Security fix for CVE-2023-35936 and CVE-2023-38745 pandoc: backport fixes for CVE-2023-35936 and CVE-2023-38745 pandoc-cli: new package for pandoc binary. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-7d83cbccb6 2024-03-29 00:16:07.816517 -------------------------------------------------------------------------------- Name : patat Product : Fedora 40 Version : 0.11.0.0 Release : 1.fc40 URL : https://hackage.haskell.org/package/patat Summary : Terminal-based presentations using Pandoc Description : Terminal-based presentations using Pandoc. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-35936 and CVE-2023-38745 pandoc: backport fixes for CVE-2023-35936 and CVE-2023-38745 pandoc-cli: new package for pandoc binary patat: update to 0.11.0.0 and enable tests base64, isocline, toml-parser: now packaged in Fedora -------------------------------------------------------------------------------- ChangeLog: * Wed Feb 28 2024 Jens Petersen - 0.11.0.0-1 - update to 0.11.0.0 and enable tests -------------------------------------------------------------------------------- References: [ 1 ] Bug #2220871 - CVE-2023-35936 pandoc: allows attacker to create or overwrite arbitrary files on the system https://bugzilla.redhat.com/show_bug.cgi?id=2220871 [ 2 ] Bug #2225379 - CVE-2023-38745 pandoc: allows attacker to create or overwrite arbitrary files on the system (incomplete fix in upstream for CVE-2023-35936) https://bugzilla.redhat.com/show_bug.cgi?id=2225379 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-7d83cbccb6' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Security fix for CVE-2022-24724 - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - fixed upstream in Haskell cmark-gfm-0.2.3 in bundled cmark-gfm-0.29.0.gfm.3 C library - pandoc-citeproc: update HsYAML-aeson to 0.2.0.1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-1f981071eb 2022-04-02 01:56:09.411895 --------------------------------------------------------------------------------Name : patat Product : Fedora 34 Version : 0.8.6.1 Release : 1.1.fc34 URL : https://hackage.haskell.org/package/patat Summary : Terminal-based presentations using Pandoc Description : Terminal-based presentations using Pandoc. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-24724 - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - fixed upstream in Haskell cmark-gfm-0.2.3 in bundled cmark-gfm-0.29.0.gfm.3 C library - pandoc-citeproc: update HsYAML-aeson to 0.2.0.1 --------------------------------------------------------------------------------ChangeLog: * Fri Mar 25 2022 Jens Petersen - 0.8.6.1-1.1 - rebuild for CVE-2022-24724 (#2060663) https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x --------------------------------------------------------------------------------References: [ 1 ] Bug #2060662 - CVE-2022-24724 cmark-gfm: possible RCE due to integer overflow https://bugzilla.redhat.com/show_bug.cgi?id=2060662 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-1f981071eb' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPGkeys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Security fix for CVE-2020-5238 - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled cmark-gfm to 0.29.0.gfm.1 https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-fe299b3fa3 2020-10-06 15:06:57.555099 --------------------------------------------------------------------------------Name : patat Product : Fedora 31 Version : 0.8.2.3 Release : 2.fc31 URL : https://hackage.haskell.org/package/patat Summary : Terminal-based presentations using Pandoc Description : Terminal-based presentations using Pandoc. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2020-5238 - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled cmark-gfm to 0.29.0.gfm.1 https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85 --------------------------------------------------------------------------------ChangeLog: * Thu Sep 24 2020 Jens Petersen - 0.8.2.3-2 - rebuild for cmark-gfm-0.2.2: fixes exponential parse (#1854329) --------------------------------------------------------------------------------References: [ 1 ] Bug #1854328 - CVE-2020-5238 cmark: Exponential time to parse certain inputs could lead to DoS. https://bugzilla.redhat.com/show_bug.cgi?id=1854328 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-fe299b3fa3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.