GNOME 3.26 Platform (gnome-bluetooth-3.26.1 yelp-3.26.0 gnome-settings-daemon-3.26.0 gnome-control-center-3.26.0 gnome-user-docs-3.26.0 gnome-session-3.26.0 gdm-3.26.0 gnome-shell-3.26.0 gnome-shell-extensions-3.26.0 mutter-3.26.0) [GDM: CVE-2017-12164]

[Douglas R. Reno]

Meta ticket. I'll update with changelogs as necessary.

[Douglas R. Reno]

I will start working on these at some point today. Need more sleep.

[Douglas R. Reno]

gobject-introspection-1.54.0: Fixed at r19211 glib2-2.54.0: Fixed at r19211

Note that we need to pay attention to gobject-introspection's syntax errors in the future.

[bdubbs@…]

Typo in Summary (center, not cetner)

[Douglas R. Reno]

Anyone shipping GDM 3.24.1 or later should consider upgrading to 3.24.3
(or 3.26.0) which fixes a security hole. namely, if the user enables
autologin, then screen lock can be bypassed by trying to initiate user
switching.

---------- Forwarded message ---------
From: Ray Strode <install-module@master.gnome.org>
Date: Tue, Sep 12, 2017 at 11:47 AM
Subject: gdm 3.24.3
To: FTP Releases <ftp-release-list@gnome.org>


About gdm
=========

Display manager and login screen

News
====

- Fix for unauthenticated unlock when autologin is enabled (CVE-2017-12164)
- Fix fallback session name sorting
- Translation updates

GDM is now a critical update. I'll work on it overnight.

[Douglas R. Reno]

pygobject-3.26.0: Fixed at r19217

atk-2.26.0: Fixed at r19217

at-spi2-atk-2.26.0: Fixed at r19217

at-spi2-core-2.26.0: Fixed at r19217

[Douglas R. Reno]

libsoup has a security fix:

	* CVE-2017-2885: Fixed a chunked decoding buffer overrun that
          could be exploited against either clients or servers.
          [#785774]

[Douglas R. Reno]

libsoup-2.60.0: Fixed at r19220

^{ALL USERS WHO HAVE LIBSOUP SHOULD UPGRADE TO THIS VERSION}

glib-networking-2.54.0: Fixed at r19220

pyatspi2-2.26.0: Fixed at r19220

[Douglas R. Reno]

Add overnight packages - adwaita, totem-pl-parser, and gnome-backgrounds

[Douglas R. Reno]

adwaita-icon-theme-3.26.0: Fixed at r19222

gtkmm-3.22.2: Fixed at r19222

glibmm-2.54.0: Fixed at r19222

gtk+-3.22.21: Fixed at r19222

gdk-pixbuf-2.36.10: Fixed at r19222

Now off to WebKitGTK+.

[Douglas R. Reno]

Update summary for completed packages.

Bruce and I have discussed creating a plaintext NEWS file for GNOME releases on Anduin. I think this is a good idea and will work well.

[Douglas R. Reno]

As a result of CVE-2017-12164, I'm promoting this ticket to HIGH priority, pending promotion to HIGHEST as I get closer. This shouldn't take more than the next 48 hours to complete, WebKitGTK+'s cooperation permitting.

[Douglas R. Reno]

gnome-bluetooth-3.26.1 released to fix a tarball/build problem - icons were missing.

[Douglas R. Reno]

gjs-1.50.0: Fixed at r19260

[DJ Lucas]

gnome-desktop-3.26.0 fixed at r19370. libgweather-3.26.0 fixed at r19384. libgtop-2.38.0 fixed at r19383. vte-0.50.0 fixed at r19367. evolution-data-server-3.26.0 fixed at r19386. libpeas-1.22.0 at r19385. json-glib-1.4.2 fixed at r19369. gnome-online-accounts-3.26.0 fixed at r19381. totem-pl-parser-3.26.0 fixed at r19366.

[DJ Lucas]

gnome-backgrounds-3.26.2 fixed r19391.

[DJ Lucas]

gvfs-1.34.1 fixed in r19392.

[DJ Lucas]

nautilus-3.26.0 fixed in r19399.

[DJ Lucas]

Remainder of items fixed in r19401.