Resolved Bugs
1167537 – CVE-2014-9029 jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)
1170650 – CVE-2014-9029 jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009) [fedora-all]<br
Fixes CVE-2014-9029 vulnerability.

Resolved Bugs
1113267 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler
1125170 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler [fedora-all]<br
Security fix for CVE-2014-3564

Resolved Bugs
1112418 – CVE-2014-4607 lzo: lzo1x_decompress_safe() integer overflow
1131793 – CVE-2014-4607 grub2: lzo: lzo1x_decompress_safe() integer overflow [fedora-all]<br
Security fix for CVE-2014-4607

Resolved Bugs
1056338 – CVE-2014-1624 pyxdg: TOCTOU race condition in get_runtime_dir() when strict=False
1056339 – CVE-2014-1624 pyxdg: TOCTOU race condition in get_runtime_dir() when strict=False [fedora-all]<br
Fix CVE-2014-1624 pyxdg: TOCTOU race condition in get_runtime_dir() when strict=False

Update to the codebase of Extended Support Release (ESR) 31.3.0
Fixes various security issues, see https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html and https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html for more info

Resolved Bugs
1020220 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default
1020223 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default [epel-all]
1020258 – CVE-2013-4442 pwgen: silent fallback to insecure entropy
1020261 – CVE-2013-4442 pwgen: silent fallback to insecure entropy [epel-all]<br
Update to 2.07:
* Remove backwards compatibility for no-tty mode. Addresses CVE-2013-4440
* Fail hard if /dev/urandom and /dev/random are not available. Addresses CVE-2013-4442 and Launchpad #1183213 (Closes: #767008)
* Fix pwgen -B so that it doesn’t accidentally generate passwords with ambiguous characters after changing the case of some letters. Addresses Launchpad Bugs #638418 and #1349863
* Fix potential portability bug on architectures where unsgined ints are not 4 bytes long

Resolved Bugs
963260 – CVE-2013-2099 python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns
966272 – CVE-2013-2098 CVE-2013-2099 python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns [epel-6]<br
– Add patch to fix CVE-2013-2098 CVE-2013-2099 (bug #96627)
– Drop requires python-simplejson, not needed for modern python

Resolved Bugs
1020220 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default
1020223 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default [epel-all]
1020258 – CVE-2013-4442 pwgen: silent fallback to insecure entropy
1020261 – CVE-2013-4442 pwgen: silent fallback to insecure entropy [epel-all]<br
Update to 2.07:
* Remove backwards compatibility for no-tty mode. Addresses CVE-2013-4440
* Fail hard if /dev/urandom and /dev/random are not available. Addresses CVE-2013-4442 and Launchpad #1183213 (Closes: #767008)
* Fix pwgen -B so that it doesn’t accidentally generate passwords with ambiguous characters after changing the case of some letters. Addresses Launchpad Bugs #638418 and #1349863
* Fix potential portability bug on architectures where unsgined ints are not 4 bytes long

Resolved Bugs
1020220 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default
1020223 – CVE-2013-4440 pwgen: non-tty passwords are trivially weak by default [epel-all]
1020258 – CVE-2013-4442 pwgen: silent fallback to insecure entropy
1020261 – CVE-2013-4442 pwgen: silent fallback to insecure entropy [epel-all]<br
Update to 2.07:
* Remove backwards compatibility for no-tty mode. Addresses CVE-2013-4440
* Fail hard if /dev/urandom and /dev/random are not available. Addresses CVE-2013-4442 and Launchpad #1183213 (Closes: #767008)
* Fix pwgen -B so that it doesn’t accidentally generate passwords with ambiguous characters after changing the case of some letters. Addresses Launchpad Bugs #638418 and #1349863
* Fix potential portability bug on architectures where unsgined ints are not 4 bytes long

Resolved Bugs
1113267 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler
1125170 – CVE-2014-3564 gpgme: heap-based buffer overflow in gpgsm status handler [fedora-all]<br
Security fix for CVE-2014-3564