Resolved Bugs
1107556 – CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled [fedora-all]
1090976 – CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled<br
fixes built in also added a couple of other entities related
pacthes including a fix to CVE-2014-3660

Resolved Bugs
1205302 – Fix the legacy CA inclusions of upstream 2.1 and 2.2
1205305 – Update to version 2.3 as released with NSS 3.18<br
This is an update to the set of CA certificates released with NSS version 3.18
However, the package modifies the CA list to keep several legacy CAs still trusted for compatibility reasons. Please refer to the project URL for details.
If you prefer to use the unchanged list provided by Mozilla, and if you accept any compatibility issues it may cause, an administrator may configure the system by executing the “ca-legacy disable” command.
This update corrects the Fedora legacy classification of four root CA certificates, which had trust added or removed in the upstream 2.1 and 2.2 releases.

Resolved Bugs
1203203 – CVE-2015-2269 CVE-2015-2268 CVE-2015-2267 CVE-2015-2266 CVE-2015-2272 CVE-2015-2273 CVE-2015-2270 CVE-2015-2271 moodle: multiple flaws in moodle [fedora-all]
1203205 – CVE-2015-2269 CVE-2015-2268 CVE-2015-2267 CVE-2015-2266 CVE-2015-2272 CVE-2015-2273 CVE-2015-2270 CVE-2015-2271 moodle: multiple flaws in moodle [epel-6]
1190119 – CVE-2015-1493 moodle: Directory Traversal Attack possible through some files serving JS (MSA-15-0009) [fedora-all]<br
Update to latest versions of the respective branches. f20 has been updated from 2.5.x to 2.6.x because 2.5.x is EOL.

Resolved Bugs
1204773 – tor: security fixes in 0.2.4.26 and 0.2.5.11
1204774 – tor: security fixes in 0.2.4.26 and 0.2.5.11 [fedora-all]<br
Update to upstream release 0.2.5.11.

Resolved Bugs
1093529 – CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid
1095534 – CVE-2014-0035 Apache CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy [fedora-all]
1095550 – CVE-2014-0110 Apache CXF: Large invalid content could cause temporary space to fill [fedora-all]
1106113 – cxf: FTBFS in rawhide
1095492 – CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid [fedora-all]
1065245 – cxf: Upgrade to 2.7.11
1068021 – cxf: Switch to java-headless (build)requires
1095542 – CVE-2014-0109 Apache CXF: HTML content posted to SOAP endpoint could cause OOM errors [fedora-all]
1157305 – CVE-2014-3584 CVE-2014-3623 cxf: various flaws [fedora-all]<br
CXF upgrade to 2.7.11.

Resolved Bugs
1204796 – qt5-qtwebkit: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode [fedora-all]
1204795 – qt5-qtwebkit: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode<br
QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode.

Resolved Bugs
1204798 – mingw-qt5-qtwebkit: qt5-qtwebkit: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode [fedora-all]<br
Update to Qt 5.4.1

Resolved Bugs
1200059 – CVE-2014-9472 rt: denial of service flaw in email gateway
1200065 – CVE-2015-1165 rt: information disclosure flaw in RSS feed handler
1200066 – CVE-2015-1165 rt: information disclosure flaw in RSS feed handler [fedora-21]
1200062 – CVE-2014-9472 rt: denial of service flaw in email gateway [fedora-21]
1200069 – CVE-2015-1464 rt: session hijaking flaw in RSS feed handler
1200070 – CVE-2015-1464 rt: session hijaking flaw in RSS feed handler [fedora-21]<br
Security fix for CVE-2014-9472
Security fix for CVE-2015-1165
Security fix for CVE-2015-1464

Resolved Bugs
1204676 – CVE-2015-2331 php: libzip: integer overflow when processing ZIP archives
1204677 – CVE-2015-2331 php: libzip: integer overflow when processing ZIP archives [fedora-all]<br
CVE-2015-2331: integer overflow when processing ZIP archives (#1204676,#1204677)

Resolved Bugs
1194196 – glpi: privilege escalation via user creation with a crafted POST request
1194197 – glpi: privilege escalation via user creation with a crafted POST request [fedora-all]<br
* Fix privilege escalation via user creation with a crafted POST request