summaryrefslogtreecommitdiffstats
path: root/recompress.sh (follow)
Commit message (Expand)AuthorAgeFilesLines
* Fri Jan 13 20:29:55 UTC 2023...patches/packages/netatalk-3.1.14-x86_64-1_slack15.0.txz: Upgraded. Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-45188 (* Security fix *) 20230113202955_15.0 Patrick J Volkerding2023-01-141-0/+1
* Sat Jan 7 01:50:00 UTC 2023...extra/php80/php80-8.0.27-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: PDO::quote() may return unquoted string. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-31631 (* Security fix *) extra/php81/php81-8.1.14-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: PDO::quote() may return unquoted string. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-31631 (* Security fix *) patches/packages/mozilla-nss-3.87-x86_64-1_slack15.0.txz: Upgraded. Fixed memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures. For more information, see: https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/ https://www.cve.org/CVERecord?id=CVE-2021-43527 (* Security fix *) patches/packages/php-7.4.33-x86_64-2_slack15.0.txz: Rebuilt. This update fixes a security issue: PDO::quote() may return unquoted string. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-31631 (* Security fix *) 20230107015000_15.0 Patrick J Volkerding2023-01-071-1/+1
* Wed Jan 4 02:18:08 UTC 2023...patches/packages/libtiff-4.4.0-x86_64-1_slack15.0.txz: Upgraded. Patched various security bugs. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-2056 https://www.cve.org/CVERecord?id=CVE-2022-2057 https://www.cve.org/CVERecord?id=CVE-2022-2058 https://www.cve.org/CVERecord?id=CVE-2022-3970 https://www.cve.org/CVERecord?id=CVE-2022-34526 (* Security fix *) patches/packages/rxvt-unicode-9.26-x86_64-3_slack15.0.txz: Rebuilt. When the "background" extension was loaded, an attacker able to control the data written to the terminal would be able to execute arbitrary code as the terminal's user. Thanks to David Leadbeater and Ben Collver. For more information, see: https://www.openwall.com/lists/oss-security/2022/12/05/1 https://www.cve.org/CVERecord?id=CVE-2022-4170 (* Security fix *) patches/packages/whois-5.5.15-x86_64-1_slack15.0.txz: Upgraded. Updated the .bd, .nz and .tv TLD servers. Added the .llyw.cymru, .gov.scot and .gov.wales SLD servers. Updated the .ac.uk and .gov.uk SLD servers. Recursion has been enabled for whois.nic.tv. Updated the list of new gTLDs with four generic TLDs assigned in October 2013 which were missing due to a bug. Removed 4 new gTLDs which are no longer active. Added the Georgian translation, contributed by Temuri Doghonadze. Updated the Finnish translation, contributed by Lauri Nurmi. 20230104021808_15.0 Patrick J Volkerding2023-01-041-0/+5
* Tue Dec 20 20:40:18 UTC 2022...patches/packages/libksba-1.6.3-x86_64-1_slack15.0.txz: Upgraded. Fix another integer overflow in the CRL's signature parser. (* Security fix *) patches/packages/sdl-1.2.15-x86_64-13_slack15.0.txz: Rebuilt. This update fixes a heap overflow problem in video/SDL_pixels.c in SDL. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service, or code execution. Thanks to marav for the heads-up. For more information, see: https://www.cve.org/CVERecord?id=CVE-2021-33657 (* Security fix *) 20221220204018_15.0 Patrick J Volkerding2022-12-211-0/+5
* Mon Dec 19 21:18:22 UTC 2022...patches/packages/xorg-server-1.20.14-x86_64-6_slack15.0.txz: Rebuilt. This release fixes an invalid event type mask in XTestSwapFakeInput which was inadvertently changed from octal 0177 to hexadecimal 0x177 in the fix for CVE-2022-46340. patches/packages/xorg-server-xephyr-1.20.14-x86_64-6_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-6_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-6_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xwayland-21.1.4-x86_64-5_slack15.0.txz: Rebuilt. This release fixes an invalid event type mask in XTestSwapFakeInput which was inadvertently changed from octal 0177 to hexadecimal 0x177 in the fix for CVE-2022-46340. 20221219211822_15.0 Patrick J Volkerding2022-12-201-0/+2
* Wed Dec 14 21:19:34 UTC 2022...patches/packages/mozilla-firefox-102.6.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/102.6.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/ https://www.cve.org/CVERecord?id=CVE-2022-46880 https://www.cve.org/CVERecord?id=CVE-2022-46872 https://www.cve.org/CVERecord?id=CVE-2022-46881 https://www.cve.org/CVERecord?id=CVE-2022-46874 https://www.cve.org/CVERecord?id=CVE-2022-46875 https://www.cve.org/CVERecord?id=CVE-2022-46882 https://www.cve.org/CVERecord?id=CVE-2022-46878 (* Security fix *) patches/packages/mozilla-thunderbird-102.6.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.6.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/ https://www.cve.org/CVERecord?id=CVE-2022-46880 https://www.cve.org/CVERecord?id=CVE-2022-46872 https://www.cve.org/CVERecord?id=CVE-2022-46881 https://www.cve.org/CVERecord?id=CVE-2022-46874 https://www.cve.org/CVERecord?id=CVE-2022-46875 https://www.cve.org/CVERecord?id=CVE-2022-46882 https://www.cve.org/CVERecord?id=CVE-2022-46878 (* Security fix *) patches/packages/xorg-server-1.20.14-x86_64-5_slack15.0.txz: Rebuilt. This release fixes 6 recently reported security vulnerabilities in various extensions. For more information, see: https://lists.x.org/archives/xorg-announce/2022-December/003302.html https://www.cve.org/CVERecord?id=CVE-2022-46340 https://www.cve.org/CVERecord?id=CVE-2022-46341 https://www.cve.org/CVERecord?id=CVE-2022-46342 https://www.cve.org/CVERecord?id=CVE-2022-46343 https://www.cve.org/CVERecord?id=CVE-2022-46344 https://www.cve.org/CVERecord?id=CVE-2022-4283 (* Security fix *) patches/packages/xorg-server-xephyr-1.20.14-x86_64-5_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-5_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-5_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xwayland-21.1.4-x86_64-4_slack15.0.txz: Rebuilt. This release fixes 6 recently reported security vulnerabilities in various extensions. For more information, see: https://lists.x.org/archives/xorg-announce/2022-December/003302.html https://www.cve.org/CVERecord?id=CVE-2022-46340 https://www.cve.org/CVERecord?id=CVE-2022-46341 https://www.cve.org/CVERecord?id=CVE-2022-46342 https://www.cve.org/CVERecord?id=CVE-2022-46343 https://www.cve.org/CVERecord?id=CVE-2022-46344 https://www.cve.org/CVERecord?id=CVE-2022-4283 (* Security fix *) 20221214211934_15.0 Patrick J Volkerding2022-12-151-0/+12
* Thu Dec 8 22:48:34 UTC 2022...patches/packages/emacs-27.2-x86_64-2_slack15.0.txz: Rebuilt. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-45939 (* Security fix *) patches/packages/vim-9.0.1034-x86_64-1_slack15.0.txz: Upgraded. This update fixes various security issues such as a heap-based buffer overflow and use after free. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-4141 https://www.cve.org/CVERecord?id=CVE-2022-3591 https://www.cve.org/CVERecord?id=CVE-2022-3520 https://www.cve.org/CVERecord?id=CVE-2022-3491 https://www.cve.org/CVERecord?id=CVE-2022-4292 https://www.cve.org/CVERecord?id=CVE-2022-4293 (* Security fix *) patches/packages/vim-gvim-9.0.1034-x86_64-1_slack15.0.txz: Upgraded. 20221208224834_15.0 Patrick J Volkerding2022-12-091-0/+2
* Thu Nov 17 01:49:28 UTC 2022...patches/packages/krb5-1.19.2-x86_64-3_slack15.0.txz: Rebuilt. Fixed integer overflows in PAC parsing. Fixed memory leak in OTP kdcpreauth module. Fixed PKCS11 module path search. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-42898 (* Security fix *) patches/packages/mozilla-firefox-102.5.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/102.5.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2022-48/ https://www.cve.org/CVERecord?id=CVE-2022-45403 https://www.cve.org/CVERecord?id=CVE-2022-45404 https://www.cve.org/CVERecord?id=CVE-2022-45405 https://www.cve.org/CVERecord?id=CVE-2022-45406 https://www.cve.org/CVERecord?id=CVE-2022-45408 https://www.cve.org/CVERecord?id=CVE-2022-45409 https://www.cve.org/CVERecord?id=CVE-2022-45410 https://www.cve.org/CVERecord?id=CVE-2022-45411 https://www.cve.org/CVERecord?id=CVE-2022-45412 https://www.cve.org/CVERecord?id=CVE-2022-45416 https://www.cve.org/CVERecord?id=CVE-2022-45418 https://www.cve.org/CVERecord?id=CVE-2022-45420 https://www.cve.org/CVERecord?id=CVE-2022-45421 (* Security fix *) patches/packages/mozilla-thunderbird-102.5.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.5.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/ https://www.cve.org/CVERecord?id=CVE-2022-45403 https://www.cve.org/CVERecord?id=CVE-2022-45404 https://www.cve.org/CVERecord?id=CVE-2022-45405 https://www.cve.org/CVERecord?id=CVE-2022-45406 https://www.cve.org/CVERecord?id=CVE-2022-45408 https://www.cve.org/CVERecord?id=CVE-2022-45409 https://www.cve.org/CVERecord?id=CVE-2022-45410 https://www.cve.org/CVERecord?id=CVE-2022-45411 https://www.cve.org/CVERecord?id=CVE-2022-45412 https://www.cve.org/CVERecord?id=CVE-2022-45416 https://www.cve.org/CVERecord?id=CVE-2022-45418 https://www.cve.org/CVERecord?id=CVE-2022-45420 https://www.cve.org/CVERecord?id=CVE-2022-45421 (* Security fix *) patches/packages/samba-4.15.12-x86_64-1_slack15.0.txz: Upgraded. Fixed a security issue where Samba's Kerberos libraries and AD DC failed to guard against integer overflows when parsing a PAC on a 32-bit system, which allowed an attacker with a forged PAC to corrupt the heap. For more information, see: https://www.samba.org/samba/security/CVE-2022-42898.html https://www.cve.org/CVERecord?id=CVE-2022-42898 (* Security fix *) patches/packages/xfce4-settings-4.16.5-x86_64-1_slack15.0.txz: Upgraded. This update fixes regressions in the previous security fix: mime-settings: Properly quote command parameters. Revert "Escape characters which do not belong into an URI/URL (Issue #390)." 20221117014928_15.0 Patrick J Volkerding2022-11-171-0/+1
* Wed Nov 9 22:16:30 UTC 2022...patches/packages/sysstat-12.7.1-x86_64-1_slack15.0.txz: Upgraded. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-39377 (* Security fix *) patches/packages/xfce4-settings-4.16.4-x86_64-1_slack15.0.txz: Upgraded. Fixed an argument injection vulnerability in xfce4-mime-helper. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-45062 (* Security fix *) 20221109221630_15.0 Patrick J Volkerding2022-11-101-0/+3
* Sat Nov 5 19:18:19 UTC 2022...patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txz: Upgraded. Fixed a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-43995 (* Security fix *) 20221105191819_15.0 Patrick J Volkerding2022-11-061-0/+1
* Fri Nov 4 19:29:28 UTC 2022...patches/packages/mozilla-thunderbird-102.4.2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.4.2/releasenotes/ 20221104192928_15.0 Patrick J Volkerding2022-11-051-0/+1
* Mon Oct 17 19:31:45 UTC 2022...patches/packages/xorg-server-1.20.14-x86_64-4_slack15.0.txz: Rebuilt. xkb: proof GetCountedString against request length attacks. xkb: fix some possible memleaks in XkbGetKbdByName. xquartz: Fix a possible crash when editing the Application menu due to mutating immutable arrays. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3553 (* Security fix *) patches/packages/xorg-server-xephyr-1.20.14-x86_64-4_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-4_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-4_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xwayland-21.1.4-x86_64-3_slack15.0.txz: Rebuilt. xkb: proof GetCountedString against request length attacks. xkb: fix some possible memleaks in XkbGetKbdByName. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551 (* Security fix *) 20221017193145_15.0 Patrick J Volkerding2022-10-181-0/+5
* Wed Oct 5 18:55:36 UTC 2022...patches/packages/dhcp-4.4.3_P1-x86_64-1_slack15.0.txz: Upgraded. This update fixes two security issues: Corrected a reference count leak that occurs when the server builds responses to leasequery packets. Corrected a memory leak that occurs when unpacking a packet that has an FQDN option (81) that contains a label with length greater than 63 bytes. Thanks to VictorV of Cyber Kunlun Lab for reporting these issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2928 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2929 (* Security fix *) 20221005185536_15.0 Patrick J Volkerding2022-10-061-0/+2
* Wed Sep 28 18:59:51 UTC 2022...patches/packages/xorg-server-xwayland-21.1.4-x86_64-2_slack15.0.txz: Rebuilt. xkb: switch to array index loops to moving pointers. xkb: add request length validation for XkbSetGeometry. xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck. I hadn't realized that the xorg-server patches were needed (or applied cleanly) to Xwayland. Thanks to LuckyCyborg for the kind reminder. :-) For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2319 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2320 (* Security fix *) 20220928185951_15.0 Patrick J Volkerding2022-09-291-0/+3
* Mon Sep 26 19:43:54 UTC 2022...patches/packages/dnsmasq-2.87-x86_64-1_slack15.0.txz: Upgraded. Fix write-after-free error in DHCPv6 server code. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0934 (* Security fix *) patches/packages/vim-9.0.0594-x86_64-1_slack15.0.txz: Upgraded. Fixed stack-based buffer overflow. Thanks to marav for the heads-up. In addition, Mig21 pointed out an issue where the defaults.vim file might need to be edited for some purposes as its contents will override the settings in the system-wide vimrc. Usually this file is replaced whenever vim is upgraded, which in those situations would be inconvenient for the admin. So, I've added support for a file named defaults.vim.custom which (if it exists) will be used instead of the defaults.vim file shipped in the package and will persist through upgrades. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3296 (* Security fix *) patches/packages/vim-gvim-9.0.0594-x86_64-1_slack15.0.txz: Upgraded. 20220926194354_15.0 Patrick J Volkerding2022-09-271-0/+5
* Wed Sep 21 19:19:07 UTC 2022...patches/packages/cups-2.4.2-x86_64-3_slack15.0.txz: Rebuilt. Fixed crash when using the CUPS web setup interface: [PATCH] Fix OpenSSL crash bug - "tls" pointer wasn't cleared after freeing it (Issue #409). Thanks to MisterL, bryjen, and kjhambrick. Fixed an OpenSSL certificate loading issue: [PATCH] The OpenSSL code path wasn't loading the full certificate chain (Issue #465). Thanks to tmmukunn. 20220921191907_15.0 Patrick J Volkerding2022-09-221-0/+2
* Tue Sep 6 20:21:24 UTC 2022...extra/rust-for-mozilla/rust-1.60.0-x86_64-1_slack15.0.txz: Upgraded. Upgraded the Rust compiler for Firefox 102.2.0 and Thunderbird 102.2.1. patches/packages/mozilla-firefox-102.2.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/102.2.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2022-34/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38473 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38476 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38477 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38478 (* Security fix *) patches/packages/mozilla-thunderbird-102.2.1-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. Some accounts may need to be reconfigured after moving from Thunderbird 91.13.0 to Thunderbird 102.2.1. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.2.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3033 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3032 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3034 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059 (* Security fix *) patches/packages/vim-9.0.0396-x86_64-1_slack15.0.txz: Upgraded. Fixed use after free. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3099 (* Security fix *) patches/packages/vim-gvim-9.0.0396-x86_64-1_slack15.0.txz: Upgraded. 20220906202124_15.0 Patrick J Volkerding2022-09-071-0/+2
* Thu Sep 1 20:01:13 UTC 2022...patches/packages/poppler-21.12.0-x86_64-2_slack15.0.txz: Rebuilt. [PATCH] JBIG2Stream: Fix crash on broken file. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30860 (* Security fix *) 20220901200113_15.0 Patrick J Volkerding2022-09-021-0/+1
* Tue Aug 30 19:39:30 UTC 2022...extra/sendmail/sendmail-8.17.1-x86_64-4_slack15.0.txz: Rebuilt. Patched sendmail.h to fix SASL auth. Thanks to af7567. Build without -DUSE_EAI (which is evidently considered experimental) since the option breaks the vacation binary. Thanks to bitfuzzy and HQuest. It is possible that this could work but requires additional options. I found this in the ChangeLog for the SUSE rpm: Experimental support for SMTPUTF8 (EAI, see RFC 6530-6533) is available when using the compile time option USE_EAI (see also devtools/Site/site.config.m4.sample for other required settings) and the cf option SMTPUTF8. If a mail submission via the command line requires the use of SMTPUTF8, e.g., because a header uses UTF-8 encoding, but the addresses on the command line are all ASCII, then the new option -U must be used, and the cf option SMTPUTF8 must be set in submit.cf. Any assistance with getting -DUSE_EAI working properly would be appreciated. extra/sendmail/sendmail-cf-8.17.1-noarch-4_slack15.0.txz: Rebuilt. patches/packages/vim-9.0.0334-x86_64-1_slack15.0.txz: Upgraded. Fixed use after free. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3016 (* Security fix *) patches/packages/vim-gvim-9.0.0334-x86_64-1_slack15.0.txz: Upgraded. 20220830193930_15.0 Patrick J Volkerding2022-08-311-0/+1
* Fri Aug 26 04:02:20 UTC 2022...patches/packages/linux-5.15.63/*: Upgraded. These updates fix various bugs and security issues. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see: Fixed in 5.15.39: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1974 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1975 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1734 Fixed in 5.15.40: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1943 Fixed in 5.15.41: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28893 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32296 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1012 Fixed in 5.15.42: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1652 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1729 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21499 Fixed in 5.15.44: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1789 Fixed in 5.15.45: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2873 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1966 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32250 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2078 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1852 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1972 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2503 Fixed in 5.15.46: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1184 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1973 Fixed in 5.15.47: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34494 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34495 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32981 Fixed in 5.15.48: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21125 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21166 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21123 Fixed in 5.15.53: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2318 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33743 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33742 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33741 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33740 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26365 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33744 Fixed in 5.15.54: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33655 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34918 Fixed in 5.15.56: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36123 Fixed in 5.15.57: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29900 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29901 Fixed in 5.15.58: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21505 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1462 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36879 Fixed in 5.15.59: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36946 Fixed in 5.15.60: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26373 Fixed in 5.15.61: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2586 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2585 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1679 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2588 (* Security fix *) patches/packages/vim-9.0.0270-x86_64-1_slack15.0.txz: Upgraded. We're just going to move to vim-9 instead of continuing to backport patches to the vim-8 branch. Most users will be better served by this. Fixed use after free and null pointer dereference. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2946 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2923 (* Security fix *) patches/packages/vim-gvim-9.0.0270-x86_64-1_slack15.0.txz: Upgraded. 20220826040220_15.0 Patrick J Volkerding2022-08-271-4/+0
* Sat Aug 20 20:04:15 UTC 2022...patches/packages/vim-8.2.4649-x86_64-3_slack15.0.txz: Rebuilt. Fix use after free. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2889 (* Security fix *) patches/packages/vim-gvim-8.2.4649-x86_64-3_slack15.0.txz: Rebuilt. 20220820200415_15.0 Patrick J Volkerding2022-08-211-0/+1
* Wed Aug 17 20:41:53 UTC 2022...patches/packages/vim-8.2.4649-x86_64-2_slack15.0.txz: Rebuilt. Fix use after free, out-of-bounds read, and heap based buffer overflow. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2816 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2817 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2819 (* Security fix *) patches/packages/vim-gvim-8.2.4649-x86_64-2_slack15.0.txz: Rebuilt. 20220817204153_15.0 Patrick J Volkerding2022-08-181-0/+3
* Mon Jul 25 20:53:49 UTC 2022...patches/packages/mozilla-firefox-91.12.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.12.0/releasenotes/ (* Security fix *) patches/packages/perl-5.34.0-x86_64-2_slack15.0.txz: Rebuilt. This is a bugfix release. Upgraded: Devel-CheckLib-1.16, IO-Socket-SSL-2.074, Net-SSLeay-1.92, Path-Tiny-0.122, Template-Toolkit-3.100, URI-5.12, libnet-3.14. Added a symlink to libperl.so in /usr/${LIBDIRSUFFIX} since net-snmp (and possibly other programs) might have trouble linking with it since it's not in the LD_LIBRARY_PATH. Thanks to oneforall. 20220725205349_15.0 Patrick J Volkerding2022-07-261-0/+2
* Thu Jul 21 18:13:18 UTC 2022...patches/packages/net-snmp-5.9.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously. A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference. A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24805 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24806 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24807 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24810 (* Security fix *) 20220721181318_15.0 Patrick J Volkerding2022-07-221-0/+7
* Wed Jul 13 19:56:59 UTC 2022...patches/packages/xorg-server-1.20.14-x86_64-3_slack15.0.txz: Rebuilt. xkb: switch to array index loops to moving pointers. xkb: add request length validation for XkbSetGeometry. xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2319 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2320 (* Security fix *) patches/packages/xorg-server-xephyr-1.20.14-x86_64-3_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-3_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-3_slack15.0.txz: Rebuilt. 20220713195659_15.0 Patrick J Volkerding2022-07-141-0/+11
* Thu May 26 18:27:32 UTC 2022...patches/packages/cups-2.4.2-x86_64-1_slack15.0.txz: Upgraded. Fixed certificate strings comparison for Local authorization. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26691 (* Security fix *) 20220526182732_15.0 Patrick J Volkerding2022-05-271-0/+1
* Mon May 9 21:33:25 UTC 2022...patches/packages/linux-5.15.38/*: Upgraded. These updates fix various bugs and security issues. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see: Fixed in 5.15.27: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0742 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24958 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0494 Fixed in 5.15.28: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23038 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23039 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23960 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23036 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23037 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0001 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0002 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23041 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23040 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23042 Fixed in 5.15.29: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1199 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27666 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0995 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0854 Fixed in 5.15.32: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1015 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26490 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1048 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1016 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28356 Fixed in 5.15.33: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28390 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0168 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1353 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1198 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28389 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28388 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1516 Fixed in 5.15.34: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1263 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29582 Fixed in 5.15.35: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1204 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1205 Fixed in 5.15.37: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0500 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23222 (* Security fix *) 20220509213325_15.0 Patrick J Volkerding2022-05-101-0/+1
* Mon May 2 20:02:49 UTC 2022...patches/packages/libxml2-2.9.14-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Fix integer overflow in xmlBuf and xmlBuffer. Fix potential double-free in xmlXPtrStringRangeFunction. Fix memory leak in xmlFindCharEncodingHandler. Normalize XPath strings in-place. Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars(). Fix leak of xmlElementContent. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824 (* Security fix *) patches/packages/mozilla-firefox-91.9.0esr-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/firefox/91.9.0/releasenotes/ patches/packages/samba-4.15.7-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.samba.org/samba/history/samba-4.15.7.html 20220502200249_15.0 Patrick J Volkerding2022-05-031-0/+3
* Sat Apr 30 21:18:47 UTC 2022...patches/packages/pidgin-2.14.9-x86_64-1_slack15.0.txz: Upgraded. Mitigate the potential for a man in the middle attack via DNS spoofing by removing the code that supported the _xmppconnect DNS TXT record. For more information, see: https://www.pidgin.im/about/security/advisories/cve-2022-26491/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26491 (* Security fix *) 20220430211847_15.0 Patrick J Volkerding2022-05-011-0/+2
* Wed Mar 30 22:37:05 UTC 2022...patches/packages/vim-8.2.4649-x86_64-1_slack15.0.txz: Upgraded. Fixes a use-after-free in utf_ptr2char in vim/vim prior to 8.2.4646. This vulnerability is capable of crashing software, bypassing protection mechanisms, modifying memory, and possibly execution of arbitrary code. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1154 https://huntr.dev/bounties/7f0ec6bc-ea0e-45b0-8128-caac72d23425 https://github.com/vim/vim/commit/b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 (* Security fix *) patches/packages/vim-gvim-8.2.4649-x86_64-1_slack15.0.txz: Upgraded. 20220330223705_15.0 Patrick J Volkerding2022-03-311-0/+2
* Sat Mar 19 20:28:16 UTC 2022...patches/packages/glibc-zoneinfo-2022a-noarch-1_slack15.0.txz: Upgraded. This package provides the latest timezone updates. 20220319202816_15.0 Patrick J Volkerding2022-03-201-0/+2
* Fri Mar 18 20:16:12 UTC 2022...patches/packages/python3-3.9.11-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: libexpat upgraded from 2.4.1 to 2.4.7 bundled pip upgraded from 21.2.4 to 22.0.4 authorization bypass fixed in urllib.request REDoS avoided in importlib.metadata For more information, see: https://pythoninsider.blogspot.com/2022/03/python-3103-3911-3813-and-3713-are-now.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28363 (* Security fix *) 20220318201612_15.0 Patrick J Volkerding2022-03-191-0/+5
* Thu Mar 17 19:46:28 UTC 2022...patches/packages/bind-9.18.1-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: An assertion could occur in resume_dslookup() if the fetch had been shut down earlier. Lookups involving a DNAME could trigger an INSIST when "synth-from-dnssec" was enabled. A synchronous call to closehandle_cb() caused isc__nm_process_sock_buffer() to be called recursively, which in turn left TCP connections hanging in the CLOSE_WAIT state blocking indefinitely when out-of-order processing was disabled. The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0667 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0635 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0396 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25220 (* Security fix *) patches/packages/bluez-5.64-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release: Fix issue with handling A2DP discover procedure. Fix issue with media endpoint replies and SetConfiguration. Fix issue with HoG queuing events before report map is read. Fix issue with HoG and read order of GATT attributes. Fix issue with HoG and not using UHID_CREATE2 interface. Fix issue with failed scanning for 5 minutes after reboot. patches/packages/openssl-1.1.1n-x86_64-1_slack15.0.txz: Upgraded. This update fixes a high severity security issue: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. For more information, see: https://www.openssl.org/news/secadv/20220315.txt https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778 (* Security fix *) patches/packages/openssl-solibs-1.1.1n-x86_64-1_slack15.0.txz: Upgraded. patches/packages/qt5-5.15.3_20220312_33a3f16f-x86_64-1_slack15.0.txz: Upgraded. Thanks to Heinz Wiesinger for updating the fetch_sources.sh script to make sure that the QtWebEngine version matches the rest of Qt, which got the latest git pull compiling again. If a 32-bit userspace is detected, then: export QTWEBENGINE_CHROMIUM_FLAGS="--disable-seccomp-filter-sandbox" This works around crashes occuring with 32-bit QtWebEngine applications. Thanks to alienBOB. 20220317194628_15.0 Patrick J Volkerding2022-03-181-0/+12
* Tue Mar 15 00:13:59 UTC 2022...patches/packages/httpd-2.4.53-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: mod_sed: Read/write beyond bounds core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody HTTP request smuggling vulnerability mod_lua: Use of uninitialized value in r:parsebody For more information, see: https://downloads.apache.org/httpd/CHANGES_2.4.53 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22721 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22719 (* Security fix *) patches/packages/mozilla-firefox-91.7.1esr-x86_64-1_slack15.0.txz: Upgraded. This release makes the following change: Yandex and Mail.ru have been removed as optional search providers in the drop-down search menu in Firefox. For more information, see: https://www.mozilla.org/en-US/firefox/91.7.1/releasenotes/ (* Security fix *) 20220315001359_15.0 Patrick J Volkerding2022-03-151-0/+2
* Sat Mar 12 20:57:35 UTC 2022...patches/packages/polkit-0.120-x86_64-3_slack15.0.txz: Rebuilt. Patched to fix a security issue where an unprivileged user could cause a denial of service due to process file descriptor exhaustion. Thanks to marav. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4115 (* Security fix *) 20220312205735_15.0 Patrick J Volkerding2022-03-131-0/+5
* Thu Mar 10 02:30:54 UTC 2022...patches/packages/ca-certificates-20220309-noarch-1_slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the authenticity of SSL connections. 20220310023054_15.0 Patrick J Volkerding2022-03-101-0/+3
* Tue Mar 8 04:39:53 UTC 2022...patches/packages/boost-1.78.0-x86_64-2_slack15.0.txz: Rebuilt. This update has been patched to fix a regression: Boost.Build silently skips installation of library headers and binaries in some cases. Thanks to Willy Sudiarto Raharjo. 20220308043953_15.0 Patrick J Volkerding2022-03-091-0/+1
* Wed Mar 2 21:39:57 UTC 2022...patches/packages/seamonkey-2.53.11-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.seamonkey-project.org/releases/seamonkey2.53.11 (* Security fix *) 20220302213957_15.0 Patrick J Volkerding2022-03-031-0/+3
* Tue Mar 1 05:05:48 UTC 2022...patches/packages/libxml2-2.9.13-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Use-after-free of ID and IDREF attributes (Thanks to Shinji Sato for the report) Use-after-free in xmlXIncludeCopyRange (David Kilzer) Fix Null-deref-in-xmlSchemaGetComponentTargetNs (huangduirong) Fix memory leak in xmlXPathCompNodeTest Fix null pointer deref in xmlStringGetNodeList Fix several memory leaks found by Coverity (David King) For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308 (* Security fix *) patches/packages/libxslt-1.1.35-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Fix use-after-free in xsltApplyTemplates Fix memory leak in xsltDocumentElem (David King) Fix memory leak in xsltCompileIdKeyPattern (David King) Fix double-free with stylesheets containing entity nodes For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30560 (* Security fix *) 20220301050548_15.0 Patrick J Volkerding2022-03-021-0/+3
* Fri Feb 25 00:03:28 UTC 2022...patches/packages/cyrus-sasl-2.1.28-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407 (* Security fix *) 20220225000328_15.0 Patrick J Volkerding2022-02-251-0/+2
* Mon Feb 21 20:21:38 UTC 2022...patches/packages/expat-2.4.6-x86_64-1_slack15.0.txz: Upgraded. Fixed a regression introduced by the fix for CVE-2022-25313 that affects applications that (1) call function XML_SetElementDeclHandler and (2) are parsing XML that contains nested element declarations: (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"). patches/packages/flac-1.3.4-x86_64-1_slack15.0.txz: Upgraded. This update fixes overflow issues with encoding and decoding. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0499 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0561 (* Security fix *) patches/packages/mariadb-10.5.15-x86_64-2_slack15.0.txz: Rebuilt. Removed dangling symlink. 20220221202138_15.0 Patrick J Volkerding2022-02-221-0/+1
* Fri Feb 18 05:29:00 UTC 2022...patches/packages/mozilla-thunderbird-91.6.1-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.6.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-07/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0566 (* Security fix *) patches/packages/php-7.4.28-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *) extra/php80/php80-8.0.16-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *) extra/php81/php81-8.1.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *) 20220218052900_15.0 Patrick J Volkerding2022-02-191-0/+5
* Tue Feb 15 20:00:48 UTC 2022...patches/packages/aaa_base-15.0-x86_64-4_slack15.0.txz: Rebuilt. If root's mailbox did not already exist, it would be created with insecure permissions leading to possible local information disclosure. This update ensures that a new mailbox will be created with proper permissions and ownership, and corrects the permissions on an existing mailbox if they are found to be incorrect. Thanks to Martin for the bug report. (* Security fix *) patches/packages/util-linux-2.37.4-x86_64-1_slack15.0.txz: Upgraded. This release fixes a security issue in chsh(1) and chfn(8): By default, these utilities had been linked with libreadline, which allows the INPUTRC environment variable to be abused to produce an error message containing data from an arbitrary file. So, don't link these utilities with libreadline as it does not use secure_getenv() (or a similar concept), or sanitize the config file path to avoid vulnerabilities that could occur in set-user-ID or set-group-ID programs. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563 (* Security fix *) 20220215200048_15.0 Patrick J Volkerding2022-02-161-0/+8
* Mon Feb 14 00:10:38 UTC 2022...patches/packages/mariadb-10.5.15-x86_64-1_slack15.0.txz: Upgraded. This update fixes potential denial-of-service vulnerabilities. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46665 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46664 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46661 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46668 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46663 (* Security fix *) 20220214001038_15.0 Patrick J Volkerding2022-02-141-0/+2
* Thu Feb 10 01:46:55 UTC 2022...patches/packages/at-3.2.3-x86_64-1_slack15.0.txz: Upgraded. Switched to at-3.2.3 since version 3.2.4 has a regression that causes queued jobs to not always run on time when atd is run as a standalone daemon. Thanks to Cesare. patches/packages/mozilla-firefox-91.6.0esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.6.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2022-05/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22753 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22754 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22756 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22759 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22760 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22761 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22763 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22764 (* Security fix *) patches/packages/mozilla-thunderbird-91.6.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.6.0/releasenotes/ https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird91.6 (* Security fix *) 20220210014655_15.0 Patrick J Volkerding2022-02-101-0/+12
* Wed Feb 2 04:17:39 UTC 2022...fortune -m "I will be finished tomorrow" fortunes2 a/kernel-generic-5.15.19-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.19-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.19-x86_64-1.txz: Upgraded. ap/screen-4.9.0-x86_64-1.txz: Upgraded. Patched possible denial of service via a crafted UTF-8 character sequence. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26937 (* Security fix *) d/kernel-headers-5.15.19-x86-1.txz: Upgraded. k/kernel-source-5.15.19-noarch-1.txz: Upgraded. RTC_INTF_DEV_UIE_EMUL y -> n RTC_SYSTOHC n -> y +RTC_SYSTOHC_DEVICE "rtc0" l/lcms2-2.13-x86_64-2.txz: Rebuilt. [PATCH] Fix for optimization error on grayscale. Thanks to Aaron Boxer for reporting this issue. Thanks to gmgf. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. testing/source/linux-5.16.5-configs/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt. 20220202041739 Patrick J Volkerding2022-02-021-0/+1
* Tue Feb 1 04:37:04 UTC 2022...The sepulchral voice intones, "The cave is now closed." kde/falkon-3.2.0-x86_64-1.txz: Upgraded. kde/ktexteditor-5.90.0-x86_64-2.txz: Rebuilt. [PATCH] only start programs in user's path. [PATCH] only execute diff in path. Thanks to gmgf. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23853 (* Security fix *) l/libcanberra-0.30-x86_64-9.txz: Rebuilt. Fix a bug crashing some applications in Wayland desktops. Thanks to 01micko. n/samba-4.15.5-x86_64-1.txz: Upgraded. This is a security release in order to address the following defects: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists. Out-of-Bound Read/Write on Samba vfs_fruit module. This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit. Re-adding an SPN skips subsequent SPN conflict checks. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity. For more information, see: https://www.samba.org/samba/security/CVE-2021-44141.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44141 https://www.samba.org/samba/security/CVE-2021-44142.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44142 https://www.samba.org/samba/security/CVE-2022-0336.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0336 (* Security fix *) x/xterm-370-x86_64-7.txz: Rebuilt. Rebuilt with --disable-sixel-graphics to fix a buffer overflow. Thanks to gmgf. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24130 (* Security fix *) testing/source/linux-5.16.4-configs/*: Added. Sample config files to build 5.16.4 Linux kernels. 20220201043704 Patrick J Volkerding2022-02-011-0/+1
* Sun Jan 30 20:48:46 UTC 2022...a/aaa_libraries-15.0-x86_64-19.txz: Rebuilt. Upgraded: libexpat.so.1.8.4, libjson-c.so.5.1.0 (thanks to peake). ap/at-3.2.4-x86_64-1.txz: Upgraded. d/git-2.35.1-x86_64-1.txz: Upgraded. l/expat-2.4.4-x86_64-1.txz: Upgraded. This update merges the patches we previously applied to expat-2.4.3. l/imagemagick-7.1.0_22-x86_64-1.txz: Upgraded. l/lcms2-2.13-x86_64-1.txz: Upgraded. 20220130204846 Patrick J Volkerding2022-01-311-3/+0
* Sat Jan 29 06:17:05 UTC 2022...a/rpm2tgz-1.2.2-x86_64-5.txz: Rebuilt. rpm2targz: when extracting the cpio archive from inside the RPM, use --no-absolute-filenames to protect against a poorly made RPM scribbling all over system files/directories. Thanks to Sl4ck3ver. Support -i option to ignore non-zero exit value from rpm2cpio. This allows repackaging some malformed RPMs. Thanks to ricky_cardo for the sample malformed RPM. 20220129061705 Patrick J Volkerding2022-01-291-0/+2
* Thu Jan 27 22:43:13 UTC 2022...a/aaa_libraries-15.0-x86_64-18.txz: Rebuilt. Rebuilt to pick up the patched libexpat.so.1.8.3. a/kernel-generic-5.15.17-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.17-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.17-x86_64-1.txz: Upgraded. a/lzlib-1.13-x86_64-1.txz: Upgraded. a/sysvinit-scripts-15.0-noarch-8.txz: Rebuilt. rc.S: clear /var/lock/subsys before starting libcgroup services. Thanks to pyllyukko. ap/pamixer-1.5-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. d/kernel-headers-5.15.17-x86-1.txz: Upgraded. k/kernel-source-5.15.17-noarch-1.txz: Upgraded. kde/kig-21.12.1-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. kde/kopeninghours-21.12.1-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. kde/krita-5.0.2-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. l/boost-1.78.0-x86_64-1.txz: Upgraded. I hadn't planned to update this at such a late stage, but POV-Ray needs it and everything we ship builds fine against it. Thanks to bender647. Shared library .so-version bump. l/cryfs-0.10.3-x86_64-4.txz: Rebuilt. Recompiled against boost-1.78.0. l/expat-2.4.3-x86_64-3.txz: Rebuilt. Prevent integer overflow in doProlog. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990 (* Security fix *) l/netpbm-10.97.03-x86_64-1.txz: Upgraded. l/openexr-2.5.7-x86_64-5.txz: Rebuilt. Recompiled against boost-1.78.0. l/pipewire-0.3.44-x86_64-1.txz: Upgraded. n/fetchmail-6.4.27-x86_64-1.txz: Upgraded. n/libgpg-error-1.44-x86_64-1.txz: Upgraded. x/mesa-21.3.5-x86_64-1.txz: Upgraded. xap/mozilla-firefox-91.5.1esr-x86_64-1.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/firefox/91.5.1/releasenotes/ (* Security fix *) extra/rust-for-mozilla/rust-1.54.0-x86_64-4.txz: Rebuilt. Removed duplicated libLLVM shared library. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt. 20220127224313 Patrick J Volkerding2022-01-281-0/+1
generated by cgit v1.2.3-79-gdb01 (git 2.46.1) at 2024-09-21 13:44:37 +0000