summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Thu Apr 21 19:11:10 UTC 202220220421191110_15.0 Patrick J Volkerding2022-04-224-22/+42
| | | | | | | patches/packages/mozilla-thunderbird-91.8.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.8.1/releasenotes/
* Thu Apr 14 21:14:21 UTC 202220220414211421_15.0 Patrick J Volkerding2022-04-1514-79/+873
| | | | | | | | | | | | | | | | | | | | | | | patches/packages/git-2.35.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue where a Git worktree created by another user might be able to execute arbitrary code. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765 (* Security fix *) patches/packages/gzip-1.12-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: zgrep applied to a crafted file name with two or more newlines can no longer overwrite an arbitrary, attacker-selected file. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271 (* Security fix *) patches/packages/xz-5.2.5-x86_64-4_slack15.0.txz: Rebuilt. This update fixes a security issue: xzgrep applied to a crafted file name with two or more newlines can no longer overwrite an arbitrary, attacker-selected file. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271 (* Security fix *)
* Wed Apr 13 20:51:01 UTC 202220220413205101_15.0 Patrick J Volkerding2022-04-146-31/+242
| | | | | | | | | | | patches/packages/ruby-3.0.4-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Double free in Regexp compilation. Buffer overrun in String-to-Float conversion. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28738 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28739 (* Security fix *)
* Tue Apr 12 21:56:14 UTC 202220220412215614_15.0 Patrick J Volkerding2022-04-134-23/+42
| | | | | | patches/packages/whois-5.5.13-x86_64-1_slack15.0.txz: Upgraded. This update adds the .sd TLD server, updates the list of new gTLDs, and adds a Turkish translation.
* Fri Apr 8 20:03:36 UTC 202220220408200336_15.0 Patrick J Volkerding2022-04-097-39/+231
| | | | | | | | | | | | | | | patches/packages/libarchive-3.6.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix and security release. Security fixes: 7zip reader: fix PPMD read beyond boundary. ZIP reader: fix possible out of bounds read. ISO reader: fix possible heap buffer overflow in read_children(). RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0). Fix heap use after free in archive_read_format_rar_read_data(). Fix null dereference in read_data_compressed(). Fix heap user after free in run_filters(). (* Security fix *)
* Wed Apr 6 20:23:46 UTC 202220220406202346_15.0 Patrick J Volkerding2022-04-074-22/+64
| | | | | | | | | | | | | | | | | | patches/packages/mozilla-thunderbird-91.8.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.8.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1097 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28281 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1197 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1196 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28282 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28285 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28286 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24713 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28289 (* Security fix *)
* Tue Apr 5 19:16:30 UTC 202220220405191630_15.0 Patrick J Volkerding2022-04-064-22/+60
| | | | | | | | | | | | | | | | patches/packages/mozilla-firefox-91.8.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.8.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-14/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1097 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28281 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1196 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28282 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28285 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24713 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28289 (* Security fix *)
* Sun Apr 3 19:57:16 UTC 202220220403195716_15.0 Patrick J Volkerding2022-04-045-332/+450
| | | | | | patches/packages/ca-certificates-20220403-noarch-1_slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the authenticity of SSL connections.
* Wed Mar 30 22:37:05 UTC 202220220330223705_15.0 Patrick J Volkerding2022-03-3113-64/+941
| | | | | | | | | | | | | | patches/packages/vim-8.2.4649-x86_64-1_slack15.0.txz: Upgraded. Fixes a use-after-free in utf_ptr2char in vim/vim prior to 8.2.4646. This vulnerability is capable of crashing software, bypassing protection mechanisms, modifying memory, and possibly execution of arbitrary code. Thanks to marav for the heads-up. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1154 https://huntr.dev/bounties/7f0ec6bc-ea0e-45b0-8128-caac72d23425 https://github.com/vim/vim/commit/b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 (* Security fix *) patches/packages/vim-gvim-8.2.4649-x86_64-1_slack15.0.txz: Upgraded.
* Mon Mar 28 19:33:46 UTC 202220220328193346_15.0 Patrick J Volkerding2022-03-2910-56/+380
| | | | | | | | | | | patches/packages/whois-5.5.12-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. Thanks to Nobby6. patches/packages/zlib-1.2.12-x86_64-1_slack15.0.txz: Upgraded. This update fixes memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Thanks to marav. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032 (* Security fix *)
* Fri Mar 25 19:18:41 UTC 202220220325191841_15.0 Patrick J Volkerding2022-03-264-25/+47
| | | | | | | | patches/packages/seamonkey-2.53.11.1-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.seamonkey-project.org/releases/seamonkey2.53.11.1 (* Security fix *)
* Thu Mar 24 20:59:09 UTC 202220220324205909_15.0 Patrick J Volkerding2022-03-254-24/+50
| | | | | | | | | | patches/packages/python3-3.9.12-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://pythoninsider.blogspot.com/2022/03/python-3104-and-3912-are-now-available.html usb-and-pxe-installers/usbimg2disk.sh: Upgraded. Calculate the space requirement by checking the size of the packages in the Slackware directory tree.
* Mon Mar 21 20:24:16 UTC 202220220321202416_15.0 Patrick J Volkerding2022-03-226-42/+124
| | | | | | | | | | | | | | | | | | | patches/packages/bind-9.16.27-x86_64-1_slack15.0.txz: Upgraded. Sorry folks, I had not meant to bump BIND to the newer branch. I've moved the other packages into /testing. Thanks to Nobby6 for pointing this out. This update fixes bugs and the following security issues: A synchronous call to closehandle_cb() caused isc__nm_process_sock_buffer() to be called recursively, which in turn left TCP connections hanging in the CLOSE_WAIT state blocking indefinitely when out-of-order processing was disabled. The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0396 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25220 (* Security fix *) testing/packages/bind-9.18.1-x86_64-1_slack15.0.txz: Moved.
* Sat Mar 19 20:28:16 UTC 202220220319202816_15.0 Patrick J Volkerding2022-03-2018-482/+3592
| | | | | patches/packages/glibc-zoneinfo-2022a-noarch-1_slack15.0.txz: Upgraded. This package provides the latest timezone updates.
* Fri Mar 18 20:16:12 UTC 202220220318201612_15.0 Patrick J Volkerding2022-03-1914-69/+504
| | | | | | | | | | | | | patches/packages/python3-3.9.11-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: libexpat upgraded from 2.4.1 to 2.4.7 bundled pip upgraded from 21.2.4 to 22.0.4 authorization bypass fixed in urllib.request REDoS avoided in importlib.metadata For more information, see: https://pythoninsider.blogspot.com/2022/03/python-3103-3911-3813-and-3713-are-now.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28363 (* Security fix *)
* Thu Mar 17 19:46:28 UTC 202220220317194628_15.0 Patrick J Volkerding2022-03-1845-232/+2725
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/bind-9.18.1-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: An assertion could occur in resume_dslookup() if the fetch had been shut down earlier. Lookups involving a DNAME could trigger an INSIST when "synth-from-dnssec" was enabled. A synchronous call to closehandle_cb() caused isc__nm_process_sock_buffer() to be called recursively, which in turn left TCP connections hanging in the CLOSE_WAIT state blocking indefinitely when out-of-order processing was disabled. The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0667 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0635 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0396 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25220 (* Security fix *) patches/packages/bluez-5.64-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release: Fix issue with handling A2DP discover procedure. Fix issue with media endpoint replies and SetConfiguration. Fix issue with HoG queuing events before report map is read. Fix issue with HoG and read order of GATT attributes. Fix issue with HoG and not using UHID_CREATE2 interface. Fix issue with failed scanning for 5 minutes after reboot. patches/packages/openssl-1.1.1n-x86_64-1_slack15.0.txz: Upgraded. This update fixes a high severity security issue: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. For more information, see: https://www.openssl.org/news/secadv/20220315.txt https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778 (* Security fix *) patches/packages/openssl-solibs-1.1.1n-x86_64-1_slack15.0.txz: Upgraded. patches/packages/qt5-5.15.3_20220312_33a3f16f-x86_64-1_slack15.0.txz: Upgraded. Thanks to Heinz Wiesinger for updating the fetch_sources.sh script to make sure that the QtWebEngine version matches the rest of Qt, which got the latest git pull compiling again. If a 32-bit userspace is detected, then: export QTWEBENGINE_CHROMIUM_FLAGS="--disable-seccomp-filter-sandbox" This works around crashes occuring with 32-bit QtWebEngine applications. Thanks to alienBOB.
* Tue Mar 15 00:13:59 UTC 202220220315001359_15.0 Patrick J Volkerding2022-03-1513-57/+564
| | | | | | | | | | | | | | | | | | | | | | | | patches/packages/httpd-2.4.53-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: mod_sed: Read/write beyond bounds core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody HTTP request smuggling vulnerability mod_lua: Use of uninitialized value in r:parsebody For more information, see: https://downloads.apache.org/httpd/CHANGES_2.4.53 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22721 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22719 (* Security fix *) patches/packages/mozilla-firefox-91.7.1esr-x86_64-1_slack15.0.txz: Upgraded. This release makes the following change: Yandex and Mail.ru have been removed as optional search providers in the drop-down search menu in Firefox. For more information, see: https://www.mozilla.org/en-US/firefox/91.7.1/releasenotes/ (* Security fix *)
* Sat Mar 12 20:57:35 UTC 202220220312205735_15.0 Patrick J Volkerding2022-03-1312-59/+554
| | | | | | | | | | patches/packages/polkit-0.120-x86_64-3_slack15.0.txz: Rebuilt. Patched to fix a security issue where an unprivileged user could cause a denial of service due to process file descriptor exhaustion. Thanks to marav. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4115 (* Security fix *)
* Thu Mar 10 02:30:54 UTC 202220220310023054_15.0 Patrick J Volkerding2022-03-1014-66/+23762
| | | | | | patches/packages/ca-certificates-20220309-noarch-1_slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the authenticity of SSL connections.
* Wed Mar 9 04:14:08 UTC 202220220309041408_15.0 Patrick J Volkerding2022-03-098-294/+425
| | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/linux-5.15.27/*: Upgraded. These updates fix various bugs and security issues, including the recently announced "Dirty Pipe" vulnerability which allows overwriting data in arbitrary read-only files (CVE-2022-0847). Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see: Fixed in 5.15.20: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0492 Fixed in 5.15.23: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0516 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0435 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0487 Fixed in 5.15.24: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25375 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25258 Fixed in 5.15.25: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847 Fixed in 5.15.26: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25636 (* Security fix *)
* Tue Mar 8 04:39:53 UTC 202220220308043953_15.0 Patrick J Volkerding2022-03-098-38/+378
| | | | | | | | patches/packages/boost-1.78.0-x86_64-2_slack15.0.txz: Rebuilt. This update has been patched to fix a regression: Boost.Build silently skips installation of library headers and binaries in some cases. Thanks to Willy Sudiarto Raharjo.
* Tue Mar 8 00:52:43 UTC 202220220308005243_15.0 Patrick J Volkerding2022-03-084-22/+44
| | | | | | | | patches/packages/mozilla-firefox-91.7.0esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.7.0/releasenotes/ (* Security fix *)
* Sat Mar 5 19:56:26 UTC 202220220305195626_15.0 Patrick J Volkerding2022-03-066-35/+81
| | | | | | | | | | | | | | | | | | | | patches/packages/expat-2.4.7-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release: Relax fix to CVE-2022-25236 (introduced with release 2.4.5) with regard to all valid URI characters (RFC 3986). patches/packages/mozilla-firefox-91.6.1esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.6.1/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2022-09/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26485 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26486 (* Security fix *) patches/packages/mozilla-thunderbird-91.6.2-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.6.2/releasenotes/ (* Security fix *)
* Wed Mar 2 21:39:57 UTC 202220220302213957_15.0 Patrick J Volkerding2022-03-0315-80/+1044
| | | | | | | | patches/packages/seamonkey-2.53.11-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.seamonkey-project.org/releases/seamonkey2.53.11 (* Security fix *)
* Tue Mar 1 05:05:48 UTC 202220220301050548_15.0 Patrick J Volkerding2022-03-0215-75/+596
| | | | | | | | | | | | | | | | | | | | | | | | patches/packages/libxml2-2.9.13-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Use-after-free of ID and IDREF attributes (Thanks to Shinji Sato for the report) Use-after-free in xmlXIncludeCopyRange (David Kilzer) Fix Null-deref-in-xmlSchemaGetComponentTargetNs (huangduirong) Fix memory leak in xmlXPathCompNodeTest Fix null pointer deref in xmlStringGetNodeList Fix several memory leaks found by Coverity (David King) For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308 (* Security fix *) patches/packages/libxslt-1.1.35-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Fix use-after-free in xsltApplyTemplates Fix memory leak in xsltDocumentElem (David King) Fix memory leak in xsltCompileIdKeyPattern (David King) Fix double-free with stylesheets containing entity nodes For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30560 (* Security fix *)
* Fri Feb 25 00:03:28 UTC 202220220225000328_15.0 Patrick J Volkerding2022-02-2510-47/+310
| | | | | | | | | patches/packages/cyrus-sasl-2.1.28-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407 (* Security fix *)
* Mon Feb 21 20:21:38 UTC 202220220221202138_15.0 Patrick J Volkerding2022-02-2212-52/+281
| | | | | | | | | | | | | | | | patches/packages/expat-2.4.6-x86_64-1_slack15.0.txz: Upgraded. Fixed a regression introduced by the fix for CVE-2022-25313 that affects applications that (1) call function XML_SetElementDeclHandler and (2) are parsing XML that contains nested element declarations: (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"). patches/packages/flac-1.3.4-x86_64-1_slack15.0.txz: Upgraded. This update fixes overflow issues with encoding and decoding. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0499 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0561 (* Security fix *) patches/packages/mariadb-10.5.15-x86_64-2_slack15.0.txz: Rebuilt. Removed dangling symlink.
* Sun Feb 20 05:13:20 UTC 202220220220051320_15.0 Patrick J Volkerding2022-02-216-37/+214
| | | | | | | | | | | | | patches/packages/expat-2.4.5-x86_64-1_slack15.0.txz: Upgraded. Fixed security issues that could lead to denial of service or potentially arbitrary code execution. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25235 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25236 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25313 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25314 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25315 (* Security fix *)
* Fri Feb 18 05:29:00 UTC 202220220218052900_15.0 Patrick J Volkerding2022-02-1919-91/+837
| | | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/mozilla-thunderbird-91.6.1-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.6.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-07/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0566 (* Security fix *) patches/packages/php-7.4.28-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *) extra/php80/php80-8.0.16-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *) extra/php81/php81-8.1.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: UAF due to php_filter_float() failing for ints. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21708 (* Security fix *)
* Tue Feb 15 20:00:48 UTC 202220220215200048_15.0 Patrick J Volkerding2022-02-1633-3384/+11440
| | | | | | | | | | | | | | | | | | | | | patches/packages/aaa_base-15.0-x86_64-4_slack15.0.txz: Rebuilt. If root's mailbox did not already exist, it would be created with insecure permissions leading to possible local information disclosure. This update ensures that a new mailbox will be created with proper permissions and ownership, and corrects the permissions on an existing mailbox if they are found to be incorrect. Thanks to Martin for the bug report. (* Security fix *) patches/packages/util-linux-2.37.4-x86_64-1_slack15.0.txz: Upgraded. This release fixes a security issue in chsh(1) and chfn(8): By default, these utilities had been linked with libreadline, which allows the INPUTRC environment variable to be abused to produce an error message containing data from an arbitrary file. So, don't link these utilities with libreadline as it does not use secure_getenv() (or a similar concept), or sanitize the config file path to avoid vulnerabilities that could occur in set-user-ID or set-group-ID programs. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563 (* Security fix *)
* Mon Feb 14 00:10:38 UTC 202220220214001038_15.0 Patrick J Volkerding2022-02-1410-55/+480
| | | | | | | | | | | | patches/packages/mariadb-10.5.15-x86_64-1_slack15.0.txz: Upgraded. This update fixes potential denial-of-service vulnerabilities. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46665 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46664 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46661 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46668 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46663 (* Security fix *)
* Thu Feb 10 01:46:55 UTC 202220220210014655_15.0 Patrick J Volkerding2022-02-1045-374/+4155
| | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/at-3.2.3-x86_64-1_slack15.0.txz: Upgraded. Switched to at-3.2.3 since version 3.2.4 has a regression that causes queued jobs to not always run on time when atd is run as a standalone daemon. Thanks to Cesare. patches/packages/mozilla-firefox-91.6.0esr-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/91.6.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2022-05/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22753 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22754 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22756 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22759 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22760 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22761 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22763 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22764 (* Security fix *) patches/packages/mozilla-thunderbird-91.6.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.6.0/releasenotes/ https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird91.6 (* Security fix *)
* Wed Feb 2 22:22:22 UTC 2022slackware-15.020220202222222 Patrick J Volkerding2022-02-048-339/+320
| | | | | | | | | | | | | | | | | | | | | | Slackware 15.0 x86_64 stable is released! Another too-long development cycle is behind us after we bit off more than we could chew and then had to shine it up to a high-gloss finish. Hopefully we've managed to get the tricky parts out of the way so that we'll be able to see a 15.1 incremental update after a far shorter development cycle. Certainly the development infrastructure has been streamlined here and things should be easier moving forward. My thanks to the rest of the Slackware team, all the upstream developers who have given us such great building materials, the folks on LinuxQuestions.org and elsewhere for all the help with testing, great suggestions, and countless bug fixes, and to everyone who helped support this project so that the release could finally see the light of day. I couldn't have done any of this without your help, and I'm grateful to all of you. Thanks! For more information, check out the RELEASE_NOTES, CHANGES_AND_HINTS.TXT, and ANNOUNCE.15.0. Have fun! :-)
* Wed Feb 2 08:21:48 UTC 202220220202082148 Patrick J Volkerding2022-02-0218-127/+144
| | | | | | | | | | | | | | | | a/kernel-generic-5.15.19-x86_64-2.txz: Upgraded. a/kernel-huge-5.15.19-x86_64-2.txz: Upgraded. a/kernel-modules-5.15.19-x86_64-2.txz: Upgraded. d/kernel-headers-5.15.19-x86-2.txz: Upgraded. k/kernel-source-5.15.19-noarch-2.txz: Upgraded. -RTC_SYSTOHC_DEVICE "rtc0" RTC_SYSTOHC y -> n isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. testing/source/linux-5.16.5-configs/*: Rebuilt. -RTC_SYSTOHC_DEVICE "rtc0" RTC_SYSTOHC y -> n usb-and-pxe-installers/usbboot.img: Rebuilt.
* Wed Feb 2 04:17:39 UTC 202220220202041739 Patrick J Volkerding2022-02-0230-492/+602
| | | | | | | | | | | | | | | | | | | | | | | | | fortune -m "I will be finished tomorrow" fortunes2 a/kernel-generic-5.15.19-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.19-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.19-x86_64-1.txz: Upgraded. ap/screen-4.9.0-x86_64-1.txz: Upgraded. Patched possible denial of service via a crafted UTF-8 character sequence. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26937 (* Security fix *) d/kernel-headers-5.15.19-x86-1.txz: Upgraded. k/kernel-source-5.15.19-noarch-1.txz: Upgraded. RTC_INTF_DEV_UIE_EMUL y -> n RTC_SYSTOHC n -> y +RTC_SYSTOHC_DEVICE "rtc0" l/lcms2-2.13-x86_64-2.txz: Rebuilt. [PATCH] Fix for optimization error on grayscale. Thanks to Aaron Boxer for reporting this issue. Thanks to gmgf. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. testing/source/linux-5.16.5-configs/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Tue Feb 1 08:27:47 UTC 202220220201082747 Patrick J Volkerding2022-02-0111-48/+1353
| | | | | | | | | | kde/kate-21.12.1-x86_64-2.txz: Rebuilt. Fix missing validation of binaries executed via QProcess. Thanks to Heinz Wiesinger. For more information, see: https://kde.org/info/security/advisory-20220131-1.txt https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23853 (* Security fix *)
* Tue Feb 1 04:37:04 UTC 202220220201043704 Patrick J Volkerding2022-02-0122-95/+62140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sepulchral voice intones, "The cave is now closed." kde/falkon-3.2.0-x86_64-1.txz: Upgraded. kde/ktexteditor-5.90.0-x86_64-2.txz: Rebuilt. [PATCH] only start programs in user's path. [PATCH] only execute diff in path. Thanks to gmgf. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23853 (* Security fix *) l/libcanberra-0.30-x86_64-9.txz: Rebuilt. Fix a bug crashing some applications in Wayland desktops. Thanks to 01micko. n/samba-4.15.5-x86_64-1.txz: Upgraded. This is a security release in order to address the following defects: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists. Out-of-Bound Read/Write on Samba vfs_fruit module. This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit. Re-adding an SPN skips subsequent SPN conflict checks. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity. For more information, see: https://www.samba.org/samba/security/CVE-2021-44141.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44141 https://www.samba.org/samba/security/CVE-2021-44142.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44142 https://www.samba.org/samba/security/CVE-2022-0336.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0336 (* Security fix *) x/xterm-370-x86_64-7.txz: Rebuilt. Rebuilt with --disable-sixel-graphics to fix a buffer overflow. Thanks to gmgf. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24130 (* Security fix *) testing/source/linux-5.16.4-configs/*: Added. Sample config files to build 5.16.4 Linux kernels.
* Sun Jan 30 20:48:46 UTC 202220220130204846 Patrick J Volkerding2022-01-3113-327/+108
| | | | | | | | | | | a/aaa_libraries-15.0-x86_64-19.txz: Rebuilt. Upgraded: libexpat.so.1.8.4, libjson-c.so.5.1.0 (thanks to peake). ap/at-3.2.4-x86_64-1.txz: Upgraded. d/git-2.35.1-x86_64-1.txz: Upgraded. l/expat-2.4.4-x86_64-1.txz: Upgraded. This update merges the patches we previously applied to expat-2.4.3. l/imagemagick-7.1.0_22-x86_64-1.txz: Upgraded. l/lcms2-2.13-x86_64-1.txz: Upgraded.
* Sat Jan 29 19:23:50 UTC 202220220129192350 Patrick J Volkerding2022-01-3016-101/+133
| | | | | | | | | | | | | a/kernel-generic-5.15.18-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.18-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.18-x86_64-1.txz: Upgraded. ap/vim-8.2.4256-x86_64-1.txz: Upgraded. d/kernel-headers-5.15.18-x86-1.txz: Upgraded. k/kernel-source-5.15.18-noarch-1.txz: Upgraded. xap/vim-gvim-8.2.4256-x86_64-1.txz: Upgraded. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Sat Jan 29 06:17:05 UTC 202220220129061705 Patrick J Volkerding2022-01-2911-83/+203
| | | | | | | | | | a/rpm2tgz-1.2.2-x86_64-5.txz: Rebuilt. rpm2targz: when extracting the cpio archive from inside the RPM, use --no-absolute-filenames to protect against a poorly made RPM scribbling all over system files/directories. Thanks to Sl4ck3ver. Support -i option to ignore non-zero exit value from rpm2cpio. This allows repackaging some malformed RPMs. Thanks to ricky_cardo for the sample malformed RPM.
* Thu Jan 27 22:43:13 UTC 202220220127224313 Patrick J Volkerding2022-01-2835-223/+419
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a/aaa_libraries-15.0-x86_64-18.txz: Rebuilt. Rebuilt to pick up the patched libexpat.so.1.8.3. a/kernel-generic-5.15.17-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.17-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.17-x86_64-1.txz: Upgraded. a/lzlib-1.13-x86_64-1.txz: Upgraded. a/sysvinit-scripts-15.0-noarch-8.txz: Rebuilt. rc.S: clear /var/lock/subsys before starting libcgroup services. Thanks to pyllyukko. ap/pamixer-1.5-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. d/kernel-headers-5.15.17-x86-1.txz: Upgraded. k/kernel-source-5.15.17-noarch-1.txz: Upgraded. kde/kig-21.12.1-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. kde/kopeninghours-21.12.1-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. kde/krita-5.0.2-x86_64-2.txz: Rebuilt. Recompiled against boost-1.78.0. l/boost-1.78.0-x86_64-1.txz: Upgraded. I hadn't planned to update this at such a late stage, but POV-Ray needs it and everything we ship builds fine against it. Thanks to bender647. Shared library .so-version bump. l/cryfs-0.10.3-x86_64-4.txz: Rebuilt. Recompiled against boost-1.78.0. l/expat-2.4.3-x86_64-3.txz: Rebuilt. Prevent integer overflow in doProlog. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990 (* Security fix *) l/netpbm-10.97.03-x86_64-1.txz: Upgraded. l/openexr-2.5.7-x86_64-5.txz: Rebuilt. Recompiled against boost-1.78.0. l/pipewire-0.3.44-x86_64-1.txz: Upgraded. n/fetchmail-6.4.27-x86_64-1.txz: Upgraded. n/libgpg-error-1.44-x86_64-1.txz: Upgraded. x/mesa-21.3.5-x86_64-1.txz: Upgraded. xap/mozilla-firefox-91.5.1esr-x86_64-1.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/firefox/91.5.1/releasenotes/ (* Security fix *) extra/rust-for-mozilla/rust-1.54.0-x86_64-4.txz: Rebuilt. Removed duplicated libLLVM shared library. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Wed Jan 26 20:46:44 UTC 202220220126204644 Patrick J Volkerding2022-01-2710-57/+108
| | | | | | | | | | | | | | | a/aaa_libraries-15.0-x86_64-17.txz: Rebuilt. Upgraded: libcap.so.2.63, libglib-2.0.so.0.7000.3, libgmodule-2.0.so.0.7000.3, libgobject-2.0.so.0.7000.3, libgthread-2.0.so.0.7000.3, libtdb.so.1.4.6. a/mkinitrd-1.4.11-x86_64-28.txz: Rebuilt. Support kernel modules compressed with xz. Thanks to baldzhang. l/glib2-2.70.3-x86_64-1.txz: Upgraded. l/libcap-2.63-x86_64-1.txz: Upgraded. n/bluez-5.63-x86_64-2.txz: Rebuilt. rc.bluetooth: use #!/bin/bash shebang. Filter commented and empty lines when parsing uart.conf. Thanks to atelszewski.
* Wed Jan 26 04:37:35 UTC 202220220126043735 Patrick J Volkerding2022-01-268-55/+202
| | | | | | | | | | l/polkit-0.120-x86_64-2.txz: Rebuilt. [PATCH] pkexec: local privilege escalation. Thanks to Qualys Research Labs for reporting this issue. For more information, see: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034 (* Security fix *)
* Tue Jan 25 06:16:36 UTC 202220220125061636 Patrick J Volkerding2022-01-2520-175/+985
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It may look like we're currently experiencing more stuckness, but this will lead us to Quality. We'll have this release in the can before you know it. a/aaa_glibc-solibs-2.33-x86_64-5.txz: Rebuilt. a/aaa_libraries-15.0-x86_64-16.txz: Rebuilt. Rebuilt to pick up the patched libexpat.so.1.8.3. a/kernel-firmware-20220124_eb8ea1b-noarch-1.txz: Upgraded. a/kernel-generic-5.15.16-x86_64-2.txz: Upgraded. a/kernel-huge-5.15.16-x86_64-2.txz: Upgraded. -9P_FSCACHE n 9P_FS m -> y Thanks to peake. a/kernel-modules-5.15.16-x86_64-2.txz: Upgraded. a/mkinitrd-1.4.11-x86_64-27.txz: Rebuilt. mkinitrd_command_generator.sh: properly detect partitions of a RAID device. Thanks to perrin4869. a/util-linux-2.37.3-x86_64-1.txz: Upgraded. This release fixes two security mount(8) and umount(8) issues: An issue related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3995 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3996 (* Security fix *) ap/vim-8.2.4212-x86_64-1.txz: Upgraded. d/git-2.35.0-x86_64-1.txz: Upgraded. d/kernel-headers-5.15.16-x86-2.txz: Upgraded. k/kernel-source-5.15.16-noarch-2.txz: Upgraded. l/expat-2.4.3-x86_64-2.txz: Rebuilt. Fix signed integer overflow in function XML_GetBuffer for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or other undefined behavior. While we're here, also patch a memory leak on output file opening error. Thanks to marav. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23852 (* Security fix *) l/fluidsynth-2.2.5-x86_64-1.txz: Upgraded. l/glibc-2.33-x86_64-5.txz: Rebuilt. This update patches two security issues: Unexpected return value from glibc's realpath(). Off-by-one buffer overflow/underflow in glibc's getcwd(). Thanks to Qualys Research Labs for reporting these issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3998 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3999 (* Security fix *) l/glibc-i18n-2.33-x86_64-5.txz: Rebuilt. l/glibc-profile-2.33-x86_64-5.txz: Rebuilt. l/tdb-1.4.6-x86_64-1.txz: Upgraded. x/xf86-input-libinput-1.2.1-x86_64-1.txz: Upgraded. xap/mozilla-thunderbird-91.5.1-x86_64-1.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/91.5.1/releasenotes/ xap/vim-gvim-8.2.4212-x86_64-1.txz: Upgraded. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Sun Jan 23 19:36:54 UTC 202220220123193654 Patrick J Volkerding2022-01-244-27/+44
| | | | | l/imagemagick-7.1.0_20-x86_64-1.txz: Upgraded. Built using --with-fftw. Thanks to stormbr.
* Sun Jan 23 01:17:39 UTC 202220220123011739 Patrick J Volkerding2022-01-239-1007/+410
| | | | | | | | | | | | ap/ddrescue-1.26-x86_64-1.txz: Upgraded. d/parallel-20220122-noarch-1.txz: Upgraded. l/libimobiledevice-20211124_2c6121d-x86_64-2.txz: Rebuilt. Don't include compatibility pkgconfig symlink. It's unlikely that anything requires it. l/libimobiledevice-glue-20211125_3cb687b-x86_64-2.txz: Rebuilt. Removed broken pkgconfig symlink. Thanks to marav. isolinux/initrd.img: Rebuilt. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Fri Jan 21 19:58:34 UTC 202220220121195834 Patrick J Volkerding2022-01-227-41/+69
| | | | | kde/kconfigwidgets-5.90.1-x86_64-1.txz: Upgraded. l/libwebp-1.2.2-x86_64-1.txz: Upgraded.
* Fri Jan 21 05:47:49 UTC 202220220121054749 Patrick J Volkerding2022-01-2127-177/+1279
| | | | | | | | | | | | | | | | | | | | | | | | | | | a/aaa_libraries-15.0-x86_64-15.txz: Rebuilt. Upgraded: libzstd.so.1.5.2. a/kernel-firmware-20220119_0c6a7b3-noarch-1.txz: Upgraded. a/kernel-generic-5.15.16-x86_64-1.txz: Upgraded. a/kernel-huge-5.15.16-x86_64-1.txz: Upgraded. a/kernel-modules-5.15.16-x86_64-1.txz: Upgraded. ap/vim-8.2.4166-x86_64-1.txz: Upgraded. d/kernel-headers-5.15.16-x86-1.txz: Upgraded. d/rust-1.58.1-x86_64-1.txz: Upgraded. k/kernel-source-5.15.16-noarch-1.txz: Upgraded. l/qt5-5.15.3_20211130_014c375b-x86_64-2.txz: Rebuilt. Applied upstream patch: [PATCH] Move the wayland socket polling to a separate event thread. Thanks to LuckyCyborg. l/svgalib-1.9.25-x86_64-7.txz: Rebuilt. Don't try to use the (broken) assembly. Thanks to nobodino. l/zstd-1.5.2-x86_64-1.txz: Upgraded. x/ibus-m17n-1.4.9-x86_64-1.txz: Upgraded. xap/vim-gvim-8.2.4166-x86_64-1.txz: Upgraded. extra/php80/php80-8.0.15-x86_64-1.txz: Upgraded. extra/php81/php81-8.1.2-x86_64-1.txz: Upgraded. isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.
* Wed Jan 19 18:18:02 UTC 202220220119181802 Patrick J Volkerding2022-01-2022-935/+175
| | | | | | | | | | | | | | | | | | | | | | ap/inxi-3.3.12_1-noarch-1.txz: Upgraded. ap/man-db-2.9.4-x86_64-3.txz: Rebuilt. Don't use --no-purge in the daily cron job to update the databases. l/gst-plugins-bad-free-1.18.5-x86_64-4.txz: Rebuilt. Link against neon-0.32.2. Thanks to marav. n/bind-9.16.25-x86_64-1.txz: Upgraded. n/ethtool-5.16-x86_64-1.txz: Upgraded. n/samba-4.15.4-x86_64-1.txz: Upgraded. n/wpa_supplicant-2.10-x86_64-1.txz: Upgraded. The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23303 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23304 (* Security fix *) x/xterm-370-x86_64-6.txz: Rebuilt. XTerm-console: improve the font settings. Thanks to GazL.
* Tue Jan 18 20:39:39 UTC 202220220118203939 Patrick J Volkerding2022-01-1910-56/+114
| | | | | | | | | l/rpcsvc-proto-1.4.3-x86_64-1.txz: Upgraded. x/xterm-370-x86_64-5.txz: Rebuilt. XTerm-console: don't include locale options by default. Fix typo in comment. Thanks to GazL. isolinux/initrd.img: Rebuilt. usb-and-pxe-installers/usbboot.img: Rebuilt.
generated by cgit v1.2.3 (git 2.26.2) at 2024-05-10 20:16:25 +0000