVE-2014-9428 kernel: remote denial of service via batman-adv module [fedora-all]
1163927 – CIFS mounts fail with kernel-3.17.2-200.fc20.x86_64
972446 – F2FS kernel module not built
1170684 – CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions
1170688 – CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions [fedora-all]
1168434 – dm cache: kernel crashes when handling a partial block at end of device
1175261 – kernel bug when hotplugging a CPU
1169478 – Feature request: USB-over-IP (CONFIG_USBIP_CORE) support in Linux kernel
1175235 – CVE-2014-9420 Kernel: fs: isofs: infinite loop in CE record entries
1175250 – Kernel: fs: isofs: infinite loop in CE record entries [fedora-all]<br
The 3.17.8 stable update contains a number of important fixes across the tree.
Monthly Archives: January 2015
Fedora 21 Security Update: kernel-3.17.8-300.fc21
Resolved Bugs
1179813 – CVE-2014-9529 kernel: memory corruption or panic during key garbage collection
1179853 – CVE-2014-9529 kernel: memory corruption or panic during key garbage collection [fedora-all]
1177260 – CVE-2014-9419 kernel: partial ASLR bypass through TLS base addresses leak
1177263 – CVE-2014-9419 kernel: partial ASLR bypass through TLS base addresses leak [fedora-all]
1178826 – CVE-2014-9428 kernel: remote denial of service via batman-adv module
1178833 – CVE-2014-9428 kernel: remote denial of service via batman-adv module [fedora-all]
1163927 – CIFS mounts fail with kernel-3.17.2-200.fc20.x86_64
972446 – F2FS kernel module not built
1170684 – CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions
1170688 – CVE-2014-8989 kernel: Linux user namespaces can bypass group-based restrictions [fedora-all]
1168434 – dm cache: kernel crashes when handling a partial block at end of device
1175261 – kernel bug when hotplugging a CPU
1169478 – Feature request: USB-over-IP (CONFIG_USBIP_CORE) support in Linux kernel
1175235 – CVE-2014-9420 Kernel: fs: isofs: infinite loop in CE record entries
1175250 – Kernel: fs: isofs: infinite loop in CE record entries [fedora-all]<br
The 3.17.8 stable update contains a number of important fixes across the tree.
Fedora 21 Security Update: webkitgtk-2.4.8-1.fc21,webkitgtk3-2.4.8-1.fc21
– Fix SSL connection issues with some websites after the POODLE vulnerability fix.
– Fix a crash when loading flash plugins.
– Fix build on GNU Hurd
– Fix build on OS X.
– Fix documentation of webkit_print_operation_get_page_setup().
– Security fixes: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.
Fedora 20 Security Update: gd-2.1.0-8.fc20
Resolved Bugs
1076676 – CVE-2014-2497 gd: NULL pointer dereference in gdImageCreateFromXpm()<br
Previous patch of #1076676 introduced memory leak.
DSA-3124 otrs2 – security update
Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered
a privilege escalation vulnerability in otrs2, the Open Ticket Request
System. An attacker with valid OTRS credentials could access and
manipulate ticket data of other users via the GenericInterface, if a
ticket webservice is configured and not additionally secured.
Vuln: OpenSSL CVE-2015-0204 Man in the Middle Security Bypass Vulnerability
OpenSSL CVE-2015-0204 Man in the Middle Security Bypass Vulnerability
Vuln: OpenSSL CVE-2015-0205 Man in the Middle Security Bypass Vulnerability
OpenSSL CVE-2015-0205 Man in the Middle Security Bypass Vulnerability
Vuln: OpenSSL 'dtls1_buffer_record()' Function Denial of Service Vulnerability
OpenSSL ‘dtls1_buffer_record()’ Function Denial of Service Vulnerability
Vuln: OpenSSL 'dtls1_get_record()' Function NULL Pointer Dereference Denial of Service Vulnerability
OpenSSL ‘dtls1_get_record()’ Function NULL Pointer Dereference Denial of Service Vulnerability
Google Engineers Critical of Aviator Browser Security
Google security engineers have criticized the security and privacy of WhiteHat Security’s Aviator browser, after finding a remote code execution vulnerability within hours of Aviator’s release as open source.