Resolved Bugs
1063671 – CVE-2014-1934 python-eyed3: insecure temporary file creation<br
– Fixed CVE-2014-1934.
Category Archives: Fedora
Fedora – Security Updates
Fedora 20 Security Update: xen-4.3.3-4.fc20
Resolved Bugs
1165205 – CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109) [fedora-all]
1165204 – CVE-2014-8595 kernel: xen: Missing privilege level checks in x86 emulation of far branches (xsa110) [fedora-all]
1086776 – CVE-2014-0150 xen: qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function [fedora-all]
1160664 – CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109)
1160643 – CVE-2014-8595 kernel: xen: Missing privilege level checks in x86 emulation of far branches (xsa110)
1078846 – CVE-2014-0150 qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function<br
Insufficient restrictions on certain MMU update hypercalls,
Missing privilege level checks in x86 emulation of far branches,
Add fix for CVE-2014-0150 to qemu-dm, though it probably isn’t
exploitable from xen
Fedora 19 Security Update: rubygem-sprockets-2.8.2-4.fc19
Fedora 20 Security Update: python-eyed3-0.7.4-4.fc20
Resolved Bugs
1063671 – CVE-2014-1934 python-eyed3: insecure temporary file creation<br
– Fixed CVE-2014-1934.
Fedora 19 Security Update: clamav-0.98.5-1.fc19
Resolved Bugs
1138101 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files
1165526 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files [fedora-all]<br
ClamAV 0.98.5
=============
ClamAV 0.98.5 also includes these new features and bug fixes:
* Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. Addition of shared library support for LLVM versions 3.1 – 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. Andreas Cadhalpun submitted the patch implementing this support.
* Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs.
* Resolution of many of the warning messages from ClamAV compilation.
* Improved detection of malicious PE files.
* Security fix for ClamAV crash when using ‘clamscan -a’. This issue was identified by Kurt Siefried of Red Hat.
* Security fix for ClamAV crash when scanning maliciously crafted yoda’s crypter files. This issue, as well as several other bugs fixed in this release, were identified by Damien Millescamp of Oppida.
* ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode. Thanks to Reinhard Max for supplying the patch.
* Bug fixes and other feature enhancements.
Please see the ChangeLog file or GIT log for further details.
Fedora 19 Security Update: xen-4.2.5-4.fc19
Resolved Bugs
1165205 – CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109) [fedora-all]
1165204 – CVE-2014-8595 kernel: xen: Missing privilege level checks in x86 emulation of far branches (xsa110) [fedora-all]
1086776 – CVE-2014-0150 xen: qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function [fedora-all]
1160664 – CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109)
1160643 – CVE-2014-8595 kernel: xen: Missing privilege level checks in x86 emulation of far branches (xsa110)
1078846 – CVE-2014-0150 qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function<br
Insufficient restrictions on certain MMU update hypercalls,
Missing privilege level checks in x86 emulation of far branches,
Add fix for CVE-2014-0150 to qemu-dm, though it probably isn’t
exploitable from xen
Fedora 20 Security Update: clamav-0.98.5-1.fc20
Resolved Bugs
1138101 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files
1165526 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files [fedora-all]<br
ClamAV 0.98.5
=============
ClamAV 0.98.5 also includes these new features and bug fixes:
* Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. Addition of shared library support for LLVM versions 3.1 – 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. Andreas Cadhalpun submitted the patch implementing this support.
* Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs.
* Resolution of many of the warning messages from ClamAV compilation.
* Improved detection of malicious PE files.
* Security fix for ClamAV crash when using ‘clamscan -a’. This issue was identified by Kurt Siefried of Red Hat.
* Security fix for ClamAV crash when scanning maliciously crafted yoda’s crypter files. This issue, as well as several other bugs fixed in this release, were identified by Damien Millescamp of Oppida.
* ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode. Thanks to Reinhard Max for supplying the patch.
* Bug fixes and other feature enhancements.
Please see the ChangeLog file or GIT log for further details.
Fedora EPEL 6 Security Update: clamav-0.98.5-1.el6
Resolved Bugs
1138101 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files
1165527 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files [epel-all]<br
ClamAV 0.98.5
=============
ClamAV 0.98.5 also includes these new features and bug fixes:
* Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. Addition of shared library support for LLVM versions 3.1 – 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. Andreas Cadhalpun submitted the patch implementing this support.
* Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs.
* Resolution of many of the warning messages from ClamAV compilation.
* Improved detection of malicious PE files.
* Security fix for ClamAV crash when using ‘clamscan -a’. This issue was identified by Kurt Siefried of Red Hat.
* Security fix for ClamAV crash when scanning maliciously crafted yoda’s crypter files. This issue, as well as several other bugs fixed in this release, were identified by Damien Millescamp of Oppida.
* ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode. Thanks to Reinhard Max for supplying the patch.
* Bug fixes and other feature enhancements.
Please see the ChangeLog file or GIT log for further details.
Fedora EPEL 7 Security Update: python-eyed3-0.7.4-4.el7
Resolved Bugs
1063671 – CVE-2014-1934 python-eyed3: insecure temporary file creation<br
– Fixed CVE-2014-1934.
Fedora EPEL 7 Security Update: clamav-0.98.5-1.el7
Resolved Bugs
1138101 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files
1165527 – CVE-2013-6497 ClamAV: -a segmentation fault when processing files [epel-all]<br
ClamAV 0.98.5
=============
ClamAV 0.98.5 also includes these new features and bug fixes:
* Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. Addition of shared library support for LLVM versions 3.1 – 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. Andreas Cadhalpun submitted the patch implementing this support.
* Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs.
* Resolution of many of the warning messages from ClamAV compilation.
* Improved detection of malicious PE files.
* Security fix for ClamAV crash when using ‘clamscan -a’. This issue was identified by Kurt Siefried of Red Hat.
* Security fix for ClamAV crash when scanning maliciously crafted yoda’s crypter files. This issue, as well as several other bugs fixed in this release, were identified by Damien Millescamp of Oppida.
* ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode. Thanks to Reinhard Max for supplying the patch.
* Bug fixes and other feature enhancements.
Please see the ChangeLog file or GIT log for further details.