summaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAgeFilesLines
* Sun Jul 12 23:23:28 UTC 2026•••testing/packages/rust-1.97.0-x86_64-1_slack15.0.txz: Upgraded. Add rustdoc to tools= in the bootstrap.toml because it no longer gets installed otherwise. Thanks to ZlatkO. 20260712232328_15.015.0 Patrick J Volkerding3 hours5-31/+51
* Fri Jul 10 22:25:39 UTC 2026•••patches/packages/p11-kit-0.26.4-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-13757 (* Security fix *) 20260710222539_15.0 Patrick J Volkerding2 days4-22/+48
* Thu Jul 9 23:55:49 UTC 2026•••patches/packages/glibc-zoneinfo-2026c-noarch-1_slack15.0.txz: Upgraded. This package provides the latest timezone updates. extra/tigervnc/tigervnc-1.16.2-x86_64-4_slack15.0.txz: Rebuilt. Recompiled against xorg-server-1.20.14, including patches for security issues: glamor Font Atlas Heap Buffer Overflow. GLX contextTags Use-After-Free in CommonMakeCurrent(). For more information, see: https://lists.x.org/archives/xorg/2026-July/062255.html https://www.cve.org/CVERecord?id=CVE-2026-55999 https://www.cve.org/CVERecord?id=CVE-2026-56000 (* Security fix *) 20260709235549_15.0 Patrick J Volkerding3 days8-52/+227
* Wed Jul 8 21:48:24 UTC 2026•••patches/packages/c-ares-1.34.8-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/libXfont2-2.0.8-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow. PCF Font Parsing Heap Buffer Overflow. computeProps Property Buffer Heap Buffer Overflow. For more information, see: https://lists.x.org/archives/xorg/2026-July/062253.html https://www.cve.org/CVERecord?id=CVE-2026-56001 https://www.cve.org/CVERecord?id=CVE-2026-56002 https://www.cve.org/CVERecord?id=CVE-2026-56003 (* Security fix *) patches/packages/proftpd-1.3.9c-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: ExecEnviron values not passed due to regression since 1.3.8.d. Stack buffer overflow in MLSD/MLST handling for long path names. MaxTransfersPerUser no longer enforces configured limits. AdminControlsACLs for config, get actions not honored as they should be. Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed buffers without bounds checking. RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails to reject illegal characters. SQL group name lookup concatenates client-provided group names without escaping. Authenticated SFTP sessions can overflow the SFTP packet buffer. Default Controls socket ACLs unintentionally allow all users access for sending Controls requests. (* Security fix *) patches/packages/xorg-server-1.20.14-x86_64-21_slack15.0.txz: Rebuilt. This update fixes security issues: glamor Font Atlas Heap Buffer Overflow. GLX contextTags Use-After-Free in CommonMakeCurrent(). For more information, see: https://lists.x.org/archives/xorg/2026-July/062255.html https://www.cve.org/CVERecord?id=CVE-2026-55999 https://www.cve.org/CVERecord?id=CVE-2026-56000 (* Security fix *) patches/packages/xorg-server-xephyr-1.20.14-x86_64-21_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-21_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-21_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xwayland-21.1.4-x86_64-19_slack15.0.txz: Rebuilt. This update fixes security issues: glamor Font Atlas Heap Buffer Overflow. GLX contextTags Use-After-Free in CommonMakeCurrent(). For more information, see: https://lists.x.org/archives/xorg/2026-July/062255.html https://www.cve.org/CVERecord?id=CVE-2026-55999 https://www.cve.org/CVERecord?id=CVE-2026-56000 (* Security fix *) 20260708214824_15.0 Patrick J Volkerding4 days29-163/+1464
* Tue Jul 7 21:49:57 UTC 2026•••patches/packages/tftp-hpa-5.4-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Fix several security-relevant bugs in path validation (tftpd/path.c): an uninitialized buffer read and a broken path tokenizer could let a crafted or unlucky request bypass path restrictions or crash the daemon. Fix buffer overflows in the tftp client: an unbounded strcpy() when building requests, an out-of-bounds write when putting multiple files to a remote directory, and an unbounded write into the interactive command-line argument array. Fix an out-of-bounds read while scanning request fields in tftpd, and an incorrect address family used when creating the per-transfer socket on platforms without recvmsg(). (* Security fix *) 20260707214957_15.0 Patrick J Volkerding5 days7-42/+242
* Mon Jul 6 22:46:09 UTC 2026•••patches/packages/c-ares-1.34.7-x86_64-1_slack15.0.txz: Upgraded. This release fixes the following security issues: Use-after-free / double-free in c-ares' query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. Memory-amplification denial of service via unvalidated DNS header record counts. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-33630 https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542 https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76 https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj (* Security fix *) patches/packages/openssh-10.4p1-x86_64-1_slack15.0.txz: Upgraded. This release contains a number of security fixes: sftp(1): when downloading files on the command-line using "sftp host:/path .", a malicious server could cause the file to be downloaded to an unexpected location. This issue was identified by the Swival Security Scanner. scp(1): when copying files between two remote destinations, do not allow a malicious server to write files to the parent directory of the intended target directory. This issue was identified by the Swival Security Scanner. sshd(8): when using the "internal-sftp" SFTP server implementation (this is not the default), long command lines were previously truncated silently after the 9th argument. If a security-relevant option was in the 10th or later position, it would be discarded. Reported by Steve Caffrey. sshd(8): add a documentation note to mention that the GSSAPIStrictAcceptorCheck option is ineffective when the server is joined to a Windows Active Directory. Reported by Yarin Aharoni of Safebreach. sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes as it was documented to do. Note that PermitTunnel is not enabled by default. Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic. sshd(8): avoid a potential pre-authentication denial of service when GSSAPIAuthentication was enabled (this feature is off by default). This was not mitigated by MaxAuthTries, but would be penalised by PerSourcePenalties. This was reported by Manfred Kaiser of the milCERT AT (Austrian Ministry of Defence). sshd(8): fix a number of cases where the minimum authentication delay was not being enforced. Reported by the Orange Cyberdefense Vulnerability Team. ssh(1): fix a possible client-side use-after-free if the server changes its host key during a key reexchange. This was reported by Zhenpeng (Leo) Lin of Depthfirst. For more information, see: https://www.openssh.org/releasenotes.html#10.4 (* Security fix *) 20260706224609_15.0 Patrick J Volkerding6 days6-28/+143
* Sun Jul 5 22:39:09 UTC 2026•••extra/php82/php82-8.2.32-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: OpenSSL: Fixed memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD. For more information, see: https://www.php.net/ChangeLog-8.php#8.2.32 https://www.cve.org/CVERecord?id=CVE-2026-14355 (* Security fix *) 20260705223909_15.0 Patrick J Volkerding7 days4-25/+53
* Sun Jul 5 21:18:31 UTC 2026•••patches/packages/mutt-2.4.1-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Prevent unsigned int overflow in imap_cmd_step buffer growth. The idata->blen field is unsigned int (32-bit) while the companion variable len is size_t (64-bit on LP64). When a malicious IMAP server sends a response line longer than UINT_MAX bytes without newline, the expression wraps to a small value, causing safe_realloc() to shrink the buffer while len retains its original huge value. The subsequent mutt_socket_readln() then writes far past the shrunken allocation. Fix by changing idata->blen from unsigned int to size_t, matching the type of len and preventing the overflow on all platforms. (* Security fix *) 20260705211831_15.0 Patrick J Volkerding7 days9-45/+280
* Fri Jul 3 22:58:14 UTC 2026•••patches/packages/libseccomp-2.6.1-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Fix incorrect 64-bit comparison merge that can weaken libseccomp filters. Fix issue where oversized libseccomp filters can trigger a double free. Fix issue where oversized libseccomp filters can trigger a heap corruption. For more information, see: https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6 https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm` (* Security fix *) 20260703225814_15.0 Patrick J Volkerding9 days7-50/+263
* Wed Jul 1 23:55:11 UTC 2026•••patches/packages/libevent-2.1.13-x86_64-1_slack15.0.txz: Upgraded. This release contains several security fixes, affecting users of the following modules: evbuffer, bufferevent, evtag, evrpc, evdns, evhttp. If you have a program that uses one of those modules you should upgrade. (* Security fix *) patches/packages/mozilla-thunderbird-140.12.1esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/140.12.1esr/releasenotes/ (* Security fix *) 20260701235511_15.0 Patrick J Volkerding11 days7-54/+286
* Tue Jun 30 23:25:25 UTC 2026•••patches/packages/gmime-3.2.15-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. Thanks to Lockywolf. 20260630232525_15.0 Patrick J Volkerding12 days8-47/+250
* libidn: security update for Slackware 15.0 (salvaged from reverted commit 5e2...20260618210908_15.0 Patrick J Volkerding2026-06-271-1/+1
* Thu Jun 25 21:03:32 UTC 2026•••patches/packages/fetchmail-6.4.27-x86_64-3_slack15.0.txz: Rebuilt. This release contains an important bugfix: The IMAP client, which has always used message indexes for the selected mailbox, did not abort when receiving an EXPUNGE response - which changes message numbers inside the mailbox. Unlike UIDs, the message numbers are not stable and fetchmail does not have internal interfaces to track which messages are deleted, and adding those to a 6.6.X release would be too risky, and switching to UID is also too big a change, so we have no choice but to abort the session when seeing an EXPUNGE response without our own EXPUNGE request, to avoid marking the wrong message as seen/deleted or skip the wrong one, or assume the wrong message size. Earl Chew reported this versus Yahoo Mail via Gitlab Work Item #91, which automatically expunges messages that are marked with the \Deleted flag. 20260625210332_15.0 Patrick J Volkerding2026-06-276-31/+238
* Tue Jun 23 23:52:16 UTC 2026•••patches/packages/libarchive-3.8.8-x86_64-1_slack15.0.txz: Upgraded. Libarchive 3.8.8 is a security, bugfix and minor feature release. For more information, see: https://github.com/libarchive/libarchive/releases/tag/v3.8.8 (* Security fix *) 20260623235216_15.0 Patrick J Volkerding2026-06-274-22/+44
* Sat Jun 20 21:07:46 UTC 2026•••patches/packages/ffmpeg-4.4.7-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. 20260620210746_15.0 Patrick J Volkerding2026-06-274-26/+66
* Wed Jun 17 23:29:52 UTC 2026•••patches/packages/libinput-1.30.4-x86_64-1_slack15.0.txz: Upgraded. Switch to libinput-1.30.4 which contains the recent CVE fix, but does not break the API so that wlroots won't build. Thanks to falcon314. 20260617232952_15.0 Patrick J Volkerding2026-06-188-32/+52
* Wed Jun 17 21:45:03 UTC 2026•••patches/packages/bind-9.18.50-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Fix DNS64 owner case after DNAME restart. When BIND 9 is configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data. This fix ensures the correct owner name is used when constructing the synthesized response after a DNAME redirect. ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. (* Security fix *) patches/packages/libidn-1.44-x86_64-1-slack15.0.txz: Rebuilt. This update fixes security issues: libidn: Fix read-out-of-bounds error in ToUnicode APIs. examples: Fix strcpy buffer overflow. For more information, see: https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html https://lists.gnu.org/archive/html/help-libidn/2025-06/msg00000.html (* Security fix *) patches/packages/mozilla-firefox-140.12.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/140.12.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2026-58 https://www.cve.org/CVERecord?id=CVE-2026-12289 https://www.cve.org/CVERecord?id=CVE-2026-12290 https://www.cve.org/CVERecord?id=CVE-2026-12291 https://www.cve.org/CVERecord?id=CVE-2026-12292 https://www.cve.org/CVERecord?id=CVE-2026-12294 https://www.cve.org/CVERecord?id=CVE-2026-12295 https://www.cve.org/CVERecord?id=CVE-2026-12298 https://www.cve.org/CVERecord?id=CVE-2026-12296 https://www.cve.org/CVERecord?id=CVE-2026-12297 https://www.cve.org/CVERecord?id=CVE-2026-12299 https://www.cve.org/CVERecord?id=CVE-2026-12329 https://www.cve.org/CVERecord?id=CVE-2026-12302 https://www.cve.org/CVERecord?id=CVE-2026-12304 https://www.cve.org/CVERecord?id=CVE-2026-12305 https://www.cve.org/CVERecord?id=CVE-2026-12306 https://www.cve.org/CVERecord?id=CVE-2026-12307 https://www.cve.org/CVERecord?id=CVE-2026-12308 https://www.cve.org/CVERecord?id=CVE-2026-12309 https://www.cve.org/CVERecord?id=CVE-2026-12310 https://www.cve.org/CVERecord?id=CVE-2026-12311 https://www.cve.org/CVERecord?id=CVE-2026-12312 https://www.cve.org/CVERecord?id=CVE-2026-12313 https://www.cve.org/CVERecord?id=CVE-2026-12314 https://www.cve.org/CVERecord?id=CVE-2026-12315 https://www.cve.org/CVERecord?id=CVE-2026-12330 https://www.cve.org/CVERecord?id=CVE-2026-12324 https://www.cve.org/CVERecord?id=CVE-2026-12325 https://www.cve.org/CVERecord?id=CVE-2026-12327 https://www.cve.org/CVERecord?id=CVE-2026-12328 (* Security fix *) patches/packages/mozilla-thunderbird-140.12.0esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/140.12.0esr/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2026-61/ https://www.cve.org/CVERecord?id=CVE-2026-12289 https://www.cve.org/CVERecord?id=CVE-2026-12290 https://www.cve.org/CVERecord?id=CVE-2026-12291 https://www.cve.org/CVERecord?id=CVE-2026-12292 https://www.cve.org/CVERecord?id=CVE-2026-12294 https://www.cve.org/CVERecord?id=CVE-2026-12295 https://www.cve.org/CVERecord?id=CVE-2026-12298 https://www.cve.org/CVERecord?id=CVE-2026-12296 https://www.cve.org/CVERecord?id=CVE-2026-12297 https://www.cve.org/CVERecord?id=CVE-2026-12299 https://www.cve.org/CVERecord?id=CVE-2026-12329 https://www.cve.org/CVERecord?id=CVE-2026-12302 https://www.cve.org/CVERecord?id=CVE-2026-12304 https://www.cve.org/CVERecord?id=CVE-2026-12305 https://www.cve.org/CVERecord?id=CVE-2026-12306 https://www.cve.org/CVERecord?id=CVE-2026-12307 https://www.cve.org/CVERecord?id=CVE-2026-12308 https://www.cve.org/CVERecord?id=CVE-2026-12309 https://www.cve.org/CVERecord?id=CVE-2026-12310 https://www.cve.org/CVERecord?id=CVE-2026-12311 https://www.cve.org/CVERecord?id=CVE-2026-12312 https://www.cve.org/CVERecord?id=CVE-2026-12313 https://www.cve.org/CVERecord?id=CVE-2026-12314 https://www.cve.org/CVERecord?id=CVE-2026-12315 https://www.cve.org/CVERecord?id=CVE-2026-12330 https://www.cve.org/CVERecord?id=CVE-2026-12324 https://www.cve.org/CVERecord?id=CVE-2026-12325 https://www.cve.org/CVERecord?id=CVE-2026-12327 https://www.cve.org/CVERecord?id=CVE-2026-12328 (* Security fix *) patches/packages/net-tools-20181103_0eebece-x86_64-5_slack15.0.txz: Rebuilt. The upstream patch for CVE-2025-46836 introduced a regression that broke packet and byte reporting. Thanks to jtsn for a working alternate patch. patches/packages/openssl-1.1.1zh-x86_64-1_slack15.0.txz: Upgraded. Apply patch to fix the following security issues: Heap Buffer Over-read in ASN.1 Content Parsing. Possible NULL Dereference in Password-Based CMS Decryption. Heap Use-After-Free in the PKCS7_verify() Function. Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. Out-of-Bounds Read in CMS Password-Based Decryption. These CVEs were fixed by the 1.1.1zh release that is only available to subscribers to OpenSSL's premium extended support. The patch was prepared by backporting from the OpenSSL-3.0 repo. Thanks to Ken Zalewski for the patch! For more information, see: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34180 https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766 https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447 https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383 https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076 https://www.cve.org/CVERecord?id=CVE-2026-34180 https://www.cve.org/CVERecord?id=CVE-2026-42766 https://www.cve.org/CVERecord?id=CVE-2026-45447 https://www.cve.org/CVERecord?id=CVE-2026-7383 https://www.cve.org/CVERecord?id=CVE-2026-9076 (* Security fix *) patches/packages/openssl-solibs-1.1.1zh-x86_64-1_slack15.0.txz: Upgraded. 20260617214503_15.0 Patrick J Volkerding2026-06-1817-161/+916
* Tue Jun 16 21:35:01 UTC 2026•••patches/packages/ca-certificates-20260616-noarch-1_slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the authenticity of SSL connections. 20260616213501_15.0 Patrick J Volkerding2026-06-175-332/+209
* Mon Jun 15 23:27:31 UTC 2026•••patches/packages/dev86-0.16.21-x86_64-5_slack15.0.txz: Rebuilt. bcc: patched to account for ${LIBDIRSUFFIX}. Thanks to tauon. 20260615232731_15.0 Patrick J Volkerding2026-06-169-51/+231
* Wed Jun 10 20:15:05 UTC 2026•••patches/packages/httpd-2.4.68-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release (CVE-2026-49975 was already patched here.) For more information, see: https://downloads.apache.org/httpd/CHANGES_2.4.68 20260610201505_15.0 Patrick J Volkerding2026-06-116-103/+52
* Tue Jun 9 21:03:28 UTC 2026•••testing/packages/autoconf-2.73-noarch-1_slack15.0.txz: Added. 20260609210328_15.0 Patrick J Volkerding2026-06-107-16/+172
* Mon Jun 8 20:41:30 UTC 2026•••patches/packages/rsync-3.4.4-x86_64-1_slack15.0.txz: Upgraded. Rsync version 3.4.4 has been released. This is a regression fix release for the issues that have been reported with the 3.4.3 security release. Many thanks to everyone who reported the issues (see NEWS.md for credits). The 3.4.3 release had so many issues for two main reasons: * the 3.4 testsuite did not have broad enough coverage to catch the regressions noticed by users * the nature of a security release prevents wide beta testing, resulting in not enough manual testing in disparate environments To fix this for future releases we have greatly expanded the test suite for 3.5 (currently in master) and grown the development team, especially with more people with security expertise. Thanks for your patience! 20260608204130_15.0 Patrick J Volkerding2026-06-094-21/+57
* Sun Jun 7 22:20:12 UTC 2026•••extra/samba-4.22.10-x86_64-1_slack15.0.txz: Upgraded. This is a security release in order to address the following defects: Missing access checks on reparse point operations. WORM vfs module does not block overwrites. auto-enrolment GPO installing CA certificate over http without verification. Denial of service against AD DC WINS server. Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server. Unauthenticated Remote Code Execution in Samba printing subsystem. For more information, see: https://www.samba.org/samba/security/CVE-2026-1933.html https://www.samba.org/samba/security/CVE-2026-2340.html https://www.samba.org/samba/security/CVE-2026-3012.html https://www.samba.org/samba/security/CVE-2026-3238.html https://www.samba.org/samba/security/CVE-2026-4408.html https://www.samba.org/samba/security/CVE-2026-4480.html https://www.cve.org/CVERecord?id=CVE-2026-1933 https://www.cve.org/CVERecord?id=CVE-2026-2340 https://www.cve.org/CVERecord?id=CVE-2026-3012 https://www.cve.org/CVERecord?id=CVE-2026-3238 https://www.cve.org/CVERecord?id=CVE-2026-4408 https://www.cve.org/CVERecord?id=CVE-2026-4480 (* Security fix *) 20260607222012_15.0 Patrick J Volkerding2026-06-088-140/+88
* Thu Jun 4 21:45:06 UTC 2026•••patches/packages/dnsmasq-2.93-x86_64-1_slack15.0.txz: Upgraded. Rework storage allocation for domain names. This fixes a security bug that can cause heap-overwrite with long domain names. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-2291 (* Security fix *) patches/packages/libinput-1.31.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution. Note that since /dev/uinput and /dev/uhid are only accessible by root on Slackware (and unlike some other distributions we make no exceptions), we were not vulnerable to this flaw. (* Security fix *) patches/packages/meson-1.11.1-x86_64-1_slack15.0.txz: Upgraded. This is needed to compile libinput-1.31.3. 20260604214506_15.0 Patrick J Volkerding2026-06-0514-86/+433
* Thu Jun 4 01:22:28 UTC 2026•••extra/tigervnc/tigervnc-1.16.2-x86_64-3_slack15.0.txz: Rebuilt. Patched with fixes for the following xorg-server security issues: Font Alias Stack-based Buffer Overflow. XSYNC Use-After-Free in miSyncDestroyFence(). XKB Key Types Stack-based Buffer Overflow. XKB SetMap Request Stack-based Buffer Overflow. XSYNC Use-After-Free in FreeCounter(). XSYNC Use-After-Free in SyncChangeCounter(). GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write. CreateSaverWindow Use-After-Free Information Disclosure. DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write. For more information, see: https://lists.x.org/archives/xorg/2026-June/062239.html Zero Day Initiative identifiers: ZDI-CAN-30136 ZDI-CAN-30159 ZDI-CAN-30160 ZDI-CAN-30161 ZDI-CAN-30163 ZDI-CAN-30164 ZDI-CAN-30165 ZDI-CAN-30168 (* Security fix *) patches/packages/httpd-2.4.67-x86_64-2_slack15.0.txz: Rebuilt. This update fixes "HTTP/2 Bomb", a resource exhaustion denial-of-service attack against HTTP/2. For more information, see: https://seclists.org/oss-sec/2026/q2/790 https://www.cve.org/CVERecord?id=CVE-2026-49975 (* Security fix *) patches/packages/net-tools-20181103_0eebece-x86_64-4_slack15.0.txz: Rebuilt. This update fixes a security issue: interface.c: Stack-based Buffer Overflow in get_name(). For more information, see: https://www.cve.org/CVERecord?id=CVE-2025-46836 (* Security fix *) patches/packages/proftpd-1.3.9b-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Additional fixes for SQL injection, notably for handling `%{env:...}` and `%{note:...}` variables. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-42167 (* Security fix *) patches/packages/xorg-server-1.20.14-x86_64-20_slack15.0.txz: Rebuilt. This update fixes security issues: Font Alias Stack-based Buffer Overflow. XSYNC Use-After-Free in miSyncDestroyFence(). XKB Key Types Stack-based Buffer Overflow. XKB SetMap Request Stack-based Buffer Overflow. XSYNC Use-After-Free in FreeCounter(). XSYNC Use-After-Free in SyncChangeCounter(). GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write. CreateSaverWindow Use-After-Free Information Disclosure. DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write. For more information, see: https://lists.x.org/archives/xorg/2026-June/062239.html Zero Day Initiative identifiers: ZDI-CAN-30136 ZDI-CAN-30159 ZDI-CAN-30160 ZDI-CAN-30161 ZDI-CAN-30163 ZDI-CAN-30164 ZDI-CAN-30165 ZDI-CAN-30168 (* Security fix *) patches/packages/xorg-server-xephyr-1.20.14-x86_64-20_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xnest-1.20.14-x86_64-20_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xvfb-1.20.14-x86_64-20_slack15.0.txz: Rebuilt. patches/packages/xorg-server-xwayland-21.1.4-x86_64-18_slack15.0.txz: Rebuilt. This update fixes security issues: Font Alias Stack-based Buffer Overflow. XSYNC Use-After-Free in miSyncDestroyFence(). XKB Key Types Stack-based Buffer Overflow. XKB SetMap Request Stack-based Buffer Overflow. XSYNC Use-After-Free in FreeCounter(). XSYNC Use-After-Free in SyncChangeCounter(). GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write. CreateSaverWindow Use-After-Free Information Disclosure. For more information, see: https://lists.x.org/archives/xorg/2026-June/062239.html Zero Day Initiative identifiers: ZDI-CAN-30136 ZDI-CAN-30159 ZDI-CAN-30160 ZDI-CAN-30161 ZDI-CAN-30163 ZDI-CAN-30164 ZDI-CAN-30165 ZDI-CAN-30168 (* Security fix *) testing/packages/openrsync-20250126_a257c0f-x86_64-1_slack15.0.txz: Added. 20260604012228_15.0 Patrick J Volkerding2026-06-0457-321/+3652
* Tue Jun 2 02:32:11 UTC 2026•••patches/packages/linux-5.15.209/kernel-generic-5.15.209-x86_64-1.txz: Upgraded. This update fixes security issues: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing rxrpc: Fix anonymous key handling rxrpc: only handle RESPONSE during service challenge rxrpc: Fix recvmsg() unconditional requeue rxrpc: reject undecryptable rxkad response tickets rxrpc: Fix call removal to use RCU safe deletion rxrpc: Fix key quota calculation for multitoken keys rxrpc: proc: size address buffers for %pISpc output For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-31696 https://www.cve.org/CVERecord?id=CVE-2026-31676 https://www.cve.org/CVERecord?id=CVE-2026-23066 https://www.cve.org/CVERecord?id=CVE-2026-31637 https://www.cve.org/CVERecord?id=CVE-2026-31642 https://www.cve.org/CVERecord?id=CVE-2026-31630 (* Security fix *) patches/packages/linux-5.15.209/kernel-headers-5.15.209-x86-1.txz: Upgraded. patches/packages/linux-5.15.209/kernel-huge-5.15.209-x86_64-1.txz: Upgraded. This update fixes security issues: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing rxrpc: Fix anonymous key handling rxrpc: only handle RESPONSE during service challenge rxrpc: Fix recvmsg() unconditional requeue rxrpc: reject undecryptable rxkad response tickets rxrpc: Fix call removal to use RCU safe deletion rxrpc: Fix key quota calculation for multitoken keys rxrpc: proc: size address buffers for %pISpc output For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-31696 https://www.cve.org/CVERecord?id=CVE-2026-31676 https://www.cve.org/CVERecord?id=CVE-2026-23066 https://www.cve.org/CVERecord?id=CVE-2026-31637 https://www.cve.org/CVERecord?id=CVE-2026-31642 https://www.cve.org/CVERecord?id=CVE-2026-31630 (* Security fix *) patches/packages/linux-5.15.209/kernel-modules-5.15.209-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.209/kernel-source-5.15.209-noarch-1.txz: Upgraded. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. 20260602023211_15.0 Patrick J Volkerding2026-06-02356-688273/+2575
* Tue May 26 23:17:58 UTC 2026•••patches/packages/mozilla-thunderbird-140.11.1esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/140.11.1esr/releasenotes/ (* Security fix *) 20260526231758_15.0 Patrick J Volkerding2026-05-274-22/+44
* Sun May 24 20:43:18 UTC 2026•••patches/packages/linux-5.15.208/kernel-generic-5.15.208-x86_64-1.txz: Upgraded. This update fixes security issues: net: skbuff: propagate shared-frag marker through frag-transfer helpers. net: skbuff: preserve shared-frag marker during coalescing. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-43503 https://www.cve.org/CVERecord?id=CVE-2026-46300 (* Security fix *) patches/packages/linux-5.15.208/kernel-headers-5.15.208-x86-1.txz: Upgraded. patches/packages/linux-5.15.208/kernel-huge-5.15.208-x86_64-1.txz: Upgraded. This update fixes security issues: net: skbuff: propagate shared-frag marker through frag-transfer helpers. net: skbuff: preserve shared-frag marker during coalescing. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-43503 https://www.cve.org/CVERecord?id=CVE-2026-46300 (* Security fix *) patches/packages/linux-5.15.208/kernel-modules-5.15.208-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.208/kernel-source-5.15.208-noarch-1.txz: Upgraded. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. 20260524204318_15.0 Patrick J Volkerding2026-05-2557-270/+62697
* Fri May 22 20:33:38 UTC 2026•••patches/packages/lxc-4.0.12-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. Thanks to fourtysixandtwo. 20260522203338_15.0 Patrick J Volkerding2026-05-2312-50/+968
* Thu May 21 04:59:09 UTC 2026•••patches/packages/bind-9.18.49-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: Fix outgoing zone transfers' quota issue. Limit resolver server list size. Fix GSS-API resource leak. Avoid unbounded recursion loop. Disable recursion, UPDATE, and NOTIFY for non-IN views. For more information, see: https://kb.isc.org/docs/CVE-2026-3592 https://kb.isc.org/docs/CVE-2026-3039 https://kb.isc.org/docs/CVE-2026-5947 https://kb.isc.org/docs/CVE-2026-5950 https://kb.isc.org/docs/CVE-2026-5946 https://www.cve.org/CVERecord?id=CVE-2026-3592 https://www.cve.org/CVERecord?id=CVE-2026-3039 https://www.cve.org/CVERecord?id=CVE-2026-5947 https://www.cve.org/CVERecord?id=CVE-2026-5950 https://www.cve.org/CVERecord?id=CVE-2026-5946 (* Security fix *) patches/packages/rsync-3.4.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. Hostname/ACL bypass on an rsync daemon configured with `daemon chroot = /X` in rsyncd.conf when the chroot tree lacks DNS resolution support. Integer overflow in the compressed-token decoder enabling remote memory disclosure to an authenticated daemon peer. Symlink races on path-based system calls in "use chroot = no" daemon mode. Out-of-bounds read in the receiver's recv_files() enabling remote denial-of-service of any client pulling from a malicious server. Off-by-one out-of-bounds stack write in the rsync client's HTTP CONNECT proxy handler (`establish_proxy_connection()` in `socket.c`). For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-29518 https://www.cve.org/CVERecord?id=CVE-2026-43617 https://www.cve.org/CVERecord?id=CVE-2026-43618 https://www.cve.org/CVERecord?id=CVE-2026-43619 https://www.cve.org/CVERecord?id=CVE-2026-43620 https://www.cve.org/CVERecord?id=CVE-2026-45232 (* Security fix *) 20260521045909_15.0 Patrick J Volkerding2026-05-215-27/+119
generated by cgit v1.2.3-87-g23bc (git 2.50.0) at 2026-07-13 03:15:12 +0000