Resolved Bugs
1168463 – CVE-2014-9116 mutt: incorrect use of mutt_substrdup() in write_one_header()
1168464 – mutt: heap-based buffer overflow in mutt_substrdup() [fedora-all]<br
Security fix for

Resolved Bugs
1091438 – CVE-2012-4230 tinymce: XSS attacks via security policy bypass
1091442 – CVE-2012-4230 sagemath: tinymce: XSS attacks via security policy bypass [fedora-all]<br
Add patch for CVE-2012-4230.

Resolved Bugs
986773 – CVE-2013-4159 ctdb: /tmp file vulnerability issues
1102900 – CVE-2013-4159 ctdb: /tmp file vulnerability issues [fedora-all]<br
Updated to a ctdb version which does not use /tmp anymore.

p2m lock starvation, fix build with –without xsm

CVE fixes for everyone – all the X.org CVE fixes from Dec 9th 2014

Resolved Bugs
1172572 – XBMC issues due to Curl
1153814 – yum cannot access repositories using TLS 1.2
1166567 – curl: Disable out-of-protocol fallback to SSL 3.0
1166239 – Please include “low-speed-limit: avoid timeout flood” patch into fedora curl package
1154941 – CVE-2014-3707 curl: incorrect handle duplication after COPYPOSTFIELDS<br
– make CURLOPT_LOW_SPEED_LIMIT work again with threaded resolver (#1172572)
– allow to use TLS 1.1 and TLS 1.2 (#1153814)
– disable libcurl-level downgrade to SSLv3 (#1166567)
– low-speed-limit: avoid timeout flood (#1166239)
– fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)

Resolved Bugs
1172065 – CVE-2014-8602 unbound: specially crafted request can lead to denial of service
1172066 – CVE-2014-8602 unbound: specially crafted request can lead to denial of service [fedora-all]<br
Security fix for CVE-2014-8602

Resolved Bugs
1091438 – CVE-2012-4230 tinymce: XSS attacks via security policy bypass
1091442 – CVE-2012-4230 sagemath: tinymce: XSS attacks via security policy bypass [fedora-all]<br
Add patch for CVE-2012-4230.

Resolved Bugs
1163080 – CVE-2014-7840 qemu: insufficient parameter validation during ram load [fedora-all]
1163075 – CVE-2014-7840 qemu: insufficient parameter validation during ram load<br
* Fix qemu-img convert corruption for unflushed files (bz #1167249)
* Fix SLES11 migration issue (bz #1109427)
* CVE-2014-7840: insufficient parameter validation during ram load (bz #1163080)

Resolved Bugs
1165206 – USB mouse fails after resume from suspend
1167511 – HDMI output broken on Radeon with kernels 3.17.3 and 3.17.4
1094048 – [abrt] WARNING: CPU: 4 PID: 0 at drivers/usb/core/urb.c:450 usb_submit_urb+0x1fd/0x5c0()
1170691 – CVE-2014-9090 kernel: espfix64: local DoS via do_double_fault() due to improper handling of faults associated with SS segment register<br
The 3.17.6 stable update contains a number of important fixes across the tree.