FEDORA-2021-bdaf015218 — security update for kf5-messagelib and qt5-qtwebengine

stable

kf5-messagelib-19.12.2-2.fc32 and qt5-qtwebengine-5.15.2-7.fc32

FEDORA-2021-bdaf015218 created by kkofler 3 years ago for Fedora 32

This update rebases QtWebEngine to the latest Qt 5 release, 5.15.2, fixing dozens of security issues. (The same version is already shipped on Fedora 33 and Rawhide.) The included kf5-messagelib update backports a fix for compatibility with QtWebEngine 5.15.x.

The Chromium version has been updated to 83.0.4103.122, with backported security fixes from Chromium up to version 86.0.4240.183. That fixes dozens of security issues compared to 5.14.2.

This version also adds the Qt PDF module, a Qt wrapper around PDFium. This is a separate library and cannot cause backwards compatibility issues.

In addition, several bugs have been fixed, see the Changes files:

Behavior Changes since 5.14.2:

XSS Auditing has been removed, and the XSSAuditingEnabled setting no longer has any effect.
[QTBUG-79864] The viz display compositor is now used by default on all platforms, but can be disabled with --disable-viz-display-compositor.
The network layer integration has been rewritten to use Chromium's network service, and now runs in a separate sandboxed process by default.
[QTBUG-83656] CTRL+mouse wheel page zoom fixed, and now works by default.

Logout Required

After installing this update it is required that you logout of your current user session and log back in to ensure the changes supplied by this update are applied properly.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2021-bdaf015218

This update has been submitted for testing by kkofler.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update's test gating status has been changed to 'waiting'.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update has been pushed to testing.

3 years ago

nucleo commented & provided feedback 3 years ago

karma

Displaing of emails headers broken In KMail.

kkofler commented 3 years ago

Looks like we need this backported in the PIM Messagelib for KMail: https://invent.kde.org/pim/messagelib/-/commit/1f2548805df60707ffba2bba27d35d441232d140 I am going to look into this.

kkofler commented 3 years ago

Note that this was fixed in 20.04.2, but the kdepim stack was never upgraded from 19.12.2 (which is now almost 1 year old, it was released on 2020-02-04) in F32.

I am building kf5-messagelib-19.12.2-2.fc32 with a backported fix now and will edit it into this update.

kkofler edited this update.

New build(s):