summaryrefslogtreecommitdiffstats
path: root/ChangeLog.txt (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Mon Oct 9 18:10:01 UTC 202320231009181001_15.0 Patrick J Volkerding2023-10-101-0/+15
| | | | | | | | | | | | | | | | patches/packages/wayland-1.22.0-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/whois-5.5.19-x86_64-1_slack15.0.txz: Upgraded. Fixed english support for Japanese queries to not add again the /e argument if it had already been provided by the user. (Closes: #1050171) Added the .ye and .*************** (.xn--54b7fta0cc, Bangladesh) TLD servers. Updated the .ba, .bb, .dk, .es, .gt, .jo, .ml, .mo, .pa, .pn, .sv, .uy, .a+-la-r+-d+.n+, (.xn--mgbayh7gpa, Jordan) and .****** (.xn--mix891f, Macao) TLD servers. Upgraded the TLD URLs to HTTPS whenever possible. Updated the charset for whois.jprs.jp. Removed 3 new gTLDs which are no longer active. Removed support for the obsolete as32 dot notation.
* Fri Oct 6 21:28:34 UTC 202320231006212834_15.0 Patrick J Volkerding2023-10-071-0/+9
| | | | | | | | | | patches/packages/netatalk-3.1.18-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Harden create_appledesktop_folder(). For more information, see: https://netatalk.sourceforge.io/CVE-2022-22995.php https://www.cve.org/CVERecord?id=CVE-2022-22995 (* Security fix *)
* Tue Oct 3 22:19:10 UTC 202320231003221910_15.0 Patrick J Volkerding2023-10-041-0/+22
| | | | | | | | | | | | | | | | | | | | | | | patches/packages/libX11-1.8.7-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: libX11: out-of-bounds memory access in _XkbReadKeySyms(). libX11: stack exhaustion from infinite recursion in PutSubImage(). libX11: integer overflow in XCreateImage() leading to a heap overflow. For more information, see: https://lists.x.org/archives/xorg-announce/2023-October/003424.html https://www.cve.org/CVERecord?id=CVE-2023-43785 https://www.cve.org/CVERecord?id=CVE-2023-43786 https://www.cve.org/CVERecord?id=CVE-2023-43787 (* Security fix *) patches/packages/libXpm-3.5.17-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: libXpm: out of bounds read in XpmCreateXpmImageFromBuffer(). libXpm: out of bounds read on XPM with corrupted colormap. For more information, see: https://lists.x.org/archives/xorg-announce/2023-October/003424.html https://www.cve.org/CVERecord?id=CVE-2023-43788 https://www.cve.org/CVERecord?id=CVE-2023-43789 (* Security fix *)
* Sat Sep 30 21:33:49 UTC 202320230930213349_15.0 Patrick J Volkerding2023-10-011-0/+16
| | | | | | | | | | | | | | | | | patches/packages/libvpx-1.12.0-x86_64-1_slack15.0.txz: Upgraded. This release contains two security related fixes -- one each for VP8 and VP9. For more information, see: https://crbug.com/1486441 https://www.cve.org/CVERecord?id=CVE-2023-5217 (* Security fix *) patches/packages/mozilla-thunderbird-115.3.1-x86_64-1_slack15.0.txz: Upgraded. This release contains a security fix for a critical heap buffer overflow in the libvpx VP8 encoder. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.3.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ https://www.cve.org/CVERecord?id=CVE-2023-5217 (* Security fix *)
* Thu Sep 28 21:37:06 UTC 202320230928213706_15.0 Patrick J Volkerding2023-09-291-0/+13
| | | | | | | | | | | | | | extra/php81/php81-8.1.24-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.php.net/ChangeLog-8.php#8.1.24 patches/packages/mozilla-firefox-115.3.1esr-x86_64-1_slack15.0.txz: Upgraded. This update contains a security fix. For more information, see: https://www.mozilla.org/en-US/firefox/115.3.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ https://www.cve.org/CVERecord?id=CVE-2023-5217 (* Security fix *)
* Wed Sep 27 23:51:07 UTC 202320230927235107_15.0 Patrick J Volkerding2023-09-281-0/+6
| | | | | | | patches/packages/mozilla-thunderbird-115.3.0-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.3.0/releasenotes/
* Tue Sep 26 19:30:21 UTC 202320230926193021_15.0 Patrick J Volkerding2023-09-271-0/+15
| | | | | | | | | | | | | | | | patches/packages/Cython-0.29.36-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/mozilla-firefox-115.3.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/115.3.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-42/ https://www.cve.org/CVERecord?id=CVE-2023-5168 https://www.cve.org/CVERecord?id=CVE-2023-5169 https://www.cve.org/CVERecord?id=CVE-2023-5171 https://www.cve.org/CVERecord?id=CVE-2023-5174 https://www.cve.org/CVERecord?id=CVE-2023-5176 (* Security fix *)
* Thu Sep 21 19:32:42 UTC 202320230921193242_15.0 Patrick J Volkerding2023-09-221-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/bind-9.16.44-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Limit the amount of recursion that can be performed by isccc_cc_fromwire. For more information, see: https://kb.isc.org/docs/cve-2023-3341 https://www.cve.org/CVERecord?id=CVE-2023-3341 (* Security fix *) patches/packages/cups-2.4.7-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Fixed Heap-based buffer overflow when reading Postscript in PPD files. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-4504 (* Security fix *) patches/packages/mozilla-thunderbird-115.2.3-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.2.3/releasenotes/ patches/packages/seamonkey-2.53.17.1-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.seamonkey-project.org/releases/seamonkey2.53.17.1 https://www.cve.org/CVERecord?id=CVE-2023-4863 (* Security fix *) testing/packages/bind-9.18.19-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Limit the amount of recursion that can be performed by isccc_cc_fromwire. Fix use-after-free error in TLS DNS code when sending data. For more information, see: https://kb.isc.org/docs/cve-2023-3341 https://www.cve.org/CVERecord?id=CVE-2023-3341 https://kb.isc.org/docs/cve-2023-4236 https://www.cve.org/CVERecord?id=CVE-2023-4236 (* Security fix *)
* Mon Sep 18 18:40:04 UTC 202320230918184004_15.0 Patrick J Volkerding2023-09-191-0/+10
| | | | | | | | | | | patches/packages/netatalk-3.1.17-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Validate data type in dalloc_value_for_key(). This flaw could allow a malicious actor to cause Netatalk's afpd daemon to crash, or possibly to execute arbitrary code. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-42464 (* Security fix *)
* Fri Sep 15 19:48:39 UTC 202320230915194839_15.0 Patrick J Volkerding2023-09-161-0/+11
| | | | | | | | | | | | patches/packages/python3-3.9.18-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported by Aapo Oksman; patch by Gregory P. Smith. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-40217 (* Security fix *)
* Thu Sep 14 21:10:50 UTC 202320230914211050_15.0 Patrick J Volkerding2023-09-151-0/+36
| | | | | | | | patches/packages/libwebp-1.3.2-x86_64-1_slack15.0.txz: Upgraded. Security fix for lossless decoder (chromium: #1479274, CVE-2023-4863). For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-4863 (* Security fix *)
* Wed Sep 13 01:32:01 UTC 202320230913013201_15.0 Patrick J Volkerding2023-09-131-0/+11
| | | | | | | | | | | | patches/packages/mozilla-firefox-115.2.1esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/115.2.1/releasenotes/ (* Security fix *) patches/packages/mozilla-thunderbird-115.2.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.2.1/releasenotes/
* Mon Sep 11 20:19:30 UTC 202320230911201930_15.0 Patrick J Volkerding2023-09-121-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/openssl-1.1.1w-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue that does not affect Linux: Fix POLY1305 MAC implementation corrupting XMM registers on Windows. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-4807 patches/packages/openssl-solibs-1.1.1w-x86_64-1_slack15.0.txz: Upgraded. patches/packages/vim-9.0.1897-x86_64-1_slack15.0.txz: Upgraded. Fixed three use-after-free security issues. Thanks to marav for the heads-up. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-4733 https://www.cve.org/CVERecord?id=CVE-2023-4752 https://www.cve.org/CVERecord?id=CVE-2023-4750 (* Security fix *) patches/packages/vim-gvim-9.0.1897-x86_64-1_slack15.0.txz: Upgraded. Fixed three use-after-free security issues. Thanks to marav for the heads-up. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-4733 https://www.cve.org/CVERecord?id=CVE-2023-4752 https://www.cve.org/CVERecord?id=CVE-2023-4750 (* Security fix *)
* Sun Sep 3 19:37:21 UTC 202320230903193721_15.0 Patrick J Volkerding2023-09-041-0/+4
| | | | | patches/packages/rocs-21.12.1-x86_64-2_slack15.0.txz: Rebuilt. Fix crash on startup. Thanks to Lockywolf and ponce.
* Fri Sep 1 20:16:14 UTC 202320230901201614_15.0 Patrick J Volkerding2023-09-021-0/+6
| | | | | | | extra/php81/php81-8.1.23-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.php.net/ChangeLog-8.php#8.1.23
* Wed Aug 30 21:58:04 UTC 202320230830215804_15.0 Patrick J Volkerding2023-08-311-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/mozilla-firefox-115.2.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/115.2.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2023-36/ https://www.cve.org/CVERecord?id=CVE-2023-4573 https://www.cve.org/CVERecord?id=CVE-2023-4574 https://www.cve.org/CVERecord?id=CVE-2023-4575 https://www.cve.org/CVERecord?id=CVE-2023-4576 https://www.cve.org/CVERecord?id=CVE-2023-4577 https://www.cve.org/CVERecord?id=CVE-2023-4051 https://www.cve.org/CVERecord?id=CVE-2023-4578 https://www.cve.org/CVERecord?id=CVE-2023-4053 https://www.cve.org/CVERecord?id=CVE-2023-4580 https://www.cve.org/CVERecord?id=CVE-2023-4581 https://www.cve.org/CVERecord?id=CVE-2023-4582 https://www.cve.org/CVERecord?id=CVE-2023-4583 https://www.cve.org/CVERecord?id=CVE-2023-4584 https://www.cve.org/CVERecord?id=CVE-2023-4585 (* Security fix *) patches/packages/mozilla-thunderbird-115.2.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.2.0/releasenotes/ (* Security fix *)
* Wed Aug 16 20:45:00 UTC 202320230816204500_15.0 Patrick J Volkerding2023-08-171-0/+6
| | | | | | | patches/packages/mozilla-thunderbird-115.1.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.1.1/releasenotes/
* Mon Aug 14 19:04:41 UTC 202320230814190441_15.0 Patrick J Volkerding2023-08-151-0/+6
| | | | | | | patches/packages/mariadb-10.5.22-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://mariadb.com/kb/en/mariadb-10-5-22-changelog/
* Mon Aug 7 19:22:02 UTC 202320230807192202_15.0 Patrick J Volkerding2023-08-081-0/+18
| | | | | | | | | | | | | | | | | | | extra/php80/php80-8.0.30-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Security issue with external entity loading in XML without enabling it. Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3823 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3247 (* Security fix *) patches/packages/vim-9.0.1678-x86_64-1_slack15.0.txz: Upgraded. Applied the last patches from Bram Moolenaar. RIP Bram, and thanks for your great work on VIM and your kindness to the orphan children in Uganda. If you'd like to honor Bram with a donation to his charity, please visit: https://iccf-holland.org/ patches/packages/vim-gvim-9.0.1678-x86_64-1_slack15.0.txz: Upgraded.
* Fri Aug 4 20:17:36 UTC 202320230804201736_15.0 Patrick J Volkerding2023-08-051-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | extra/php81/php81-8.1.22-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-3823 (* Security fix *) extra/rust-for-mozilla/rust-1.70.0-x86_64-1_slack15.0.txz: Upgraded. Upgraded the Rust compiler for Firefox 115.1.0 ESR and Thunderbird 115.1.0. pasture/samba-4.15.13-x86_64-1_slack15.0.txz: Added. We'll hang onto this just in case. patches/packages/mozilla-firefox-115.1.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/115.1.0esr/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-31/ https://www.cve.org/CVERecord?id=CVE-2023-4045 https://www.cve.org/CVERecord?id=CVE-2023-4046 https://www.cve.org/CVERecord?id=CVE-2023-4047 https://www.cve.org/CVERecord?id=CVE-2023-4048 https://www.cve.org/CVERecord?id=CVE-2023-4049 https://www.cve.org/CVERecord?id=CVE-2023-4050 https://www.cve.org/CVERecord?id=CVE-2023-4052 https://www.cve.org/CVERecord?id=CVE-2023-4054 https://www.cve.org/CVERecord?id=CVE-2023-4055 https://www.cve.org/CVERecord?id=CVE-2023-4056 https://www.cve.org/CVERecord?id=CVE-2023-4057 (* Security fix *) patches/packages/mozilla-thunderbird-115.1.0-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/115.1.0/releasenotes/ patches/packages/samba-4.18.5-x86_64-1_slack15.0.txz: Upgraded. PLEASE NOTE: We are taking the unusual step of moving to the latest Samba branch because Windows has made changes that break Samba 4.15.x. The last 4.15.x will be retained in /pasture as a fallback. There may be some required configuration changes with this, but we've kept using MIT Kerberos to try to have the behavior change as little as possible. Upgrade carefully. This update fixes security issues: When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it. SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request. Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process. As part of the Spotlight protocol Samba discloses the server-side absolute path of shares and files and directories in search results. For more information, see: https://www.samba.org/samba/security/CVE-2022-2127.html https://www.samba.org/samba/security/CVE-2023-3347.html https://www.samba.org/samba/security/CVE-2023-34966.html https://www.samba.org/samba/security/CVE-2023-34967.html https://www.samba.org/samba/security/CVE-2023-34968.html https://www.cve.org/CVERecord?id=CVE-2022-2127 https://www.cve.org/CVERecord?id=CVE-2023-3347 https://www.cve.org/CVERecord?id=CVE-2023-34966 https://www.cve.org/CVERecord?id=CVE-2023-34967 https://www.cve.org/CVERecord?id=CVE-2023-34968 (* Security fix *)
* Tue Aug 1 19:50:53 UTC 202320230801195053_15.0 Patrick J Volkerding2023-08-021-0/+13
| | | | | | | | | | | | | | patches/packages/openssl-1.1.1v-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: Fix excessive time spent checking DH q parameter value. Fix DH_check() excessive time with over sized modulus. For more information, see: https://www.openssl.org/news/secadv/20230731.txt https://www.openssl.org/news/secadv/20230719.txt https://www.cve.org/CVERecord?id=CVE-2023-3817 https://www.cve.org/CVERecord?id=CVE-2023-3446 (* Security fix *) patches/packages/openssl-solibs-1.1.1v-x86_64-1_slack15.0.txz: Upgraded.
* Mon Jul 31 21:52:46 UTC 202320230731215246_15.0 Patrick J Volkerding2023-08-011-0/+14
| | | | | | | | | | | | | | | patches/packages/mozilla-thunderbird-102.13.1-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.13.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/ https://www.cve.org/CVERecord?id=CVE-2023-3417 (* Security fix *) patches/packages/seamonkey-2.53.17-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.seamonkey-project.org/releases/seamonkey2.53.17 (* Security fix *)
* Wed Jul 26 19:26:39 UTC 202320230726192639_15.0 Patrick J Volkerding2023-07-271-0/+12
| | | | | | | | | | | | | patches/packages/curl-8.2.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. testing/packages/mozilla-firefox-115.0.3esr-x86_64-1_slack15.0.txz: Added. This seems good to go, but a little testing won't hurt. testing/packages/mozilla-thunderbird-115.0.1-x86_64-1_slack15.0.txz: Added. Here, like in -current, we're going to wait until upstream deems this ready to trigger the automatic update from earlier versions. testing/packages/rust-1.70.0-x86_64-1_slack15.0.txz: Added. This will replace the package in /extra/rust-for-mozilla/ when the 115.x versions of Firefox and Thunderbird become the main ones in Slackware 15.0.
* Tue Jul 25 19:45:27 UTC 202320230725194527_15.0 Patrick J Volkerding2023-07-261-0/+4
| | | | | patches/packages/kernel-firmware-20230725_b6ea35f-noarch-1.txz: Upgraded. Restored license files and other documentation. Thanks to drumz.
* Mon Jul 24 22:07:56 UTC 202320230724220756_15.0 Patrick J Volkerding2023-07-251-0/+14
| | | | | | | | | | | | | | | patches/packages/kernel-firmware-20230724_59fbffa-noarch-1.txz: Upgraded. AMD microcode updated to fix a use-after-free in AMD Zen2 processors. From Tavis Ormandy's annoucement of the issue: "The practical result here is that you can spy on the registers of other processes. No system calls or privileges are required. It works across virtual machines and affects all operating systems. I have written a poc for this issue that's fast enough to reconstruct keys and passwords as users log in." For more information, see: https://seclists.org/oss-sec/2023/q3/59 https://www.cve.org/CVERecord?id=CVE-2023-20593 (* Security fix *)
* Mon Jul 24 00:17:18 UTC 202320230724001718_15.0 Patrick J Volkerding2023-07-241-0/+11
| | | | | | | | | | | | patches/packages/whois-5.5.18-x86_64-1_slack15.0.txz: Upgraded. Updated the .ga TLD server. Added new recovered IPv4 allocations. Removed the delegation of 43.0.0.0/8 to JPNIC. Removed 12 new gTLDs which are no longer active. Improved the man page source, courtesy of Bjarni Ingi Gislason. Added the .edu.za SLD server. Updated the .alt.za SLD server. Added the -ru and -su NIC handles servers.
* Fri Jul 21 19:35:45 UTC 202320230721193545_15.0 Patrick J Volkerding2023-07-221-0/+5
| | | | | | patches/packages/ca-certificates-20230721-noarch-1_slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the authenticity of SSL connections.
* Wed Jul 19 20:36:46 UTC 202320230719203646_15.0 Patrick J Volkerding2023-07-211-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | patches/packages/curl-8.2.0-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: fopen race condition. For more information, see: https://curl.se/docs/CVE-2023-32001.html https://www.cve.org/CVERecord?id=CVE-2023-32001 (* Security fix *) patches/packages/openssh-9.3p2-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: ssh-agent(1) in OpenSSH between and 5.5 and 9.3p1 (inclusive): remote code execution relating to PKCS#11 providers. The PKCS#11 support ssh-agent(1) could be abused to achieve remote code execution via a forwarded agent socket if the following conditions are met: * Exploitation requires the presence of specific libraries on the victim system. * Remote exploitation requires that the agent was forwarded to an attacker-controlled system. Exploitation can also be prevented by starting ssh-agent(1) with an empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring an allowlist that contains only specific provider libraries. This vulnerability was discovered and demonstrated to be exploitable by the Qualys Security Advisory team. Potentially-incompatible changes: * ssh-agent(8): the agent will now refuse requests to load PKCS#11 modules issued by remote clients by default. A flag has been added to restore the previous behaviour: "-Oallow-remote-pkcs11". For more information, see: https://www.openssh.com/txt/release-9.3p2 https://www.cve.org/CVERecord?id=CVE-2023-38408 (* Security fix *)
* Mon Jul 17 19:17:19 UTC 202320230717191719_15.0 Patrick J Volkerding2023-07-181-0/+4
| | | | | patches/packages/sudo-1.9.14p2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Wed Jul 12 20:41:16 UTC 202320230712204116_15.0 Patrick J Volkerding2023-07-131-0/+9
| | | | | | | | | | patches/packages/krb5-1.19.2-x86_64-4_slack15.0.txz: Rebuilt. Fix potential uninitialized pointer free in kadm5 XDR parsing. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-36054 (* Security fix *) patches/packages/sudo-1.9.14p1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Fri Jul 7 23:06:07 UTC 202320230707230607_15.0 Patrick J Volkerding2023-07-081-0/+13
| | | | | | | | | | | | | | patches/packages/mozilla-thunderbird-102.13.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.13.0/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/ https://www.cve.org/CVERecord?id=CVE-2023-37201 https://www.cve.org/CVERecord?id=CVE-2023-37202 https://www.cve.org/CVERecord?id=CVE-2023-37207 https://www.cve.org/CVERecord?id=CVE-2023-37208 https://www.cve.org/CVERecord?id=CVE-2023-37211 (* Security fix *)
* Tue Jul 4 20:26:12 UTC 202320230704202612_15.0 Patrick J Volkerding2023-07-051-0/+13
| | | | | | | | | | | | | | patches/packages/mozilla-firefox-102.13.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/102.13.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2023-23/ https://www.cve.org/CVERecord?id=CVE-2023-37201 https://www.cve.org/CVERecord?id=CVE-2023-37202 https://www.cve.org/CVERecord?id=CVE-2023-37207 https://www.cve.org/CVERecord?id=CVE-2023-37208 https://www.cve.org/CVERecord?id=CVE-2023-37211 (* Security fix *)
* Mon Jun 26 19:44:44 UTC 202320230626194444_15.0 Patrick J Volkerding2023-06-271-0/+16
| | | | | | | | | | | | | | | | | patches/packages/network-scripts-15.0-noarch-19_slack15.0.txz: Rebuilt. This update fixes a bug and adds a new feature: Re-add support for the DHCP_IPADDR parameter from rc.inet1.conf. Expand the help text for DHCP_IPADDR in rc.inet1.conf. Add support for a DHCP_OPTS parameter. Thanks to ljb643 and Darren 'Tadgy' Austin. patches/packages/vim-9.0.1667-x86_64-1_slack15.0.txz: Upgraded. This fixes a rare divide-by-zero bug that could cause vim to crash. In an interactive program such as vim, I can't really see this qualifying as a security issue, but since it was brought up as such on LQ we'll just go along with it this time. :) Thanks to marav for the heads-up. (* Security fix *) patches/packages/vim-gvim-9.0.1667-x86_64-1_slack15.0.txz: Upgraded.
* Sat Jun 24 00:16:22 UTC 202320230624001622_15.0 Patrick J Volkerding2023-06-241-0/+10
| | | | | | | | | | | patches/packages/linux-5.15.117/*: Upgraded. We're going to back up one version to avoid an amdgpu regression in 5.15.118. If you're already using 5.15.118 without issues, feel free to stick with it. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition.
* Thu Jun 22 19:07:50 UTC 202320230622190750_15.0 Patrick J Volkerding2023-06-231-0/+94
| | | | | | | | | patches/packages/cups-2.4.6-x86_64-1_slack15.0.txz: Upgraded. Fixed use-after-free when logging warnings in case of failures in cupsdAcceptClient(). For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-34241 (* Security fix *)
* Thu Jun 15 18:59:33 UTC 202320230615185933_15.0 Patrick J Volkerding2023-06-161-0/+8
| | | | | | | | | patches/packages/libX11-1.8.6-x86_64-1_slack15.0.txz: Upgraded. This update fixes buffer overflows in InitExt.c that could at least cause the client to crash due to memory corruption. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-3138 (* Security fix *)
* Wed Jun 14 21:43:32 UTC 202320230614214332_15.0 Patrick J Volkerding2023-06-151-0/+6
| | | | | | | patches/packages/cups-2.4.5-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/ksh93-1.0.6-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Fri Jun 9 01:06:21 UTC 202320230609010621_15.0 Patrick J Volkerding2023-06-091-0/+19
| | | | | | | | | | | | | | | | | | | | extra/php81/php81-8.1.20-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues. For more information, see: https://www.php.net/ChangeLog-8.php#8.1.20 (* Security fix *) patches/packages/mozilla-thunderbird-102.12.0-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.12.0/releasenotes/ (* Security fix *) patches/packages/python3-3.9.17-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and a security issue: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-24329 (* Security fix *)
* Wed Jun 7 21:12:41 UTC 202320230607211241_15.0 Patrick J Volkerding2023-06-081-0/+10
| | | | | | | | | | | patches/packages/cups-2.4.4-x86_64-1_slack15.0.txz: Upgraded. This update is a hotfix for a segfault in cupsGetNamedDest(), when caller tries to find the default destination and the default destination is not set on the machine. patches/packages/ksh93-1.0.5_20230607_9b251344-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix and robustness enhancement release. Thanks to McDutchie for the great work! Thanks to pghvlaans for improvements to the build script.
* Tue Jun 6 20:26:59 UTC 202320230606202659_15.0 Patrick J Volkerding2023-06-071-0/+16
| | | | | | | | | | | | | | | | | extra/sendmail/sendmail-8.17.2-x86_64-2_slack15.0.txz: Rebuilt. Recompiled without -DUSE_EAI or ICU libraries as this experimental option is still leading to regressions. extra/sendmail/sendmail-cf-8.17.2-noarch-2_slack15.0.txz: Rebuilt. patches/packages/mozilla-firefox-102.12.0esr-x86_64-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/102.12.0/releasenotes/ https://www.mozilla.org/security/advisories/mfsa2023-19/ https://www.cve.org/CVERecord?id=CVE-2023-34414 https://www.cve.org/CVERecord?id=CVE-2023-34416 (* Security fix *) patches/packages/ntp-4.2.8p17-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Sun Jun 4 19:16:13 UTC 202320230604191613_15.0 Patrick J Volkerding2023-06-051-0/+7
| | | | | | | | extra/sendmail/sendmail-8.17.2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. extra/sendmail/sendmail-cf-8.17.2-noarch-1_slack15.0.txz: Upgraded. patches/packages/libmilter-8.17.2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Fri Jun 2 20:56:35 UTC 202320230602205635_15.0 Patrick J Volkerding2023-06-031-0/+19
| | | | | | | | | | | | | | | | | | | | patches/packages/cups-2.4.3-x86_64-1_slack15.0.txz: Upgraded. Fixed a heap buffer overflow in _cups_strlcpy(), when the configuration file cupsd.conf sets the value of loglevel to DEBUG, that could allow a remote attacker to launch a denial of service (DoS) attack, or possibly execute arbirary code. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-32324 (* Security fix *) patches/packages/ntp-4.2.8p16-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-26551 https://www.cve.org/CVERecord?id=CVE-2023-26552 https://www.cve.org/CVERecord?id=CVE-2023-26553 https://www.cve.org/CVERecord?id=CVE-2023-26554 https://www.cve.org/CVERecord?id=CVE-2023-26555 (* Security fix *)
* Wed May 31 01:29:12 UTC 202320230531012912_15.0 Patrick J Volkerding2023-05-311-0/+12
| | | | | | | | | | | | | patches/packages/curl-8.1.2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/openssl-1.1.1u-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Possible DoS translating ASN.1 object identifiers. For more information, see: https://www.openssl.org/news/secadv/20230530.txt https://www.cve.org/CVERecord?id=CVE-2023-2650 (* Security fix *) patches/packages/openssl-solibs-1.1.1u-x86_64-1_slack15.0.txz: Upgraded.
* Sat May 27 20:42:29 UTC 202320230527204229_15.0 Patrick J Volkerding2023-05-281-0/+6
| | | | | | | patches/packages/mozilla-thunderbird-102.11.2-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.11.2/releasenotes/
* Thu May 25 19:04:56 UTC 202320230525190456_15.0 Patrick J Volkerding2023-05-261-0/+22
| | | | | | | | | | | | | | | | | | | | | | | patches/packages/mozilla-thunderbird-102.11.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.11.1/releasenotes/ patches/packages/ntfs-3g-2022.10.3-x86_64-1_slack15.0.txz: Upgraded. Fixed vulnerabilities that may allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to potentially execute arbitrary privileged code or cause a denial of service. Thanks to opty. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40284 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30789 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30788 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30787 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30786 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30785 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30784 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30783 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46790 (* Security fix *)
* Thu May 25 00:24:33 UTC 202320230525002433_15.0 Patrick J Volkerding2023-05-251-0/+14
| | | | | | | | | | | | | | | patches/packages/curl-8.1.1-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. patches/packages/texlive-2023.230322-x86_64-1_slack15.0.txz: Upgraded. This update patches a security issue: LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Thanks to Johannes Schoepfer. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-32700 (* Security fix *)
* Mon May 22 19:05:02 UTC 202320230522190502_15.0 Patrick J Volkerding2023-05-231-0/+14
| | | | | | | | | | | | | | | patches/packages/c-ares-1.19.1-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues: 0-byte UDP payload causes Denial of Service. Insufficient randomness in generation of DNS query IDs. Buffer Underwrite in ares_inet_net_pton(). AutoTools does not set CARES_RANDOM_FILE during cross compilation. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-32067 https://www.cve.org/CVERecord?id=CVE-2023-31147 https://www.cve.org/CVERecord?id=CVE-2023-31130 https://www.cve.org/CVERecord?id=CVE-2023-31124 (* Security fix *)
* Fri May 19 18:59:24 UTC 202320230519185924_15.0 Patrick J Volkerding2023-05-201-0/+12
| | | | | | | | | | | | | patches/packages/cups-filters-1.28.17-x86_64-1_slack15.0.txz: Upgraded. [PATCH] Merge pull request from GHSA-gpxc-v2m8-fr3x. With execv() command line arguments are passed as separate strings and not the full command line in a single string. This prevents arbitrary command execution by escaping the quoting of the arguments in a job with forged job title. Thanks to marav. For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-24805 (* Security fix *)
* Wed May 17 20:59:51 UTC 202320230517205951_15.0 Patrick J Volkerding2023-05-181-0/+22
| | | | | | | | | | | | | | | | | | | | | | | patches/packages/curl-8.1.0-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: more POST-after-PUT confusion. IDN wildcard match. siglongjmp race condition. UAF in SSH sha256 fingerprint check. For more information, see: https://curl.se/docs/CVE-2023-28322.html https://curl.se/docs/CVE-2023-28321.html https://curl.se/docs/CVE-2023-28320.html https://curl.se/docs/CVE-2023-28319.html https://www.cve.org/CVERecord?id=CVE-2023-28322 https://www.cve.org/CVERecord?id=CVE-2023-28321 https://www.cve.org/CVERecord?id=CVE-2023-28320 https://www.cve.org/CVERecord?id=CVE-2023-28319 (* Security fix *) patches/packages/bind-9.16.41-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. testing/packages/bind-9.18.15-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release.
* Sun May 14 17:03:16 UTC 202320230514170316_15.0 Patrick J Volkerding2023-05-151-0/+8
| | | | | | | | | extra/php80/php80-8.0.28-x86_64-2_slack15.0.txz: Rebuilt. This update removes extension=xmlrpc from the php.ini files. extra/php81/php81-8.1.19-x86_64-1_slack15.0.txz: Upgraded. This is a bugfix release. For more information, see: https://www.php.net/ChangeLog-8.php#8.1.19
generated by cgit v1.2.3-65-gdbad (git 2.45.1) at 2024-06-12 16:59:55 +0000