a/kernel-firmware-20200421_78c0348-noarch-1.txz: Upgraded.
a/kernel-generic-5.4.34-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.34-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.34-x86_64-1.txz: Upgraded.
a/openssl-solibs-1.1.1g-x86_64-1.txz: Upgraded.
d/git-2.26.2-x86_64-1.txz: Upgraded.
This update fixes a security issue:
With a crafted URL that contains a newline or empty host, or lacks
a scheme, the credential helper machinery can be fooled into
providing credential information that is not appropriate for the
protocol in use and host being contacted.
Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the
credentials are not for a host of the attacker's choosing; instead,
they are for some unspecified host (based on how the configured
credential helper handles an absent "host" parameter).
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11008
(* Security fix *)
d/kernel-headers-5.4.34-x86-1.txz: Upgraded.
d/vala-0.48.4-x86_64-1.txz: Upgraded.
k/kernel-source-5.4.34-noarch-1.txz: Upgraded.
INFINIBAND_CXGB3 n -> m
INFINIBAND_IPOIB_CM n -> y
INFINIBAND_IPOIB_DEBUG_DATA n -> y
Thanks to Karl Magnus Kolstø.
l/M2Crypto-0.35.2-x86_64-4.txz: Rebuilt.
Don't package typing-3.7.4.1 for python3.
l/netpbm-10.90.01-x86_64-1.txz: Upgraded.
n/openssl-1.1.1g-x86_64-1.txz: Upgraded.
This update fixes a security issue:
Fixed segmentation fault in SSL_check_chain() that could be exploited by a
malicious peer in a Denial of Service attack.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967
(* Security fix *)
x/libva-2.7.1-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/PAM/openvpn-2.4.9-x86_64-1_pam.txz: Upgraded.
This update fixes a security issue:
Fix illegal client float. Thanks to Lev Stipakov.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11810
(* Security fix *)
usb-and-pxe-installers/usbboot.img: Rebuilt.
d/python-2.7.17-x86_64-2.txz: Removed.
d/python2-2.7.18-x86_64-1.txz: Added.
OK, I know a few people got excited seeing python-2 removed in the previous
entry, but it's just being renamed to python2 for consistency with the
python3 package. It's DOA though, and is the final release of the already EOL
python 2 branch (a "commemorative" release as they say in the announcement).
l/M2Crypto-0.35.2-x86_64-3.txz: Rebuilt.
Added python3 modules. Thanks to sombragris and ponce.
l/harfbuzz-2.6.5-x86_64-1.txz: Upgraded.
l/imagemagick-7.0.10_7-x86_64-1.txz: Upgraded.
l/libuv-1.37.0-x86_64-1.txz: Upgraded.
l/libyaml-0.2.4-x86_64-1.txz: Upgraded.
l/oniguruma-6.9.5-x86_64-1.txz: Upgraded.
x/pixman-0.40.0-x86_64-1.txz: Upgraded.
ap/lsof-4.93.2-x86_64-2.txz: Rebuilt.
Fixed the manpage. Thanks to kaott.
ap/sc-7.16-x86_64-7.txz: Rebuilt.
Brought back the classic SC. Thanks to dive.
d/Cython-0.29.16-x86_64-1.txz: Upgraded.
d/mercurial-5.3.2-x86_64-1.txz: Upgraded.
l/gtk+3-3.24.17-x86_64-1.txz: Upgraded.
n/dhcpcd-8.1.7-x86_64-1.txz: Upgraded.
n/iproute2-5.6.0-x86_64-1.txz: Upgraded.
x/libdrm-2.4.101-x86_64-1.txz: Upgraded.
x/mesa-20.0.4-x86_64-1.txz: Upgraded.
xap/mozilla-firefox-68.6.1esr-x86_64-1.txz: Upgraded.
This release contains critical security fixes and improvements.
"Under certain conditions, when running the nsDocShell destructor, a race
condition can cause a use-after-free. We are aware of targeted attacks in
the wild abusing this flaw."
"Under certain conditions, when handling a ReadableStream, a race condition
can cause a use-after-free. We are aware of targeted attacks in the wild
abusing this flaw."
For more information, see:
https://www.mozilla.org/en-US/firefox/68.6.1/releasenotes/https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6819https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6820
(* Security fix *)
l/gobject-introspection-1.64.0-x86_64-1.txz: Upgraded.
l/imagemagick-7.0.10_0-x86_64-1.txz: Upgraded.
l/libical-3.0.8-x86_64-1.txz: Upgraded.
l/librsvg-2.48.0-x86_64-1.txz: Upgraded.
l/libsoup-2.70.0-x86_64-1.txz: Upgraded.
l/mozilla-nss-3.51-x86_64-1.txz: Upgraded.
xap/libnma-1.8.28-x86_64-1.txz: Added.
This is the NetworkManager GUI client library, which was previously
provided by network-manager-applet. It's now a standalone project, and
is required by network-manager-applet and other NetworkManager frontends.
xap/network-manager-applet-1.16.0-x86_64-1.txz: Upgraded.
This requires the new libnma package.
a/ed-1.16-x86_64-1.txz: Upgraded.
l/gtk+3-3.24.14-x86_64-3.txz: Rebuilt.
Rebuilt to add wayland backend.
l/libuv-1.34.2-x86_64-1.txz: Added.
This is needed by bind-9.16.0.
l/qt5-5.13.2-x86_64-2.txz: Rebuilt.
Rebuilt to add wayland support.
Use the system ffmpeg, not the bundled one.
n/bind-9.16.0-x86_64-1.txz: Upgraded.
rc.bind: don't change file ownerships in /var/named. Thanks to voegelas.
n/proftpd-1.3.6c-x86_64-1.txz: Upgraded.
No CVEs assigned, but this sure looks like a security issue:
Use-after-free vulnerability in memory pools during data transfer.
(* Security fix *)
x/libinput-1.15.2-x86_64-1.txz: Upgraded.
x/xkbcomp-1.4.3-x86_64-1.txz: Upgraded.
testing/packages/PAM/proftpd-1.3.6c-x86_64-1_pam.txz: Upgraded.
No CVEs assigned, but this sure looks like a security issue:
Use-after-free vulnerability in memory pools during data transfer.
(* Security fix *)
a/gptfdisk-1.0.5-x86_64-1.txz: Upgraded.
a/kernel-firmware-20200219_2277987-noarch-1.txz: Upgraded.
a/kernel-generic-5.4.21-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.21-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.21-x86_64-1.txz: Upgraded.
a/shadow-4.8.1-x86_64-5.txz: Rebuilt.
a/util-linux-2.35.1-x86_64-4.txz: Rebuilt.
ap/cdparanoia-III_10.2-x86_64-3.txz: Rebuilt.
Moved man page from /usr/man/jp/man1/ to /usr/man/ja/man1/. Thanks to Xsane.
Don't ship the static libraries.
d/kernel-headers-5.4.21-x86-1.txz: Upgraded.
k/kernel-source-5.4.21-noarch-1.txz: Upgraded.
SND_SOC n -> m
SPI n -> y
VFIO_PCI_VGA n -> y
+ADE7854_SPI m
+ADT7316_SPI m
+BMC150_ACCEL_SPI m
+BMG160_SPI m
+BMP280_SPI m
+FXAS21002C_SPI m
+HTS221_SPI m
+IIO_ST_ACCEL_SPI_3AXIS m
+IIO_ST_GYRO_SPI_3AXIS m
+IIO_ST_MAGN_SPI_3AXIS m
+IIO_ST_PRESS_SPI m
+IIO_ST_SENSORS_SPI m
+INPUT_AD714X_SPI m
+INPUT_ADXL34X_SPI m
+KXSD9_SPI m
+REGMAP_SPI m
+SND_COMPRESS_OFFLOAD m
+SND_DESIGNWARE_I2S m
+SND_DESIGNWARE_PCM y
+SND_DMAENGINE_PCM m
+SND_HDA_EXT_CORE m
+SND_I2S_HI6210_I2S m
+SND_PCM_ELD y
+SND_PCM_IEC958 y
+SND_SIMPLE_CARD m
+SND_SIMPLE_CARD_UTILS m
+SND_SOC_AC97_BUS y
+SND_SOC_AC97_CODEC m
+SND_SOC_ACPI m
+SND_SOC_ACPI_INTEL_MATCH m
+SND_SOC_ADAU1761 m
+SND_SOC_ADAU1761_I2C m
+SND_SOC_ADAU1761_SPI m
+SND_SOC_ADAU17X1 m
+SND_SOC_ADAU7002 m
+SND_SOC_ADAU_UTILS m
+SND_SOC_AMD_ACP m
+SND_SOC_AMD_ACP3x m
+SND_SOC_AMD_CZ_DA7219MX98357_MACH m
+SND_SOC_AMD_CZ_RT5645_MACH m
+SND_SOC_BD28623 m
+SND_SOC_COMPRESS y
+SND_SOC_CROS_EC_CODEC m
+SND_SOC_CS35L34 m
+SND_SOC_CS35L35 m
+SND_SOC_CS35L36 m
+SND_SOC_CS42L42 m
+SND_SOC_CS43130 m
+SND_SOC_CX2072X m
+SND_SOC_DA7213 m
+SND_SOC_DA7219 m
+SND_SOC_DMIC m
+SND_SOC_ES7134 m
+SND_SOC_ES7241 m
+SND_SOC_ES8316 m
+SND_SOC_ES8328 m
+SND_SOC_ES8328_I2C m
+SND_SOC_ES8328_SPI m
+SND_SOC_GENERIC_DMAENGINE_PCM y
+SND_SOC_HDAC_HDA m
+SND_SOC_HDAC_HDMI m
+SND_SOC_HDMI_CODEC m
+SND_SOC_I2C_AND_SPI m
+SND_SOC_INTEL_APL m
+SND_SOC_INTEL_BDW_RT5677_MACH m
+SND_SOC_INTEL_BROADWELL_MACH m
+SND_SOC_INTEL_BXT_DA7219_MAX98357A_MACH m
+SND_SOC_INTEL_BXT_RT298_MACH m
+SND_SOC_INTEL_BYTCR_RT5640_MACH m
+SND_SOC_INTEL_BYTCR_RT5651_MACH m
+SND_SOC_INTEL_BYT_CHT_CX2072X_MACH m
+SND_SOC_INTEL_BYT_CHT_DA7213_MACH m
+SND_SOC_INTEL_BYT_CHT_ES8316_MACH m
+SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH m
+SND_SOC_INTEL_CFL m
+SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH m
+SND_SOC_INTEL_CHT_BSW_NAU8824_MACH m
+SND_SOC_INTEL_CHT_BSW_RT5645_MACH m
+SND_SOC_INTEL_CHT_BSW_RT5672_MACH m
+SND_SOC_INTEL_CML_H m
+SND_SOC_INTEL_CML_LP m
+SND_SOC_INTEL_CNL m
+SND_SOC_INTEL_DA7219_MAX98357A_GENERIC m
+SND_SOC_INTEL_GLK m
+SND_SOC_INTEL_GLK_RT5682_MAX98357A_MACH m
+SND_SOC_INTEL_HASWELL m
+SND_SOC_INTEL_HASWELL_MACH m
+SND_SOC_INTEL_KBL m
+SND_SOC_INTEL_KBL_DA7219_MAX98357A_MACH m
+SND_SOC_INTEL_KBL_DA7219_MAX98927_MACH m
+SND_SOC_INTEL_KBL_RT5660_MACH m
+SND_SOC_INTEL_KBL_RT5663_MAX98927_MACH m
+SND_SOC_INTEL_MACH y
+SND_SOC_INTEL_SKL m
+SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH m
+SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH m
+SND_SOC_INTEL_SKL_RT286_MACH m
+SND_SOC_INTEL_SKYLAKE m
+SND_SOC_INTEL_SKYLAKE_COMMON m
+SND_SOC_INTEL_SKYLAKE_FAMILY m
+SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC y
+SND_SOC_INTEL_SKYLAKE_SSP_CLK m
+SND_SOC_INTEL_SST m
+SND_SOC_INTEL_SST_ACPI m
+SND_SOC_INTEL_SST_FIRMWARE m
+SND_SOC_INTEL_SST_TOPLEVEL y
+SND_SOC_MAX9759 m
+SND_SOC_MAX98088 m
+SND_SOC_MAX98090 m
+SND_SOC_MAX98357A m
+SND_SOC_MAX98373 m
+SND_SOC_MAX9867 m
+SND_SOC_MAX98927 m
+SND_SOC_NAU8540 m
+SND_SOC_NAU8824 m
+SND_SOC_NAU8825 m
+SND_SOC_PCM1789 m
+SND_SOC_PCM1789_I2C m
+SND_SOC_PCM186X m
+SND_SOC_PCM186X_I2C m
+SND_SOC_PCM186X_SPI m
+SND_SOC_PCM3060 m
+SND_SOC_PCM3060_I2C m
+SND_SOC_PCM3060_SPI m
+SND_SOC_RL6231 m
+SND_SOC_RL6347A m
+SND_SOC_RT286 m
+SND_SOC_RT298 m
+SND_SOC_RT5640 m
+SND_SOC_RT5645 m
+SND_SOC_RT5651 m
+SND_SOC_RT5660 m
+SND_SOC_RT5663 m
+SND_SOC_RT5670 m
+SND_SOC_RT5677 m
+SND_SOC_RT5677_SPI m
+SND_SOC_RT5682 m
+SND_SOC_SIGMADSP m
+SND_SOC_SIGMADSP_REGMAP m
+SND_SOC_SIMPLE_AMPLIFIER m
+SND_SOC_SOF m
+SND_SOC_SOF_ACPI m
+SND_SOC_SOF_APOLLOLAKE m
+SND_SOC_SOF_APOLLOLAKE_SUPPORT y
+SND_SOC_SOF_BAYTRAIL m
+SND_SOC_SOF_BAYTRAIL_SUPPORT y
+SND_SOC_SOF_CANNONLAKE m
+SND_SOC_SOF_CANNONLAKE_SUPPORT y
+SND_SOC_SOF_COFFEELAKE m
+SND_SOC_SOF_COFFEELAKE_SUPPORT y
+SND_SOC_SOF_COMETLAKE_H m
+SND_SOC_SOF_COMETLAKE_H_SUPPORT y
+SND_SOC_SOF_COMETLAKE_LP m
+SND_SOC_SOF_COMETLAKE_LP_SUPPORT y
+SND_SOC_SOF_ELKHARTLAKE m
+SND_SOC_SOF_ELKHARTLAKE_SUPPORT y
+SND_SOC_SOF_GEMINILAKE m
+SND_SOC_SOF_GEMINILAKE_SUPPORT y
+SND_SOC_SOF_HDA m
+SND_SOC_SOF_HDA_AUDIO_CODEC y
+SND_SOC_SOF_HDA_COMMON m
+SND_SOC_SOF_HDA_LINK y
+SND_SOC_SOF_HDA_LINK_BASELINE m
+SND_SOC_SOF_ICELAKE m
+SND_SOC_SOF_ICELAKE_SUPPORT y
+SND_SOC_SOF_INTEL_ACPI m
+SND_SOC_SOF_INTEL_ATOM_HIFI_EP m
+SND_SOC_SOF_INTEL_COMMON m
+SND_SOC_SOF_INTEL_HIFI_EP_IPC m
+SND_SOC_SOF_INTEL_PCI m
+SND_SOC_SOF_INTEL_TOPLEVEL y
+SND_SOC_SOF_MERRIFIELD m
+SND_SOC_SOF_MERRIFIELD_SUPPORT y
+SND_SOC_SOF_OPTIONS m
+SND_SOC_SOF_PCI m
+SND_SOC_SOF_PROBE_WORK_QUEUE y
+SND_SOC_SOF_TIGERLAKE m
+SND_SOC_SOF_TIGERLAKE_SUPPORT y
+SND_SOC_SOF_TOPLEVEL y
+SND_SOC_SOF_XTENSA m
+SND_SOC_SPDIF m
+SND_SOC_SSM4567 m
+SND_SOC_TAS6424 m
+SND_SOC_TDA7419 m
+SND_SOC_TLV320AIC32X4 m
+SND_SOC_TLV320AIC32X4_I2C m
+SND_SOC_TLV320AIC32X4_SPI m
+SND_SOC_TOPOLOGY y
+SND_SOC_TS3A227E m
+SND_SOC_TSCS42XX m
+SND_SOC_WM8524 m
+SND_SPI y
+SND_SST_ATOM_HIFI2_PLATFORM m
+SND_SST_ATOM_HIFI2_PLATFORM_ACPI m
+SND_SST_ATOM_HIFI2_PLATFORM_PCI m
+SND_SST_IPC m
+SND_SST_IPC_ACPI m
+SND_SST_IPC_PCI m
+SPI_MASTER y
+ST_UVIS25_SPI m
l/gegl-0.4.22-x86_64-1.txz: Upgraded.
l/glib2-2.62.5-x86_64-1.txz: Upgraded.
l/python-requests-2.23.0-x86_64-1.txz: Upgraded.
n/NetworkManager-1.22.8-x86_64-1.txz: Upgraded.
n/openssh-8.2p1-x86_64-2.txz: Rebuilt.
n/php-7.4.3-x86_64-1.txz: Upgraded.
This update fixes bugs and security issues:
Phar: Files added to tar with Phar::buildFromIterator have
all-access permissions.
Phar: heap-buffer-overflow in phar_extract_file.
Session: Null Pointer Dereference in PHP Session Upload Progress.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7063https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7061https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7062
(* Security fix *)
x/mesa-20.0.0-x86_64-1.txz: Upgraded.
Added Wayland platform support.
x/wayland-1.18.0-x86_64-1.txz: Added.
x/wayland-protocols-1.18-noarch-1.txz: Added.
x/xorg-server-1.20.7-x86_64-2.txz: Rebuilt.
x/xorg-server-xephyr-1.20.7-x86_64-2.txz: Rebuilt.
x/xorg-server-xnest-1.20.7-x86_64-2.txz: Rebuilt.
x/xorg-server-xvfb-1.20.7-x86_64-2.txz: Rebuilt.
x/xorg-server-xwayland-1.20.7-x86_64-2.txz: Added.
xap/gimp-2.10.16-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/PAM/openssh-8.2p1-x86_64-2_pam.txz: Rebuilt.
/etc/pam.d/sshd: add commented out pam_tally2 example.
testing/packages/PAM/shadow-4.8.1-x86_64-5_pam.txz: Rebuilt.
/etc/pam.d/system-auth: add support for pam_group, remove pam_tally2.
Thanks to ivandi.
/etc/pam.d/*: Don't use tabs.
testing/packages/PAM/util-linux-2.35.1-x86_64-4_pam.txz: Rebuilt.
/etc/pam.d/login: add commented out pam_tally2 example.
/etc/pam.d/*: Don't use tabs.
usb-and-pxe-installers/usbboot.img: Rebuilt.
ap/ksh93-20200131_e4fea8c5-x86_64-1.txz: Upgraded.
ap/zsh-5.8-x86_64-1.txz: Upgraded.
l/brotli-1.0.7-x86_64-1.txz: Added.
l/gmime-3.2.6-x86_64-1.txz: Upgraded.
l/hyphen-2.8.8-x86_64-1.txz: Added.
l/openal-soft-1.20.1-x86_64-1.txz: Upgraded.
Thanks to Skaendo and Willy Sudiarto Raharjo.
l/qt5-webkit-5.212.0_alpha3-x86_64-1.txz: Added.
Thanks to alienBOB.
l/woff2-20180531_a0d0ed7-x86_64-1.txz: Added.
n/bluez-5.53-x86_64-1.txz: Upgraded.
n/mutt-1.13.4-x86_64-1.txz: Upgraded.
n/samba-4.11.6-x86_64-3.txz: Rebuilt.
n/socat-1.7.3.4-x86_64-1.txz: Added.
n/whois-5.5.6-x86_64-1.txz: Upgraded.
testing/packages/PAM/samba-4.11.6-x86_64-3_pam.txz: Rebuilt.
Added patches to fix joining a DC when using krb5. Looks like the patches are
already upstreamed in the latest 4.12.0-rc. Thanks to camerabambai.
a/libcgroup-0.41-x86_64-6.txz: Rebuilt.
ap/mariadb-10.4.12-x86_64-2.txz: Rebuilt.
d/Cython-0.29.15-x86_64-1.txz: Upgraded.
d/cmake-3.16.4-x86_64-2.txz: Rebuilt.
Recompiled against qt5-5.13.2.
d/doxygen-1.8.17-x86_64-2.txz: Rebuilt.
Recompiled against qt5-5.13.2.
l/ConsoleKit2-1.2.1-x86_64-3.txz: Rebuilt.
l/gnome-keyring-3.34.0-x86_64-2.txz: Rebuilt.
l/imagemagick-7.0.9_23-x86_64-1.txz: Upgraded.
l/polkit-0.116-x86_64-2.txz: Rebuilt.
l/python-future-0.18.2-x86_64-1.txz: Added.
This is needed by fetchmailconf and will probably see additional use as
projects jump off of the sinking Python 2 ship.
l/v4l-utils-1.18.0-x86_64-2.txz: Rebuilt.
Recompiled against qt5-5.13.2.
n/cifs-utils-6.10-x86_64-3.txz: Rebuilt.
n/fetchmail-6.4.2-x86_64-1.txz: Upgraded.
n/pinentry-1.1.0-x86_64-3.txz: Rebuilt.
Recompiled against qt5-5.13.2.
n/samba-4.11.6-x86_64-2.txz: Rebuilt.
n/wpa_supplicant-2.9-x86_64-2.txz: Rebuilt.
Recompiled against qt5-5.13.2.
xap/xpdf-4.02-x86_64-3.txz: Rebuilt.
Recompiled against qt5-5.13.2.
testing/packages/PAM/ConsoleKit2-1.2.1-x86_64-3_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
Remove .la files in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/cifs-utils-6.10-x86_64-3_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/gnome-keyring-3.34.0-x86_64-2_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
Remove .la files in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/libcgroup-0.41-x86_64-6_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
Remove .la files in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/libpwquality-1.4.2-x86_64-2_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
Remove .la files in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/mariadb-10.4.12-x86_64-2_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/pam-1.3.1-x86_64-2_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security to support
multilib. Thanks to GazL.
testing/packages/PAM/polkit-0.116-x86_64-2_pam.txz: Rebuilt.
Rebuilt using --with-pam-module-dir=/lib${LIBDIRSUFFIX}/security.
testing/packages/PAM/samba-4.11.6-x86_64-2_pam.txz: Rebuilt.
Put the pam security modules in /lib${LIBDIRSUFFIX}/security.
a/kernel-generic-5.4.20-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.20-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.20-x86_64-1.txz: Upgraded.
a/shadow-4.8.1-x86_64-3.txz: Rebuilt.
a/util-linux-2.35.1-x86_64-3.txz: Rebuilt.
d/kernel-headers-5.4.20-x86-1.txz: Upgraded.
k/kernel-source-5.4.20-noarch-1.txz: Upgraded.
l/ConsoleKit2-1.2.1-x86_64-2.txz: Rebuilt.
l/dconf-editor-3.34.4-x86_64-1.txz: Upgraded.
l/libxkbcommon-0.10.0-x86_64-1.txz: Added.
l/openal-soft-1.19.1-x86_64-1.txz: Added.
l/qt5-5.13.2-x86_64-1.txz: Added.
Thanks to alienBOB.
n/openssh-8.2p1-x86_64-1.txz: Upgraded.
Potentially incompatible changes:
* ssh(1), sshd(8): the removal of "ssh-rsa" from the accepted
CASignatureAlgorithms list.
* ssh(1), sshd(8): this release removes diffie-hellman-group14-sha1
from the default key exchange proposal for both the client and
server.
* ssh-keygen(1): the command-line options related to the generation
and screening of safe prime numbers used by the
diffie-hellman-group-exchange-* key exchange algorithms have
changed. Most options have been folded under the -O flag.
* sshd(8): the sshd listener process title visible to ps(1) has
changed to include information about the number of connections that
are currently attempting authentication and the limits configured
by MaxStartups.
x/mesa-19.3.4-x86_64-2.txz: Rebuilt.
Reverted "[PATCH] swr: Fix GCC 4.9 checks." which makes X fail to start with
an illegal instruction on some hardware.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/PAM/ConsoleKit2-1.2.1-x86_64-2_pam.txz: Rebuilt.
Rebuilt with --disable-libcgmanager to fix setting limits on PAM.
Thanks to gattocarlo.
testing/packages/PAM/openssh-8.2p1-x86_64-1_pam.txz: Upgraded.
testing/packages/PAM/shadow-4.8.1-x86_64-3_pam.txz: Rebuilt.
Moved some of the /etc/pam.d/ file to the util-linux package where they
more properly belong.
testing/packages/PAM/util-linux-2.35.1-x86_64-3_pam.txz: Rebuilt.
Added some /etc/pam.d/ files previously in the shadow package.
Changed /etc/pam.d/{chfn,chsh} and made chfn/chsh setuid root to fix them.
Added /etc/pam.d/{runuser,runuser-l}.
usb-and-pxe-installers/usbboot.img: Rebuilt.
Hey folks! PAM has finally landed in /testing. Some here wanted it to go
right into the main tree immediately, and in a more normal development cycle
I'd have been inclined to agree (it is -current, after all). But it's
probably better for it to appear in /testing first, to make sure we didn't
miss any bugs and also to serve as a warning shot that we'll be shaking up
the tree pretty good over the next few weeks. I'd like to see this merged
into the main tree in a day or two, so any testing is greatly appreciated.
Switching to the PAM packages (or reverting from them) is as easy as
installing all of them with upgradepkg --install-new, and if reverting then
remove the three leftover _pam packages. After reverting, a bit of residue
will remain in /etc/pam.d/ and /etc/security/ which can either be manually
deleted or simply ignored. While there are many more features available in
PAM compared with plain shadow, out of the box about the only noticable
change is the use of cracklib and libpwquality to check the quality of a
user-supplied password. Hopefully having PAM and krb5 will get us on track
to having proper Active Directory integration as well as using code paths
that are likely better audited these days. The attack surface *might* be
bigger, but it's also a lot better scrutinized.
Thanks to Robby Workman and Vincent Batts who did most of the initial heavy
lifting on the core PAM packages as a side project for many years. Thanks
also to Phantom X whose PAM related SlackBuilds were a valuable reference.
And thanks as well to ivandi - I learned a lot from the SlackMATE build
scripts and was even occasionally thankful for the amusing ways you would
kick my ass on LQ. ;-) You're more than welcome to let us know where we've
messed up this time.
The binutils and glibc packages in /testing were removed and are off the
table for now. I'm not seeing much upside to heading down that rabbit hole
at the moment. Next we need to be looking at Xfce 4.14 and Plasma 5.18 LTS
and some other things that have been held back since KDE4 couldn't use them.
Cheers! :-)
a/kernel-generic-5.4.19-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.19-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.19-x86_64-1.txz: Upgraded.
a/lvm2-2.03.08-x86_64-1.txz: Upgraded.
a/shadow-4.8.1-x86_64-2.txz: Rebuilt.
Automatically backup /etc/login.defs and install the new version if
incompatible PAM options are detected.
d/kernel-headers-5.4.19-x86-1.txz: Upgraded.
k/kernel-source-5.4.19-noarch-1.txz: Upgraded.
VALIDATE_FS_PARSER y -> n
xap/mozilla-thunderbird-68.5.0-x86_64-1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/68.5.0/releasenotes/https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6793https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6794https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6795https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6797https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6798https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6792https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6800
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/PAM/ConsoleKit2-1.2.1-x86_64-1_pam.txz: Added.
testing/packages/PAM/at-3.2.1-x86_64-1_pam.txz: Added.
testing/packages/PAM/cifs-utils-6.10-x86_64-2_pam.txz: Added.
testing/packages/PAM/cracklib-2.9.7-x86_64-1_pam.txz: Added.
testing/packages/PAM/cups-2.3.1-x86_64-1_pam.txz: Added.
testing/packages/PAM/cyrus-sasl-2.1.27-x86_64-2_pam.txz: Added.
testing/packages/PAM/dovecot-2.3.9.2-x86_64-1_pam.txz: Added.
testing/packages/PAM/gnome-keyring-3.34.0-x86_64-1_pam.txz: Added.
testing/packages/PAM/hplip-3.19.12-x86_64-2_pam.txz: Added.
testing/packages/PAM/kde-workspace-4.11.22-x86_64-6_pam.txz: Added.
testing/packages/PAM/libcap-2.31-x86_64-1_pam.txz: Added.
testing/packages/PAM/libcgroup-0.41-x86_64-5_pam.txz: Added.
testing/packages/PAM/libpwquality-1.4.2-x86_64-1_pam.txz: Added.
testing/packages/PAM/mariadb-10.4.12-x86_64-1_pam.txz: Added.
testing/packages/PAM/netatalk-3.1.12-x86_64-2_pam.txz: Added.
testing/packages/PAM/netkit-rsh-0.17-x86_64-2_pam.txz: Added.
testing/packages/PAM/openssh-8.1p1-x86_64-1_pam.txz: Added.
testing/packages/PAM/openvpn-2.4.8-x86_64-1_pam.txz: Added.
testing/packages/PAM/pam-1.3.1-x86_64-1_pam.txz: Added.
testing/packages/PAM/polkit-0.116-x86_64-1_pam.txz: Added.
testing/packages/PAM/popa3d-1.0.3-x86_64-3_pam.txz: Added.
testing/packages/PAM/ppp-2.4.7-x86_64-3_pam.txz: Added.
testing/packages/PAM/proftpd-1.3.6b-x86_64-1_pam.txz: Added.
testing/packages/PAM/samba-4.11.6-x86_64-1_pam.txz: Added.
testing/packages/PAM/screen-4.8.0-x86_64-1_pam.txz: Added.
testing/packages/PAM/shadow-4.8.1-x86_64-2_pam.txz: Added.
testing/packages/PAM/sudo-1.8.31-x86_64-1_pam.txz: Added.
testing/packages/PAM/system-config-printer-1.5.12-x86_64-2_pam.txz: Added.
testing/packages/PAM/util-linux-2.35.1-x86_64-1_pam.txz: Added.
testing/packages/PAM/vsftpd-3.0.3-x86_64-5_pam.txz: Added.
testing/packages/PAM/xdm-1.1.11-x86_64-9_pam.txz: Added.
testing/packages/PAM/xlockmore-5.62-x86_64-1_pam.txz: Added.
testing/packages/PAM/xscreensaver-5.43-x86_64-1_pam.txz: Added.
testing/packages/binutils-2.34-x86_64-1.txz: Removed.
testing/packages/glibc-2.31-x86_64-1.txz: Removed.
testing/packages/glibc-i18n-2.31-x86_64-1.txz: Removed.
testing/packages/glibc-profile-2.31-x86_64-1.txz: Removed.
testing/packages/glibc-solibs-2.31-x86_64-1.txz: Removed.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/util-linux-2.35.1-x86_64-1.txz: Upgraded.
a/zerofree-1.1.1-x86_64-1.txz: Added.
Also queued up for the next installer build. Thanks to bifferos.
ap/sudo-1.8.31-x86_64-1.txz: Upgraded.
This update fixes a security issue:
In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can
trigger a stack-based buffer overflow in the privileged sudo process.
(pwfeedback is a default setting in some Linux distributions; however, it
is not the default for upstream or in Slackware, and would exist only if
enabled by an administrator.) The attacker needs to deliver a long string
to the stdin of getln() in tgetpass.c.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634
(* Security fix *)
n/NetworkManager-1.22.6-x86_64-1.txz: Upgraded.
n/openldap-client-2.4.49-x86_64-1.txz: Upgraded.
xfce/Thunar-1.8.11-x86_64-1.txz: Removed.
xfce/thunar-1.8.12-x86_64-1.txz: Added.
Changed package name from "Thunar" to "thunar" to follow upstream's naming.
a/kernel-generic-5.4.16-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.16-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.16-x86_64-1.txz: Upgraded.
ap/linuxdoc-tools-0.9.73-x86_64-5.txz: Rebuilt.
gnome-doc-tools: Make '/usr/bin/xml2po' and its accompanying Python module
build against Python3.
Thanks to bassmadrigal and ponce on LQ for the report and the patch.
docbook2x: Removed '--disable-maintainer-mode' configuration flag because
it's no longer valid.
Thanks to Stuart Winter.
d/kernel-headers-5.4.16-x86-1.txz: Upgraded.
k/kernel-source-5.4.16-noarch-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/aaa_elflibs-15.0-x86_64-21.txz: Rebuilt.
Upgraded: libisl.so.22.0.1.
Added: libkeyutils.so.1.9.
a/kernel-generic-5.4.15-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.15-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.15-x86_64-1.txz: Upgraded.
a/pciutils-3.6.4-x86_64-1.txz: Upgraded.
a/shadow-4.8.1-x86_64-1.txz: Upgraded.
d/check-0.14.0-x86_64-1.txz: Upgraded.
d/kernel-headers-5.4.15-x86-1.txz: Upgraded.
d/make-4.2.1-x86_64-5.txz: Rebuilt.
Drop back to make-4.2.1 since make-4.3 is breaking a few builds. We'll
revisit it later after sources have caught up to it or regressions have
been patched upstream.
d/python-pip-20.0.2-x86_64-1.txz: Upgraded.
k/kernel-source-5.4.15-noarch-1.txz: Upgraded.
l/imagemagick-7.0.9_18-x86_64-1.txz: Upgraded.
l/python-packaging-20.1-x86_64-1.txz: Upgraded.
n/php-7.4.2-x86_64-3.txz: Rebuilt.
php.ini: Added extension=gd and extension=zip. Thanks to avian.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/aaa_elflibs-15.0-x86_64-19.txz: Rebuilt.
Upgraded: libcap.so.2.31, libgmp.so.10.4.0, libgmpxx.so.4.6.0.
Added: libgssapi_krb5.so.2.2, libk5crypto.so.3.1, libkrb5.so.3.3,
libkrb5support.so.0.1.
a/util-linux-2.35-x86_64-1.txz: Upgraded.
d/python-pip-20.0.1-x86_64-1.txz: Upgraded.
l/Mako-1.1.1-x86_64-1.txz: Upgraded.
l/keyutils-1.6.1-x86_64-1.txz: Upgraded.
n/krb5-1.17-x86_64-1.txz: Added.
Nothing links to this yet, but we'll need it soon enough. :-)
n/php-7.4.2-x86_64-1.txz: Upgraded.
This update fixes bugs and security issues:
Standard: OOB read in php_strip_tags_ex
Mbstring: global buffer-overflow in 'mbfl_filt_conv_big5_wchar'
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7059https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7060
(* Security fix *)
n/samba-4.11.5-x86_64-1.txz: Upgraded.
This update fixes the following security issues:
Replication of ACLs set to inherit down a subtree on AD Directory
not automatic.
Crash after failed character conversion at log level 3 or above.
Use after free during DNS zone scavenging in Samba AD DC.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14902https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19344
(* Security fix *)
xap/gparted-1.1.0-x86_64-1.txz: Upgraded.
a/elvis-2.2_0-x86_64-5.txz: Rebuilt.
Don't make /usr/bin/{ex,vi} symlinks.
a/kernel-generic-5.4.11-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.11-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.11-x86_64-1.txz: Upgraded.
a/nvi-1.81.6-x86_64-1.txz: Added.
This is an implementation of the classic ex/vi text editor written by Keith
Bostic. Due to this having UTF8 support which elvis lacks, we'll have it
take over the ex/vi symlinks if they aren't already pointing to a different
choice. Note that the removal of vi/ex symlinks from the elvis and vim
packages might cause your ex/vi symlinks to point to this after all the ex/vi
packages have been upgraded. You can set them to your preferences using
pkgtool -> Setup -> vi-ex.
a/pkgtools-15.0-noarch-29.txz: Rebuilt.
Added an installer/pkgtool menu to select the default ex/vi editor.
ap/vim-8.2.0114-x86_64-1.txz: Upgraded.
Don't make /usr/bin/{ex,vi} symlinks.
d/kernel-headers-5.4.11-x86-1.txz: Upgraded.
d/python-setuptools-45.0.0-x86_64-1.txz: Upgraded.
k/kernel-source-5.4.11-noarch-1.txz: Upgraded.
l/imagemagick-7.0.9_15-x86_64-1.txz: Upgraded.
n/ethtool-5.4-x86_64-1.txz: Upgraded.
xap/vim-gvim-8.2.0114-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
d/ccache-3.7.7-x86_64-1.txz: Upgraded.
l/libpsl-0.21.0-x86_64-2.txz: Rebuilt.
Patched for new gtk-doc. Thanks to Matteo Bernardini.
l/pyparsing-2.4.6-x86_64-1.txz: Upgraded.
l/python-packaging-20.0-x86_64-1.txz: Upgraded.
l/python-pygments-2.5.2-x86_64-1.txz: Added.
This is needed by gtk-doc.
n/iputils-20190709-x86_64-2.txz: Rebuilt.
Patched for new libcap. Thanks to Matteo Bernardini.
x/fonttosfnt-1.1.0-x86_64-1.txz: Upgraded.
xap/mozilla-firefox-68.4.0esr-x86_64-1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/firefox/68.4.0/releasenotes/https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
a/kernel-generic-5.4.6-x86_64-1.txz: Upgraded.
a/kernel-huge-5.4.6-x86_64-1.txz: Upgraded.
a/kernel-modules-5.4.6-x86_64-1.txz: Upgraded.
a/procps-ng-3.3.16-x86_64-2.txz: Rebuilt.
Patched to hardcode the pgrep command string buffer size to 4096 as was done
in the previous release. This avoids an allocation error when the stack size
is unlimited. Thanks to Jeroslaw Siebert.
a/xfsprogs-5.4.0-x86_64-1.txz: Upgraded.
d/kernel-headers-5.4.6-x86-1.txz: Upgraded.
k/kernel-source-5.4.6-noarch-1.txz: Upgraded.
l/QScintilla-2.11.4-x86_64-1.txz: Upgraded.
n/dhcpcd-8.1.4-x86_64-1.txz: Upgraded.
n/lftp-4.9.0-x86_64-1.txz: Upgraded.
xap/hexchat-2.14.3-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
ap/mariadb-10.4.11-x86_64-1.txz: Upgraded.
d/cmake-3.16.1-x86_64-1.txz: Upgraded.
d/git-2.24.1-x86_64-1.txz: Upgraded.
l/mozjs52-52.9.0esr-x86_64-2.txz: Removed.
This was used only by polkit-0.115.
l/mozjs60-60.9.0esr-x86_64-1.txz: Added.
This is needed for polkit-0.116.
l/polkit-0.116-x86_64-1.txz: Upgraded.
n/ModemManager-1.12.2-x86_64-1.txz: Upgraded.
xap/xine-ui-0.99.12-x86_64-1.txz: Upgraded.
n/bind-9.14.8-x86_64-1.txz: Upgraded.
This update fixes a security issue:
Set a limit on the number of concurrently served pipelined TCP queries.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477
(* Security fix *)
x/mesa-19.2.5-x86_64-1.txz: Upgraded.
ap/qpdf-9.1.0-x86_64-1.txz: Upgraded.
d/check-0.13.0-x86_64-1.txz: Added.
This is needed to build PulseAudio using Meson.
l/alsa-lib-1.2.1-x86_64-2.txz: Rebuilt.
Merge alsa-topology-conf-1.2.1 and alsa-ucm-conf-1.2.1 into the package.
l/pulseaudio-13.0-x86_64-2.txz: Rebuilt.
Rebuilt with meson. This causes esound support to be dropped, but it's
likely that nobody will care.
l/pyparsing-2.4.5-x86_64-1.txz: Upgraded.
extra/pure-alsa-system/alsa-lib-1.2.1-x86_64-2_alsa.txz: Rebuilt.
Merge alsa-topology-conf-1.2.1 and alsa-ucm-conf-1.2.1 into the package.
a/aaa_elflibs-15.0-x86_64-14.txz: Rebuilt.
Upgraded: libglib-2.0.so.0.6200.2, libgmodule-2.0.so.0.6200.2,
libgobject-2.0.so.0.6200.2, libgthread-2.0.so.0.6200.2.
Added: libgomp.so.1.0.0.
a/kernel-firmware-20191029_4065643-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.81-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.81-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.81-x86_64-1.txz: Upgraded.
ap/sudo-1.8.29-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.81-x86-1.txz: Upgraded.
d/python-setuptools-41.6.0-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.81-noarch-1.txz: Upgraded.
l/harfbuzz-2.6.3-x86_64-1.txz: Upgraded.
n/samba-4.11.2-x86_64-1.txz: Upgraded.
This update fixes bugs and these security issues:
Client code can return filenames containing path separators.
Samba AD DC check password script does not receive the full password.
User with "get changes" permission can crash AD DC LDAP server via dirsync.
For more information, see:
https://www.samba.org/samba/security/CVE-2019-10218.htmlhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10218https://www.samba.org/samba/security/CVE-2019-14833.htmlhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14833https://www.samba.org/samba/security/CVE-2019-14847.htmlhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14847
(* Security fix *)
x/libglvnd-1.2.0-x86_64-4.txz: Rebuilt.
Applied upstream patches to fix EGL/eglplatform.h.
x/xorg-server-1.20.5-x86_64-3.txz: Rebuilt.
#define EGL_NO_X11 to fix glamor build against libglvnd-1.2.0.
x/xorg-server-xephyr-1.20.5-x86_64-3.txz: Rebuilt.
x/xorg-server-xnest-1.20.5-x86_64-3.txz: Rebuilt.
x/xorg-server-xvfb-1.20.5-x86_64-3.txz: Rebuilt.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
l/imagemagick-6.9.10_70-x86_64-1.txz: Upgraded.
x/libinput-1.14.3-x86_64-1.txz: Upgraded.
x/mkfontdir-1.0.7-noarch-2.txz: Removed.
The mkfontdir wrapper script and man page are provided by recent versions
of the mkfontscale package, making the mkfontdir package redundant.
Thanks to DarkVision.
x/mkfontscale-1.2.1-x86_64-2.txz: Rebuilt.
Moved the mkfontdir install script to this package since it includes the
mkfontdir wrapper script now.
xap/gimp-2.10.14-x86_64-1.txz: Upgraded.
a/getty-ps-2.1.0b-x86_64-4.txz: Removed.
a/lha-114i-x86_64-2.txz: Removed.
Removed due to vague licensing terms.
a/lhasa-0.3.1-x86_64-1.txz: Added.
This is an extraction-only LHA utility with an OSI approved license.
a/shadow-4.7-x86_64-2.txz: Rebuilt.
Added /etc/environment.new to fix "sudo -i" noise.
ap/lm_sensors-3.6.0-x86_64-1.txz: Upgraded.
ap/vim-8.1.2174-x86_64-1.txz: Upgraded.
l/netpbm-10.88.00-x86_64-1.txz: Upgraded.
n/ca-certificates-20191018-noarch-1.txz: Upgraded.
n/samba-4.11.1-x86_64-1.txz: Upgraded.
xap/vim-gvim-8.1.2174-x86_64-1.txz: Upgraded.
xap/xfractint-20.04p13-x86_64-2.txz: Removed.
xap/xv-3.10a-x86_64-9.txz: Removed.
extra/getty-ps/getty-ps-2.1.0b-x86_64-4.txz: Rebuilt.
Moved here from the A series due to commercial use restrictions.
extra/xfractint/xfractint-20.04p14-x86_64-1.txz: Upgraded.
Moved here from the XAP series due to commercial use restrictions.
extra/xv/xv-3.10a-x86_64-9.txz: Rebuilt.
Moved here from the XAP series due to non-commercial use shareware license.
a/etc-15.0-x86_64-10.txz: Rebuilt.
Fix "include /etc/ld.so.conf.d/*.conf" repeats in /etc/ld.so.conf.
l/imagemagick-6.9.10_64-x86_64-1.txz: Upgraded.
l/seamonkey-solibs-2.49.5-x86_64-1.txz: Removed.
This package was included years ago to support a few things that needed
nss/nspr, but we've since included that in the mozilla-nss package.
Nothing should be using this anymore.
xap/seamonkey-2.49.5-x86_64-2.txz: Rebuilt.
Added additional options to more closely match the official build:
--enable-rust --enable-js-shell --enable-elf-hack --enable-release
--enable-calendar
Thanks to ljb643 for the bug report.
Removed /usr/lib{,64}/seamonkey from /etc/ld.so.conf.
a/kernel-generic-4.19.66-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.66-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.66-x86_64-1.txz: Upgraded.
ap/amp-0.7.6-x86_64-3.txz: Rebuilt.
Patched to clean up the code for a modern compiler and to not use overly
aggressive optimizations that can lead to crashes. Thanks to Labinnah.
d/doxygen-1.8.16-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.66-x86-1.txz: Upgraded.
d/scons-3.1.1-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.66-noarch-1.txz: Upgraded.
n/NetworkManager-1.20.0-x86_64-1.txz: Upgraded.
n/wpa_supplicant-2.9-x86_64-1.txz: Upgraded.
x/libinput-1.14.0-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/bzip2-1.0.8-x86_64-1.txz: Upgraded.
Fixes security issues:
bzip2recover: Fix use after free issue with outFile.
Make sure nSelectors is not out of range.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3189https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900
(* Security fix *)
a/kernel-generic-4.19.59-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.59-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.59-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.59-x86-1.txz: Upgraded.
k/kernel-source-4.19.59-noarch-1.txz: Upgraded.
l/libwebp-1.0.3-x86_64-1.txz: Upgraded.
n/dovecot-2.3.7-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.57-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.57-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.57-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.57-x86-1.txz: Upgraded.
k/kernel-source-4.19.57-noarch-1.txz: Upgraded.
l/Mako-1.0.13-x86_64-1.txz: Upgraded.
l/SDL2_image-2.0.5-x86_64-1.txz: Upgraded.
n/postfix-3.4.6-x86_64-1.txz: Upgraded.
xap/blueman-2.0.8-x86_64-2.txz: Rebuilt.
Reverted to blueman-2.0.8 as I'm also seeing connection issues here with
the newer version.
xap/xscreensaver-5.43-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/blueman-2.1-x86_64-1.txz: Upgraded.
This doesn't seem to be working properly. Any patches are welcome.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/gettext-0.20.1-x86_64-1.txz: Upgraded.
a/kernel-generic-4.19.46-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.46-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.46-x86_64-1.txz: Upgraded.
d/gcc-9.1.0-x86_64-6.txz: Rebuilt.
Patched to fix a format string error in the es locale that led to an
assertion failure when compiling the Linux kernel.
Thanks to USUARIONUEVO.
d/gcc-brig-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-g++-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-gdc-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-gfortran-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-gnat-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-go-9.1.0-x86_64-6.txz: Rebuilt.
d/gcc-objc-9.1.0-x86_64-6.txz: Rebuilt.
d/gettext-tools-0.20.1-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.46-x86-1.txz: Upgraded.
d/rust-1.35.0-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.46-noarch-1.txz: Upgraded.
l/python-urllib3-1.25.3-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-firmware-20190514_711d329-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.43-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.43-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.43-x86_64-1.txz: Upgraded.
ap/hplip-3.19.5-x86_64-1.txz: Upgraded.
ap/mariadb-10.3.15-x86_64-1.txz: Upgraded.
This update fixes denial-of-service security issues.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2614https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2627https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2628
(* Security fix *)
d/cmake-3.14.4-x86_64-1.txz: Upgraded.
d/gcc-9.1.0-x86_64-5.txz: Rebuilt.
Rebuilt with --enable-clocale=gnu. This is recommended by Linux From
Scratch, and while it doesn't seem to fix the issue with kernel compiles
failing with some locales, it probably doesn't hurt.
d/gcc-brig-9.1.0-x86_64-5.txz: Rebuilt.
d/gcc-g++-9.1.0-x86_64-5.txz: Rebuilt.
Applied patch: PR libstdc++/90397 fix std::variant friend declaration
This fixes problems compiling programs that use std::variant with clang.
Thanks to orbea.
d/gcc-gdc-9.1.0-x86_64-5.txz: Rebuilt.
d/gcc-gfortran-9.1.0-x86_64-5.txz: Rebuilt.
d/gcc-gnat-9.1.0-x86_64-5.txz: Rebuilt.
d/gcc-go-9.1.0-x86_64-5.txz: Rebuilt.
d/gcc-objc-9.1.0-x86_64-5.txz: Rebuilt.
d/kernel-headers-4.19.43-x86-1.txz: Upgraded.
d/rust-1.34.2-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.43-noarch-1.txz: Upgraded.
l/librsvg-2.44.14-x86_64-1.txz: Upgraded.
n/samba-4.10.3-x86_64-1.txz: Upgraded.
This is a security release in order to address the following defect:
The checksum validation in the S4U2Self handler in the embedded Heimdal KDC
did not first confirm that the checksum was keyed, allowing replacement of
the requested target (client) principal.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16860
(* Security fix *)
x/xterm-345-x86_64-1.txz: Upgraded.
xap/rdesktop-1.8.5-x86_64-1.txz: Upgraded.
This update fixes security issues:
Add bounds checking to protocol handling in order to fix many
security problems when communicating with a malicious server.
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.42-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.42-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.42-x86_64-1.txz: Upgraded.
a/tcsh-6.21.00-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.42-x86-1.txz: Upgraded.
k/kernel-source-4.19.42-noarch-1.txz: Upgraded.
x/libglvnd-1.1.1-x86_64-1.txz: Added.
This is the GL Vendor-Neutral Dispatch library, which allows multiple
drivers from different vendors to coexist on the same machine. When
libglvnd is present, the NVIDIA driver will not overwrite any system
files. Note that this is known to work when installing the NVIDIA driver
using the .run installer. Other methods may require adjustment.
This library is now a dependency of Mesa.
Thanks to Heinz Wiesinger.
x/libinput-1.13.2-x86_64-1.txz: Upgraded.
x/mesa-19.0.4-x86_64-1.txz: Upgraded.
Compiled with --enable-libglvnd.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/hwdata-0.323-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.41-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.41-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.41-x86_64-1.txz: Upgraded.
a/usbutils-012-x86_64-1.txz: Upgraded.
ap/lsof-4.93.2-x86_64-1.txz: Upgraded.
d/gcc-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-brig-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-g++-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-gdc-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-gfortran-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-gnat-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-go-9.1.0-x86_64-4.txz: Rebuilt.
d/gcc-objc-9.1.0-x86_64-4.txz: Rebuilt.
Add support for Objective-C++. Thanks to USUARIONUEVO.
d/kernel-headers-4.19.41-x86-1.txz: Upgraded.
d/python-pip-19.1.1-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.41-noarch-1.txz: Upgraded.
l/gegl-0.4.16-x86_64-1.txz: Upgraded.
l/vte-0.56.3-x86_64-1.txz: Upgraded.
xap/mozilla-firefox-60.6.3esr-x86_64-1.txz: Upgraded.
This update provides further improvements to re-enable web extensions which
had been disabled for users with a master password set (Bug 1549249).
For more information, see:
https://www.mozilla.org/en-US/firefox/60.6.3/releasenotes/
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.34-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.34-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.34-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.34-x86-1.txz: Upgraded.
k/kernel-source-4.19.34-noarch-1.txz: Upgraded.
SPEAKUP y -> m
SPEAKUP_SYNTH_ACNTPC y -> m
SPEAKUP_SYNTH_ACNTSA y -> m
SPEAKUP_SYNTH_APOLLO y -> m
SPEAKUP_SYNTH_AUDPTR y -> m
SPEAKUP_SYNTH_BNS y -> m
SPEAKUP_SYNTH_DECEXT y -> m
SPEAKUP_SYNTH_DECTLK y -> m
SPEAKUP_SYNTH_DTLK y -> m
SPEAKUP_SYNTH_DUMMY y -> m
SPEAKUP_SYNTH_KEYPC y -> m
SPEAKUP_SYNTH_LTLK y -> m
SPEAKUP_SYNTH_SOFT y -> m
SPEAKUP_SYNTH_SPKOUT y -> m
SPEAKUP_SYNTH_TXPRT y -> m
Thanks to Didier Spaier.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.32-x86_64-1.txz: Upgraded.
ap/hplip-3.19.3-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.32-x86-1.txz: Upgraded.
d/python3-3.7.3-x86_64-1.txz: Upgraded.
Fixed bugs and the following security issues:
bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
characters that decompose under IDNA encoding (NFKC-normalization) into
characters that affect how the URL is parsed.
bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.
bpo-35121: Don't send cookies of domain A without Domain attribute to
domain B when domain A is a suffix match of domain B while using a
cookiejar with http.cookiejar.DefaultCookiePolicy policy.
Patch by Karthikeyan Singaravelan.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(* Security fix *)
d/scons-3.0.5-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.32-noarch-1.txz: Upgraded.
n/curl-7.64.1-x86_64-1.txz: Upgraded.
n/gnutls-3.6.7-x86_64-1.txz: Upgraded.
Fixes security issues:
libgnutls, gnutls tools: Every gnutls_free() will automatically set
the free'd pointer to NULL. This prevents possible use-after-free and
double free issues. Use-after-free will be turned into NULL dereference.
The counter-measure does not extend to applications using gnutls_free().
libgnutls: Fixed a memory corruption (double free) vulnerability in the
certificate verification API. Reported by Tavis Ormandy; addressed with
the change above. [GNUTLS-SA-2019-03-27, #694]
libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async
messages; Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704]
libgnutls: enforce key usage limitations on certificates more actively.
Previously we would enforce it for TLS1.2 protocol, now we enforce it
even when TLS1.3 is negotiated, or on client certificates as well. When
an inappropriate for TLS1.3 certificate is seen on the credentials
structure GnuTLS will disable TLS1.3 support for that session (#690).
libgnutls: enforce the equality of the two signature parameters fields
in a certificate. We were already enforcing the signature algorithm,
but there was a bug in parameter checking code.
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/hwdata-0.321-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.27-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.27-x86-1.txz: Upgraded.
k/kernel-source-4.19.27-noarch-1.txz: Upgraded.
l/M2Crypto-0.32.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_32-x86_64-1.txz: Upgraded.
n/dovecot-2.3.5-x86_64-1.txz: Upgraded.
x/xdm-1.1.11-x86_64-9.txz: Rebuilt.
Reverted to xdm-1.1.11, as the new release after 7 years has some issues.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-firmware-20190212_28f5f7d-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.21-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.21-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.21-x86_64-1.txz: Upgraded.
ap/lxc-2.0.9_d3a03247-x86_64-1.txz: Upgraded.
This update fixes a security issue where a malicious privileged container
could overwrite the host binary and thus gain root-level code execution on
the host. As the LXC project considers privileged containers to be unsafe
no CVE has been assigned for this issue for LXC. To prevent this attack,
LXC has been patched to create a temporary copy of the calling binary
itself when it starts or attaches to containers. To do this LXC creates an
anonymous, in-memory file using the memfd_create() system call and copies
itself into the temporary in-memory file, which is then sealed to prevent
further modifications. LXC then executes this sealed, in-memory file
instead of the original on-disk binary.
For more information, see:
https://seclists.org/oss-sec/2019/q1/119
(* Security fix *)
d/kernel-headers-4.19.21-x86-1.txz: Upgraded.
k/kernel-source-4.19.21-noarch-1.txz: Upgraded.
l/libbluray-1.1.0-x86_64-1.txz: Upgraded.
l/libcap-2.26-x86_64-2.txz: Rebuilt.
Don't ship static library.
l/xapian-core-1.4.10-x86_64-1.txz: Upgraded.
n/gnupg2-2.2.13-x86_64-1.txz: Upgraded.
n/irssi-1.2.0-x86_64-1.txz: Upgraded.
n/libassuan-2.5.3-x86_64-1.txz: Upgraded.
x/bitmap-1.0.9-x86_64-1.txz: Upgraded.
x/libXau-1.0.9-x86_64-1.txz: Upgraded.
x/pixman-0.38.0-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/hwdata-0.320-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.20-x86_64-1.txz: Upgraded.
a/mcelog-162-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.20-x86-1.txz: Upgraded.
d/opencl-headers-2.2-noarch-2.txz: Rebuilt.
Don't trigger "#pragma message" in cl_version.h when falling back on a
default version of OpenCL to target. Applications such as ffmpeg detect
this as an error and fail to compile.
k/kernel-source-4.19.20-noarch-1.txz: Upgraded.
l/ffmpeg-3.4.5-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
Reenabled libsmbclient support.
l/gst-plugins-good-1.14.4-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
l/libvpx-1.8.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
n/curl-7.64.0-x86_64-1.txz: Upgraded.
This release fixes the following security issues:
NTLM type-2 out-of-bounds buffer read.
NTLMv2 type-3 header stack buffer overflow.
SMTP end-of-response out-of-bounds read.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3822https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3823
(* Security fix *)
n/samba-4.9.4-x86_64-2.txz: Rebuilt.
Added time.h to libsmbclient.h to fix ffmpeg compatibility.
Thanks to USUARIONUEVO.
xap/xine-lib-1.2.9-x86_64-4.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.17-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.17-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.17-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.17-x86-1.txz: Upgraded.
d/scons-3.0.4-x86_64-1.txz: Upgraded.
d/vala-0.42.5-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.17-noarch-1.txz: Upgraded.
n/httpd-2.4.38-x86_64-1.txz: Upgraded.
This release contains security fixes and improvements.
mod_session: mod_session_cookie does not respect expiry time allowing
sessions to be reused. [Hank Ibell]
mod_http2: fixes a DoS attack vector. By sending slow request bodies
to resources not consuming them, httpd cleanup code occupies a server
thread unnecessarily. This was changed to an immediate stream reset
which discards all stream state and incoming data. [Stefan Eissing]
mod_ssl: Fix infinite loop triggered by a client-initiated
renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and
later. PR 63052. [Joe Orton]
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17199https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17189https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0190
(* Security fix *)
x/libdrm-2.4.97-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
ap/qpdf-8.3.0-x86_64-1.txz: Upgraded.
l/argon2-20171227-x86_64-1.txz: Added.
This is a new dependency for the PHP package.
n/libmbim-1.18.0-x86_64-1.txz: Upgraded.
n/libqmi-1.22.0-x86_64-1.txz: Upgraded.
n/php-7.2.14-x86_64-1.txz: Upgraded.
Use --with-password-argon2. PHP now requires the new argon2 package.
a/kernel-generic-4.19.13-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.13-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.13-x86_64-1.txz: Upgraded.
d/doxygen-1.8.15-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.13-x86-1.txz: Upgraded.
k/kernel-source-4.19.13-noarch-1.txz: Upgraded.
FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER y -> n
l/libsecret-0.18.7-x86_64-1.txz: Upgraded.
n/wpa_supplicant-2.6-x86_64-6.txz: Upgraded.
It seems we're not the only ones with broken WPA2-Enterprise support
with wpa_supplicant-2.7, so we'll fix it the same way as everyone else -
by reverting to wpa_supplicant-2.6 for now.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/wpa_supplicant-2.7-x86_64-2.txz: Upgraded.
Applied a patch from Gentoo to allow building CONFIG_IEEE80211X=y without
the experimental CONFIG_FILS=y option.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/coreutils-8.30-x86_64-3.txz: Rebuilt.
Support tmux terms in DIR_COLORS. Thanks to qunying.
a/grep-3.3-x86_64-1.txz: Upgraded.
a/kernel-generic-4.19.12-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.12-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.12-x86_64-1.txz: Upgraded.
a/sed-4.7-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.12-x86-1.txz: Upgraded.
d/rust-1.31.1-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.12-noarch-1.txz: Upgraded.
l/graphite2-1.3.13-x86_64-1.txz: Upgraded.
l/harfbuzz-2.3.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_19-x86_64-1.txz: Upgraded.
l/lmdb-0.9.23-x86_64-1.txz: Upgraded.
l/v4l-utils-1.16.3-x86_64-1.txz: Upgraded.
n/netatalk-3.1.12-x86_64-1.txz: Upgraded.
Netatalk before 3.1.12 is vulnerable to an out of bounds write in
dsi_opensess.c. This is due to lack of bounds checking on attacker
controlled data. A remote unauthenticated attacker can leverage
this vulnerability to achieve arbitrary code execution.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1160
(* Security fix *)
n/openldap-client-2.4.47-x86_64-1.txz: Upgraded.
n/samba-4.9.4-x86_64-1.txz: Upgraded.
x/intel-vaapi-driver-2.3.0-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.7-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.7-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.7-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.7-x86-1.txz: Upgraded.
k/kernel-source-4.19.7-noarch-1.txz: Upgraded.
n/gnutls-3.6.5-x86_64-1.txz: Upgraded.
This update fixes a security issue:
Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and
padding oracle verification.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16868
(* Security fix *)
n/nettle-3.4.1-x86_64-1.txz: Upgraded.
This update fixes a security issue:
A Bleichenbacher type side-channel based padding oracle attack was found
in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5
data. An attacker who is able to run a process on the same physical core
as the victim process, could use this flaw to extract plaintext or in some
cases downgrade any TLS connections to a vulnerable server.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16869
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/elilo-3.16-x86_64-9.txz: Rebuilt.
eliloconfig: don't assume that mount output lists the / partition first.
a/f2fs-tools-1.12.0-x86_64-1.txz: Added.
a/kernel-generic-4.19.5-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.5-x86_64-1.txz: Upgraded.
CRYPTO_CRC32 m -> y
F2FS_FS m -> y
a/kernel-modules-4.19.5-x86_64-1.txz: Upgraded.
a/sysvinit-scripts-2.1-noarch-22.txz: Rebuilt.
rc.S: if we're using F2FS for the root filesystem, don't try to check it as
fsck.f2fs throws an error on trying to check a read-only filesystem.
d/clisp-2.49_20181112_df3b9f6fd-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.5-x86-1.txz: Upgraded.
k/kernel-source-4.19.5-noarch-1.txz: Upgraded.
l/graphite2-1.3.12-x86_64-1.txz: Added.
Required by harfbuzz in order to use it as a system library for TeXlive.
l/harfbuzz-2.1.3-x86_64-1.txz: Upgraded.
Requires graphite2-1.3.12.
t/texlive-2018.180822-x86_64-4.txz: Rebuilt.
Use system harfbuzz, not the bundled version.
isolinux/initrd.img: Rebuilt.
Activate LVM volumes at boot, not only when setup is run.
Make /etc/mtab a symlink to /proc/mounts on the installer.
On a freshly installed system, make /etc/mtab a symlink to /proc/mounts.
Include f2fs-tools on the installer.
Support installing on F2FS partitions.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.3-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.3-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.3-x86_64-1.txz: Upgraded.
a/openssl-solibs-1.1.1a-x86_64-1.txz: Upgraded.
a/sysvinit-scripts-2.1-noarch-21.txz: Rebuilt.
rc.S: Don't run rc.fuse - udev takes care of the FUSE module and filesystem.
rc.S: Support replacing the /etc/mtab file with a symlink to /proc/mounts.
rc.6: Show more information when unmounting filesystems at shutdown.
ap/ghostscript-9.26-x86_64-1.txz: Upgraded.
ap/mariadb-10.3.11-x86_64-1.txz: Upgraded.
This update fixes bugs and security issues.
For more information, see:
https://mariadb.com/kb/en/library/mariadb-10311-release-notes/https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3282
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-9843
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3174
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3143
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3156
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3251
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3185
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3277
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3162
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3173
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3200
https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2018-3284
(* Security fix *)
d/cmake-3.13.0-x86_64-1.txz: Upgraded.
d/git-2.19.2-x86_64-1.txz: Upgraded.
d/kernel-headers-4.14.63-x86-1.txz: Upgraded.
d/kernel-headers-4.19.3-x86-1.txz: Upgraded.
d/vala-0.42.3-x86_64-1.txz: Added.
k/kernel-source-4.19.3-noarch-1.txz: Upgraded.
l/adwaita-icon-theme-3.30.0-noarch-1.txz: Upgraded.
l/at-spi2-atk-2.30.0-x86_64-1.txz: Upgraded.
l/at-spi2-core-2.30.0-x86_64-1.txz: Upgraded.
l/atk-2.30.0-x86_64-1.txz: Upgraded.
l/atkmm-2.28.0-x86_64-1.txz: Upgraded.
l/dconf-0.28.0-x86_64-1.txz: Upgraded.
dconf and dconf-editor require Vala; the alternative would be to try to
stick with the old versions forever, and we don't want to do that.
l/dconf-editor-3.30.2-x86_64-1.txz: Upgraded.
l/gcr-3.28.0-x86_64-3.txz: Rebuilt.
Recompiled to add Vala bindings.
l/gdk-pixbuf2-2.38.0-x86_64-1.txz: Upgraded.
l/gexiv2-0.10.9-x86_64-1.txz: Upgraded.
l/glib-networking-2.58.0-x86_64-1.txz: Upgraded.
l/glib2-2.58.1-x86_64-1.txz: Upgraded.
l/glibmm-2.58.0-x86_64-1.txz: Upgraded.
l/gobject-introspection-1.58.0-x86_64-1.txz: Upgraded.
l/gtk+3-3.24.1-x86_64-1.txz: Upgraded.
l/gtkmm3-3.24.0-x86_64-1.txz: Upgraded.
l/gvfs-1.38.1-x86_64-1.txz: Upgraded.
l/libcap-2.26-x86_64-1.txz: Upgraded.
l/libpsl-0.20.1-x86_64-1.txz: Added.
Required by libsoup.
l/libsoup-2.64.2-x86_64-1.txz: Upgraded.
l/pangomm-2.42.0-x86_64-1.txz: Upgraded.
l/pygobject3-3.30.2-x86_64-1.txz: Upgraded.
l/vte-0.54.2-x86_64-1.txz: Upgraded.
n/openssl-1.1.1a-x86_64-1.txz: Upgraded.
This update fixes timing side channel attacks on DSA and ECDSA signature
generation that could allow an attacker to recover the private key.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0735
(* Security fix *)
x/pixman-0.36.0-x86_64-1.txz: Upgraded.
xfce/xfce4-terminal-0.8.7.4-x86_64-2.txz: Rebuilt.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
l/js185-1.0.0-x86_64-2.txz: Removed.
l/libwebp-1.0.1-x86_64-1.txz: Upgraded.
l/mozjs52-52.9.0esr-x86_64-1.txz: Added.
Required by the new version of polkit.
l/polkit-0.115-x86_64-1.txz: Upgraded.
Thanks to Robby Workman.
a/aaa_terminfo-6.1_20181110-x86_64-1.txz: Upgraded.
a/kernel-generic-4.19.2-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.2-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.2-x86_64-1.txz: Upgraded.
ap/vim-8.1.0526-x86_64-1.txz: Upgraded.
Don't package .desktop files for the base vim package.
Move the terminal-based vim.desktop (menu clutter) into the docs directory.
d/kernel-headers-4.19.2-x86-1.txz: Upgraded.
k/kernel-source-4.19.2-noarch-1.txz: Upgraded.
l/librsvg-2.44.9-x86_64-1.txz: Upgraded.
l/ncurses-6.1_20181110-x86_64-1.txz: Upgraded.
The new kernel fixes the artifact on the virtual console, so the original
linux terminal definition has been restored.
xap/vim-gvim-8.1.0526-x86_64-1.txz: Upgraded.
Let vim install its own icon and gvim.desktop files. Thanks to drumz.
Don't include the terminal-based vim.desktop file.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/btrfs-progs-v4.19-x86_64-1.txz: Upgraded.
a/haveged-1.9.4-x86_64-2.txz: Rebuilt.
rc.haveged: eliminate startup noise.
a/kernel-generic-4.19.1-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.1-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.1-x86_64-1.txz: Upgraded.
d/cmake-3.12.4-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.1-x86-1.txz: Upgraded.
k/kernel-source-4.19.1-noarch-1.txz: Upgraded.
Temporarily build in speakup drivers until the modular ones are fixed.
Thanks to Didier Spaier.
SPEAKUP m -> y
SPEAKUP_SYNTH_ACNTPC m -> y
SPEAKUP_SYNTH_ACNTSA m -> y
SPEAKUP_SYNTH_APOLLO m -> y
SPEAKUP_SYNTH_AUDPTR m -> y
SPEAKUP_SYNTH_BNS m -> y
SPEAKUP_SYNTH_DECEXT m -> y
SPEAKUP_SYNTH_DECTLK m -> y
SPEAKUP_SYNTH_DTLK m -> y
SPEAKUP_SYNTH_DUMMY m -> y
SPEAKUP_SYNTH_KEYPC m -> y
SPEAKUP_SYNTH_LTLK m -> y
SPEAKUP_SYNTH_SOFT m -> y
SPEAKUP_SYNTH_SPKOUT m -> y
SPEAKUP_SYNTH_TXPRT m -> y
l/alsa-lib-1.1.7-x86_64-2.txz: Rebuilt.
Fixed PCM interval. Thanks to aaditya.
l/xapian-core-1.4.9-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.19.0-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.0-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.0-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.0-x86-1.txz: Upgraded.
d/parallel-20181022-noarch-1.txz: Upgraded.
k/kernel-source-4.19.0-noarch-1.txz: Upgraded.
[581 lines of diffconfig output omitted here]
l/alsa-plugins-1.1.7-x86_64-3.txz: Rebuilt.
Reverted two patches that have been reported to cause crashes with USB audio
devices. Thanks to Jean-Philippe Guillemin.
l/harfbuzz-1.9.0-x86_64-2.txz: Rebuilt.
Reverted (for now) to harfbuzz-1.9.0 to fix build failures with texlive, php,
and calligra caused by API changes. Thanks to nobodino.
l/libpng-1.6.35-x86_64-1.txz: Upgraded.
n/samba-4.9.1-x86_64-1.txz: Upgraded.
xap/mozilla-firefox-60.3.0esr-x86_64-1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
extra/pure-alsa-system/alsa-plugins-1.1.7-x86_64-3_alsa.txz: Rebuilt.
Reverted two patches that have been reported to cause crashes with USB audio
devices. Thanks to Jean-Philippe Guillemin.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-generic-4.14.77-x86_64-1.txz: Upgraded.
a/kernel-huge-4.14.77-x86_64-1.txz: Upgraded.
a/kernel-modules-4.14.77-x86_64-1.txz: Upgraded.
d/kernel-headers-4.14.77-x86-1.txz: Upgraded.
d/ruby-2.5.3-x86_64-1.txz: Upgraded.
This update fixes bugs and two security issues:
OpenSSL::X509::Name equality check does not work correctly.
Tainted flags are not propagated in Array#pack and String#unpack with
some directives.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16395https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16396
(* Security fix *)
k/kernel-source-4.14.77-noarch-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/kernel-firmware-20181008_c6b6265-noarch-1.txz: Upgraded.
a/kernel-generic-4.14.75-x86_64-1.txz: Upgraded.
a/kernel-huge-4.14.75-x86_64-1.txz: Upgraded.
a/kernel-modules-4.14.75-x86_64-1.txz: Upgraded.
d/git-2.19.1-x86_64-1.txz: Upgraded.
Submodules' "URL"s come from the untrusted .gitmodules file, but we
blindly gave it to "git clone" to clone submodules when "git clone
--recurse-submodules" was used to clone a project that has such a
submodule. The code has been hardened to reject such malformed URLs
(e.g. one that begins with a dash). Credit for finding and fixing this
vulnerability goes to joernchen and Jeff King, respectively.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17456
(* Security fix *)
d/kernel-headers-4.14.75-x86-1.txz: Upgraded.
d/make-4.2.1-x86_64-4.txz: Rebuilt.
Use a non-blocking read with pselect to avoid hangs.
Thanks to Linux.tar.gz and David Spencer.
d/subversion-1.10.3-x86_64-1.txz: Upgraded.
k/kernel-source-4.14.75-noarch-1.txz: Upgraded.
Config changes since 4.14.74:
FB_HYPERV n -> m
Thanks to walecha.
l/librsvg-2.44.7-x86_64-1.txz: Upgraded.
l/python-pillow-5.3.0-x86_64-1.txz: Upgraded.
n/nghttp2-1.34.0-x86_64-1.txz: Upgraded.
x/libSM-1.2.3-x86_64-1.txz: Upgraded.
x/libX11-1.6.7-x86_64-1.txz: Upgraded.
x/libdrm-2.4.95-x86_64-1.txz: Upgraded.
x/libxcb-1.13.1-x86_64-1.txz: Upgraded.
x/vulkan-sdk-1.1.85.0-x86_64-1.txz: Upgraded.
Thanks to dugan.
xap/gnuplot-5.2.5-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
