diff options
author | Patrick J Volkerding <volkerdi@slackware.com> | 2018-05-25 23:29:36 +0000 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2018-05-31 15:18:32 -0700 |
commit | 8ff4f2f51a6cf07fc33742ce3bee81328896e49b (patch) | |
tree | 4a166b8389404be98a6c098babaa444e2dec8f48 /ChangeLog.txt | |
parent | 76fc4757ac91ac7947a01fb7b53dddf9a78a01d1 (diff) | |
download | current-8ff4f2f51a6cf07fc33742ce3bee81328896e49b.tar.gz current-8ff4f2f51a6cf07fc33742ce3bee81328896e49b.tar.xz |
Fri May 25 23:29:36 UTC 201814.1
patches/packages/glibc-zoneinfo-2018e-noarch-2_slack14.1.txz: Rebuilt.
Handle removal of US/Pacific-New timezone. If we see that the machine is
using this, it will be automatically switched to US/Pacific.
Diffstat (limited to 'ChangeLog.txt')
-rw-r--r-- | ChangeLog.txt | 4531 |
1 files changed, 4531 insertions, 0 deletions
diff --git a/ChangeLog.txt b/ChangeLog.txt index ea455f516..5aaee124c 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,4534 @@ +Fri May 25 23:29:36 UTC 2018 +patches/packages/glibc-zoneinfo-2018e-noarch-2_slack14.1.txz: Rebuilt. + Handle removal of US/Pacific-New timezone. If we see that the machine is + using this, it will be automatically switched to US/Pacific. ++--------------------------+ +Thu May 17 04:13:16 UTC 2018 +patches/packages/curl-7.60.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes: + FTP: shutdown response buffer overflow + RTSP: bad headers buffer over-read + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000300 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000301 + (* Security fix *) +patches/packages/php-5.6.36-x86_64-1_slack14.1.txz: Upgraded. + This fixes many bugs, including some security issues: + Heap Buffer Overflow (READ: 1786) in exif_iif_add_value + stream filter convert.iconv leads to infinite loop on invalid sequence + Malicious LDAP-Server Response causes crash + fix for CVE-2018-5712 may not be complete + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10549 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10546 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10548 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10547 + (* Security fix *) ++--------------------------+ +Thu May 10 21:01:11 UTC 2018 +patches/packages/mariadb-5.5.60-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2755 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2819 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2817 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2761 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2781 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2771 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2813 + (* Security fix *) ++--------------------------+ +Thu May 10 01:24:19 UTC 2018 +patches/packages/glibc-zoneinfo-2018e-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/wget-1.19.5-x86_64-1_slack14.1.txz: Upgraded. + Fixed a security issue where a malicious web server could inject arbitrary + cookies into the cookie jar file. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0494 + (* Security fix *) ++--------------------------+ +Fri May 4 19:40:52 UTC 2018 +patches/packages/python-2.7.15-x86_64-1_slack14.1.txz: Upgraded. + Updated to the latest 2.7.x release. + This fixes some security issues in difflib and poplib (regexes vulnerable + to denial of service attacks), as well as security issues with the bundled + expat library. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0876 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061 + (* Security fix *) ++--------------------------+ +Mon Apr 30 22:35:43 UTC 2018 +patches/packages/libwmf-0.2.8.4-x86_64-6_slack14.1.txz: Rebuilt. + Patched denial of service and possible execution of arbitrary code + security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10167 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10168 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9011 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9317 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6362 + (* Security fix *) ++--------------------------+ +Fri Apr 27 03:58:48 UTC 2018 +patches/packages/openvpn-2.4.6-x86_64-1_slack14.1.txz: Upgraded. + This is a security update fixing a potential double-free() in Interactive + Service. This usually only leads to a process crash (DoS by an unprivileged + local account) but since it could possibly lead to memory corruption if + happening while multiple other threads are active at the same time, + CVE-2018-9336 has been assigned to acknowledge this risk. + For more information, see: + https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9336 + (* Security fix *) ++--------------------------+ +Fri Apr 6 20:47:43 UTC 2018 +patches/packages/patch-2.7.6-x86_64-1_slack14.1.txz: Upgraded. + Fix arbitrary shell execution possible with obsolete ed format patches. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000156 + (* Security fix *) ++--------------------------+ +Sun Apr 1 19:45:12 UTC 2018 +patches/packages/libidn-1.34-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues: + Fix integer overflow in combine_hangul() + Fix integer overflow in punycode decoder + Fix NULL pointer dereference in g_utf8_normalize() + Fix NULL pointer dereference in stringprep_ucs4_nfkc_normalize() + (* Security fix *) ++--------------------------+ +Sun Apr 1 02:53:26 UTC 2018 +patches/packages/php-5.6.35-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where sensitive data belonging to other + accounts might be accessed by a local user. + For more information, see: + http://bugs.php.net/75605 + (* Security fix *) ++--------------------------+ +Fri Mar 23 22:28:20 UTC 2018 +patches/packages/glibc-zoneinfo-2018d-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Sun Mar 18 00:55:39 UTC 2018 +patches/packages/libvorbis-1.3.6-x86_64-1_slack14.1.txz: Upgraded. + This release fixes security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 + (* Security fix *) ++--------------------------+ +Fri Mar 16 02:29:29 UTC 2018 +patches/packages/curl-7.59.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues: + FTP path trickery leads to NIL byte out of bounds write + LDAP NULL pointer dereference + RTSP RTP buffer over-read + For more information, see: + https://curl.haxx.se/docs/adv_2018-9cd6.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000120 + https://curl.haxx.se/docs/adv_2018-97a2.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000121 + https://curl.haxx.se/docs/adv_2018-b047.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000122 + (* Security fix *) ++--------------------------+ +Tue Mar 13 21:12:51 UTC 2018 +patches/packages/samba-4.4.16-x86_64-3_slack14.1.txz: Rebuilt. + This is a security update in order to patch the following defect: + On a Samba 4 AD DC the LDAP server in all versions of Samba from + 4.0.0 onwards incorrectly validates permissions to modify passwords + over LDAP allowing authenticated users to change any other users` + passwords, including administrative users. + For more information, see: + https://www.samba.org/samba/security/CVE-2018-1057.html + https://wiki.samba.org/index.php/CVE-2018-1057 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1057 + (* Security fix *) ++--------------------------+ +Thu Mar 8 07:07:45 UTC 2018 +patches/packages/openssh-7.4p1-x86_64-2_slack14.1.txz: Rebuilt. + sftp-server: in read-only mode, sftp-server was incorrectly permitting + creation of zero-length files. Reported by Michal Zalewski. + Thanks to arny (of Bluewhite64 fame) for the heads-up. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15906 + (* Security fix *) +patches/packages/php-5.6.34-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a stack buffer overflow vulnerability. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7584 + (* Security fix *) ++--------------------------+ +Thu Mar 1 23:24:54 UTC 2018 +patches/packages/dhcp-4.4.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + Corrected an issue where large sized 'X/x' format options were causing + option handling logic to overwrite memory when expanding them to human + readable form. Reported by Felix Wilhelm, Google Security Team. + Option reference count was not correctly decremented in error path + when parsing buffer for options. Reported by Felix Wilhelm, Google + Security Team. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5732 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5733 + (* Security fix *) +patches/packages/ntp-4.2.8p11-x86_64-1_slack14.1.txz: Upgraded. + This release addresses five security issues in ntpd: + * LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: + ephemeral association attack. While fixed in ntp-4.2.8p7, there are + significant additional protections for this issue in 4.2.8p11. + Reported by Matt Van Gundy of Cisco. + * INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer + read overrun leads to undefined behavior and information leak. + Reported by Yihan Lian of Qihoo 360. + * LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated + ephemeral associations. Reported on the questions@ list. + * LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode + cannot recover from bad state. Reported by Miroslav Lichvar of Red Hat. + * LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet + can reset authenticated interleaved association. + Reported by Miroslav Lichvar of Red Hat. + For more information, see: + http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7182 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7170 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7184 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7185 + (* Security fix *) ++--------------------------+ +Sat Feb 24 07:41:40 UTC 2018 +patches/packages/wget-1.19.4-x86_64-2_slack14.1.txz: Rebuilt. + Applied upstream patch to fix logging in background mode. + Thanks to Willy Sudiarto Raharjo. ++--------------------------+ +Fri Feb 16 03:19:36 UTC 2018 +patches/packages/irssi-1.0.7-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://irssi.org/security/html/irssi_sa_2018_02 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7054 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7053 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7050 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7052 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7051 + (* Security fix *) ++--------------------------+ +Sun Feb 4 05:13:27 UTC 2018 +patches/packages/php-5.6.33-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues, including: + Potential infinite loop in gdImageCreateFromGifCtx. + Reflected XSS in .phar 404 page. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5711 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5712 + (* Security fix *) ++--------------------------+ +Thu Feb 1 18:24:15 UTC 2018 +patches/packages/mariadb-5.5.59-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2562 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2622 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2640 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2665 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2668 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2612 + (* Security fix *) +patches/packages/rsync-3.1.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + Fixed a buffer overrun in the protocol's handling of xattr names and + ensure that the received name is null terminated. + Fix an issue with --protect-args where the user could specify the arg in + the protected-arg list and short-circuit some of the arg-sanitizing code. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5764 + (* Security fix *) ++--------------------------+ +Thu Jan 25 02:24:04 UTC 2018 +patches/packages/curl-7.58.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues: + HTTP authentication leak in redirects + HTTP/2 trailer out-of-bounds read + For more information, see: + https://curl.haxx.se/docs/adv_2018-b3bf.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000007 + https://curl.haxx.se/docs/adv_2018-824a.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000005 + (* Security fix *) ++--------------------------+ +Wed Jan 24 04:21:44 UTC 2018 +patches/packages/glibc-zoneinfo-2018c-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Mon Jan 22 22:47:47 UTC 2018 +patches/packages/wget-1.19.4-x86_64-1_slack14.1.txz: Upgraded. + More bug fixes: + A major bug that caused GZip'ed pages to never be decompressed has been fixed + Support for Content-Encoding and Transfer-Encoding have been marked as + experimental and disabled by default ++--------------------------+ +Sat Jan 20 16:00:51 UTC 2018 +patches/packages/wget-1.19.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes various non-security bugs, including this one: + Prevent erroneous decompression of .gz and .tgz files with broken servers. ++--------------------------+ +Wed Jan 17 21:36:23 UTC 2018 +patches/packages/bind-9.9.11_P1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a high severity security issue: + Improper sequencing during cleanup can lead to a use-after-free error, + triggering an assertion failure and crash in named. + For more information, see: + https://kb.isc.org/article/AA-01542 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3145 + (* Security fix *) ++--------------------------+ +Tue Jan 9 00:54:19 UTC 2018 +patches/packages/irssi-1.0.6-x86_64-1_slack14.1.txz: Upgraded. + This update fixes multiple security vulnerabilities. + For more information, see: + https://irssi.org/security/irssi_sa_2018_01.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5205 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5206 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5207 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5208 + (* Security fix *) ++--------------------------+ +Mon Dec 25 00:00:16 UTC 2017 +patches/packages/xscreensaver-5.38-x86_64-1_slack14.1.txz: Upgraded. + Here's an upgrade to the latest xscreensaver. ++--------------------------+ +Wed Nov 29 21:48:33 UTC 2017 +patches/packages/curl-7.57.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues: + SSL out of buffer access + FTP wildcard out of bounds read + NTLM buffer overflow via integer overflow + For more information, see: + https://curl.haxx.se/docs/adv_2017-af0a.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8818 + https://curl.haxx.se/docs/adv_2017-ae72.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817 + https://curl.haxx.se/docs/adv_2017-12e7.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8816 + (* Security fix *) ++--------------------------+ +Wed Nov 29 08:15:09 UTC 2017 +patches/packages/libXcursor-1.1.15-x86_64-1_slack14.1.txz: Upgraded. + Fix heap overflows when parsing malicious files. (CVE-2017-16612) + It is possible to trigger heap overflows due to an integer overflow + while parsing images and a signedness issue while parsing comments. + The integer overflow occurs because the chosen limit 0x10000 for + dimensions is too large for 32 bit systems, because each pixel takes + 4 bytes. Properly chosen values allow an overflow which in turn will + lead to less allocated memory than needed for subsequent reads. + The signedness bug is triggered by reading the length of a comment + as unsigned int, but casting it to int when calling the function + XcursorCommentCreate. Turning length into a negative value allows the + check against XCURSOR_COMMENT_MAX_LEN to pass, and the following + addition of sizeof (XcursorComment) + 1 makes it possible to allocate + less memory than needed for subsequent reads. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16612 + (* Security fix *) +patches/packages/libXfont-1.4.7-x86_64-2_slack14.1.txz: Rebuilt. + Open files with O_NOFOLLOW. (CVE-2017-16611) + A non-privileged X client can instruct X server running under root + to open any file by creating own directory with "fonts.dir", + "fonts.alias" or any font file being a symbolic link to any other + file in the system. X server will then open it. This can be issue + with special files such as /dev/watchdog (which could then reboot + the system). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16611 + (* Security fix *) ++--------------------------+ +Tue Nov 28 06:20:03 UTC 2017 +patches/packages/samba-4.4.16-x86_64-2_slack14.1.txz: Rebuilt. + This is a security update in order to patch the following defects: + CVE-2017-14746 (Use-after-free vulnerability.) + All versions of Samba from 4.0.0 onwards are vulnerable to a use after + free vulnerability, where a malicious SMB1 request can be used to + control the contents of heap memory via a deallocated heap pointer. It + is possible this may be used to compromise the SMB server. + CVE-2017-15275 (Server heap memory information leak.) + All versions of Samba from 3.6.0 onwards are vulnerable to a heap + memory information leak, where server allocated heap memory may be + returned to the client without being cleared. + For more information, see: + https://www.samba.org/samba/security/CVE-2017-14746.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14746 + https://www.samba.org/samba/security/CVE-2017-15275.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15275 + (* Security fix *) ++--------------------------+ +Fri Nov 3 03:31:56 UTC 2017 +patches/packages/mariadb-5.5.58-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://jira.mariadb.org/browse/MDEV-13819 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10268 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10378 + (* Security fix *) ++--------------------------+ +Fri Oct 27 20:34:35 UTC 2017 +patches/packages/php-5.6.32-x86_64-1_slack14.1.txz: Upgraded. + Several security bugs were fixed in this release: + Out of bounds read in timelib_meridian(). + The arcfour encryption stream filter crashes PHP. + Applied upstream patch for PCRE (CVE-2016-1283). + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 + (* Security fix *) +patches/packages/wget-1.19.2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes stack and heap overflows in in HTTP protocol handling. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13089 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13090 + (* Security fix *) ++--------------------------+ +Wed Oct 25 19:09:26 UTC 2017 +patches/packages/glibc-zoneinfo-2017c-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/httpd-2.4.29-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. +patches/packages/irssi-1.0.5-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some remote denial of service issues. + For more information, see: + https://irssi.org/security/irssi_sa_2017_10.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15228 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15227 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15721 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15723 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15722 + (* Security fix *) +patches/packages/xfce4-weather-plugin-0.8.10-x86_64-1_slack14.1.txz: Upgraded. + This has a bugfix related to setting the location: + https://bugzilla.xfce.org/show_bug.cgi?id=13877 ++--------------------------+ +Tue Oct 24 05:31:18 UTC 2017 +patches/packages/curl-7.56.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue: + IMAP FETCH response out of bounds read may cause a crash or information leak. + For more information, see: + https://curl.haxx.se/docs/adv_20171023.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257 + (* Security fix *) ++--------------------------+ +Wed Oct 18 18:21:18 UTC 2017 +patches/packages/libXres-1.2.0-x86_64-1_slack14.1.txz: Upgraded. + Integer overflows may allow X servers to trigger allocation of insufficient + memory and a buffer overflow via vectors related to the (1) + XResQueryClients and (2) XResQueryClientResources functions. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1988 + (* Security fix *) +patches/packages/wpa_supplicant-2.6-x86_64-1_slack14.1.txz: Upgraded. + This update includes patches to mitigate the WPA2 protocol issues known + as "KRACK" (Key Reinstallation AttaCK), which may be used to decrypt data, + hijack TCP connections, and to forge and inject packets. This is the + list of vulnerabilities that are addressed here: + CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the + 4-way handshake. + CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake. + CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way + handshake. + CVE-2017-13080: Reinstallation of the group key (GTK) in the group key + handshake. + CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group + key handshake. + CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) + Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) + while processing it. + CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake. + CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) + PeerKey (TPK) key in the TDLS handshake. + CVE-2017-13087: reinstallation of the group key (GTK) when processing a + Wireless Network Management (WNM) Sleep Mode Response frame. + CVE-2017-13088: reinstallation of the integrity group key (IGTK) when + processing a Wireless Network Management (WNM) Sleep Mode Response frame. + For more information, see: + https://www.krackattacks.com/ + https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13077 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13078 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13079 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13081 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13082 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13084 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13086 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13087 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13088 + (* Security fix *) +patches/packages/xorg-server-1.14.3-x86_64-6_slack14.1.txz: Rebuilt. + This update fixes integer overflows and other possible security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12176 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12179 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12183 + (* Security fix *) +patches/packages/xorg-server-xephyr-1.14.3-x86_64-6_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xnest-1.14.3-x86_64-6_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xvfb-1.14.3-x86_64-6_slack14.1.txz: Rebuilt. ++--------------------------+ +Fri Oct 6 06:32:32 UTC 2017 +patches/packages/curl-7.56.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue: + libcurl may read outside of a heap allocated buffer when doing FTP. + For more information, see: + https://curl.haxx.se/docs/adv_20171004.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254 + (* Security fix *) +patches/packages/xorg-server-1.14.3-x86_64-5_slack14.1.txz: Rebuilt. + This update fixes a security issue: + Generating strings for XKB data used a single shared static buffer, + which offered several opportunities for errors. Use a ring of + resizable buffers instead, to avoid problems when strings end up + longer than anticipated. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13723 + (* Security fix *) +patches/packages/xorg-server-xephyr-1.14.3-x86_64-5_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xnest-1.14.3-x86_64-5_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xvfb-1.14.3-x86_64-5_slack14.1.txz: Rebuilt. ++--------------------------+ +Mon Oct 2 17:16:06 UTC 2017 +patches/packages/dnsmasq-2.78-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and remotely exploitable security issues that may + have impacts including denial of service, information leak, and execution + of arbitrary code. Thanks to Felix Wilhelm, Fermin J. Serna, Gabriel Campana, + Kevin Hamacher, Ron Bowes, and Gynvael Coldwind of the Google Security Team. + For more information, see: + https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13704 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14491 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14492 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14493 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14494 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14495 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14496 + (* Security fix *) ++--------------------------+ +Thu Sep 28 05:31:20 UTC 2017 +patches/packages/gegl-0.2.0-x86_64-3_slack14.1.txz: Rebuilt. + Patched integer overflows in operations/external/ppm-load.c that could allow + a denial of service (application crash) or possibly the execution of + arbitrary code via a large width or height value in a ppm image. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4433 + (* Security fix *) ++--------------------------+ +Sat Sep 23 01:02:32 UTC 2017 +patches/packages/libxml2-2.9.5-x86_64-1_slack14.1.txz: Upgraded. + This release fixes some security issues: + Detect infinite recursion in parameter entities (Nick Wellnhofer), + Fix handling of parameter-entity references (Nick Wellnhofer), + Disallow namespace nodes in XPointer ranges (Nick Wellnhofer), + Fix XPointer paths beginning with range-to (Nick Wellnhofer). + (* Security fix *) +patches/packages/python-2.7.14-x86_64-1_slack14.1.txz: Upgraded. + Updated to the latest 2.7.x release. + This fixes some security issues related to the bundled expat library. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233 + (* Security fix *) ++--------------------------+ +Thu Sep 21 01:23:24 UTC 2017 +patches/packages/samba-4.4.16-x86_64-1_slack14.1.txz: Upgraded. + This is a security release in order to address the following defects: + SMB1/2/3 connections may not require signing where they should. A man in the + middle attack may hijack client connections. + SMB3 connections don't keep encryption across DFS redirects. A man in the + middle attack can read and may alter confidential documents transferred via + a client connection, which are reached via DFS redirect when the original + connection used SMB3. + Server memory information leak over SMB1. Client with write access to a share + can cause server memory contents to be written into a file or printer. + For more information, see: + https://www.samba.org/samba/security/CVE-2017-12150.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12150 + https://www.samba.org/samba/security/CVE-2017-12151.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12151 + https://www.samba.org/samba/security/CVE-2017-12163.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12163 + (* Security fix *) ++--------------------------+ +Mon Sep 18 19:15:03 UTC 2017 +patches/packages/httpd-2.4.27-x86_64-2_slack14.1.txz: Rebuilt. + This update patches a security issue ("Optionsbleed") with the OPTIONS http + method which may leak arbitrary pieces of memory to a potential attacker. + Thanks to Hanno Bo:ck. + For more information, see: + http://seclists.org/oss-sec/2017/q3/477 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798 + (* Security fix *) ++--------------------------+ +Fri Sep 15 17:31:57 UTC 2017 +patches/packages/bluez-4.99-x86_64-4_slack14.1.txz: Rebuilt. + Fixed an information disclosure vulnerability which allows remote attackers + to obtain sensitive information from the bluetoothd process memory. This + vulnerability lies in the processing of SDP search attribute requests. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000250 + (* Security fix *) +patches/packages/linux-3.10.107/*: Upgraded. + This update fixes the security vulnerability known as "BlueBorne". + The native Bluetooth stack in the Linux Kernel (BlueZ), starting at + Linux kernel version 3.3-rc1 is vulnerable to a stack overflow in + the processing of L2CAP configuration responses resulting in remote + code execution in kernel space. + Be sure to upgrade your initrd after upgrading the kernel packages. + If you use lilo to boot your machine, be sure lilo.conf points to the correct + kernel and initrd and run lilo as root to update the bootloader. + If you use elilo to boot your machine, you should run eliloconfig to copy the + kernel and initrd to the EFI System Partition. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000251 + https://www.armis.com/blueborne + (* Security fix *) ++--------------------------+ +Tue Sep 12 22:18:51 UTC 2017 +patches/packages/emacs-25.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security vulnerability in Emacs. Gnus no longer + supports "richtext" and "enriched" inline MIME objects. This support + was disabled to avoid evaluation of arbitrary Lisp code contained in + email messages and news articles. + For more information, see: + http://seclists.org/oss-sec/2017/q3/422 + https://bugs.gnu.org/28350 + (* Security fix *) ++--------------------------+ +Fri Sep 8 17:56:01 UTC 2017 +patches/packages/bash-4.2.053-x86_64-2_slack14.1.txz: Rebuilt. + This update fixes two security issues found in bash before 4.4: + The expansion of '\h' in the prompt string allows remote authenticated users + to execute arbitrary code via shell metacharacters placed in 'hostname' of a + machine. The theoretical attack vector is a hostile DHCP server providing a + crafted hostname, but this is unlikely to occur in a normal Slackware + configuration as we ignore the hostname provided by DHCP. + Specially crafted SHELLOPTS+PS4 environment variables used against bogus + setuid binaries using system()/popen() allowed local attackers to execute + arbitrary code as root. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0634 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7543 + (* Security fix *) +patches/packages/mariadb-5.5.57-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3636 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3641 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3653 + (* Security fix *) +patches/packages/mozilla-nss-3.31.1-x86_64-1_slack14.1.txz: Upgraded. + Upgraded to nss-3.31.1 and nspr-4.16. + This is a bugfix release. +patches/packages/tcpdump-4.9.2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and many security issues (see the included + CHANGES file). + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12893 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12894 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12895 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12896 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12897 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12898 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12899 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12900 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12901 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12902 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12985 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12986 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12987 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12988 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12989 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12990 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12991 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12992 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12993 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12994 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12995 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12996 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12997 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12998 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12999 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13000 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13001 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13002 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13003 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13004 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13005 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13006 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13007 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13008 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13009 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13010 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13011 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13012 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13013 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13014 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13015 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13016 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13017 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13018 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13019 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13020 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13021 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13022 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13023 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13024 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13025 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13026 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13027 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13028 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13029 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13030 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13031 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13032 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13033 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13034 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13035 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13036 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13037 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13038 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13039 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13040 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13041 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13042 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13043 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13044 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13045 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13046 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13047 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13048 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13049 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13050 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13051 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13052 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13053 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13054 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13055 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13687 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13688 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13689 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13690 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13725 + (* Security fix *) ++--------------------------+ +Tue Aug 15 22:16:12 UTC 2017 +patches/packages/xorg-server-1.14.3-x86_64-4_slack14.1.txz: Rebuilt. + This update fixes two security issues: + A user authenticated to an X Session could crash or execute code in the + context of the X Server by exploiting a stack overflow in the endianness + conversion of X Events. + Uninitialized data in endianness conversion in the XEvent handling of the + X.Org X Server allowed authenticated malicious users to access potentially + privileged data from the X server. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10971 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10972 + (* Security fix *) +patches/packages/xorg-server-xephyr-1.14.3-x86_64-4_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xnest-1.14.3-x86_64-4_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xvfb-1.14.3-x86_64-4_slack14.1.txz: Rebuilt. ++--------------------------+ +Fri Aug 11 23:02:43 UTC 2017 +patches/packages/git-2.14.1-x86_64-1_slack14.1.txz: Upgraded. + Fixes security issues: + A "ssh://..." URL can result in a "ssh" command line with a hostname that + begins with a dash "-", which would cause the "ssh" command to instead + (mis)treat it as an option. This is now prevented by forbidding such a + hostname (which should not impact any real-world usage). + Similarly, when GIT_PROXY_COMMAND is configured, the command is run with + host and port that are parsed out from "ssh://..." URL; a poorly written + GIT_PROXY_COMMAND could be tricked into treating a string that begins with a + dash "-" as an option. This is now prevented by forbidding such a hostname + and port number (again, which should not impact any real-world usage). + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000117 + (* Security fix *) +patches/packages/libsoup-2.42.2-x86_64-2_slack14.1.txz: Rebuilt. + Fixed a chunked decoding buffer overrun that could be exploited against + either clients or servers. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2885 + (* Security fix *) +patches/packages/mercurial-4.3.1-x86_64-1_slack14.1.txz: Upgraded. + Fixes security issues: + Mercurial's symlink auditing was incomplete prior to 4.3, and could + be abused to write to files outside the repository. + Mercurial was not sanitizing hostnames passed to ssh, allowing + shell injection attacks on clients by specifying a hostname starting + with -oProxyCommand. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000115 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000116 + (* Security fix *) +patches/packages/subversion-1.7.22-x86_64-3_slack14.1.txz: Rebuilt. + Fixed client side arbitrary code execution vulnerability. + For more information, see: + https://subversion.apache.org/security/CVE-2017-9800-advisory.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9800 + (* Security fix *) ++--------------------------+ +Wed Aug 9 20:23:16 UTC 2017 +patches/packages/curl-7.55.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes three security issues: + URL globbing out of bounds read + TFTP sends more than buffer size + FILE buffer read out of bounds + For more information, see: + https://curl.haxx.se/docs/adv_20170809A.html + https://curl.haxx.se/docs/adv_20170809B.html + https://curl.haxx.se/docs/adv_20170809C.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000099 + (* Security fix *) ++--------------------------+ +Wed Aug 2 03:43:51 UTC 2017 +patches/packages/gnupg-1.4.22-x86_64-1_slack14.1.txz: Upgraded. + Mitigate a flush+reload side-channel attack on RSA secret keys dubbed + "Sliding right into disaster". + For more information, see: + https://eprint.iacr.org/2017/627 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526 + (* Security fix *) ++--------------------------+ +Tue Jul 25 21:09:42 UTC 2017 +patches/packages/bind-9.9.10_P3-x86_64-1_slack14.1.txz: Upgraded. + Fix a regression in the previous BIND release that broke verification + of TSIG signed TCP message sequences where not all the messages contain + TSIG records. ++--------------------------+ +Mon Jul 24 19:59:34 UTC 2017 +patches/packages/tcpdump-4.9.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes an issue where tcpdump 4.9.0 allows remote attackers + to cause a denial of service (heap-based buffer over-read and application + crash) via crafted packet data. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11108 + (* Security fix *) ++--------------------------+ +Tue Jul 18 23:10:25 UTC 2017 +patches/packages/expat-2.2.2-x86_64-1_slack14.1.txz: Upgraded. + Fixes security issues including: + External entity infinite loop DoS + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233 + https://libexpat.github.io/doc/cve-2017-9233/ + (* Security fix *) ++--------------------------+ +Fri Jul 14 22:11:58 UTC 2017 +patches/packages/mariadb-5.5.56-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3238 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3243 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3244 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3258 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3265 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3291 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3302 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3308 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3309 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3312 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3313 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3317 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3318 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3453 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3456 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3464 + (* Security fix *) +patches/packages/samba-4.4.15-x86_64-1_slack14.1.txz: Upgraded. + This update fixes an authentication validation bypass security issue: + "Orpheus' Lyre mutual authentication validation bypass" + All versions of Samba from 4.0.0 onwards using embedded Heimdal + Kerberos are vulnerable to a man-in-the-middle attack impersonating + a trusted server, who may gain elevated access to the domain by + returning malicious replication or authorization data. + Samba binaries built against MIT Kerberos are not vulnerable. + For more information, see: + https://www.samba.org/samba/security/CVE-2017-11103.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103 + (* Security fix *) ++--------------------------+ +Thu Jul 13 18:19:01 UTC 2017 +patches/packages/httpd-2.4.27-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + Read after free in mod_http2 (CVE-2017-9789) + Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788) + Thanks to Robert Swiecki for reporting these issues. + For more information, see: + https://httpd.apache.org/security/vulnerabilities_24.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9789 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9788 + (* Security fix *) ++--------------------------+ +Sun Jul 9 20:38:08 UTC 2017 +patches/packages/irssi-1.0.4-x86_64-1_slack14.1.txz: Upgraded. + This release fixes two remote crash issues as well as a few bugs. + For more information, see: + https://irssi.org/security/irssi_sa_2017_07.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10965 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10966 + (* Security fix *) ++--------------------------+ +Sat Jul 8 00:11:34 UTC 2017 +patches/packages/ca-certificates-20161130-noarch-1_slack14.1.txz: Upgraded. + This update provides the latest CA certificates to check for the + authenticity of SSL connections. +patches/packages/php-5.6.31-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://php.net/ChangeLog-5.php#5.6.31 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9224 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9226 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9227 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9228 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9229 + (* Security fix *) ++--------------------------+ +Thu Jul 6 00:57:41 UTC 2017 +patches/packages/xscreensaver-5.37-x86_64-1_slack14.1.txz: Upgraded. + Here's an upgrade to the latest xscreensaver. ++--------------------------+ +Thu Jun 29 20:55:09 UTC 2017 +patches/packages/bind-9.9.10_P2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a high severity security issue: + An error in TSIG handling could permit unauthorized zone transfers + or zone updates. + For more information, see: + https://kb.isc.org/article/AA-01503/0 + https://kb.isc.org/article/AA-01504/0 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3142 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143 + (* Security fix *) +patches/packages/httpd-2.4.26-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues which may lead to an authentication bypass + or a denial of service: + important: ap_get_basic_auth_pw() Authentication Bypass CVE-2017-3167 + important: mod_ssl Null Pointer Dereference CVE-2017-3169 + important: mod_http2 Null Pointer Dereference CVE-2017-7659 + important: ap_find_token() Buffer Overread CVE-2017-7668 + important: mod_mime Buffer Overread CVE-2017-7679 + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3167 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3169 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7659 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7668 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7679 + (* Security fix *) +patches/packages/linux-3.10.107/*: Upgraded. + This kernel fixes two "Stack Clash" vulnerabilities reported by Qualys. + The first issue may allow attackers to execute arbitrary code with elevated + privileges. Failed attack attempts will likely result in denial-of-service + conditions. The second issue can be exploited to bypass certain security + restrictions and perform unauthorized actions. + Be sure to upgrade your initrd after upgrading the kernel packages. + If you use lilo to boot your machine, be sure lilo.conf points to the correct + kernel and initrd and run lilo as root to update the bootloader. + If you use elilo to boot your machine, you should run eliloconfig to copy the + kernel and initrd to the EFI System Partition. + For more information, see: + https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000364 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000365 + (* Security fix *) + In addition, a patch is included and preapplied to guard against other == sk + in unix_dgram_sendmsg. This bug has been known to cause Samba related stalls. + Thanks to Ben Stern for the bug report. +patches/packages/mkinitrd-1.4.10-x86_64-1_slack14.1.txz: Upgraded. + Added support for -P option and MICROCODE_ARCH in mkinitrd.conf to specify + a microcode archive to be prepended to the initrd for early CPU microcode + patching by the kernel. Thanks to SeB. ++--------------------------+ +Wed Jun 21 18:38:46 UTC 2017 +patches/packages/openvpn-2.3.17-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several denial of service issues discovered + by Guido Vranken. + For more information, see: + https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7508 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7512 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7522 + (* Security fix *) ++--------------------------+ +Wed Jun 14 22:04:45 UTC 2017 +patches/packages/bind-9.9.10_P1-x86_64-1_slack14.1.txz: Upgraded. + Fixed denial of service security issue: + Some RPZ configurations could go into an infinite query loop when + encountering responses with TTL=0. + For more information, see: + https://kb.isc.org/article/AA-01495 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3140 + (* Security fix *) ++--------------------------+ +Wed Jun 7 22:42:04 UTC 2017 +patches/packages/irssi-1.0.3-x86_64-1_slack14.1.txz: Upgraded. + Fixed security issues that may result in a denial of service. + For more information, see: + https://irssi.org/security/irssi_sa_2017_06.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9468 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9469 + (* Security fix *) ++--------------------------+ +Wed May 31 23:07:23 UTC 2017 +patches/packages/sudo-1.8.20p2-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release: + Fixed a bug parsing /proc/pid/stat when the process name contains + a newline. This is not exploitable due to the /dev traversal changes + made in sudo 1.8.20p1. ++--------------------------+ +Tue May 30 17:39:17 UTC 2017 +patches/packages/lynx-2.8.8rel.2-x86_64-1_slack14.1.txz: Upgraded. + Fixed lynx startup without a URL by correcting STARTFILE in lynx.cfg to use + the new URL for the Lynx homepage. Thanks to John David Yost. +patches/packages/sudo-1.8.20p1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a potential overwrite of arbitrary system files. + This bug was discovered and analyzed by Qualys, Inc. + For more information, see: + https://www.sudo.ws/alerts/linux_tty.html + http://www.openwall.com/lists/oss-security/2017/05/30/16 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000367 + (* Security fix *) ++--------------------------+ +Wed May 24 19:38:59 UTC 2017 +patches/packages/samba-4.4.14-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a remote code execution vulnerability, allowing a + malicious client to upload a shared library to a writable share, and + then cause the server to load and execute it. + For more information, see: + https://www.samba.org/samba/security/CVE-2017-7494.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494 + (* Security fix *) ++--------------------------+ +Tue May 16 20:11:03 UTC 2017 +patches/packages/freetype-2.5.5-x86_64-2_slack14.1.txz: Rebuilt. + This update fixes an out-of-bounds write caused by a heap-based buffer + overflow related to the t1_builder_close_contour function in psaux/psobjs.c. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8287 + (* Security fix *) +patches/packages/kdelibs-4.10.5-x86_64-3_slack14.1.txz: Rebuilt. + This update fixes a security issue with KAuth that can lead to gaining + root from an unprivileged account. + For more information, see: + http://www.openwall.com/lists/oss-security/2017/05/10/3 + https://www.kde.org/info/security/advisory-20170510-1.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422 + (* Security fix *) ++--------------------------+ +Mon May 1 23:31:02 UTC 2017 +patches/packages/rxvt-2.7.10-x86_64-5_slack14.1.txz: Rebuilt. + Patched an integer overflow that can crash rxvt with an escape sequence, + or possibly have unspecified other impact. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7483 + (* Security fix *) ++--------------------------+ +Wed Apr 26 23:09:45 UTC 2017 +patches/packages/xfce4-weather-plugin-0.8.9-x86_64-1_slack14.1.txz: Upgraded. + Package upgraded to fix the API used to fetch weather data. + Thanks to Robby Workman. ++--------------------------+ +Fri Apr 21 22:40:12 UTC 2017 +patches/packages/mozilla-firefox-45.9.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + Also, switching back to the 45.x ESR branch due to instabilty of the + 52.x ESR branch on Slackware 14.1. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/ntp-4.2.8p10-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes security + issues of medium and low severity: + Denial of Service via Malformed Config (Medium) + Authenticated DoS via Malicious Config Option (Medium) + Potential Overflows in ctl_put() functions (Medium) + Buffer Overflow in ntpq when fetching reslist from a malicious ntpd (Medium) + 0rigin DoS (Medium) + Buffer Overflow in DPTS Clock (Low) + Improper use of snprintf() in mx4200_send() (Low) + The following issues do not apply to Linux systems: + Privileged execution of User Library code (WINDOWS PPSAPI ONLY) (Low) + Stack Buffer Overflow from Command Line (WINDOWS installer ONLY) (Low) + Data Structure terminated insufficiently (WINDOWS installer ONLY) (Low) + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6464 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6463 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6458 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6460 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6462 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6451 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6455 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6452 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6459 + (* Security fix *) +patches/packages/proftpd-1.3.5e-x86_64-1_slack14.1.txz: Upgraded. + This release fixes a security issue: + AllowChrootSymlinks off does not check entire DefaultRoot path for symlinks. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7418 + (* Security fix *) ++--------------------------+ +Wed Apr 19 04:46:45 UTC 2017 +patches/packages/minicom-2.7.1-x86_64-1_slack14.1.txz: Upgraded. + Fix an out of bounds data access that can lead to remote code execution. + This issue was found by Solar Designer of Openwall during a security audit + of the Virtuozzo 7 product, which contains derived downstream code in its + prl-vzvncserver component. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7467 + (* Security fix *) ++--------------------------+ +Thu Apr 13 21:19:45 UTC 2017 +patches/packages/bind-9.9.9_P8-x86_64-1_slack14.1.txz: Upgraded. + Fixed denial of service security issues. + For more information, see: + https://kb.isc.org/article/AA-01465 + https://kb.isc.org/article/AA-01466 + https://kb.isc.org/article/AA-01471 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3136 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3137 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3138 + (* Security fix *) ++--------------------------+ +Mon Apr 10 18:08:13 UTC 2017 +patches/packages/vim-7.4.399-x86_64-1_slack14.1.txz: Upgraded. + In Vim 7.3+ but prior to 7.4.399, blowfish encryption is weak. + Upgrade to Vim 7.4.399 to address this issue. + For more information, see: + https://dgl.cx/2014/10/vim-blowfish + (* Security fix *) +patches/packages/vim-gvim-7.4.399-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Sat Apr 1 05:16:59 UTC 2017 +patches/packages/samba-4.4.13-x86_64-1_slack14.1.txz: Upgraded. + This is a bug fix release to address a regression introduced by the security + fixes for CVE-2017-2619 (Symlink race allows access outside share definition). + Please see https://bugzilla.samba.org/show_bug.cgi?id=12721 for details. ++--------------------------+ +Thu Mar 30 20:18:17 UTC 2017 +patches/packages/mozilla-firefox-52.0.2esr-x86_64-2_slack14.1.txz: Rebuilt. + Recompiled without --enable-optimize to fix crashes. Thanks to holderm. ++--------------------------+ +Tue Mar 28 20:30:50 UTC 2017 +patches/packages/mozilla-firefox-52.0.2esr-x86_64-1_slack14.1.txz: Upgraded. + Upgraded to new Firefox 52.x ESR branch. ++--------------------------+ +Thu Mar 23 21:38:23 UTC 2017 +patches/packages/glibc-zoneinfo-2017b-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/mcabber-1.0.5-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue: + An incorrect implementation of XEP-0280: Message Carbons in multiple XMPP + clients allows a remote attacker to impersonate any user, including + contacts, in the vulnerable application's display. This allows for various + kinds of social engineering attacks. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5604 + (* Security fix *) +patches/packages/samba-4.4.12-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue: + All versions of Samba prior to 4.6.1, 4.5.7, 4.4.12 are vulnerable to + a malicious client using a symlink race to allow access to areas of + the server file system not exported under the share definition. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2619 + (* Security fix *) ++--------------------------+ +Thu Mar 16 01:37:05 UTC 2017 +patches/packages/pidgin-2.12.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a minor security issue (out of bounds memory read in + purple_markup_unescape_entity). + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2640 + (* Security fix *) ++--------------------------+ +Wed Mar 8 00:17:36 UTC 2017 +patches/packages/mozilla-firefox-45.8.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-45.8.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Tue Feb 28 23:51:55 UTC 2017 +patches/packages/glibc-zoneinfo-2017a-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Fri Feb 10 21:07:35 UTC 2017 +patches/packages/bind-9.9.9_P6-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a denial-of-service vulnerability. Under some conditions + when using both DNS64 and RPZ to rewrite query responses, query processing + can resume in an inconsistent state leading to either an INSIST assertion + failure or an attempt to read through a NULL pointer. + For more information, see: + https://kb.isc.org/article/AA-01453 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3135 + (* Security fix *) +patches/packages/libpcap-1.8.1-x86_64-1_slack14.1.txz: Upgraded. + This update is required for the new version of tcpdump. +patches/packages/mozilla-thunderbird-45.7.1-x86_64-1_slack14.1.txz: Upgraded. + Fixed crash when viewing certain IMAP messages (introduced in 45.7.0) +patches/packages/php-5.6.30-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://php.net/ChangeLog-5.php#5.6.30 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10158 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10167 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10168 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10159 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10160 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10161 + (* Security fix *) +patches/packages/tcpdump-4.9.0-x86_64-1_slack14.1.txz: Upgraded. + Fixed bugs which allow an attacker to crash tcpdump (denial of service). + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7922 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7923 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7924 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7925 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7926 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7927 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7928 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7929 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7930 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7931 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7932 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7933 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7934 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7935 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7936 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7937 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7938 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7939 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7940 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7973 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7974 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7975 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7983 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7984 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7985 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7986 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7992 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7993 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8574 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8575 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5202 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5203 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5204 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5205 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5341 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5342 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5482 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5483 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5484 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5485 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5486 + (* Security fix *) ++--------------------------+ +Thu Jan 26 18:42:29 UTC 2017 +patches/packages/mozilla-thunderbird-45.7.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5375 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5376 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5378 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5380 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5390 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5396 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5383 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5386 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5373 + (* Security fix *) ++--------------------------+ +Mon Jan 23 21:30:13 UTC 2017 +patches/packages/mozilla-firefox-45.7.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Fri Jan 20 04:18:02 UTC 2017 +patches/packages/seamonkey-2.46-x86_64-3_slack14.1.txz: Rebuilt. + Recompiled with less aggressive optimization (-Os) to fix crashes. +patches/packages/seamonkey-solibs-2.46-x86_64-3_slack14.1.txz: Rebuilt. ++--------------------------+ +Wed Jan 18 20:39:17 UTC 2017 +patches/packages/mariadb-5.5.54-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6664 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3238 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3243 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3244 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3257 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3258 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3265 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3291 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3312 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3317 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3318 + (* Security fix *) ++--------------------------+ +Wed Jan 18 01:02:19 UTC 2017 +patches/packages/seamonkey-2.46-x86_64-2_slack14.1.txz: Rebuilt. + Restored missing nspr/obsolete headers. +patches/packages/seamonkey-solibs-2.46-x86_64-2_slack14.1.txz: Rebuilt. ++--------------------------+ +Thu Jan 12 01:15:52 UTC 2017 +patches/packages/bind-9.9.9_P5-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a denial-of-service vulnerability. An error in handling + certain queries can cause an assertion failure when a server is using the + nxdomain-redirect feature to cover a zone for which it is also providing + authoritative service. A vulnerable server could be intentionally stopped + by an attacker if it was using a configuration that met the criteria for + the vulnerability and if the attacker could cause it to accept a query + that possessed the required attributes. + Please note: This vulnerability affects the "nxdomain-redirect" feature, + which is one of two methods of handling NXDOMAIN redirection, and is only + available in certain versions of BIND. Redirection using zones of type + "redirect" is not affected by this vulnerability. + For more information, see: + https://kb.isc.org/article/AA-01442 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9778 + (* Security fix *) +patches/packages/gnutls-3.3.26-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + https://gnutls.org/security.html#GNUTLS-SA-2017-1 + https://gnutls.org/security.html#GNUTLS-SA-2017-2 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5334 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5335 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5336 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5337 + (* Security fix *) +patches/packages/irssi-0.8.21-x86_64-1_slack14.1.txz: Upgraded. + Fixed security issues that may result in a denial of service. + For more information, see: + https://irssi.org/security/irssi_sa_2017_01.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5193 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5194 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5195 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5196 + (* Security fix *) +patches/packages/python-2.7.13-x86_64-2_slack14.1.txz: Rebuilt. + This is a rebuilt package to fix a build-time regression with the + multiprocessing.synchronize module. + Thanks to Damien Goutte-Gattat for the bug report. ++--------------------------+ +Fri Dec 30 19:29:13 UTC 2016 +patches/packages/libpng-1.4.20-x86_64-1_slack14.1.txz: Upgraded. + This release fixes an old NULL pointer dereference bug in png_set_text_2() + discovered and patched by Patrick Keshishian. The potential "NULL + dereference" bug has existed in libpng since version 0.71 of June 26, 1995. + To be vulnerable, an application has to load a text chunk into the png + structure, then delete all text, then add another text chunk to the same + png structure, which seems to be an unlikely sequence, but it has happened. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10087 + (* Security fix *) +patches/packages/mozilla-thunderbird-45.6.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9899 + (* Security fix *) +patches/packages/seamonkey-2.46-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.seamonkey-project.org/releases/seamonkey2.46 + (* Security fix *) +patches/packages/seamonkey-solibs-2.46-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Wed Dec 28 21:05:19 UTC 2016 +patches/packages/python-2.7.13-x86_64-1_slack14.1.txz: Upgraded. + This release fixes security issues: + Issue #27850: Remove 3DES from ssl module's default cipher list to counter + measure sweet32 attack (CVE-2016-2183). + Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the + HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates + that the script is in CGI mode. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000110 + (* Security fix *) ++--------------------------+ +Sat Dec 24 18:14:51 UTC 2016 +patches/packages/expat-2.2.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues: + Multiple integer overflows in XML_GetBuffer. + Fix crash on malformed input. + Improve insufficient fix to CVE-2015-1283 / CVE-2015-2716. + Use more entropy for hash initialization. + Resolve troublesome internal call to srand. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1283 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6702 + (* Security fix *) ++--------------------------+ +Sat Dec 24 02:36:05 UTC 2016 +patches/packages/httpd-2.4.25-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + * CVE-2016-8740: mod_http2: Mitigate DoS memory exhaustion via endless + CONTINUATION frames. + * CVE-2016-5387: core: Mitigate [f]cgi "httpoxy" issues. + * CVE-2016-2161: mod_auth_digest: Prevent segfaults during client entry + allocation when the shared memory space is exhausted. + * CVE-2016-0736: mod_session_crypto: Authenticate the session data/cookie + with a MAC (SipHash) to prevent deciphering or tampering with a padding + oracle attack. + * CVE-2016-8743: Enforce HTTP request grammar corresponding to RFC7230 for + request lines and request headers, to prevent response splitting and + cache pollution by malicious clients or downstream proxies. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8740 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5387 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2161 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0736 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8743 + (* Security fix *) +patches/packages/openssh-7.4p1-x86_64-1_slack14.1.txz: Upgraded. + This is primarily a bugfix release, and also addresses security issues. + ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside + a trusted whitelist. + sshd(8): When privilege separation is disabled, forwarded Unix-domain + sockets would be created by sshd(8) with the privileges of 'root'. + sshd(8): Avoid theoretical leak of host private key material to + privilege-separated child processes via realloc(). + sshd(8): The shared memory manager used by pre-authentication compression + support had a bounds checks that could be elided by some optimising + compilers to potentially allow attacks against the privileged monitor. + process from the sandboxed privilege-separation process. + sshd(8): Validate address ranges for AllowUser and DenyUsers directives at + configuration load time and refuse to accept invalid ones. It was + previously possible to specify invalid CIDR address ranges + (e.g. user@127.1.2.3/55) and these would always match, possibly resulting + in granting access where it was not intended. + For more information, see: + https://www.openssh.com/txt/release-7.4 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10009 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10010 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10011 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10012 + (* Security fix *) +patches/packages/xfce4-weather-plugin-0.8.8-x86_64-1_slack14.1.txz: Upgraded. + Package upgraded to fix the API used to fetch weather data. + Thanks to Robby Workman. ++--------------------------+ +Sun Dec 18 05:20:25 UTC 2016 +patches/packages/glibc-zoneinfo-2016j-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Tue Dec 13 22:14:13 UTC 2016 +patches/packages/mozilla-firefox-45.6.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Mon Dec 12 21:25:50 UTC 2016 +patches/packages/loudmouth-1.5.3-x86_64-1_slack14.1.txz: Upgraded. + This update is needed for the mcabber security update. +patches/packages/mcabber-1.0.4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue which can lead to a malicious actor + MITMing a conversation, or adding themselves as an entity on a third + parties roster (thereby granting themselves the associated priviledges + such as observing when the user is online). + For more information, see: + https://gultsch.de/gajim_roster_push_and_message_interception.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9928 + (* Security fix *) +patches/packages/php-5.6.29-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://php.net/ChangeLog-5.php#5.6.29 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9933 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9934 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9935 + (* Security fix *) ++--------------------------+ +Thu Dec 1 08:49:20 UTC 2016 +patches/packages/mozilla-firefox-45.5.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9079 + (* Security fix *) +patches/packages/mozilla-thunderbird-45.5.1-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9079 + (* Security fix *) ++--------------------------+ +Mon Nov 21 19:21:22 UTC 2016 +patches/packages/ntp-4.2.8p9-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes the + following 1 high- (Windows only :-), 2 medium-, 2 medium-/low, and + 5 low-severity vulnerabilities, and provides 28 other non-security + fixes and improvements. + CVE-2016-9311: Trap crash + CVE-2016-9310: Mode 6 unauthenticated trap info disclosure and DDoS vector + CVE-2016-7427: Broadcast Mode Replay Prevention DoS + CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS + CVE-2016-9312: Windows: ntpd DoS by oversized UDP packet + CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass + CVE-2016-7434: Null pointer dereference in _IO_str_init_static_internal() + CVE-2016-7429: Interface selection attack + CVE-2016-7426: Client rate limiting and server responses + CVE-2016-7433: Reboot sync calculation problem + For more information, see: + https://www.kb.cert.org/vuls/id/633847 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9311 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9310 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7428 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9312 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7431 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7434 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7429 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7426 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7433 + (* Security fix *) ++--------------------------+ +Fri Nov 18 22:49:40 UTC 2016 +patches/packages/libxcb-1.11.1-x86_64-2_slack14.1.txz: Rebuilt. + This update fixes a regression where previously compiled binaries could be + broken due to a changed shared library soname. This package adds + compatibility symlinks to the old names where needed. +patches/packages/mozilla-firefox-45.5.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Fri Nov 4 03:31:38 UTC 2016 +patches/packages/bind-9.9.9_P4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a denial-of-service vulnerability. A defect in BIND's + handling of responses containing a DNAME answer can cause a resolver to exit + after encountering an assertion failure in db.c or resolver.c. A server + encountering either of these error conditions will stop, resulting in denial + of service to clients. The risk to authoritative servers is minimal; + recursive servers are chiefly at risk. + For more information, see: + https://kb.isc.org/article/AA-01434 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8864 + (* Security fix *) +patches/packages/curl-7.51.0-x86_64-1_slack14.1.txz: Upgraded. + This release fixes security issues: + CVE-2016-8615: cookie injection for other servers + CVE-2016-8616: case insensitive password comparison + CVE-2016-8617: OOB write via unchecked multiplication + CVE-2016-8618: double-free in curl_maprintf + CVE-2016-8619: double-free in krb5 code + CVE-2016-8620: glob parser write/read out of bounds + CVE-2016-8621: curl_getdate read out of bounds + CVE-2016-8622: URL unescape heap overflow via integer truncation + CVE-2016-8623: Use-after-free via shared cookies + CVE-2016-8624: invalid URL parsing with '#' + CVE-2016-8625: IDNA 2003 makes curl use wrong host + For more information, see: + https://curl.haxx.se/docs/adv_20161102A.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8615 + https://curl.haxx.se/docs/adv_20161102B.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8616 + https://curl.haxx.se/docs/adv_20161102C.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8617 + https://curl.haxx.se/docs/adv_20161102D.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8618 + https://curl.haxx.se/docs/adv_20161102E.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8619 + https://curl.haxx.se/docs/adv_20161102F.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8620 + https://curl.haxx.se/docs/adv_20161102G.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8621 + https://curl.haxx.se/docs/adv_20161102H.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8622 + https://curl.haxx.se/docs/adv_20161102I.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8623 + https://curl.haxx.se/docs/adv_20161102J.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8624 + https://curl.haxx.se/docs/adv_20161102K.html + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8625 + (* Security fix *) +patches/packages/glibc-zoneinfo-2016i-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Mon Oct 31 23:38:24 UTC 2016 +patches/packages/inputproto-2.3.2-noarch-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/libX11-1.6.4-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory read in XGetImage() or write in XListFonts(). + Affected versions libX11 <= 1.6.3. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943 + (* Security fix *) +patches/packages/libXext-1.3.3-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/libXfixes-5.0.3-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause an integer + overflow on 32 bit architectures. + Affected versions : libXfixes <= 5.0.2. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944 + (* Security fix *) +patches/packages/libXi-1.7.8-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory access or endless loops (Denial of Service). + Affected versions libXi <= 1.7.6. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7945 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7946 + (* Security fix *) +patches/packages/libXrandr-1.5.1-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory writes. + Affected versions: libXrandr <= 1.5.0. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948 + (* Security fix *) +patches/packages/libXrender-0.9.10-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory writes. + Affected version: libXrender <= 0.9.9. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7949 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7950 + (* Security fix *) +patches/packages/libXtst-1.2.3-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory access or endless loops (Denial of Service). + Affected version libXtst <= 1.2.2. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7952 + (* Security fix *) +patches/packages/libXv-1.0.11-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause out of boundary + memory and memory corruption. + Affected version libXv <= 1.0.10. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5407 + (* Security fix *) +patches/packages/libXvMC-1.0.10-x86_64-1_slack14.1.txz: Upgraded. + Insufficient validation of data from the X server can cause a one byte buffer + read underrun. + Affected version: libXvMC <= 1.0.9. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7953 + (* Security fix *) +patches/packages/libxcb-1.11.1-x86_64-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/linux-3.10.104/*: Upgraded. + This kernel fixes a security issue known as "Dirty COW". A race condition + was found in the way the Linux kernel's memory subsystem handled the + copy-on-write (COW) breakage of private read-only memory mappings. An + unprivileged local user could use this flaw to gain write access to + otherwise read-only memory mappings and thus increase their privileges on + the system. + Be sure to upgrade your initrd after upgrading the kernel packages. + If you use lilo to boot your machine, be sure lilo.conf points to the correct + kernel and initrd and run lilo as root to update the bootloader. + If you use elilo to boot your machine, you should run eliloconfig to copy the + kernel and initrd to the EFI System Partition. + For more information, see: + https://dirtycow.ninja/ + https://www.kb.cert.org/vuls/id/243144 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5195 + (* Security fix *) +patches/packages/mariadb-5.5.53-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5616 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5624 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5626 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3492 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5629 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8283 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7440 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5584 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6663 + (* Security fix *) +patches/packages/php-5.6.27-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://php.net/ChangeLog-5.php#5.6.27 + (* Security fix *) +patches/packages/randrproto-1.5.0-noarch-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/xcb-proto-1.11-x86_64-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/xextproto-7.3.0-x86_64-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/xproto-7.0.29-noarch-1_slack14.1.txz: Upgraded. + This update is a prerequisite for other security updates. +patches/packages/xscreensaver-5.36-x86_64-1_slack14.1.txz: Upgraded. + Here's an upgrade to the latest xscreensaver. ++--------------------------+ +Sat Oct 1 17:11:13 UTC 2016 +patches/packages/mozilla-thunderbird-45.4.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Wed Sep 28 23:24:37 UTC 2016 +patches/packages/glibc-zoneinfo-2016g-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Tue Sep 27 19:16:56 UTC 2016 +patches/packages/bind-9.9.9_P3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a denial-of-service vulnerability. Testing by ISC has + uncovered a critical error condition which can occur when a nameserver is + constructing a response. A defect in the rendering of messages into + packets can cause named to exit with an assertion failure in buffer.c while + constructing a response to a query that meets certain criteria. + For more information, see: + https://kb.isc.org/article/AA-01419/0 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2776 + (* Security fix *) ++--------------------------+ +Fri Sep 23 23:30:53 UTC 2016 +patches/packages/php-5.6.26-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://php.net/ChangeLog-5.php#5.6.26 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7416 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7412 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7414 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7417 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7411 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7413 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7418 + (* Security fix *) ++--------------------------+ +Thu Sep 22 18:38:07 UTC 2016 +patches/packages/openssl-1.0.1u-x86_64-1_slack14.1.txz: Upgraded. + This update fixes denial-of-service and other security issues. + For more information, see: + https://www.openssl.org/news/secadv/20160922.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6304 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6305 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6303 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6302 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2182 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2180 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2178 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2179 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2181 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6306 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6307 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6308 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1u-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/pidgin-2.11.0-x86_64-1_slack14.1.txz: Upgraded. + NOTE: These packages provide updates to pidgin-2.11.0, since the previous + version was mistakenly reissued for Slackware 13.0 - 14.1. Sorry! + This release fixes bugs and security issues. + For more information, see: + https://www.pidgin.im/news/security/ + (* Security fix *) ++--------------------------+ +Wed Sep 21 21:10:52 UTC 2016 +patches/packages/irssi-0.8.20-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two remote crash and heap corruption vulnerabilites + in Irssi's format parsing code. Impact: Remote crash and heap + corruption. Remote code execution seems difficult since only Nuls are + written. Bugs discovered by, and patches provided by Gabriel Campana + and Adrien Guinet from Quarkslab. + For more information, see: + https://irssi.org/security/irssi_sa_2016.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7044 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7045 + (* Security fix *) ++--------------------------+ +Wed Sep 21 15:54:06 UTC 2016 +patches/packages/mozilla-firefox-45.4.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/pidgin-2.10.12-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + https://www.pidgin.im/news/security/ + (* Security fix *) ++--------------------------+ +Thu Sep 15 22:54:52 UTC 2016 +patches/packages/curl-7.50.3-x86_64-1_slack14.1.txz: Upgraded. + Fixed heap overflows in four libcurl functions: curl_escape(), + curl_easy_escape(), curl_unescape() and curl_easy_unescape(). + For more information, see: + https://curl.haxx.se/docs/adv_20160914.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7167 + (* Security fix *) ++--------------------------+ +Tue Sep 13 18:13:32 UTC 2016 +patches/packages/mariadb-5.5.52-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a critical vulnerability which can allow local and + remote attackers to inject malicious settings into MySQL configuration + files (my.cnf). A successful exploitation could allow attackers to + execute arbitrary code with root privileges which would then allow them + to fully compromise the server. + This issue was discovered and reported by Dawid Golunski. + For more information, see: + http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html + https://jira.mariadb.org/browse/MDEV-10465 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6662 + (* Security fix *) ++--------------------------+ +Sat Sep 10 18:04:42 UTC 2016 +patches/packages/gnutls-3.3.24-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + http://www.gnutls.org/security.html#GNUTLS-SA-2015-2 + http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6251 + (* Security fix *) +patches/packages/gtk+2-2.24.20-x86_64-2_slack14.1.txz: Rebuilt. + This update fixes a security issue: Integer overflow in the + gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c allows remote + attackers to cause a denial of service (crash) via a large image file, + which triggers a large memory allocation. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7447 + (* Security fix *) ++--------------------------+ +Thu Sep 8 21:35:02 UTC 2016 +patches/packages/php-5.6.25-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.25 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7125 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7126 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7127 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7128 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7129 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7130 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7131 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7132 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7133 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7134 + (* Security fix *) ++--------------------------+ +Wed Aug 31 20:43:10 UTC 2016 +patches/packages/mozilla-thunderbird-45.3.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Mon Aug 29 22:51:27 UTC 2016 +patches/packages/linux-3.10.103/*: Upgraded. + A flaw was found in the implementation of the Linux kernels handling of + networking challenge ack where an attacker is able to determine the shared + counter. This may allow an attacker located on different subnet to inject + or take over a TCP connection between a server and client without having to + be a traditional Man In the Middle (MITM) style attack. + Be sure to upgrade your initrd after upgrading the kernel packages. + If you use lilo to boot your machine, be sure lilo.conf points to the correct + kernel and initrd and run lilo as root to update the bootloader. + If you use elilo to boot your machine, you should run eliloconfig to copy the + kernel and initrd to the EFI System Partition. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389 + (* Security fix *) ++--------------------------+ +Tue Aug 23 19:45:33 UTC 2016 +patches/packages/gnupg-1.4.21-x86_64-1_slack14.1.txz: Upgraded. + Fix critical security bug in the RNG [CVE-2016-6313]. An attacker who + obtains 580 bytes from the standard RNG can trivially predict the next + 20 bytes of output. (This is according to the NEWS file included in the + source. According to the annoucement linked below, an attacker who obtains + 4640 bits from the RNG can trivially predict the next 160 bits of output.) + Problem detected by Felix Doerre and Vladimir Klebanov, KIT. + For more information, see: + https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313 + (* Security fix *) +patches/packages/libgcrypt-1.5.6-x86_64-1_slack14.1.txz: Upgraded. + Fix critical security bug in the RNG [CVE-2016-6313]. An attacker who + obtains 580 bytes from the standard RNG can trivially predict the next + 20 bytes of output. (This is according to the NEWS file included in the + source. According to the annoucement linked below, an attacker who obtains + 4640 bits from the RNG can trivially predict the next 160 bits of output.) + Problem detected by Felix Doerre and Vladimir Klebanov, KIT. + For more information, see: + https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313 + (* Security fix *) +patches/packages/stunnel-5.35-x86_64-2_slack14.1.txz: Rebuilt. + Fixed incorrect config file name in generate-stunnel-key.sh. + Thanks to Ebben Aries. ++--------------------------+ +Thu Aug 11 18:55:48 UTC 2016 +patches/packages/glibc-zoneinfo-2016f-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Sat Aug 6 19:29:16 UTC 2016 +patches/packages/curl-7.50.1-x86_64-1_slack14.1.txz: Upgraded. + This release fixes security issues: + TLS: switch off SSL session id when client cert is used + TLS: only reuse connections with the same client cert + curl_multi_cleanup: clear connection pointer for easy handles + For more information, see: + https://curl.haxx.se/docs/adv_20160803A.html + https://curl.haxx.se/docs/adv_20160803B.html + https://curl.haxx.se/docs/adv_20160803C.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5419 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5420 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5421 + (* Security fix *) +patches/packages/mozilla-firefox-45.3.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/openssh-7.3p1-x86_64-1_slack14.1.txz: Upgraded. + This is primarily a bugfix release, and also addresses security issues. + sshd(8): Mitigate a potential denial-of-service attack against the system's + crypt(3) function via sshd(8). + sshd(8): Mitigate timing differences in password authentication that could + be used to discern valid from invalid account names when long passwords were + sent and particular password hashing algorithms are in use on the server. + ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle + countermeasures. + ssh(1), sshd(8): Improve operation ordering of MAC verification for + Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC + before decrypting any ciphertext. + sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes. + For more information, see: + http://www.openssh.com/txt/release-7.3 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6210 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325 + (* Security fix *) +patches/packages/stunnel-5.35-x86_64-1_slack14.1.txz: Upgraded. + Fixes security issues: + Fixed malfunctioning "verify = 4". + Fixed incorrectly enforced client certificate requests. + (* Security fix *) ++--------------------------+ +Thu Jul 28 18:17:17 UTC 2016 +patches/packages/libidn-1.33-x86_64-1_slack14.1.txz: Upgraded. + Fixed out-of-bounds read bugs. Fixed crashes on invalid UTF-8. + Thanks to Hanno Böck. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8948 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6261 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6262 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6263 + (* Security fix *) ++--------------------------+ +Fri Jul 22 20:51:23 UTC 2016 +patches/packages/bind-9.9.9_P2-x86_64-1_slack14.1.txz: Upgraded. + Fixed a security issue: + getrrsetbyname with a non absolute name could trigger an infinite + recursion bug in lwresd and named with lwres configured if when + combined with a search list entry the resulting name is too long. + (CVE-2016-2775) [RT #42694] + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2775 + (* Security fix *) ++--------------------------+ +Thu Jul 21 23:25:54 UTC 2016 +patches/packages/gimp-2.8.18-x86_64-1_slack14.1.txz: Upgraded. + This release fixes a security issue: + Use-after-free vulnerability in the xcf_load_image function in + app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of + service (program crash) or possibly execute arbitrary code via a crafted + XCF file. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4994 + (* Security fix *) +patches/packages/php-5.6.24-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.24 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5385 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6207 + (* Security fix *) ++--------------------------+ +Thu Jul 7 19:52:36 UTC 2016 +patches/packages/samba-4.2.14-x86_64-1_slack14.1.txz: Upgraded. + This release fixes a security issue: + Client side SMB2/3 required signing can be downgraded. + It's possible for an attacker to downgrade the required signing for an + SMB2/3 client connection, by injecting the SMB2_SESSION_FLAG_IS_GUEST or + SMB2_SESSION_FLAG_IS_NULL flags. This means that the attacker can + impersonate a server being connected to by Samba, and return malicious + results. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2119 + (* Security fix *) ++--------------------------+ +Tue Jul 5 04:52:45 UTC 2016 +patches/packages/mozilla-thunderbird-45.2.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Fri Jun 24 23:37:19 UTC 2016 +patches/packages/php-5.6.23-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.23 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5766 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5767 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5768 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5769 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5770 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5771 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5772 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5773 + (* Security fix *) ++--------------------------+ +Mon Jun 20 21:39:07 UTC 2016 +patches/packages/libarchive-3.2.1-x86_64-1_slack14.1.txz: Upgraded. + This release fixes several critical bugs, including some with security + implications. + (* Security fix *) +patches/packages/pcre-8.39-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs (including a couple of DoS security issues), and + retrofits to PCRE1 some appropriate JIT improvements from PCRE2. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 + (* Security fix *) ++--------------------------+ +Wed Jun 15 01:57:05 UTC 2016 +patches/packages/glibc-zoneinfo-2016e-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Tue Jun 14 03:48:17 UTC 2016 +patches/packages/pidgin-2.10.12-x86_64-1_slack14.1.txz: Upgraded. + Use the much larger collection of SSL certs in /etc/ssl/certs rather + than the ones that ship with Pidgin, otherwise certificates issued by + Let's Encrypt (and others) cannot be verified. Thanks to Cesare. ++--------------------------+ +Mon Jun 13 07:07:39 UTC 2016 +patches/packages/wget-1.18-x86_64-1_slack14.1.txz: Upgraded. + This version fixes a security vulnerability present in all old versions + of wget. On a server redirect from HTTP to a FTP resource, wget would + trust the HTTP server and use the name in the redirected URL as the + destination filename. This behaviour was changed and now it works + similarly as a redirect from HTTP to another HTTP resource so the original + name is used as the destination file. To keep the previous behaviour the + user must provide --trust-server-names. + The vulnerability was discovered by Dawid Golunski and was reported by + Beyond Security's SecuriTeam. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4971 + (* Security fix *) ++--------------------------+ +Fri Jun 3 23:36:07 UTC 2016 +patches/packages/libxml2-2.9.4-x86_64-2_slack14.1.txz: Rebuilt. + Fix attribute decoding during XML schema validation. + Thanks to Andreas Vögele. +patches/packages/ntp-4.2.8p8-x86_64-1_slack14.1.txz: Upgraded. + This release patches one high and four low severity security issues: + CVE-2016-4957: Crypto-NAK crash + CVE-2016-4953: Bad authentication demobilizes ephemeral associations + CVE-2016-4954: Processing spoofed server packets + CVE-2016-4955: Autokey association reset + CVE-2016-4956: Broadcast interleave + For more information, see: + http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4957 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4953 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4954 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4955 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4956 + (* Security fix *) ++--------------------------+ +Thu Jun 2 19:08:13 UTC 2016 +patches/packages/xscreensaver-5.35-x86_64-2_slack14.1.txz: Rebuilt. + Fixed missing '\' in the build script which caused a few configure options + to be skipped. Thanks to Stuart Winter. ++--------------------------+ +Tue May 31 05:42:04 UTC 2016 +patches/packages/imagemagick-6.8.6_10-x86_64-3_slack14.1.txz: Rebuilt. + Removed popen() support to prevent another shell vulnerability. This + issue was discovered by Bob Friesenhahn, of the GraphicsMagick project. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5118 + (* Security fix *) +patches/packages/mozilla-thunderbird-45.1.1-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/xscreensaver-5.35-x86_64-1_slack14.1.txz: Upgraded. + Here's an upgrade to the latest xscreensaver. ++--------------------------+ +Fri May 27 23:08:17 UTC 2016 +patches/packages/libxml2-2.9.4-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues: + Heap-based buffer underreads due to xmlParseName (CVE-2016-4447). + Format string vulnerability (CVE-2016-4448). + Inappropriate fetch of entities content (CVE-2016-4449). + For more information, see: + http://xmlsoft.org/news.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4448 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449 + (* Security fix *) +patches/packages/libxslt-1.1.29-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and a security issue: + Fix for type confusion in preprocessing attributes (Daniel Veillard). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7995 + (* Security fix *) +patches/packages/php-5.6.22-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.22 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7456 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5093 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5094 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5096 + (* Security fix *) ++--------------------------+ +Wed May 25 01:42:49 UTC 2016 +patches/packages/libarchive-3.1.2-x86_64-2_slack14.1.txz: Rebuilt. + Patched an issue with Zip archive handling that could allow an attacker + to overwrite parts of the heap in a controlled fashion and execute + arbitrary code. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1541 + (* Security fix *) ++--------------------------+ +Fri May 20 21:20:29 UTC 2016 +patches/packages/curl-7.49.0-x86_64-1_slack14.1.txz: Upgraded. + Fixed a TLS certificate check bypass with mbedTLS/PolarSSL. + For more information, see: + https://curl.haxx.se/docs/adv_20160518.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3739 + (* Security fix *) ++--------------------------+ +Thu May 12 01:03:31 UTC 2016 +patches/packages/mozilla-thunderbird-45.1.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Wed May 11 05:20:01 UTC 2016 +patches/packages/git-2.8.2-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix package update to change color "lime" to "00FF00" in + gitk. Otherwise it might not start if "lime" is not defined. + Thanks to AlvaroG. +patches/packages/imagemagick-6.8.6_10-x86_64-2_slack14.1.txz: Rebuilt. + This update addresses several security issues in ImageMagick, including: + Insufficient shell characters filtering allows code execution (CVE-2016-3714) + Server Side Request Forgery (CVE-2016-3718) + File deletion (CVE-2016-3715) + File moving (CVE-2016-3716) + Local file read (CVE-2016-3717) + To mitigate these issues, the default policy.xml config file has been + modified to disable all of the vulnerable coders. + For more information, see: + https://imagetragick.com + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3714 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3718 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3715 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3716 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3717 + (* Security fix *) ++--------------------------+ +Tue May 3 19:35:56 UTC 2016 +patches/packages/openssl-1.0.1t-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + Memory corruption in the ASN.1 encoder (CVE-2016-2108) + Padding oracle in AES-NI CBC MAC check (CVE-2016-2107) + EVP_EncodeUpdate overflow (CVE-2016-2105) + EVP_EncryptUpdate overflow (CVE-2016-2106) + ASN.1 BIO excessive memory allocation (CVE-2016-2109) + EBCDIC overread (CVE-2016-2176) + For more information, see: + https://www.openssl.org/news/secadv/20160503.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2108 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2107 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2105 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2106 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2109 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2176 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1t-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Mon May 2 19:42:54 UTC 2016 +patches/packages/mercurial-3.8.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes possible arbitrary code execution when converting Git + repos. Mercurial prior to 3.8 allowed arbitrary code execution when using + the convert extension on Git repos with hostile names. This could affect + automated code conversion services that allow arbitrary repository names. + This is a further side-effect of Git CVE-2015-7545. + Reported and fixed by Blake Burkhart. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3105 + (* Security fix *) +patches/packages/samba-4.2.12-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. ++--------------------------+ +Sat Apr 30 20:28:33 UTC 2016 +patches/packages/subversion-1.7.22-x86_64-2_slack14.1.txz: Rebuilt. + This update patches two security issues: + CVE-2016-2167: svnserve/sasl may authenticate users using the wrong realm. + CVE-2016-2168: Remotely triggerable DoS vulnerability in mod_authz_svn + during COPY/MOVE authorization check. + For more information, see: + http://subversion.apache.org/security/CVE-2016-2167-advisory.txt + http://subversion.apache.org/security/CVE-2016-2168-advisory.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2167 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2168 + (* Security fix *) ++--------------------------+ +Fri Apr 29 20:54:01 UTC 2016 +patches/packages/ntp-4.2.8p7-x86_64-1_slack14.1.txz: Upgraded. + This release patches several low and medium severity security issues: + CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering + CVE-2016-1549: Sybil vulnerability: ephemeral association attack, + AKA: ntp-sybil - MITIGATION ONLY + CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion + botch + CVE-2016-2517: Remote configuration trustedkey/requestkey values are not + properly validated + CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with + MATCH_ASSOC + CVE-2016-2519: ctl_getitem() return value not always checked + CVE-2016-1547: Validate crypto-NAKs, AKA: nak-dos + CVE-2016-1548: Interleave-pivot - MITIGATION ONLY + CVE-2015-7704: KoD fix: peer associations were broken by the fix for + NtpBug2901, AKA: Symmetric active/passive mode is broken + CVE-2015-8138: Zero Origin Timestamp Bypass, AKA: Additional KoD Checks + CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, + authdecrypt-timing, AKA: authdecrypt-timing + For more information, see: + http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8138 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1547 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1548 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1550 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1551 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2516 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2517 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2518 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2519 + (* Security fix *) +patches/packages/php-5.6.21-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.21 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3074 + (* Security fix *) ++--------------------------+ +Wed Apr 27 04:20:57 UTC 2016 +patches/packages/mozilla-firefox-38.8.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Sun Apr 24 00:53:14 UTC 2016 +patches/packages/ca-certificates-20160104-noarch-1_slack14.1.txz: Upgraded. + This update provides the latest CA certificates to check for the + authenticity of SSL connections. ++--------------------------+ +Mon Apr 18 22:21:58 UTC 2016 +patches/packages/glibc-zoneinfo-2016d-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Fri Apr 15 20:37:37 UTC 2016 +patches/packages/mozilla-thunderbird-45.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/samba-4.2.11-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the security issues known as "badlock" (or "sadlock"), + which may allow man-in-the-middle or denial-of-service attacks: + CVE-2015-5370 (Multiple errors in DCE-RPC code) + CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP) + CVE-2016-2111 (NETLOGON Spoofing Vulnerability) + CVE-2016-2112 (LDAP client and server don't enforce integrity) + CVE-2016-2113 (Missing TLS certificate validation) + CVE-2016-2114 ("server signing = mandatory" not enforced) + CVE-2016-2115 (SMB IPC traffic is not integrity protected) + CVE-2016-2118 (SAMR and LSA man in the middle attacks possible) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5370 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2112 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2113 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2114 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2115 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118 + (* Security fix *) ++--------------------------+ +Wed Apr 6 05:07:44 UTC 2016 +patches/packages/subversion-1.7.22-x86_64-1_slack14.1.txz: Upgraded. + Subversion servers and clients are vulnerable to a remotely triggerable + heap-based buffer overflow and out-of-bounds read that may allow remote + attackers to cause a denial of service or possibly execute arbitrary code + under the context of the targeted process. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5343 + (* Security fix *) ++--------------------------+ +Mon Apr 4 19:54:22 UTC 2016 +patches/packages/mozilla-thunderbird-38.7.2-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Fri Apr 1 21:17:37 UTC 2016 +patches/packages/dhcp-4.3.4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and (previously patched) security issues. +patches/packages/mercurial-3.7.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes security issues and bugs, including remote code execution + in binary delta decoding, arbitrary code execution with Git subrepos, and + arbitrary code execution when converting Git repos. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3630 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3068 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3069 + (* Security fix *) +patches/packages/php-5.6.20-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.20 + (* Security fix *) ++--------------------------+ +Fri Mar 25 20:43:59 UTC 2016 +patches/packages/glibc-zoneinfo-2016c-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/libevent-2.0.22-x86_64-1_slack14.1.txz: Upgraded. + Multiple integer overflows in the evbuffer API allow context-dependent + attackers to cause a denial of service or possibly have other unspecified + impact via "insanely large inputs" to the (1) evbuffer_add, + (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a + heap-based buffer overflow or an infinite loop. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272 + (* Security fix *) +patches/packages/mozilla-thunderbird-38.7.1-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Fri Mar 18 20:02:40 UTC 2016 +patches/packages/git-2.7.4-x86_64-1_slack14.1.txz: Upgraded. + NOTE: Issuing this patch again since the bug reporter listed the + wrong git version (2.7.1) as fixed. The vulnerability was actually + patched in git-2.7.4. + Fixed buffer overflows allowing server and client side remote code + execution in all git versions before 2.7.4. + For more information, see: + http://seclists.org/oss-sec/2016/q1/645 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2315 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2324 + (* Security fix *) +patches/packages/mozilla-thunderbird-38.7.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Thu Mar 17 22:09:16 UTC 2016 +patches/packages/mozilla-firefox-38.7.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefox.html + (* Security fix *) ++--------------------------+ +Tue Mar 15 21:31:49 UTC 2016 +patches/packages/git-2.7.3-x86_64-1_slack14.1.txz: Upgraded. + Fixed buffer overflows allowing server and client side remote code + execution in all git versions before 2.7.1. + For more information, see: + http://seclists.org/oss-sec/2016/q1/645 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2315 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2324 + (* Security fix *) +patches/packages/glibc-zoneinfo-2016b-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/seamonkey-2.40-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.seamonkey-project.org/releases/seamonkey2.40 + (* Security fix *) +patches/packages/seamonkey-solibs-2.40-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Thu Mar 10 23:43:47 UTC 2016 +patches/packages/openssh-7.2p2-x86_64-1_slack14.1.txz: Upgraded. + This release fixes a security bug: + sshd(8): sanitise X11 authentication credentials to avoid xauth + command injection when X11Forwarding is enabled. + For more information, see: + http://www.openssh.com/txt/x11fwd.adv + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3115 + (* Security fix *) ++--------------------------+ +Thu Mar 10 02:46:49 UTC 2016 +patches/packages/bind-9.9.8_P4-x86_64-1_slack14.1.txz: Upgraded. + Fixed security issues: + Fix resolver assertion failure due to improper DNAME handling when + parsing fetch reply messages. (CVE-2016-1286) [RT #41753] + Malformed control messages can trigger assertions in named and rndc. + (CVE-2016-1285) [RT #41666] + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285 + (* Security fix *) +patches/packages/mozilla-nss-3.23-x86_64-1_slack14.1.txz: Upgraded. + Upgraded to nss-3.23 and nspr-4.12. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/nss.html + (* Security fix *) ++--------------------------+ +Tue Mar 8 19:55:57 UTC 2016 +patches/packages/mozilla-firefox-38.7.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/samba-4.1.23-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs, and two security issues: + Incorrect ACL get/set allowed on symlink path (CVE-2015-7560). + Out-of-bounds read in internal DNS server (CVE-2016-0771). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7560 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0771 + (* Security fix *) ++--------------------------+ +Tue Mar 8 01:54:33 UTC 2016 +patches/packages/php-5.6.19-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.19 + (* Security fix *) ++--------------------------+ +Thu Mar 3 05:41:26 UTC 2016 +patches/packages/mailx-12.5-x86_64-2_slack14.1.txz: Rebuilt. + Drop SSLv2 support (no longer supported by OpenSSL), and fix security issues + that could allow a local attacker to cause mailx to execute arbitrary + shell commands through the use of a specially-crafted email address. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2771 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7844 + (* Security fix *) +patches/packages/openssl-1.0.1s-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800) + Double-free in DSA code (CVE-2016-0705) + Memory leak in SRP database lookups (CVE-2016-0798) + BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption (CVE-2016-0797) + Fix memory issues in BIO_*printf functions (CVE-2016-0799) + Side channel attack on modular exponentiation (CVE-2016-0702) + To avoid breaking the ABI, "enable-ssl2" is used, but all the vulnerable or + weak ciphers have been removed. + For more information, see: + https://www.openssl.org/news/secadv/20160301.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0705 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0798 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0797 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0799 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0702 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1s-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/php-5.6.18-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + For more information, see: + http://php.net/ChangeLog-5.php#5.6.18 + (* Security fix *) ++--------------------------+ +Fri Feb 26 22:54:05 UTC 2016 +patches/packages/libssh-0.7.3-x86_64-1_slack14.1.txz: Upgraded. + Fixed weak key generation. Due to a bug in the ephemeral secret key + generation for the diffie-hellman-group1 and diffie-hellman-group14 + methods, ephemeral secret keys of size 128 bits are generated, instead + of the recommended sizes of 1024 and 2048 bits, giving a practical + security of 63 bits. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0739 + (* Security fix *) ++--------------------------+ +Tue Feb 23 19:31:59 UTC 2016 +patches/packages/bind-9.9.8_P3-x86_64-1_slack14.1.txz: Upgraded. + This release fixes two possible denial-of-service issues: + render_ecs errors were mishandled when printing out a OPT record resulting + in a assertion failure. (CVE-2015-8705) [RT #41397] + Specific APL data could trigger a INSIST. (CVE-2015-8704) [RT #41396] + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8705 + (* Security fix *) +patches/packages/glibc-2.17-x86_64-11_slack14.1.txz: Rebuilt. + This update provides a patch to fix the stack-based buffer overflow in + libresolv that could allow specially crafted DNS responses to seize + control of execution flow in the DNS client (CVE-2015-7547). However, + due to a patch applied to Slackware's glibc back in 2009 (don't use the + gethostbyname4() lookup method as it was causing some cheap routers to + misbehave), we were not vulnerable to that issue. Nevertheless it seems + prudent to patch the overflows anyway even if we're not currently using + the code in question. Thanks to mancha for the backported patch. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7547 + (* Security fix *) +patches/packages/glibc-i18n-2.17-x86_64-11_slack14.1.txz: Rebuilt. +patches/packages/glibc-profile-2.17-x86_64-11_slack14.1.txz: Rebuilt. +patches/packages/glibc-solibs-2.17-x86_64-11_slack14.1.txz: Rebuilt. +patches/packages/libgcrypt-1.5.5-x86_64-1_slack14.1.txz: Upgraded. + Mitigate chosen cipher text attacks on ECDH with Weierstrass curves. + Use ciphertext blinding for Elgamal decryption. + For more information, see: + http://www.cs.tau.ac.IL/~tromer/ecdh/ + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7511 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591 + (* Security fix *) +patches/packages/ntp-4.2.8p6-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes + several low and medium severity vulnerabilities. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7973 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7974 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7975 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7976 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7977 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7978 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7979 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8138 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8158 + (* Security fix *) ++--------------------------+ +Sun Feb 14 19:40:04 UTC 2016 +patches/packages/mozilla-thunderbird-38.6.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Thu Feb 11 21:56:21 UTC 2016 +patches/packages/mozilla-firefox-38.6.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Mon Feb 8 22:08:35 UTC 2016 +patches/packages/curl-7.47.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where NTLM credentials are not checked + for proxy connection reuse. The effects of this flaw is that the application + could be reusing a proxy connection using the previously used credentials + and thus it could be given to or prevented access from resources that it + wasn't intended to. Thanks to Isaac Boukris. + For more information, see: + https://curl.haxx.se/docs/adv_20160127A.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0755 + (* Security fix *) +patches/packages/flac-1.3.1-x86_64-1_slack14.1.txz: Upgraded. + This update is needed by the latest version of libsndfile. +patches/packages/libsndfile-1.0.26-x86_64-1_slack14.1.txz: Upgraded. + This release fixes security issues which may allow attackers to cause + a denial of service, or possibly execute arbitrary code. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9496 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9756 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7805 + (* Security fix *) ++--------------------------+ +Wed Feb 3 22:39:25 UTC 2016 +patches/packages/glibc-zoneinfo-2016a-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. +patches/packages/mozilla-firefox-38.6.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/MPlayer-1.2_20160125-x86_64-1_slack14.1.txz: Upgraded. + This is the latest MPlayer-1.2 branch, identical to the 1.2.1 stable release. + The bundled ffmpeg has been upgraded to 2.8.5, which fixes two security + issues by which a remote attacker may conduct a cross-origin attack and read + arbitrary files on the system. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1897 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1898 + (* Security fix *) +patches/packages/openssl-1.0.1r-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issue: + SSLv2 doesn't block disabled ciphers (CVE-2015-3197). + For more information, see: + https://openssl.org/news/secadv/20160128.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1r-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/php-5.6.17-x86_64-1_slack14.1.txz: Upgraded. + This release fixes bugs and security issues. + ***************************************************************** + * IMPORTANT: READ BELOW ABOUT POTENTIALLY INCOMPATIBLE CHANGES * + ***************************************************************** + PHP 5.4.x has been declared EOL (end of life) and is no longer receiving + upstream support. PHP 5.5.x is also no longer on active support status and + security fixes will continue only until 5 months from now. For this reason + we have provided PHP 5.6 packages as security updates. Be aware that PHP + 5.6 is not 100% compatible with PHP 5.4, and some changes may be required + to existing web pages written for PHP 5.4. + For information on how to migrate from PHP 5.4, please see: + http://php.net/manual/en/migration55.php + http://php.net/manual/en/migration56.php + The final PHP 5.4 packages may be found in /pasture in case there is a need + to revert this update. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7803 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7804 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1903 + (* Security fix *) ++--------------------------+ +Fri Jan 15 02:29:54 UTC 2016 +patches/packages/openssh-7.1p2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes an information leak and a buffer overflow. In particular, + the information leak allows a malicious SSH server to steal the client's + private keys. Thanks to Qualys for reporting this issue. + For more information, see: + https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0778 + ***************************************************************** + * IMPORTANT: READ BELOW ABOUT POTENTIALLY INCOMPATIBLE CHANGES * + ***************************************************************** + Rather than backport the fix for the information leak (which is the only + hazardous flaw), we have upgraded to the latest OpenSSH. As of version + 7.0, OpenSSH has deprecated some older (and presumably less secure) + algorithms, and also (by default) only allows root login by public-key, + hostbased and GSSAPI authentication. Make sure that your keys and + authentication method will allow you to continue accessing your system + after the upgrade. + The release notes for OpenSSH 7.0 list the following incompatible changes + to be aware of: + * Support for the legacy SSH version 1 protocol is disabled by + default at compile time. + * Support for the 1024-bit diffie-hellman-group1-sha1 key exchange + is disabled by default at run-time. It may be re-enabled using + the instructions at http://www.openssh.com/legacy.html + * Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled + by default at run-time. These may be re-enabled using the + instructions at http://www.openssh.com/legacy.html + * Support for the legacy v00 cert format has been removed. + * The default for the sshd_config(5) PermitRootLogin option has + changed from "yes" to "prohibit-password". + * PermitRootLogin=without-password/prohibit-password now bans all + interactive authentication methods, allowing only public-key, + hostbased and GSSAPI authentication (previously it permitted + keyboard-interactive and password-less authentication if those + were enabled). + (* Security fix *) ++--------------------------+ +Wed Jan 13 00:01:23 UTC 2016 +patches/packages/dhcp-4.3.3_P1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a denial-of-service vulnerability. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8605 + (* Security fix *) +patches/packages/mozilla-thunderbird-38.5.1-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. +patches/packages/xscreensaver-5.34-x86_64-1_slack14.1.txz: Upgraded. + I promised jwz that I'd keep this updated in -stable when I removed (against + his wishes) the nag screen that complains if a year has passed since that + version was released. So, here's the latest one. ++--------------------------+ +Wed Dec 23 22:44:58 UTC 2015 +patches/packages/mozilla-thunderbird-38.5.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Wed Dec 23 05:20:09 UTC 2015 +patches/packages/blueman-r708-x86_64-4_slack14.1.txz: Rebuilt. + This update fixes a local privilege escalation vulnerability. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8612 + (* Security fix *) +patches/packages/mozilla-firefox-38.5.2esr-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. ++--------------------------+ +Fri Dec 18 05:28:25 UTC 2015 +patches/packages/grub-2.00-x86_64-3_slack14.1.txz: Rebuilt. + Patched bug where password protection during system startup may be + bypassed by hitting the backspace key 28 times giving a rescue shell. + Thanks to Hector Marco and Ismael Ripoll. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8370 + (* Security fix *) +patches/packages/libpng-1.4.19-x86_64-1_slack14.1.txz: Upgraded. + Fixed an out-of-range read in png_check_keyword(). Thanks to Qixue Xiao. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540 + (* Security fix *) ++--------------------------+ +Wed Dec 16 04:21:07 UTC 2015 +patches/packages/bind-9.9.8_P2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes three security issues: + Update allowed OpenSSL versions as named is potentially vulnerable + to CVE-2015-3193. + Insufficient testing when parsing a message allowed records with an + incorrect class to be be accepted, triggering a REQUIRE failure when + those records were subsequently cached. (CVE-2015-8000) + Address fetch context reference count handling error on socket error. + (CVE-2015-8461) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3193 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8461 + (* Security fix *) +patches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz: Upgraded. + Fixed incorrect implementation of png_set_PLTE() that uses png_ptr + not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126 + vulnerability. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472 + (* Security fix *) +patches/packages/mozilla-firefox-38.5.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/openssl-1.0.1q-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193). + Certificate verify crash with missing PSS parameter (CVE-2015-3194). + X509_ATTRIBUTE memory leak (CVE-2015-3195). + Race condition handling PSK identify hint (CVE-2015-3196). + Anon DH ServerKeyExchange with 0 p parameter (CVE-2015-1794). + For more information, see: + https://openssl.org/news/secadv_20151203.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1794 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3193 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3194 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3196 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1q-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Thu Dec 3 07:28:30 UTC 2015 +patches/packages/libpng-1.4.17-x86_64-1_slack14.1.txz: Upgraded. + Fixed buffer overflows in the png_set_PLTE(), png_get_PLTE(), + png_set_tIME(), and png_convert_to_rfc1123() functions that allow + attackers to cause a denial of service (application crash) or + possibly have unspecified other impact via a small bit-depth value + in an IHDR (aka image header) chunk in a PNG image. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7981 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126. + (* Security fix *) +patches/packages/mozilla-thunderbird-38.4.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Wed Nov 25 06:36:06 UTC 2015 +patches/packages/pcre-8.38-x86_64-1_slack14.1.txz: Upgraded. + Fixed overflows that could lead to a denial of service or the execution + of arbitrary code. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3210 + (* Security fix *) ++--------------------------+ +Sat Nov 14 21:35:57 UTC 2015 +patches/packages/seamonkey-2.39-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.39-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Fri Nov 6 01:15:43 UTC 2015 +patches/packages/mozilla-firefox-38.4.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-nss-3.20.1-x86_64-1_slack14.1.txz: Upgraded. + Upgraded to nss-3.20.1 and nspr-4.10.10. + This release contains security fixes and improvements. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7181 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7182 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7183 + (* Security fix *) ++--------------------------+ +Thu Oct 29 20:12:14 UTC 2015 +patches/packages/curl-7.45.0-x86_64-1_slack14.1.txz: Upgraded. + Fixes some security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3143 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3144 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3145 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3236 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3237 + (* Security fix *) +patches/packages/jasper-1.900.1-x86_64-4_slack14.1.txz: Rebuilt. + Applied many security and bug fixes. + Thanks to Heinz Wiesinger. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4516 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4517 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8137 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8138 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8157 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9029 + (* Security fix *) +patches/packages/ntp-4.2.8p4-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes + several low and medium severity vulnerabilities. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9750 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5196 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7691 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7692 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7702 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7705 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7848 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7849 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7850 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7851 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7852 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7853 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7854 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7855 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7871 + (* Security fix *) ++--------------------------+ +Thu Oct 8 23:09:33 UTC 2015 +patches/packages/mozilla-thunderbird-38.3.0-x86_64-2_slack14.1.txz: Rebuilt. + Recompiled with --enable-calendar. ++--------------------------+ +Mon Oct 5 17:24:30 UTC 2015 +patches/packages/glibc-zoneinfo-2015g-noarch-1_slack14.1.txz: Upgraded. + This package provides the latest timezone updates. ++--------------------------+ +Thu Oct 1 21:21:36 UTC 2015 +patches/packages/mozilla-thunderbird-38.3.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/php-5.4.45-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6834 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6835 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6836 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6837 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6838 + (* Security fix *) +patches/packages/seamonkey-2.38-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.38-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Wed Sep 23 01:10:36 UTC 2015 +patches/packages/mozilla-firefox-38.3.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Tue Sep 15 22:36:17 UTC 2015 +patches/packages/ca-certificates-20150426-noarch-2_slack14.1.txz: Rebuilt. + Patched update-ca-certificates to remove incompatible command operators + used to call 'run-parts'. Thanks to Stuart Winter. ++--------------------------+ +Thu Sep 3 22:02:39 UTC 2015 +patches/packages/seamonkey-2.35-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.35-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Wed Sep 2 19:36:31 UTC 2015 +patches/packages/bind-9.9.7_P3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two denial-of-service vulnerabilities: + + CVE-2015-5722 is a denial-of-service vector which can be + exploited remotely against a BIND server that is performing + validation on DNSSEC-signed records. Validating recursive + resolvers are at the greatest risk from this defect, but it has not + been ruled out that it could be exploited against an + authoritative-only nameserver under limited conditions. Servers + that are not performing validation are not vulnerable. However, + ISC does not recommend disabling validation as a workaround to + this issue as it exposes the server to other types of attacks. + Upgrading to the patched versions is the recommended solution. + All versions of BIND since 9.0.0 are vulnerable to CVE-2015-5722. + + CVE-2015-5986 is a denial-of-service vector which can be used + against a BIND server that is performing recursion. Validation + is not required. Recursive resolvers are at the greatest risk + from this defect, but it has not been ruled out that it could + be exploited against an authoritative-only nameserver under + limited conditions. + Only versions of BIND since 9.9.7 and 9.10.2 are vulnerable to + CVE-2015-5986. + For more information, see: + https://kb.isc.org/article/AA-01287/0 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5722 + https://kb.isc.org/article/AA-01291/0 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5986 + (* Security fix *) ++--------------------------+ +Tue Sep 1 23:29:22 UTC 2015 +patches/packages/gdk-pixbuf2-2.28.2-x86_64-2_slack14.1.txz: Rebuilt. + Gustavo Grieco discovered a heap overflow in the processing of BMP images + which may result in the execution of arbitrary code if a malformed image + is opened. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4491 + (* Security fix *) ++--------------------------+ +Sat Aug 29 05:27:29 UTC 2015 +patches/packages/mozilla-firefox-38.2.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Fri Aug 21 21:17:48 UTC 2015 +patches/packages/gnutls-3.3.17.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + http://www.gnutls.org/security.html#GNUTLS-SA-2015-2 + http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6251 + (* Security fix *) ++--------------------------+ +Fri Aug 14 19:31:42 UTC 2015 +patches/packages/mozilla-firefox-38.2.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-38.2.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Fri Aug 7 22:55:40 UTC 2015 +patches/packages/ca-certificates-20150426-noarch-1_slack14.1.txz: Upgraded. + This package updates to the latest CA certificates. +patches/packages/mozilla-firefox-38.1.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-nss-3.19.2-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/nss.html + (* Security fix *) ++--------------------------+ +Tue Jul 28 19:36:39 UTC 2015 +patches/packages/bind-9.9.7_P2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where an error in the handling of TKEY + queries can be exploited by an attacker for use as a denial-of-service + vector, as a constructed packet can use the defect to trigger a REQUIRE + assertion failure, causing BIND to exit. + Impact: + Both recursive and authoritative servers are vulnerable to this defect. + Additionally, exposure is not prevented by either ACLs or configuration + options limiting or denying service because the exploitable code occurs + early in the packet handling, before checks enforcing those boundaries. + Operators should take steps to upgrade to a patched version as soon as + possible. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477 + https://kb.isc.org/article/AA-01272 + (* Security fix *) ++--------------------------+ +Fri Jul 17 19:38:52 UTC 2015 +patches/packages/httpd-2.4.16-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + * CVE-2015-0253: Fix a crash with ErrorDocument 400 pointing to a local + URL-path with the INCLUDES filter active, introduced in 2.4.11. + * CVE-2015-0228: mod_lua: A maliciously crafted websockets PING after a + script calls r:wsupgrade() can cause a child process crash. + * CVE-2015-3183: core: Fix chunk header parsing defect. Remove + apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN + filter, parse chunks in a single pass with zero copy. Limit accepted + chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. + * CVE-2015-3185: Replacement of ap_some_auth_required (unusable in Apache + httpd 2.4) with new ap_some_authn_required and ap_force_authn hook. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0228 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0253 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3183 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3185 + (* Security fix *) +patches/packages/php-5.4.43-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2325 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2326 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3414 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3415 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3416 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4642 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4643 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4644 + (* Security fix *) ++--------------------------+ +Sun Jul 12 04:28:10 UTC 2015 +patches/packages/mozilla-thunderbird-38.1.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Thu Jul 9 18:29:23 UTC 2015 +patches/packages/openssl-1.0.1p-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issue: + Alternative chains certificate forgery (CVE-2015-1793). + During certificate verification, OpenSSL (starting from version 1.0.1n and + 1.0.2b) will attempt to find an alternative certificate chain if the first + attempt to build such a chain fails. An error in the implementation of this + logic can mean that an attacker could cause certain checks on untrusted + certificates to be bypassed, such as the CA flag, enabling them to use a + valid leaf certificate to act as a CA and "issue" an invalid certificate. + This issue will impact any application that verifies certificates including + SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication. + This issue affects OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o. + This issue was reported to OpenSSL on 24th June 2015 by Adam Langley/David + Benjamin (Google/BoringSSL). The fix was developed by the BoringSSL project. + For more information, see: + https://openssl.org/news/secadv_20150709.txt + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1793 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1p-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Tue Jul 7 22:59:17 UTC 2015 +patches/packages/bind-9.9.7_P1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where an attacker who can cause + a validating resolver to query a zone containing specifically constructed + contents can cause that resolver to fail an assertion and terminate due + to a defect in validation code. This means that a recursive resolver that + is performing DNSSEC validation can be deliberately stopped by an attacker + who can cause the resolver to perform a query against a + maliciously-constructed zone. This will result in a denial of service to + clients who rely on that resolver. + For more information, see: + https://kb.isc.org/article/AA-01267/ + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4620 + (* Security fix *) +patches/packages/cups-1.5.4-x86_64-4_slack14.1.txz: Rebuilt. + This release fixes a security issue: + CWE-911: Improper Update of Reference Count - CVE-2015-1158 + This bug could allow an attacker to upload a replacement CUPS + configuration file and mount further attacks. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158 + (* Security fix *) +patches/packages/mozilla-firefox-31.8.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/ntp-4.2.8p3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where under specific circumstances an + attacker can send a crafted packet to cause a vulnerable ntpd instance to + crash. Since this requires 1) ntpd set up to allow remote configuration + (not allowed by default), and 2) knowledge of the configuration password, + and 3) access to a computer entrusted to perform remote configuration, + the vulnerability is considered low-risk. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5146 + (* Security fix *) ++--------------------------+ +Fri Jun 12 17:58:45 UTC 2015 +patches/packages/openssl-1.0.1o-x86_64-1_slack14.1.txz: Upgraded. + New release to resolve 1.0.1n HMAC ABI incompatibility. +patches/packages/openssl-solibs-1.0.1o-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Thu Jun 11 21:31:47 UTC 2015 +patches/packages/openssl-1.0.1n-x86_64-1_slack14.1.txz: Upgraded. + Fixes several bugs and security issues: + o Malformed ECParameters causes infinite loop (CVE-2015-1788) + o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789) + o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790) + o CMS verify infinite loop with unknown hash function (CVE-2015-1792) + o Race condition handling NewSessionTicket (CVE-2015-1791) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1n-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/php-5.4.41-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some bugs and security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7243 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2325 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2326 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4021 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4022 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4024 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4025 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4026 + (* Security fix *) +patches/packages/qt-4.8.7-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. ++--------------------------+ +Sun May 17 04:35:46 UTC 2015 +patches/packages/mozilla-thunderbird-31.7.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Wed May 13 02:29:39 UTC 2015 +patches/packages/mozilla-firefox-31.7.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Tue May 12 07:17:33 UTC 2015 +patches/packages/mariadb-5.5.43-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2568 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2573 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0433 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0441 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0501 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2571 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0505 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0499 + (* Security fix *) +patches/packages/qt-4.8.6-x86_64-2_slack14.1.txz: Rebuilt. + QNAM: Fix upload corruptions when server closes connection + This patch fixes several upload corruptions if the server closes the + connection while/before we send data into it. + cherry picked from commit: qtbase/cff39fba10ffc10ee4dcfdc66ff6528eb +patches/packages/wpa_supplicant-2.4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes potential denial of service issues. + For more information, see: + http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt + http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt + http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt + http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1863 + (* Security fix *) ++--------------------------+ +Wed Apr 29 05:10:52 UTC 2015 +patches/packages/gnupg-1.4.19-x86_64-2_slack14.1.txz: Rebuilt. + Patched to fix spurious debug messages that may break sbopkg and slackpkg. + Thanks to Willy Sudiarto Raharjo. ++--------------------------+ +Tue Apr 21 23:44:00 UTC 2015 +patches/packages/bind-9.9.6_P2-x86_64-1_slack14.1.txz: Upgraded. + Fix some denial-of-service and other security issues. + For more information, see: + https://kb.isc.org/article/AA-01166/ + https://kb.isc.org/article/AA-01161/ + https://kb.isc.org/article/AA-01167/ + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1349 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8680 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3214 + (* Security fix *) +patches/packages/gnupg-1.4.19-x86_64-1_slack14.1.txz: Upgraded. + * Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. + See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. + * Fixed data-dependent timing variations in modular exponentiation + [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks + are Practical]. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837 + (* Security fix *) +patches/packages/httpd-2.4.12-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + * CVE-2014-3583 mod_proxy_fcgi: Fix a potential crash due to buffer + over-read, with response headers' size above 8K. + * CVE-2014-3581 mod_cache: Avoid a crash when Content-Type has an + empty value. PR 56924. + * CVE-2014-8109 mod_lua: Fix handling of the Require line when a + LuaAuthzProvider is used in multiple Require directives with + different arguments. PR57204. + * CVE-2013-5704 core: HTTP trailers could be used to replace HTTP + headers late during request processing, potentially undoing or + otherwise confusing modules that examined or modified request + headers earlier. Adds "MergeTrailers" directive to restore legacy + behavior. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3583 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3581 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8109 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704 + (* Security fix *) +patches/packages/libssh-0.6.4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0017 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8132 + (* Security fix *) +patches/packages/mozilla-firefox-31.6.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-31.6.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/mutt-1.5.23-x86_64-2_slack14.1.txz: Rebuilt. + Patched a vulnerability where malformed headers can cause mutt to crash. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9116 + (* Security fix *) +patches/packages/ntp-4.2.8p2-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes the + following medium-severity vulnerabilities involving private key + authentication: + * ntpd accepts unauthenticated packets with symmetric key crypto. + * Authentication doesn't protect symmetric associations against DoS attacks. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1798 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1799 + (* Security fix *) +patches/packages/openssl-1.0.1m-x86_64-1_slack14.1.txz: Upgraded. + Fixes several bugs and security issues: + o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286) + o ASN.1 structure reuse memory corruption fix (CVE-2015-0287) + o PKCS7 NULL pointer dereferences fix (CVE-2015-0289) + o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293) + o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209) + o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288) + o Removed the export ciphers from the DEFAULT ciphers + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0286 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0289 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0293 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0209 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0288 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1m-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/php-5.4.40-x86_64-1_slack14.1.txz: Upgraded. + This update fixes some security issues. + Please note that this package build also moves the configuration files + from /etc/httpd to /etc, /etc/php.d, and /etc/php-fpm.d. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9709 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0231 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1351 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1352 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2301 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2305 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2331 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2783 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3330 + (* Security fix *) +patches/packages/ppp-2.4.5-x86_64-3_slack14.1.txz: Rebuilt. + Fixed a potential security issue in parsing option files. + Fixed remotely triggerable PID overflow that causes pppd to crash. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3158 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3310 + (* Security fix *) +patches/packages/proftpd-1.3.4e-x86_64-1_slack14.1.txz: Upgraded. + Patched an issue where mod_copy allowed unauthenticated copying + of files via SITE CPFR/CPTO. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3306 + (* Security fix *) +patches/packages/qt-4.8.6-x86_64-1_slack14.1.txz: Upgraded. + Fixed issues with BMP, ICO, and GIF handling that could lead to a denial + of service or the execution of arbitrary code when processing malformed + images. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0295 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1858 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1859 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1860 + (* Security fix *) +patches/packages/seamonkey-2.33.1-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.33.1-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Thu Mar 5 21:56:15 UTC 2015 +patches/packages/samba-4.1.17-x86_64-1_slack14.1.txz: Upgraded. + This package fixes security issues since the last update: + BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer + in netlogon server could lead to security vulnerability. + BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference + a NULL pointer. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240 + (* Security fix *) ++--------------------------+ +Thu Feb 26 01:06:11 UTC 2015 +patches/packages/mozilla-firefox-31.5.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-31.5.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Mon Feb 16 19:33:36 UTC 2015 +patches/packages/btrfs-progs-20150213-x86_64-1.txz: Upgraded. + Added the header files to the package. Thanks to Vincent Batts. +patches/packages/patch-2.7.4-x86_64-1_slack14.1.txz: Upgraded. + Patch no longer follows symbolic links to input and output files. This + ensures that symbolic links created by git-style patches cannot cause + patch to write outside the working directory. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1196 + (* Security fix *) +patches/packages/seamonkey-2.32.1-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.32.1-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/sudo-1.8.12-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a potential security issue by only passing the TZ + environment variable it is considered safe. This prevents exploiting bugs + in glibc's TZ parser that could be used to read files that the user does + not have access to, or to cause a denial of service. + For more information, see: + http://www.sudo.ws/sudo/alerts/tz.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9680 + (* Security fix *) ++--------------------------+ +Wed Jan 28 19:23:00 UTC 2015 +patches/packages/glibc-2.17-x86_64-10_slack14.1.txz: Rebuilt. + This update patches a security issue __nss_hostname_digits_dots() function + of glibc which may be triggered through the gethostbyname*() set of + functions. This flaw could allow local or remote attackers to take control + of a machine running a vulnerable version of glibc. Thanks to Qualys for + discovering this issue (also known as the GHOST vulnerability.) + For more information, see: + https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235 + (* Security fix *) +patches/packages/glibc-i18n-2.17-x86_64-10_slack14.1.txz: Rebuilt. +patches/packages/glibc-profile-2.17-x86_64-10_slack14.1.txz: Rebuilt. +patches/packages/glibc-solibs-2.17-x86_64-10_slack14.1.txz: Rebuilt. +patches/packages/glibc-zoneinfo-2014j-noarch-1.txz: Upgraded. + Upgraded to tzcode2014j and tzdata2014j. ++--------------------------+ +Wed Jan 21 03:10:01 UTC 2015 +patches/packages/samba-4.1.16-x86_64-1_slack14.1.txz: Upgraded. + This update is a security release in order to address CVE-2014-8143 + (Elevation of privilege to Active Directory Domain Controller). + Samba's AD DC allows the administrator to delegate creation of user or + computer accounts to specific users or groups. However, all released + versions of Samba's AD DC did not implement the additional required + check on the UF_SERVER_TRUST_ACCOUNT bit in the userAccountControl + attributes. Most Samba deployments are not of the AD Domain Controller, + but are of the classic domain controller, the file server or print server. + Only the Active Directory Domain Controller is affected by this issue. + Additionally, most sites running the AD Domain Controller do not configure + delegation for the creation of user or computer accounts, and so are not + vulnerable to this issue, as no writes are permitted to the + userAccountControl attribute, no matter what the value. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8143 + (* Security fix *) ++--------------------------+ +Sat Jan 17 04:26:41 UTC 2015 +patches/packages/freetype-2.5.5-x86_64-1_slack14.1.txz: Upgraded. + This release fixes a security bug that could cause freetype to crash + or run programs upon opening a specially crafted file. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2240 + (* Security fix *) +patches/packages/mozilla-firefox-31.4.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-31.4.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/seamonkey-2.32-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.32-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Fri Jan 9 17:47:53 UTC 2015 +patches/packages/openssl-1.0.1k-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues: + DTLS segmentation fault in dtls1_get_record (CVE-2014-3571) + DTLS memory leak in dtls1_buffer_record (CVE-2015-0206) + no-ssl3 configuration sets method to NULL (CVE-2014-3569) + ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572) + RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204) + DH client certificates accepted without verification [Server] (CVE-2015-0205) + Certificate fingerprints can be modified (CVE-2014-8275) + Bignum squaring may produce incorrect results (CVE-2014-3570) + For more information, see: + https://www.openssl.org/news/secadv_20150108.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3571 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0206 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3569 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3572 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0205 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8275 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3570 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1k-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Tue Dec 23 00:05:23 UTC 2014 +patches/packages/ntp-4.2.8-x86_64-1_slack14.1.txz: Upgraded. + In addition to bug fixes and enhancements, this release fixes + several high-severity vulnerabilities discovered by Neel Mehta + and Stephen Roettger of the Google Security Team. + For more information, see: + https://www.kb.cert.org/vuls/id/852879 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9293 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9294 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9295 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9296 + (* Security fix *) +patches/packages/php-5.4.36-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + #68545 (NULL pointer dereference in unserialize.c). + #68594 (Use after free vulnerability in unserialize()). (CVE-2014-8142) + #68283 (fileinfo: out-of-bounds read in elf note headers). (CVE-2014-3710) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3710 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8142 + (* Security fix *) +patches/packages/xorg-server-1.14.3-x86_64-3_slack14.1.txz: Rebuilt. + This update fixes many security issues discovered by Ilja van Sprundel, + a security researcher with IOActive. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8091 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8092 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8093 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8094 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8095 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8096 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8097 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8098 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8099 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8100 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8101 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8102 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8103 + (* Security fix *) +patches/packages/xorg-server-xephyr-1.14.3-x86_64-3_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xnest-1.14.3-x86_64-3_slack14.1.txz: Rebuilt. +patches/packages/xorg-server-xvfb-1.14.3-x86_64-3_slack14.1.txz: Rebuilt. ++--------------------------+ +Thu Dec 11 01:18:35 UTC 2014 +patches/packages/bind-9.9.6_P1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue where a failure to place limits on + delegation chaining can allow an attacker to crash BIND or cause memory + exhaustion. + For more information, see: + https://kb.isc.org/article/AA-01216 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500 + (* Security fix *) +patches/packages/mozilla-firefox-31.3.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/openssh-6.7p1-x86_64-2_slack14.1.txz: Rebuilt. + Restored support for tcpwrappers that was dropped by upstream. + Thanks to mancha. +patches/packages/openvpn-2.3.6-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue that allows remote authenticated + users to cause a denial of service (server crash) via a small control + channel packet. + For more information, see: + https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8104 + (* Security fix *) +patches/packages/pidgin-2.10.11-x86_64-1_slack14.1.txz: Upgraded. + This update contains login fixes for MSN and some XMPP servers. +patches/packages/seamonkey-2.31-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.31-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/wpa_supplicant-2.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a remote command-execution vulnerability caused by a + failure to adequately sanitize user-supplied input. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3686 + (* Security fix *) ++--------------------------+ +Wed Dec 3 07:03:12 UTC 2014 +patches/packages/mozilla-thunderbird-31.3.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Sun Nov 16 22:41:20 UTC 2014 +patches/packages/mozilla-thunderbird-31.2.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Thu Nov 13 20:45:54 UTC 2014 +patches/packages/mariadb-5.5.40-x86_64-2_slack14.1.txz: Rebuilt. + Reverted change to my_config.h that breaks compiling many applications + that link against the MariaDB libraries. + Thanks to Willy Sudiarto Raharjo. +patches/packages/pidgin-2.10.10-x86_64-2_slack14.1.txz: Rebuilt. + Fix Gadu-Gadu protocol when GnuTLS is not used. Thanks to mancha. ++--------------------------+ +Fri Nov 7 21:02:55 UTC 2014 +patches/packages/bash-4.2.053-x86_64-1_slack14.1.txz: Upgraded. + Applied all upstream patches. The previously applied patch requiring + a specific prefix/suffix in order to parse variables for functions + closed all of the known vulnerabilities anyway, but it's clear that + until all the patches were applied that the "is this still vulnerable" + questions were not going to end... +patches/packages/xfce4-weather-plugin-0.8.4-x86_64-1_slack14.1.txz: Upgraded. + Package upgraded to fix the API used to fetch weather data. ++--------------------------+ +Tue Nov 4 00:05:23 UTC 2014 +patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464 + (* Security fix *) +patches/packages/mozilla-firefox-31.2.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/php-5.4.34-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + #68044 (Integer overflow in unserialize() (32-bits only)). (CVE-2014-3669) + #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670) + #68027 (Global buffer overflow in mkgmtime() function). (CVE-2014-3668) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668 + (* Security fix *) +patches/packages/seamonkey-2.30-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.30-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Wed Oct 29 18:21:12 UTC 2014 +patches/packages/wget-1.14-x86_64-3_slack14.1.txz: Rebuilt. + This update fixes a symlink vulnerability that could allow an attacker + to write outside of the expected directory. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4877 + (* Security fix *) ++--------------------------+ +Fri Oct 24 21:11:15 UTC 2014 +patches/packages/glibc-2.17-x86_64-9_slack14.1.txz: Rebuilt. + Rebuilt using --enable-kernel=2.6.32 for better compatibility with + host kernels when running Slackware in a VM or container. + Thanks to Vincent Batts and Eric Hameleers. +patches/packages/glibc-i18n-2.17-x86_64-9_slack14.1.txz: Rebuilt. +patches/packages/glibc-profile-2.17-x86_64-9_slack14.1.txz: Rebuilt. +patches/packages/glibc-solibs-2.17-x86_64-9_slack14.1.txz: Rebuilt. ++--------------------------+ +Fri Oct 24 04:55:44 UTC 2014 +patches/packages/glibc-2.17-x86_64-8_slack14.1.txz: Rebuilt. + This update fixes several security issues, and adds an extra security + hardening patch from Florian Weimer. Thanks to mancha for help with + tracking and backporting patches. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4424 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4458 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040 + (* Security fix *) +patches/packages/glibc-i18n-2.17-x86_64-8_slack14.1.txz: Rebuilt. +patches/packages/glibc-profile-2.17-x86_64-8_slack14.1.txz: Rebuilt. +patches/packages/glibc-solibs-2.17-x86_64-8_slack14.1.txz: Rebuilt. +patches/packages/glibc-zoneinfo-2014i-noarch-1_slack14.1.txz: Rebuilt. + Upgraded to tzcode2014i and tzdata2014i. +pidgin-2.10.10-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues: + Insufficient SSL certificate validation (CVE-2014-3694) + Remote crash parsing malformed MXit emoticon (CVE-2014-3695) + Remote crash parsing malformed Groupwise message (CVE-2014-3696) + Malicious smiley themes could alter arbitrary files (CVE-2014-3697) + Potential information leak from XMPP (CVE-2014-3698) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3694 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3695 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3696 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3697 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3698 + (* Security fix *) ++--------------------------+ +Mon Oct 20 22:21:45 UTC 2014 +patches/packages/openssh-6.7p1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue that allows remote servers to trigger + the skipping of SSHFP DNS RR checking by presenting an unacceptable + HostCertificate. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2653 + (* Security fix *) ++--------------------------+ +Wed Oct 15 17:28:59 UTC 2014 +patches/packages/openssl-solibs-1.0.1j-x86_64-1_slack14.1.txz: Upgraded. + (* Security fix *) +patches/packages/openssl-1.0.1j-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues: + SRTP Memory Leak (CVE-2014-3513): + A flaw in the DTLS SRTP extension parsing code allows an attacker, who + sends a carefully crafted handshake message, to cause OpenSSL to fail + to free up to 64k of memory causing a memory leak. This could be + exploited in a Denial Of Service attack. + Session Ticket Memory Leak (CVE-2014-3567): + When an OpenSSL SSL/TLS/DTLS server receives a session ticket the + integrity of that ticket is first verified. In the event of a session + ticket integrity check failing, OpenSSL will fail to free memory + causing a memory leak. By sending a large number of invalid session + tickets an attacker could exploit this issue in a Denial Of Service + attack. + SSL 3.0 Fallback protection: + OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications + to block the ability for a MITM attacker to force a protocol + downgrade. + Some client applications (such as browsers) will reconnect using a + downgraded protocol to work around interoperability bugs in older + servers. This could be exploited by an active man-in-the-middle to + downgrade connections to SSL 3.0 even if both sides of the connection + support higher protocols. SSL 3.0 contains a number of weaknesses + including POODLE (CVE-2014-3566). + Build option no-ssl3 is incomplete (CVE-2014-3568): + When OpenSSL is configured with "no-ssl3" as a build option, servers + could accept and complete a SSL 3.0 handshake, and clients could be + configured to send them. + For more information, see: + https://www.openssl.org/news/secadv_20141015.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568 + (* Security fix *) ++--------------------------+ +Mon Sep 29 18:41:23 UTC 2014 +patches/packages/bash-4.2.050-x86_64-1_slack14.1.txz: Upgraded. + Another bash update. Here's some information included with the patch: + "This patch changes the encoding bash uses for exported functions to avoid + clashes with shell variables and to avoid depending only on an environment + variable's contents to determine whether or not to interpret it as a shell + function." + After this update, an environment variable will not go through the parser + unless it follows this naming structure: BASH_FUNC_*%% + Most scripts never expected to import functions from environment variables, + so this change (although not backwards compatible) is not likely to break + many existing scripts. It will, however, close off access to the parser as + an attack surface in the vast majority of cases. There's already another + vulnerability similar to CVE-2014-6271 for which there is not yet a fix, + but this hardening patch prevents it (and likely many more similar ones). + Thanks to Florian Weimer and Chet Ramey. + (* Security fix *) ++--------------------------+ +Sun Sep 28 23:07:39 UTC 2014 +patches/packages/mozilla-firefox-24.8.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.8.1-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/seamonkey-2.29.1-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.29.1-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Fri Sep 26 22:23:32 UTC 2014 +patches/packages/bash-4.2.049-x86_64-1_slack14.1.txz: Upgraded. + This is essentially a rebuild as the preliminary patch for CVE-2014-7169 + has been accepted by upstream and is now signed. This also bumps the + patchlevel, making it easy to tell this is the fixed version. + Possibly more changes to come, given the ongoing discussions on oss-sec. ++--------------------------+ +Thu Sep 25 19:55:13 UTC 2014 +patches/packages/bash-4.2.048-x86_64-2_slack14.1.txz: Rebuilt. + Patched an additional trailing string processing vulnerability discovered + by Tavis Ormandy. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 + (* Security fix *) ++--------------------------+ +Wed Sep 24 22:52:53 UTC 2014 +patches/packages/bash-4.2.048-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a vulnerability in bash related to how environment + variables are processed: trailing code in function definitions was + executed, independent of the variable name. In many common configurations + (such as the use of CGI scripts), this vulnerability is exploitable over + the network. Thanks to Stephane Chazelas for discovering this issue. + For more information, see: + http://seclists.org/oss-sec/2014/q3/650 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 + (* Security fix *) +patches/packages/mozilla-nss-3.16.5-x86_64-1_slack14.1.txz: Upgraded. + Fixed an RSA Signature Forgery vulnerability. + For more information, see: + https://www.mozilla.org/security/announce/2014/mfsa2014-73.html + (* Security fix *) ++--------------------------+ +Tue Sep 9 18:01:05 UTC 2014 +patches/packages/seamonkey-2.29-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + (* Security fix *) +patches/packages/seamonkey-solibs-2.29-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Thu Sep 4 19:43:25 UTC 2014 +patches/packages/mozilla-firefox-24.8.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.8.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/php-5.4.32-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2497 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3538 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3587 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3597 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4670 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4698 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5120 + (* Security fix *) ++--------------------------+ +Thu Aug 28 23:17:47 UTC 2014 +patches/packages/mozilla-nss-3.16.4-x86_64-1.txz: Upgraded. + Upgraded to nss-3.16.4 and nspr-4.10.7. ++--------------------------+ +Fri Aug 8 19:02:50 UTC 2014 +patches/packages/openssl-1.0.1i-x86_64-1_slack14.1.txz: Upgraded. + This update fixes several security issues: + Double Free when processing DTLS packets (CVE-2014-3505) + DTLS memory exhaustion (CVE-2014-3506) + DTLS memory leak from zero-length fragments (CVE-2014-3507) + Information leak in pretty printing functions (CVE-2014-3508) + Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) + OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) + OpenSSL TLS protocol downgrade attack (CVE-2014-3511) + SRP buffer overrun (CVE-2014-3512) + Crash with SRP ciphersuite in Server Hello message (CVE-2014-5139) + For more information, see: + https://www.openssl.org/news/secadv_20140806.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3505 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3506 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3508 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3509 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3510 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3511 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3512 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5139 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1i-x86_64-1_slack14.1.txz: Upgraded. + (* Security fix *) ++--------------------------+ +Fri Aug 1 21:13:18 UTC 2014 +patches/packages/dhcpcd-6.0.5-x86_64-3_slack14.1.txz: Rebuilt. + This update fixes a security issue where a specially crafted packet + received from a malicious DHCP server causes dhcpcd to enter an infinite + loop causing a denial of service. + Thanks to Tobias Stoeckmann for the bug report. + (* Security fix *) +patches/packages/samba-4.1.11-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a remote code execution attack on unauthenticated nmbd + NetBIOS name services. A malicious browser can send packets that may + overwrite the heap of the target nmbd NetBIOS name services daemon. + It may be possible to use this to generate a remote code execution + vulnerability as the superuser (root). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3560 + (* Security fix *) +patches/packages/xscreensaver-5.29-x86_64-1_slack14.1.txz: Upgraded. + Disabled nag screen that says "This version of XScreenSaver is very old! + Please upgrade!" when the age of the software exceeds 12 months. ++--------------------------+ +Wed Jul 23 23:00:34 UTC 2014 +patches/packages/httpd-2.4.10-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + *) SECURITY: CVE-2014-0117 (cve.mitre.org) + mod_proxy: Fix crash in Connection header handling which + allowed a denial of service attack against a reverse proxy + with a threaded MPM. [Ben Reser] + *) SECURITY: CVE-2014-0118 (cve.mitre.org) + mod_deflate: The DEFLATE input filter (inflates request bodies) now + limits the length and compression ratio of inflated request bodies to + avoid denial of sevice via highly compressed bodies. See directives + DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, + and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener] + *) SECURITY: CVE-2014-0226 (cve.mitre.org) + Fix a race condition in scoreboard handling, which could lead to + a heap buffer overflow. [Joe Orton, Eric Covener] + *) SECURITY: CVE-2014-0231 (cve.mitre.org) + mod_cgid: Fix a denial of service against CGI scripts that do + not consume stdin that could lead to lingering HTTPD child processes + filling up the scoreboard and eventually hanging the server. By + default, the client I/O timeout (Timeout directive) now applies to + communication with scripts. The CGIDScriptTimeout directive can be + used to set a different timeout for communication with scripts. + [Rainer Jung, Eric Covener, Yann Ylavic] + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0117 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0118 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231 + (* Security fix *) +patches/packages/mozilla-firefox-24.7.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.7.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Sat Jul 12 02:24:10 UTC 2014 +patches/packages/php-5.4.30-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0207 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3478 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3479 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3480 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3487 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3515 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3981 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4049 + (* Security fix *) ++--------------------------+ +Tue Jun 24 22:35:07 UTC 2014 +patches/packages/bind-9.9.5_P1-x86_64-1_slack14.1.txz: Upgraded. + This fixes security issues and other bugs. Please note that the first + CVE only affects Windows, and the second one was claimed to be fixed by + an earlier version of BIND. But we'll update anyway just in case. :-) + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6230 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 + (* Security fix *) +patches/packages/gnupg-1.4.17-x86_64-1_slack14.1.txz: Upgraded. + This release includes a security fix to stop a denial of service using + garbled compressed data packets which can be used to put gpg into an + infinite loop. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617 + (* Security fix *) +patches/packages/gnupg2-2.0.24-x86_64-1_slack14.1.txz: Upgraded. + This release includes a security fix to stop a denial of service using + garbled compressed data packets which can be used to put gpg into an + infinite loop. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617 + (* Security fix *) +patches/packages/samba-4.1.9-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues, including a flaw in Samba's + internal DNS server which can be exploited to cause a denial of service, + a flaw in SRV_SNAPSHOT_ARRAY that permits attackers to leverage + configurations that use shadow_copy* for vfs objects to reveal potentially + private server information, a denial of service on the nmbd NetBIOS name + services daemon, and a denial of service crash involving overwriting + memory on an authenticated connection to the smbd file server. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0178 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0239 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0244 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3493 + (* Security fix *) +patches/packages/seamonkey-2.26.1-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.26.1-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Tue Jun 17 22:19:30 UTC 2014 +patches/packages/yptools-2.14-x86_64-3_slack14.1.txz: Rebuilt. + Corrected yppasswd patch that was causing password changes to fail. + Thanks to Henrik Carlqvist. ++--------------------------+ +Thu Jun 12 05:11:52 UTC 2014 +patches/packages/mozilla-thunderbird-24.6.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Mon Jun 9 20:16:02 UTC 2014 +patches/packages/php-5.4.29-x86_64-1_slack14.1.txz: Upgraded. + This update fixes bugs and security issues, including a possible denial + of service, and an issue where insecure default permissions on the FPM + socket may allow local users to run arbitrary code as the apache user. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0185 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0237 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238 + (* Security fix *) ++--------------------------+ +Sat Jun 7 02:47:42 UTC 2014 +patches/packages/mozilla-firefox-24.6.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) ++--------------------------+ +Fri Jun 6 04:27:01 UTC 2014 +patches/packages/gnutls-3.1.25-x86_64-1_slack14.1.txz: Upgraded. + A security issue has been corrected in gnutls. This vulnerability + affects the client side of the gnutls library. A server that sends + a specially crafted ServerHello could corrupt the memory of a requesting + client. This may allow a remote attacker to execute arbitrary code. + Additional vulnerabilities in the embedded libtasn1 library have also + been patched. + Thanks to mancha for the backported patches. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3465 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469 + (* Security fix *) +patches/packages/libtasn1-3.6-x86_64-1_slack14.1.txz: Upgraded. + Multiple security issues have been corrected in the libtasn1 library. + These errors allow a remote attacker to cause a denial of service, or + possibly to execute arbitrary code. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469 + (* Security fix *) +patches/packages/openssl-1.0.1h-x86_64-1_slack14.1.txz: Upgraded. + Multiple security issues have been corrected, including a possible + man-in-the-middle attack where weak keying material is forced, denial + of service, and the execution of arbitrary code. + For more information, see: + http://www.openssl.org/news/secadv_20140605.txt + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1h-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/sendmail-8.14.9-x86_64-1_slack14.1.txz: Upgraded. + This release fixes one security related bug by properly closing file + descriptors (except stdin, stdout, and stderr) before executing programs. + This bug could enable local users to interfere with an open SMTP + connection if they can execute their own program for mail delivery + (e.g., via procmail or the prog mailer). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3956 + (* Security fix *) +patches/packages/sendmail-cf-8.14.9-noarch-1_slack14.1.txz: Upgraded. ++--------------------------+ +Sun Jun 1 19:48:54 UTC 2014 +patches/packages/mariadb-5.5.37-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0384 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2419 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2430 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2431 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2432 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2436 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2438 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2440 + (* Security fix *) ++--------------------------+ +Mon May 12 02:24:36 UTC 2014 +patches/packages/seamonkey-2.26-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.26-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Tue Apr 29 23:35:59 UTC 2014 +patches/packages/mozilla-firefox-24.5.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.5.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) ++--------------------------+ +Tue Apr 22 17:31:48 UTC 2014 +patches/packages/openssh-6.6p1-x86_64-3_slack14.1.txz: Rebuilt. + Fixed a bug with curve25519-sha256 that caused a key exchange failure in + about 1 in 512 connection attempts. ++--------------------------+ +Mon Apr 21 20:09:48 UTC 2014 +patches/packages/libyaml-0.1.6-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a heap overflow in URI escape parsing of YAML in Ruby, + where a specially crafted string could cause a heap overflow leading to + arbitrary code execution. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525 + https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/ + (* Security fix *) +patches/packages/php-5.4.27-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue in the in the awk script detector + which allows context-dependent attackers to cause a denial of service + (CPU consumption) via a crafted ASCII file that triggers a large amount + of backtracking. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345 + (* Security fix *) ++--------------------------+ +Tue Apr 8 14:19:51 UTC 2014 +patches/packages/openssl-1.0.1g-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + A missing bounds check in the handling of the TLS heartbeat extension + can be used to reveal up to 64k of memory to a connected client or server. + Thanks for Neel Mehta of Google Security for discovering this bug and to + Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for + preparing the fix. + Fix for the attack described in the paper "Recovering OpenSSL + ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack" + by Yuval Yarom and Naomi Benger. Details can be obtained from: + http://eprint.iacr.org/2014/140 + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1g-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Mon Mar 31 20:30:28 UTC 2014 +patches/packages/apr-1.5.0-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/apr-util-1.5.3-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/httpd-2.4.9-x86_64-2_slack14.1.txz: Rebuilt. + Recompiled against new apr/apr-util to restore missing mod_mpm_event.so. +patches/packages/openssh-6.6p1-x86_64-2_slack14.1.txz: Rebuilt. + Fixed the rc.sshd script to create an ed25519 host key if it doesn't + already exist. ++--------------------------+ +Fri Mar 28 03:43:11 UTC 2014 +patches/packages/curl-7.36.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes four security issues. + For more information, see: + http://curl.haxx.se/docs/adv_20140326A.html + http://curl.haxx.se/docs/adv_20140326B.html + http://curl.haxx.se/docs/adv_20140326C.html + http://curl.haxx.se/docs/adv_20140326D.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1263 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2522 + (* Security fix *) +patches/packages/httpd-2.4.9-x86_64-1_slack14.1.txz: Upgraded. + This update addresses two security issues. + Segfaults with truncated cookie logging. mod_log_config: Prevent segfaults + when logging truncated cookies. Clean up the cookie logging parser to + recognize only the cookie=value pairs, not valueless cookies. + mod_dav: Keep track of length of cdata properly when removing leading + spaces. Eliminates a potential denial of service from specifically crafted + DAV WRITE requests. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438 + (* Security fix *) +patches/packages/mozilla-firefox-24.4.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-nss-3.16-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue: + The cert_TestHostName function in lib/certdb/certdb.c in the + certificate-checking implementation in Mozilla Network Security Services + (NSS) before 3.16 accepts a wildcard character that is embedded in an + internationalized domain name's U-label, which might allow man-in-the-middle + attackers to spoof SSL servers via a crafted certificate. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1492 + (* Security fix *) +patches/packages/mozilla-thunderbird-24.4.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/openssh-6.6p1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a security issue when using environment passing with + a sshd_config(5) AcceptEnv pattern with a wildcard. OpenSSH could be + tricked into accepting any environment variable that contains the + characters before the wildcard character. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2532 + (* Security fix *) +patches/packages/seamonkey-2.25-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.25-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Sun Mar 16 02:52:28 UTC 2014 +patches/packages/php-5.4.26-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a flaw where a specially crafted data file may cause a + segfault or 100% CPU consumption when a web page uses fileinfo() on it. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943 + (* Security fix *) ++--------------------------+ +Fri Mar 14 00:44:48 UTC 2014 +patches/packages/samba-4.1.6-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + CVE-2013-4496: + Samba versions 3.4.0 and above allow the administrator to implement + locking out Samba accounts after a number of bad password attempts. + However, all released versions of Samba did not implement this check for + password changes, such as are available over multiple SAMR and RAP + interfaces, allowing password guessing attacks. + CVE-2013-6442: + Samba versions 4.0.0 and above have a flaw in the smbcacls command. If + smbcacls is used with the "-C|--chown name" or "-G|--chgrp name" + command options it will remove the existing ACL on the object being + modified, leaving the file or directory unprotected. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6442 + (* Security fix *) ++--------------------------+ +Thu Mar 13 03:32:38 UTC 2014 +patches/packages/mutt-1.5.23-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a buffer overflow where malformed RFC2047 header + lines could result in denial of service or potentially the execution + of arbitrary code as the user running mutt. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 + (* Security fix *) ++--------------------------+ +Tue Mar 11 07:06:18 UTC 2014 +patches/packages/udisks-1.0.5-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a stack-based buffer overflow when handling long path + names. A malicious, local user could use this flaw to create a + specially-crafted directory structure that could lead to arbitrary code + execution with the privileges of the udisks daemon (root). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0004 + (* Security fix *) +patches/packages/udisks2-2.1.3-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a stack-based buffer overflow when handling long path + names. A malicious, local user could use this flaw to create a + specially-crafted directory structure that could lead to arbitrary code + execution with the privileges of the udisks daemon (root). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0004 + (* Security fix *) ++--------------------------+ +Mon Mar 3 23:32:18 UTC 2014 +patches/packages/gnutls-3.1.22-x86_64-1_slack14.1.txz: Upgraded. + Fixed a security issue where a specially crafted certificate could + bypass certificate validation checks. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 + (* Security fix *) ++--------------------------+ +Thu Feb 27 20:43:28 UTC 2014 +patches/packages/subversion-1.7.16-x86_64-1_slack14.1.txz: Upgraded. + Fix denial of service bugs. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4505 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 + (* Security fix *) ++--------------------------+ +Thu Feb 20 00:30:49 UTC 2014 +patches/packages/gnutls-3.1.21-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a flaw where a version 1 intermediate certificate would be + considered as a CA certificate by GnuTLS by default. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1959 + (* Security fix *) +patches/packages/linux-3.10.17-2/*: + These are new kernels that fix CVE-2014-0038, a bug that can allow local + users to gain a root shell. + Be sure to reinstall LILO (run "lilo" as root) after upgrading the kernel + packages, or on UEFI systems, copy the appropriate kernel to + /boot/efi/EFI/Slackware/vmlinuz). + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0038 + (* Security fix *) +patches/packages/mariadb-5.5.35-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a buffer overflow in the mysql command line client which + may allow malicious or compromised database servers to cause a denial of + service (crash) and possibly execute arbitrary code via a long server + version string. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0001 + (* Security fix *) +patches/packages/shadow-4.1.5.1-x86_64-3_slack14.1.txz: Rebuilt. + Shadow 4.1.5 addressed a tty-hijacking vulnerability in "su -c" + (CVE-2005-4890) by detaching the controlling terminal in the non-PAM + case via a TIOCNOTTY request. Bi-directional protection is excessive + and breaks a commonly-used methods for privilege escalation on non-PAM + systems (e.g. xterm -e /bin/su -s /bin/bash -c /bin/bash myscript). + This update relaxes the restriction and only detaches the controlling + tty when the callee is not root (which is, after all, the threat vector). + Thanks to mancha for the patch (and the above information). ++--------------------------+ +Thu Feb 13 23:45:53 UTC 2014 +patches/packages/curl-7.35.0-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a flaw where libcurl could, in some circumstances, reuse + the wrong connection when asked to do an NTLM-authenticated HTTP or HTTPS + request. + For more information, see: + http://curl.haxx.se/docs/adv_20140129.html + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015 + (* Security fix *) +patches/packages/ntp-4.2.6p5-x86_64-5_slack14.1.txz: Rebuilt. + All stable versions of NTP remain vulnerable to a remote attack where the + "ntpdc -c monlist" command can be used to amplify network traffic as part + of a denial of service attack. By default, Slackware is not vulnerable + since it includes "noquery" as a default restriction. However, it is + vulnerable if this restriction is removed. To help mitigate this flaw, + "disable monitor" has been added to the default ntp.conf (which will disable + the monlist command even if other queries are allowed), and the default + restrictions have been extended to IPv6 as well. + All users of the NTP daemon should make sure that their ntp.conf contains + "disable monitor" to prevent misuse of the NTP service. The new ntp.conf + file will be installed as /etc/ntp.conf.new with a package upgrade, but the + changes will need to be merged into any existing ntp.conf file by the admin. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211 + http://www.kb.cert.org/vuls/id/348126 + (* Security fix *) ++--------------------------+ +Sat Feb 8 18:41:15 UTC 2014 +patches/packages/mozilla-firefox-24.3.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.3.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/seamonkey-2.24-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.24-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Mon Feb 3 20:58:32 UTC 2014 +patches/packages/pidgin-2.10.9-x86_64-1_slack14.1.txz: Upgraded. + This update fixes various security issues and other bugs. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6152 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6477 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6478 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6479 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6481 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6482 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6483 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6484 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6485 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6486 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6487 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6489 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6490 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0020 + (* Security fix *) ++--------------------------+ +Sat Feb 1 00:56:38 UTC 2014 +patches/packages/cairo-1.12.16-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix update that was tested in -current and found to resolve + some outstanding issues with the package that shipped in Slackware 14.1. + Removed --enable-xcb-shm (may cause instability with GTK+3). + Removed --enable-xlib-xcb (causes GIMP slowdown). + Added --enable-ft and --enable-gl. ++--------------------------+ +Tue Jan 28 21:07:13 UTC 2014 +patches/packages/bind-9.9.4_P2-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a defect in the handling of NSEC3-signed zones that can + cause BIND to be crashed by a specific set of queries. + NOTE: According to the second link below, Slackware is probably not + vulnerable since we aren't using glibc-2.18 yet. Might as well fix it + anyway, though. + For more information, see: + https://kb.isc.org/article/AA-01078 + https://kb.isc.org/article/AA-01085 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 + (* Security fix *) +patches/packages/mozilla-nss-3.15.4-x86_64-1_slack14.1.txz: Upgraded. + Upgraded to nss-3.15.4 and nspr-4.10.3. + Fixes a possible man-in-the-middle issue. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1740 + (* Security fix *) ++--------------------------+ +Tue Jan 14 03:54:48 UTC 2014 +patches/packages/libXfont-1.4.7-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a stack overflow when reading a BDF font file containing + a longer than expected string, which could lead to crashes or privilege + escalation. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6462 + (* Security fix *) +patches/packages/openssl-1.0.1f-x86_64-1_slack14.1.txz: Upgraded. + This update fixes the following security issues: + Fix for TLS record tampering bug CVE-2013-4353 + Fix for TLS version checking bug CVE-2013-6449 + Fix for DTLS retransmission bug CVE-2013-6450 + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4353 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6449 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6450 + (* Security fix *) +patches/packages/openssl-solibs-1.0.1f-x86_64-1_slack14.1.txz: Upgraded. +patches/packages/php-5.4.24-x86_64-1_slack14.1.txz: Upgraded. + The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before + 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly + parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, + which allows remote attackers to execute arbitrary code or cause a denial + of service (memory corruption) via a crafted certificate that is not + properly handled by the openssl_x509_parse function. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6420 + (* Security fix *) +patches/packages/samba-4.1.4-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a heap-based buffer overflow that may allow AD domain + controllers to execute arbitrary code via an invalid fragment length in + a DCE-RPC packet. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408 + (* Security fix *) ++--------------------------+ +Fri Dec 20 22:46:09 UTC 2013 +patches/packages/gnupg-1.4.16-x86_64-1_slack14.1.txz: Upgraded. + Fixed the RSA Key Extraction via Low-Bandwidth Acoustic + Cryptanalysis attack as described by Genkin, Shamir, and Tromer. + For more information, see: + http://www.cs.tau.ac.il/~tromer/acoustic/ + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4576 + (* Security fix *) ++--------------------------+ +Mon Dec 16 20:51:01 UTC 2013 +patches/packages/libiodbc-3.52.8-x86_64-1_slack14.1.txz: Upgraded. + This update fixes an rpath pointing to a location in /tmp that was found in + two test programs (iodbctest and iodbctestw). This could have allowed a + local attacker with write access to /tmp to add modified libraries (and + execute arbitrary code) as any user running the test programs. + Thanks to Christopher Oliver for the bug report. + (* Security fix *) +patches/packages/libjpeg-v8a-x86_64-2_slack14.1.txz: Rebuilt. + Fix use of uninitialized memory when decoding images with missing SOS data + for the luminance component (Y) in presence of valid chroma data (Cr, Cb). + This could allow remote attackers to obtain sensitive information from + uninitialized memory locations via a crafted JPEG image. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629 + (* Security fix *) +patches/packages/llvm-3.3-x86_64-3_slack14.1.txz: Rebuilt. + The LLVM package included binaries with an rpath pointing to the build + location in /tmp. This allows an attacker with write access to /tmp to + add modified libraries (and execute arbitrary code) as any user running + the LLVM binaries. This updated package rebuilds LLVM to exclude the + build directories from the rpath information. + Thanks to Christopher Oliver for the bug report. + (* Security fix *) +patches/packages/mozilla-firefox-24.2.0esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.2.0-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbirdESR.html + (* Security fix *) +patches/packages/ruby-1.9.3_p484-x86_64-1_slack14.1.txz: Upgraded. + This update fixes a heap overflow in floating point parsing. A specially + crafted string could cause a heap overflow leading to a denial of service + attack via segmentation faults and possibly arbitrary code execution. + For more information, see: + https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/ + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 + (* Security fix *) +patches/packages/seamonkey-2.23-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.23-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Fri Dec 6 00:20:17 UTC 2013 +patches/packages/mozilla-nss-3.15.3-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/announce/2013/mfsa2013-103.html + (* Security fix *) +patches/packages/mozilla-thunderbird-24.1.1-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html + (* Security fix *) +patches/packages/seamonkey-2.22.1-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.22.1-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ +Mon Nov 18 20:52:16 UTC 2013 +patches/packages/mozilla-firefox-24.1.1esr-x86_64-1_slack14.1.txz: Upgraded. + This release contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html + (* Security fix *) +patches/packages/openssh-6.4p1-x86_64-1_slack14.1.txz: Upgraded. + sshd(8): fix a memory corruption problem triggered during rekeying + when an AES-GCM cipher is selected. + For more information, see: + http://www.openssh.com/txt/gcmrekey.adv + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4548 + (* Security fix *) +patches/packages/php-5.4.22-x86_64-1_slack14.1.txz: Upgraded. + This is a bugfix release. +patches/packages/samba-4.1.1-x86_64-1_slack14.1.txz: Upgraded. + This update fixes two security issues: + * Samba versions 3.2.0 and above do not check the underlying file or + directory ACL when opening an alternate data stream. + * In setups which provide ldap(s) and/or https services, the private key + for SSL/TLS encryption might be world readable. This typically happens + in active directory domain controller setups. + For more information, see: + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4475 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4476 + (* Security fix *) + Added tdb.h, tdb.pc, and a libtdb.so symlink. Thanks to Matteo Bernardini. +patches/packages/seamonkey-2.22-x86_64-1_slack14.1.txz: Upgraded. + This update contains security fixes and improvements. + For more information, see: + http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html + (* Security fix *) +patches/packages/seamonkey-solibs-2.22-x86_64-1_slack14.1.txz: Upgraded. ++--------------------------+ Mon Nov 4 17:08:47 UTC 2013 Slackware 14.1 x86_64 stable is released! |