Resolved Bugs
1229706 – CVE-2015-4411 rubygem-moped: Denial of Service with crafted ObjectId string (incomplete fix for CVE-2015-4410)
1229708 – CVE-2015-4411 rubygem-moped: Denial of Service with crafted ObjectId string [fedora-all]<br
Security fix for CVE-2015-4411

Resolved Bugs
1238241 – openssh: various flaws [fedora-all]
1238231 – CVE-2015-5352 openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)
1238238 – openssh: weakness of agent locking (ssh-add -x) to password guessing
1238253 – openssh-6.9p1 is available<br
This update brings security fix for two announced vulnerabilities. Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking (ssh-add -x) to password guessing (more info in related bugs). It also provides new version of openssh-6.9 which is bringing many bugfixes and few new features with maintaining compatibility with previous version.

Resolved Bugs
1238241 – openssh: various flaws [fedora-all]
1238238 – openssh: weakness of agent locking (ssh-add -x) to password guessing
1238231 – CVE-2015-5352 openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)<br
This update brings security fix for two announced vulnerabilities. Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking (ssh-add -x) to password guessing (more info in related bugs). For more information see related bugs.

Resolved Bugs
1229706 – CVE-2015-4411 rubygem-moped: Denial of Service with crafted ObjectId string (incomplete fix for CVE-2015-4410)
1229708 – CVE-2015-4411 rubygem-moped: Denial of Service with crafted ObjectId string [fedora-all]<br
Security fix for CVE-2015-4411

Resolved Bugs
910262 – [abrt] polkit-0.107-4.fc18: js::PropertyTable::search: Process /usr/lib/polkit-1/polkitd was killed by signal 11 (SIGSEGV)
1175061 – [abrt] polkit: js::ShapeTable::search(): polkitd killed by SIGSEGV
1177930 – [abrt] polkit: LookupPropertyWithFlagsInline(): polkitd killed by SIGSEGV
1194391 – [abrt] polkit: getObjectClass(): polkitd killed by SIGSEGV
1228738 – CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent
1228739 – CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent [fedora-all]
1233808 – CVE-2015-4625 polkit: potential information disclosure vulnerability due to cookie counter wrapping
1233810 – CVE-2015-4625 polkit: potential information disclosure vulnerability due to cookie counter wrapping [fedora-all]<br
Security fix for CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625

Resolved Bugs
910262 – [abrt] polkit-0.107-4.fc18: js::PropertyTable::search: Process /usr/lib/polkit-1/polkitd was killed by signal 11 (SIGSEGV)
1175061 – [abrt] polkit: js::ShapeTable::search(): polkitd killed by SIGSEGV
1177930 – [abrt] polkit: LookupPropertyWithFlagsInline(): polkitd killed by SIGSEGV
1194391 – [abrt] polkit: getObjectClass(): polkitd killed by SIGSEGV
1228738 – CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent
1228739 – CVE-2015-3218 polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent [fedora-all]
1233808 – CVE-2015-4625 polkit: potential information disclosure vulnerability due to cookie counter wrapping
1233810 – CVE-2015-4625 polkit: potential information disclosure vulnerability due to cookie counter wrapping [fedora-all]<br
Security fix for CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625

Resolved Bugs
1224538 – [abrt] rsyslog: SanitizeMsg(): rsyslogd killed by SIGSEGV
1224972 – rsyslog logrotate issue<br
Besides other changes, this update mitigates this vulnerability:
https://access.redhat.com/security/cve/CVE-2015-3243