Updated file packages fix security vulnerabilities:

Thomas Jarosch of Intra2net AG reported that using the file command
on a specially-crafted ELF binary could lead to a denial of service
due to uncontrolled resource consumption (CVE-2014-8116).

Thomas Jarosch of Intra2net AG reported that using the file command
on a specially-crafted ELF binary could lead to a denial of service
due to uncontrolled recursion (CVE-2014-8117).

The updated file packages has been upgraded to the latest 5.22 version
which is not vulnerable to these issues.

Updated krb5 packages fix security vulnerability:

In MIT krb5, when kadmind is configured to use LDAP for the KDC
database, an authenticated remote attacker can cause a NULL dereference
by attempting to use a named ticket policy object as a password policy
for a principal. The attacker needs to be authenticated as a user
who has the elevated privilege for setting password policy by adding
or modifying principals (CVE-2014-5353).

Updated pwgen package fixes security vulnerabilities:

Pwgen was found to generate weak non-tty passwords by default, which
could be brute-forced with a commendable success rate, which could
raise security concerns (CVE-2013-4440).

Pwgen was found to silently falling back to use standard pseudo
generated numbers on the systems that heavily use entropy. Systems,
such as those with a lot of daemons providing encryption services,
the entropy was found to be exhausted, which forces pwgen to fall
back to use standard pseudo generated numbers (CVE-2013-4442).

Updated unrtf package fixes security vulnerabilities:

Michal Zalewski reported an out-of-bounds memory access vulnerability
in unrtf. Processing a malformed RTF file could lead to a segfault
while accessing a pointer that may be under the attacker’s control.
This would lead to a denial of service (application crash) or,
potentially, the execution of arbitrary code (CVE-2014-9274).

Hanno Bck also reported a number of other crashes in unrtf
(CVE-2014-9275).

Updated mediawiki packages fix security vulnerabilities:

In MediaWiki before 1.23.8, thumb.php outputs wikitext message as
raw HTML, which could lead to cross-site scripting. Permission to
edit MediaWiki namespace is required to exploit this.

In MediaWiki before 1.23.8, a malicious site can bypass CORS
restrictions in in API calls if it only included an allowed domain
as part of its name.