Sat Mar 12 20:57:35 UTC 202220220312205735

a/kernel-generic-5.16.14-x86_64-1.txz:  Upgraded.
a/kernel-huge-5.16.14-x86_64-1.txz:  Upgraded.
a/kernel-modules-5.16.14-x86_64-1.txz:  Upgraded.
ap/qpdf-10.6.3-x86_64-1.txz:  Upgraded.
ap/sqlite-3.38.1-x86_64-1.txz:  Upgraded.
d/kernel-headers-5.16.14-x86-1.txz:  Upgraded.
k/kernel-source-5.16.14-noarch-1.txz:  Upgraded.
l/harfbuzz-4.0.1-x86_64-1.txz:  Upgraded.
l/librsvg-2.52.7-x86_64-1.txz:  Upgraded.
l/polkit-0.120-x86_64-3.txz:  Rebuilt.
  Patched to fix a security issue where an unprivileged user could cause a
  denial of service due to process file descriptor exhaustion.
  Thanks to marav.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4115
  (* Security fix *)
xap/NetworkManager-openvpn-1.8.18-x86_64-1.txz:  Upgraded.
xap/xlockmore-5.69-x86_64-1.txz:  Upgraded.
xfce/xfce4-screenshooter-1.9.10-x86_64-1.txz:  Upgraded.
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
usb-and-pxe-installers/usbboot.img:  Rebuilt.

9 files changed, 80 insertions, 8 deletions

diff --git a/source/k/kernel-configs/config-generic-5.16.13 b/source/k/kernel-configs/config-generic-5.16.14
index 5440d6e1e..096b05961 100644
--- a/source/k/kernel-configs/config-generic-5.16.13
+++ b/source/k/kernel-configs/config-generic-5.16.14
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/k/kernel-configs/config-generic-5.16.13.x64 b/source/k/kernel-configs/config-generic-5.16.14.x64
index 80d3f7810..f53fbdc28 100644
--- a/source/k/kernel-configs/config-generic-5.16.13.x64
+++ b/source/k/kernel-configs/config-generic-5.16.14.x64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/k/kernel-configs/config-generic-smp-5.16.13-smp b/source/k/kernel-configs/config-generic-smp-5.16.14-smp
index 6e2a33034..bbf5b963e 100644
--- a/source/k/kernel-configs/config-generic-smp-5.16.13-smp
+++ b/source/k/kernel-configs/config-generic-smp-5.16.14-smp
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/k/kernel-configs/config-huge-5.16.13 b/source/k/kernel-configs/config-huge-5.16.14
index 560025949..9a0ef7a1a 100644
--- a/source/k/kernel-configs/config-huge-5.16.13
+++ b/source/k/kernel-configs/config-huge-5.16.14
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/k/kernel-configs/config-huge-5.16.13.x64 b/source/k/kernel-configs/config-huge-5.16.14.x64
index f1980afac..93107f865 100644
--- a/source/k/kernel-configs/config-huge-5.16.13.x64
+++ b/source/k/kernel-configs/config-huge-5.16.14.x64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/k/kernel-configs/config-huge-smp-5.16.13-smp b/source/k/kernel-configs/config-huge-smp-5.16.14-smp
index 7beee7ad4..a2ace5385 100644
--- a/source/k/kernel-configs/config-huge-smp-5.16.13-smp
+++ b/source/k/kernel-configs/config-huge-smp-5.16.14-smp
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.16.13 Kernel Configuration
+# Linux/x86 5.16.14 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0"
 CONFIG_CC_IS_GCC=y
diff --git a/source/l/polkit/CVE-2021-4115.patch b/source/l/polkit/CVE-2021-4115.patch
new file mode 100644
index 000000000..3cb55819c
--- /dev/null
+++ b/source/l/polkit/CVE-2021-4115.patch
@@ -0,0 +1,71 @@
+diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
+index 8ed1363..2fbf5f1 100644
+--- a/src/polkit/polkitsystembusname.c
++++ b/src/polkit/polkitsystembusname.c
+@@ -62,6 +62,10 @@ enum
+   PROP_NAME,
+ };
+ 
++
++guint8 dbus_call_respond_fails;      // has to be global because of callback
++
++
+ static void subject_iface_init (PolkitSubjectIface *subject_iface);
+ 
+ G_DEFINE_TYPE_WITH_CODE (PolkitSystemBusName, polkit_system_bus_name, G_TYPE_OBJECT,
+@@ -364,6 +368,7 @@ on_retrieved_unix_uid_pid (GObject              *src,
+   if (!v)
+     {
+       data->caught_error = TRUE;
++      dbus_call_respond_fails += 1;
+     }
+   else
+     {
+@@ -405,6 +410,8 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
+   tmp_context = g_main_context_new ();
+   g_main_context_push_thread_default (tmp_context);
+ 
++  dbus_call_respond_fails = 0;
++
+   /* Do two async calls as it's basically as fast as one sync call.
+    */
+   g_dbus_connection_call (connection,
+@@ -432,11 +439,34 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
+ 			  on_retrieved_unix_uid_pid,
+ 			  &data);
+ 
+-  while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
+-    g_main_context_iteration (tmp_context, TRUE);
++  while (TRUE)
++  {
++    /* If one dbus call returns error, we must wait until the other call
++     * calls _call_finish(), otherwise fd leak is possible.
++     * Resolves: GHSL-2021-077
++    */
+ 
+-  if (data.caught_error)
+-    goto out;
++    if ( (dbus_call_respond_fails > 1) )
++    {
++      // we got two faults, we can leave
++      goto out;
++    }
++
++    if ((data.caught_error && (data.retrieved_pid || data.retrieved_uid)))
++    {
++      // we got one fault and the other call finally finished, we can leave
++      goto out;
++    }
++
++    if ( !(data.retrieved_uid && data.retrieved_pid) )
++    {
++      g_main_context_iteration (tmp_context, TRUE);
++    }
++    else
++    {
++      break;
++    }
++  }
+ 
+   if (out_uid)
+     *out_uid = data.uid;
diff --git a/source/l/polkit/polkit.SlackBuild b/source/l/polkit/polkit.SlackBuild
index 13e1f948f..74949650b 100755
--- a/source/l/polkit/polkit.SlackBuild
+++ b/source/l/polkit/polkit.SlackBuild
@@ -26,7 +26,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=polkit
 VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-2}
+BUILD=${BUILD:-3}
 
 # Automatically determine the architecture we're building on:
 if [ -z "$ARCH" ]; then
@@ -82,6 +82,7 @@ find . \
 
 zcat $CWD/dont-set-wheel-group-as-admin.diff.gz | patch -p1 --verbose || exit 1
 zcat $CWD/a2bf5c9c83b6ae46cbd5c779d3055bff81ded683.patch.gz | patch -p1 --verbose || exit 1
+zcat $CWD/CVE-2021-4115.patch.gz | patch -p1 --verbose || exit 1
 
 # https://gitlab.freedesktop.org/polkit/polkit/-/issues/29
 zcat $CWD/0001-configure-fix-elogind-support.patch.gz | patch -p1 || exit 1
diff --git a/source/xfce/xfce4-screenshooter/xfce4-screenshooter.url b/source/xfce/xfce4-screenshooter/xfce4-screenshooter.url
index 8a1770af6..948ed85aa 100644
--- a/source/xfce/xfce4-screenshooter/xfce4-screenshooter.url
+++ b/source/xfce/xfce4-screenshooter/xfce4-screenshooter.url
@@ -1 +1 @@
-http://archive.xfce.org/src/apps/xfce4-screenshooter/1.9/xfce4-screenshooter-1.9.9.tar.bz2
+http://archive.xfce.org/src/apps/xfce4-screenshooter/1.9/xfce4-screenshooter-1.9.10.tar.bz2