[SECURITY] Fedora 14 Update: syslog-ng-3.1.4-4.fc14

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-8405
2011-06-21 16:09:02
--------------------------------------------------------------------------------

Name        : syslog-ng
Product     : Fedora 14
Version     : 3.1.4
Release     : 4.fc14
URL         : http://www.balabit.com/products/syslog_ng/
Summary     : Next-generation syslog server
Description :
syslog-ng, as the name shows, is a syslogd replacement, but with new
functionality for the new generation. The original syslogd allows
messages only to be sorted based on priority/facility pairs; syslog-ng
adds the possibility to filter based on message contents using regular
expressions. The new configuration scheme is intuitive and powerful.
Forwarding logs over TCP and remembering all forwarding hops makes it
ideal for firewalled environments.

--------------------------------------------------------------------------------
Update Information:

Patch for CVE-2011-1951
--------------------------------------------------------------------------------
ChangeLog:

* Fri Jun 17 2011 Jose Pedro Oliveira <jpo at di.uminho.pt> - 3.1.4-4
- Patch for CVE-2011-1951: syslog-ng-3.1.4-pcre-dos.patch (#709088)
- Enabled the test suite
* Mon May  9 2011 Jose Pedro Oliveira <jpo at di.uminho.pt> - 3.1.4-3
- Bumped the eventlog version to match the latest upstream version (0.2.12)
- Overrided the default _localstatedir value (configure --localstatedir)
  (value hardcoded in update-patterndb)
- Manually created the patterndb.d configuration directory (update-patterndb)
  (see also https://bugzilla.balabit.com/show_bug.cgi?id=119 comments >= 4)
- Minor modifications of the %post, %preun and %postun scripts
- Corrected a couple of macro references in changelog entries (rpmlint)
- Expanded tabs to spaces (also added a vim modeline)
* Mon Apr 25 2011 Jose Pedro Oliveira <jpo at di.uminho.pt> - 3.1.4-2
- cleans the sysconfig and logrotate file mess (#651823 comments 17, 20 and 21)
- add support for vim versions 72 and 73; drop support for versions 6.2 and 6.3
- clean the spoofsource conditional logical: libnet resides in /lib{,64}
  since 2009
* Wed Apr 13 2011 Jose Pedro Oliveira <jpo at di.uminho.pt> - 3.1.4-1
- update for syslog-ng 3.1.4
- updated the source URL
- versioned some of the build requirements
- dropped the libnet patch (syslog-ng-2.1.4-libnet.patch)
- dropped support for EPEL-4 and EPEL-5 (syslog-ng 3.x requires pcre >= 7.3)
- new file: update-patterndb
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #709088 - CVE-2011-1951 syslog-ng: DoS (excessive memory use) by processing certain pcre patterns
        https://bugzilla.redhat.com/show_bug.cgi?id=709088
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update syslog-ng' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------