diff options
Diffstat (limited to 'ChangeLog.rss')
| -rw-r--r-- | ChangeLog.rss | 62 |
1 files changed, 60 insertions, 2 deletions
diff --git a/ChangeLog.rss b/ChangeLog.rss index 5e19d2108..d698e0b94 100644 --- a/ChangeLog.rss +++ b/ChangeLog.rss @@ -11,10 +11,68 @@ <description>Tracking Slackware development in git.</description> <language>en-us</language> <id xmlns="http://www.w3.org/2005/Atom">urn:uuid:c964f45e-6732-11e8-bbe5-107b4450212f</id> - <pubDate>Tue, 26 Mar 2019 23:04:49 GMT</pubDate> - <lastBuildDate>Wed, 27 Mar 2019 07:59:42 GMT</lastBuildDate> + <pubDate>Wed, 27 Mar 2019 20:37:56 GMT</pubDate> + <lastBuildDate>Thu, 28 Mar 2019 07:59:42 GMT</lastBuildDate> <generator>maintain_current_git.sh v 1.10</generator> <item> + <title>Wed, 27 Mar 2019 20:37:56 GMT</title> + <pubDate>Wed, 27 Mar 2019 20:37:56 GMT</pubDate> + <link>https://git.slackware.nl/current/tag/?h=20190327203756</link> + <guid isPermaLink="false">20190327203756</guid> + <description> + <![CDATA[<pre> +a/kernel-generic-4.19.32-x86_64-1.txz: Upgraded. +a/kernel-huge-4.19.32-x86_64-1.txz: Upgraded. +a/kernel-modules-4.19.32-x86_64-1.txz: Upgraded. +ap/hplip-3.19.3-x86_64-1.txz: Upgraded. +d/kernel-headers-4.19.32-x86-1.txz: Upgraded. +d/python3-3.7.3-x86_64-1.txz: Upgraded. + Fixed bugs and the following security issues: + bpo-36216: Changes urlsplit() to raise ValueError when the URL contains + characters that decompose under IDNA encoding (NFKC-normalization) into + characters that affect how the URL is parsed. + bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The + cert parser did not handle CRL distribution points with empty DP or URI + correctly. A malicious or buggy certificate can result into segfault. + Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet + of Cisco. + bpo-35121: Don't send cookies of domain A without Domain attribute to + domain B when domain A is a suffix match of domain B while using a + cookiejar with http.cookiejar.DefaultCookiePolicy policy. + Patch by Karthikeyan Singaravelan. + For more information, see: + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010 + (* Security fix *) +d/scons-3.0.5-x86_64-1.txz: Upgraded. +k/kernel-source-4.19.32-noarch-1.txz: Upgraded. +n/curl-7.64.1-x86_64-1.txz: Upgraded. +n/gnutls-3.6.7-x86_64-1.txz: Upgraded. + Fixes security issues: + libgnutls, gnutls tools: Every gnutls_free() will automatically set + the free'd pointer to NULL. This prevents possible use-after-free and + double free issues. Use-after-free will be turned into NULL dereference. + The counter-measure does not extend to applications using gnutls_free(). + libgnutls: Fixed a memory corruption (double free) vulnerability in the + certificate verification API. Reported by Tavis Ormandy; addressed with + the change above. [GNUTLS-SA-2019-03-27, #694] + libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async + messages; Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704] + libgnutls: enforce key usage limitations on certificates more actively. + Previously we would enforce it for TLS1.2 protocol, now we enforce it + even when TLS1.3 is negotiated, or on client certificates as well. When + an inappropriate for TLS1.3 certificate is seen on the credentials + structure GnuTLS will disable TLS1.3 support for that session (#690). + libgnutls: enforce the equality of the two signature parameters fields + in a certificate. We were already enforcing the signature algorithm, + but there was a bug in parameter checking code. + (* Security fix *) +isolinux/initrd.img: Rebuilt. +kernels/*: Upgraded. +usb-and-pxe-installers/usbboot.img: Rebuilt. + </pre>]]> + </description> + </item> + <item> <title>Tue, 26 Mar 2019 23:04:49 GMT</title> <pubDate>Tue, 26 Mar 2019 23:04:49 GMT</pubDate> <link>https://git.slackware.nl/current/tag/?h=20190326230449</link> |