Resolved Bugs
1238619 – CVE-2015-1793 openssl: alternative chains certificate forgery
1241544 – CVE-2015-1793 openssl: alternative chains certificate forgery [fedora-all]<br
Security fix for CVE-2015-1793 high severity issue.

Resolved Bugs
1232206 – sizeof – kernel core/modules x 10
1231454 – Updated Polish translation
1230798 – run-elflint-self test failure with 0.162 with –enable-gcov
1170810 – Fuzzing elfutils — various badness
1139815 – Ukrainian translation update
1129756 – Unwinding core fails in vDSO frame when elf_begin is called with ELF_C_READ
1020842 – libelf: segment fault on x86-64 while file’s bss offset have a large number
1230468 – BuildRequires on glibc-devel not glibc-headers.<br
Update to 0.163. Hardening fixes. Updated eu-addr2line utility. Various bug fixes. Updated translations.

New upstream – Firefox 39.0

Resolved Bugs
1225733 – [abrt] [faf] webkitgtk4: bmalloc::Heap::allocateXLarge(std::lock_guard&, unsigned int, unsigned int)(): /usr/libexec/webkit2gtk-4.0/WebKitWebProcess killed by 11<br
WebKitGTK+ 2.8.4 includes fixes for 12 security issues. Additional fixes:
* Make WebSQL work by using a default quota instead of always failing in openDatabase with DOM Exception 18.
* Improve detection and usage of GL/GLES/EGL libraries.
* Fix a crash on memory allocation using bmalloc on 32bit systems.
* Fix DOCUMENT_VIEWER cache model to actually disable the memory cache.
* Fix a WebProcess crash after too many redirect error when there’s an active NPAPI plugin.
* Fix a WebProcess crash when gtk-font-name setting is empty.
* Ensure Math.abs() doesn’t return negative.
* Correctly restore accelerated compositing after a WebProcess crash.
* Respect X-Frame-Options headers when loading from application cache.
* Several crashes and rendering issues fixed.
* Fix the MIPS N64 detection.
* Fix several memory leaks.
* Translation updates: Catalan.
* Workaround a crash affecting 32-bit computers.

Update to nx-libs 3.5.0.32:
– Proper integration of all patches in the source tarballs. Bugs in the tarball generation script and patch file names prohibited inclusion of many patches previously, including security fixes.
– Better support for debug (DEBUG, TEST, TRACE and other directives) builds, in part thanks to Nito Martinez.
– Build fixes due to underlinking of libdl thanks to Bernard Cafarelli.
– Retroactively document correct GPLv2 licensing of previously potentially offending DXPC code.
– Help text fixups.
– Restart reading if interrupted, gets rid of “Negotiation in stage 10” errors thanks to Vadim Troshchinskiy.
– A dozen X.Org Server fixes backported by Ulrich Sibiller.
The X2Go Project thanks Bernard Cafarelli, Nito Martinez (Qindel Group), Vadim Troshchinskiy (Qindel Group) and Ulrich Sibiller for their contributions.

Resolved Bugs
1241905 – hostapd and wpa_supplicant: Incomplete WPS and P2P NFC NDEF record payload length validation
1241906 – hostapd: hostapd and wpa_supplicant: Incomplete WPS and P2P NFC NDEF record payload length validation [fedora-all]<br
apply fix for NDEF record payload length checking