Tue Oct 18 20:29:54 UTC 2022

patches/packages/git-2.35.5-x86_64-1_slack15.0.txz:  Upgraded.
  This release fixes two security issues:
  * CVE-2022-39253:
  When relying on the `--local` clone optimization, Git dereferences
  symbolic links in the source repository before creating hardlinks
  (or copies) of the dereferenced link in the destination repository.
  This can lead to surprising behavior where arbitrary files are
  present in a repository's `$GIT_DIR` when cloning from a malicious
  repository.
  Git will no longer dereference symbolic links via the `--local`
  clone mechanism, and will instead refuse to clone repositories that
  have symbolic links present in the `$GIT_DIR/objects` directory.
  Additionally, the value of `protocol.file.allow` is changed to be
  "user" by default.
  * CVE-2022-39260:
  An overly-long command string given to `git shell` can result in
  overflow in `split_cmdline()`, leading to arbitrary heap writes and
  remote code execution when `git shell` is exposed and the directory
  `$HOME/git-shell-commands` exists.
  `git shell` is taught to refuse interactive commands that are
  longer than 4MiB in size. `split_cmdline()` is hardened to reject
  inputs larger than 2GiB.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
  (* Security fix *)
patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.4.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2022-45/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932
  (* Security fix *)
This commit is contained in:
Patrick J Volkerding 2022-10-18 20:29:54 +00:00 committed by Eric Hameleers
parent 2559feca78
commit f6bba8a1d2
5 changed files with 114 additions and 30 deletions

View file

@ -11,9 +11,55 @@
<description>Tracking Slackware development in git.</description>
<language>en-us</language>
<id xmlns="http://www.w3.org/2005/Atom">urn:uuid:c964f45e-6732-11e8-bbe5-107b4450212f</id>
<pubDate>Mon, 17 Oct 2022 19:31:45 GMT</pubDate>
<lastBuildDate>Tue, 18 Oct 2022 11:30:20 GMT</lastBuildDate>
<pubDate>Tue, 18 Oct 2022 20:29:54 GMT</pubDate>
<lastBuildDate>Wed, 19 Oct 2022 11:29:59 GMT</lastBuildDate>
<generator>maintain_current_git.sh v 1.17</generator>
<item>
<title>Tue, 18 Oct 2022 20:29:54 GMT</title>
<pubDate>Tue, 18 Oct 2022 20:29:54 GMT</pubDate>
<link>https://git.slackware.nl/current/tag/?h=20221018202954</link>
<guid isPermaLink="false">20221018202954</guid>
<description>
<![CDATA[<pre>
patches/packages/git-2.35.5-x86_64-1_slack15.0.txz: Upgraded.
This release fixes two security issues:
* CVE-2022-39253:
When relying on the `--local` clone optimization, Git dereferences
symbolic links in the source repository before creating hardlinks
(or copies) of the dereferenced link in the destination repository.
This can lead to surprising behavior where arbitrary files are
present in a repository's `$GIT_DIR` when cloning from a malicious
repository.
Git will no longer dereference symbolic links via the `--local`
clone mechanism, and will instead refuse to clone repositories that
have symbolic links present in the `$GIT_DIR/objects` directory.
Additionally, the value of `protocol.file.allow` is changed to be
"user" by default.
* CVE-2022-39260:
An overly-long command string given to `git shell` can result in
overflow in `split_cmdline()`, leading to arbitrary heap writes and
remote code execution when `git shell` is exposed and the directory
`$HOME/git-shell-commands` exists.
`git shell` is taught to refuse interactive commands that are
longer than 4MiB in size. `split_cmdline()` is hardened to reject
inputs larger than 2GiB.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
(* Security fix *)
patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/firefox/102.4.0/releasenotes/
https://www.mozilla.org/security/advisories/mfsa2022-45/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932
(* Security fix *)
</pre>]]>
</description>
</item>
<item>
<title>Mon, 17 Oct 2022 19:31:45 GMT</title>
<pubDate>Mon, 17 Oct 2022 19:31:45 GMT</pubDate>

View file

@ -1,3 +1,41 @@
Tue Oct 18 20:29:54 UTC 2022
patches/packages/git-2.35.5-x86_64-1_slack15.0.txz: Upgraded.
This release fixes two security issues:
* CVE-2022-39253:
When relying on the `--local` clone optimization, Git dereferences
symbolic links in the source repository before creating hardlinks
(or copies) of the dereferenced link in the destination repository.
This can lead to surprising behavior where arbitrary files are
present in a repository's `$GIT_DIR` when cloning from a malicious
repository.
Git will no longer dereference symbolic links via the `--local`
clone mechanism, and will instead refuse to clone repositories that
have symbolic links present in the `$GIT_DIR/objects` directory.
Additionally, the value of `protocol.file.allow` is changed to be
"user" by default.
* CVE-2022-39260:
An overly-long command string given to `git shell` can result in
overflow in `split_cmdline()`, leading to arbitrary heap writes and
remote code execution when `git shell` is exposed and the directory
`$HOME/git-shell-commands` exists.
`git shell` is taught to refuse interactive commands that are
longer than 4MiB in size. `split_cmdline()` is hardened to reject
inputs larger than 2GiB.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
(* Security fix *)
patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/firefox/102.4.0/releasenotes/
https://www.mozilla.org/security/advisories/mfsa2022-45/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932
(* Security fix *)
+--------------------------+
Mon Oct 17 19:31:45 UTC 2022
patches/packages/xorg-server-1.20.14-x86_64-4_slack15.0.txz: Rebuilt.
xkb: proof GetCountedString against request length attacks.

View file

@ -1,20 +1,20 @@
Mon Oct 17 19:34:06 UTC 2022
Tue Oct 18 20:36:19 UTC 2022
Here is the file list for this directory. If you are using a
mirror site and find missing or extra files in the disk
subdirectories, please have the archive administrator refresh
the mirror.
drwxr-xr-x 12 root root 4096 2022-10-17 19:31 .
drwxr-xr-x 12 root root 4096 2022-10-18 20:29 .
-rw-r--r-- 1 root root 5767 2022-02-02 22:44 ./ANNOUNCE.15.0
-rw-r--r-- 1 root root 16609 2022-03-30 19:03 ./CHANGES_AND_HINTS.TXT
-rw-r--r-- 1 root root 1155186 2022-10-17 00:48 ./CHECKSUMS.md5
-rw-r--r-- 1 root root 163 2022-10-17 00:48 ./CHECKSUMS.md5.asc
-rw-r--r-- 1 root root 1155688 2022-10-17 19:34 ./CHECKSUMS.md5
-rw-r--r-- 1 root root 163 2022-10-17 19:34 ./CHECKSUMS.md5.asc
-rw-r--r-- 1 root root 17976 1994-06-10 02:28 ./COPYING
-rw-r--r-- 1 root root 35147 2007-06-30 04:21 ./COPYING3
-rw-r--r-- 1 root root 19573 2016-06-23 20:08 ./COPYRIGHT.TXT
-rw-r--r-- 1 root root 616 2006-10-02 04:37 ./CRYPTO_NOTICE.TXT
-rw-r--r-- 1 root root 1941216 2022-10-17 19:31 ./ChangeLog.txt
-rw-r--r-- 1 root root 1943225 2022-10-18 20:29 ./ChangeLog.txt
drwxr-xr-x 3 root root 4096 2013-03-20 22:17 ./EFI
drwxr-xr-x 2 root root 4096 2022-02-02 08:21 ./EFI/BOOT
-rw-r--r-- 1 root root 1187840 2021-06-15 19:16 ./EFI/BOOT/bootx64.efi
@ -25,7 +25,7 @@ drwxr-xr-x 2 root root 4096 2022-02-02 08:21 ./EFI/BOOT
-rwxr-xr-x 1 root root 2504 2019-07-05 18:54 ./EFI/BOOT/make-grub.sh
-rw-r--r-- 1 root root 10722 2013-09-21 19:02 ./EFI/BOOT/osdetect.cfg
-rw-r--r-- 1 root root 1273 2013-08-12 21:08 ./EFI/BOOT/tools.cfg
-rw-r--r-- 1 root root 1507926 2022-10-17 00:47 ./FILELIST.TXT
-rw-r--r-- 1 root root 1508516 2022-10-17 19:34 ./FILELIST.TXT
-rw-r--r-- 1 root root 1572 2012-08-29 18:27 ./GPG-KEY
-rw-r--r-- 1 root root 864745 2022-02-02 08:25 ./PACKAGES.TXT
-rw-r--r-- 1 root root 8034 2022-02-02 03:36 ./README.TXT
@ -738,13 +738,13 @@ drwxr-xr-x 2 root root 4096 2008-05-07 05:21 ./pasture/source/php/pear
-rwxr-xr-x 1 root root 9448 2018-05-16 22:38 ./pasture/source/php/php.SlackBuild
-rw-r--r-- 1 root root 775 2017-07-07 19:25 ./pasture/source/php/php.ini-development.diff.gz
-rw-r--r-- 1 root root 830 2005-12-09 05:18 ./pasture/source/php/slack-desc
drwxr-xr-x 4 root root 4096 2022-10-17 19:34 ./patches
-rw-r--r-- 1 root root 51251 2022-10-17 19:34 ./patches/CHECKSUMS.md5
-rw-r--r-- 1 root root 163 2022-10-17 19:34 ./patches/CHECKSUMS.md5.asc
-rw-r--r-- 1 root root 68392 2022-10-17 19:34 ./patches/FILE_LIST
-rw-r--r-- 1 root root 11626500 2022-10-17 19:34 ./patches/MANIFEST.bz2
-rw-r--r-- 1 root root 37791 2022-10-17 19:34 ./patches/PACKAGES.TXT
drwxr-xr-x 3 root root 16384 2022-10-17 19:33 ./patches/packages
drwxr-xr-x 4 root root 4096 2022-10-18 20:36 ./patches
-rw-r--r-- 1 root root 51251 2022-10-18 20:36 ./patches/CHECKSUMS.md5
-rw-r--r-- 1 root root 163 2022-10-18 20:36 ./patches/CHECKSUMS.md5.asc
-rw-r--r-- 1 root root 68392 2022-10-18 20:36 ./patches/FILE_LIST
-rw-r--r-- 1 root root 11648939 2022-10-18 20:36 ./patches/MANIFEST.bz2
-rw-r--r-- 1 root root 37791 2022-10-18 20:36 ./patches/PACKAGES.TXT
drwxr-xr-x 3 root root 16384 2022-10-18 20:36 ./patches/packages
-rw-r--r-- 1 root root 327 2022-02-15 05:07 ./patches/packages/aaa_base-15.0-x86_64-4_slack15.0.txt
-rw-r--r-- 1 root root 10716 2022-02-15 05:07 ./patches/packages/aaa_base-15.0-x86_64-4_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-02-15 05:07 ./patches/packages/aaa_base-15.0-x86_64-4_slack15.0.txz.asc
@ -787,9 +787,9 @@ drwxr-xr-x 3 root root 16384 2022-10-17 19:33 ./patches/packages
-rw-r--r-- 1 root root 278 2022-04-25 19:25 ./patches/packages/freerdp-2.7.0-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 1625048 2022-04-25 19:25 ./patches/packages/freerdp-2.7.0-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-04-25 19:25 ./patches/packages/freerdp-2.7.0-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 397 2022-04-14 21:10 ./patches/packages/git-2.35.3-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 6657864 2022-04-14 21:10 ./patches/packages/git-2.35.3-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-04-14 21:10 ./patches/packages/git-2.35.3-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 397 2022-10-18 18:35 ./patches/packages/git-2.35.5-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 6650176 2022-10-18 18:35 ./patches/packages/git-2.35.5-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-10-18 18:35 ./patches/packages/git-2.35.5-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 503 2022-10-16 23:27 ./patches/packages/glibc-zoneinfo-2022e-noarch-1_slack15.0.txt
-rw-r--r-- 1 root root 204248 2022-10-16 23:27 ./patches/packages/glibc-zoneinfo-2022e-noarch-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-10-16 23:27 ./patches/packages/glibc-zoneinfo-2022e-noarch-1_slack15.0.txz.asc
@ -839,9 +839,9 @@ drwxr-xr-x 2 root root 4096 2022-08-26 04:06 ./patches/packages/linux-5.15
-rw-r--r-- 1 root root 369 2022-08-16 18:26 ./patches/packages/mariadb-10.5.17-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 29383552 2022-08-16 18:26 ./patches/packages/mariadb-10.5.17-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-08-16 18:26 ./patches/packages/mariadb-10.5.17-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 570 2022-09-19 21:00 ./patches/packages/mozilla-firefox-102.3.0esr-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 59164804 2022-09-19 21:00 ./patches/packages/mozilla-firefox-102.3.0esr-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-09-19 21:00 ./patches/packages/mozilla-firefox-102.3.0esr-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 570 2022-10-17 21:29 ./patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 59169076 2022-10-17 21:29 ./patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-10-17 21:29 ./patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz.asc
-rw-r--r-- 1 root root 663 2022-10-12 23:37 ./patches/packages/mozilla-thunderbird-102.3.3-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 56137276 2022-10-12 23:37 ./patches/packages/mozilla-thunderbird-102.3.3-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-10-12 23:37 ./patches/packages/mozilla-thunderbird-102.3.3-x86_64-1_slack15.0.txz.asc
@ -923,7 +923,7 @@ drwxr-xr-x 2 root root 4096 2022-08-26 04:06 ./patches/packages/linux-5.15
-rw-r--r-- 1 root root 388 2022-10-15 04:05 ./patches/packages/zlib-1.2.13-x86_64-1_slack15.0.txt
-rw-r--r-- 1 root root 105356 2022-10-15 04:05 ./patches/packages/zlib-1.2.13-x86_64-1_slack15.0.txz
-rw-r--r-- 1 root root 163 2022-10-15 04:05 ./patches/packages/zlib-1.2.13-x86_64-1_slack15.0.txz.asc
drwxr-xr-x 52 root root 4096 2022-10-17 19:30 ./patches/source
drwxr-xr-x 52 root root 4096 2022-10-18 19:09 ./patches/source
drwxr-xr-x 2 root root 4096 2022-01-16 05:07 ./patches/source/aaa_base
-rw-r--r-- 1 root root 11041 2022-02-15 04:49 ./patches/source/aaa_base/_aaa_base.tar.gz
-rwxr-xr-x 1 root root 3894 2022-02-15 05:07 ./patches/source/aaa_base/aaa_base.SlackBuild
@ -1044,9 +1044,9 @@ drwxr-xr-x 2 root root 4096 2022-04-25 19:17 ./patches/source/freerdp
-rwxr-xr-x 1 root root 4652 2022-04-25 19:24 ./patches/source/freerdp/freerdp.SlackBuild
-rw-r--r-- 1 root root 34 2021-09-23 18:07 ./patches/source/freerdp/freerdp.url
-rw-r--r-- 1 root root 765 2021-09-23 18:18 ./patches/source/freerdp/slack-desc
drwxr-xr-x 2 root root 4096 2022-04-14 19:39 ./patches/source/git
-rw-r--r-- 1 root root 566 2022-04-14 00:16 ./patches/source/git/git-2.35.3.tar.sign
-rw-r--r-- 1 root root 6876328 2022-04-14 00:16 ./patches/source/git/git-2.35.3.tar.xz
drwxr-xr-x 2 root root 4096 2022-10-18 18:26 ./patches/source/git
-rw-r--r-- 1 root root 566 2022-10-18 17:00 ./patches/source/git/git-2.35.5.tar.sign
-rw-r--r-- 1 root root 6879940 2022-10-18 17:00 ./patches/source/git/git-2.35.5.tar.xz
-rwxr-xr-x 1 root root 5491 2022-04-14 20:18 ./patches/source/git/git.SlackBuild
-rw-r--r-- 1 root root 45 2015-09-01 20:04 ./patches/source/git/git.url
-rw-r--r-- 1 root root 848 2018-02-27 06:13 ./patches/source/git/slack-desc
@ -1155,7 +1155,7 @@ drwxr-xr-x 2 root root 4096 2022-08-16 18:12 ./patches/source/mariadb
-rw-r--r-- 1 root root 34 2015-05-07 18:51 ./patches/source/mariadb/mirror.url
-rw-r--r-- 1 root root 1208 2021-04-23 17:54 ./patches/source/mariadb/rc.mysqld.gz
-rw-r--r-- 1 root root 824 2018-02-27 06:12 ./patches/source/mariadb/slack-desc
drwxr-xr-x 3 root root 4096 2022-09-19 20:04 ./patches/source/mozilla-firefox
drwxr-xr-x 3 root root 4096 2022-10-17 20:27 ./patches/source/mozilla-firefox
-rw-r--r-- 1 root root 693 2021-03-22 17:58 ./patches/source/mozilla-firefox/0027-LTO-Only-enable-LTO-for-Rust-when-complete-build-use.patch.gz
drwxr-xr-x 5 root root 4096 2021-08-13 18:36 ./patches/source/mozilla-firefox/build-deps
-rwxr-xr-x 1 root root 1919 2019-07-09 19:35 ./patches/source/mozilla-firefox/build-deps.sh
@ -1167,14 +1167,14 @@ drwxr-xr-x 2 root root 4096 2022-06-13 00:06 ./patches/source/mozilla-fire
-rw-r--r-- 1 root root 150253 2022-04-21 16:48 ./patches/source/mozilla-firefox/build-deps/cbindgen/cbindgen-0.23.0.tar.lz
-rwxr-xr-x 1 root root 2032 2022-06-14 16:39 ./patches/source/mozilla-firefox/build-deps/cbindgen/cbindgen.build
-rw-r--r-- 1 root root 35 2021-06-25 03:11 ./patches/source/mozilla-firefox/build-deps/cbindgen/cbindgen.url
drwxr-xr-x 2 root root 4096 2022-09-09 19:40 ./patches/source/mozilla-firefox/build-deps/nodejs
-rw-r--r-- 1 root root 38309908 2022-09-08 00:05 ./patches/source/mozilla-firefox/build-deps/nodejs/node-v18.9.0.tar.xz
drwxr-xr-x 2 root root 4096 2022-10-18 18:16 ./patches/source/mozilla-firefox/build-deps/nodejs
-rw-r--r-- 1 root root 38853960 2022-10-17 20:29 ./patches/source/mozilla-firefox/build-deps/nodejs/node-v19.0.0.tar.xz
-rwxr-xr-x 1 root root 3003 2022-08-10 17:53 ./patches/source/mozilla-firefox/build-deps/nodejs/nodejs.build
-rw-r--r-- 1 root root 86 2019-07-08 21:02 ./patches/source/mozilla-firefox/build-deps/nodejs/nodejs.url
-rwxr-xr-x 1 root root 840 2018-03-13 12:55 ./patches/source/mozilla-firefox/fetch-and-repack.sh
-rw-r--r-- 1 root root 330 2019-07-08 18:41 ./patches/source/mozilla-firefox/ff.ui.scrollToClick.diff.gz
-rw-r--r-- 1 root root 478260896 2022-09-19 12:40 ./patches/source/mozilla-firefox/firefox-102.3.0esr.source.tar.xz
-rw-r--r-- 1 root root 833 2022-09-19 12:40 ./patches/source/mozilla-firefox/firefox-102.3.0esr.source.tar.xz.asc
-rw-r--r-- 1 root root 482118312 2022-10-17 08:38 ./patches/source/mozilla-firefox/firefox-102.4.0esr.source.tar.xz
-rw-r--r-- 1 root root 833 2022-10-17 08:38 ./patches/source/mozilla-firefox/firefox-102.4.0esr.source.tar.xz.asc
-rw-r--r-- 1 root root 327 2008-06-17 17:19 ./patches/source/mozilla-firefox/firefox.moz_plugin_path.diff.gz
-rw-r--r-- 1 root root 518 2021-03-15 17:43 ./patches/source/mozilla-firefox/gkrust.a.no.networking.check.diff.gz
-rw-r--r-- 1 root root 462 2009-07-01 06:05 ./patches/source/mozilla-firefox/mimeTypes.rdf.gz