ap/nano-4.1-x86_64-1.txz: Upgraded.
l/giflib-5.1.9-x86_64-2.txz: Rebuilt.
Restore GifQuantizeBuffer and other deprecated functions to the shared
library. Thanks to Skaendo.
l/glib2-2.60.1-x86_64-1.txz: Upgraded.
l/orc-0.4.29-x86_64-1.txz: Upgraded.
a/glibc-zoneinfo-2019a-noarch-1.txz: Upgraded.
a/grub-2.02-x86_64-5.txz: Rebuilt.
Support F2FS filesystem. Thanks to Nille_kungen.
ap/cups-filters-1.22.5-x86_64-1.txz: Upgraded.
ap/itstool-2.0.6-x86_64-1.txz: Upgraded.
d/python-setuptools-41.0.0-x86_64-1.txz: Upgraded.
l/gobject-introspection-1.60.1-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_39-x86_64-1.txz: Upgraded.
l/libcroco-0.6.13-x86_64-1.txz: Upgraded.
l/libnotify-0.7.8-x86_64-1.txz: Upgraded.
n/cifs-utils-6.9-x86_64-1.txz: Upgraded.
n/nfs-utils-2.3.3-x86_64-2.txz: Rebuilt.
Include recovery directory. Thanks to upnort.
n/samba-4.10.2-x86_64-1.txz: Upgraded.
This is a security release in order to address the following defects:
World writable files in Samba AD DC private/ dir.
Save registry file outside share as unprivileged user.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3870https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3880
(* Security fix *)
x/libva-2.4.1-x86_64-1.txz: Upgraded.
x/pixman-0.38.2-x86_64-1.txz: Upgraded.
xap/gimp-2.10.10-x86_64-1.txz: Upgraded.
ap/ghostscript-9.27-x86_64-1.txz: Upgraded.
d/python-setuptools-40.9.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_37-x86_64-1.txz: Upgraded.
l/readline-8.0.000-x86_64-2.txz: Rebuilt.
Recompiled to link rlfe against the new libreadline. Thanks to Toutatis.
a/hwdata-0.322-noarch-1.txz: Upgraded.
a/kernel-firmware-20190402_67b7579-noarch-1.txz: Upgraded.
a/shadow-4.6-x86_64-2.txz: Rebuilt.
adduser: reprompt on invalid user input. Thanks to ttk.
ap/ghostscript-9.26-x86_64-2.txz: Rebuilt.
Fixes security issues:
A specially crafted PostScript file could have access to the file system
outside of the constrains imposed by -dSAFER.
Transient procedures can allow access to system operators, leading to
remote code execution.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6116
(* Security fix *)
d/vala-0.44.2-x86_64-1.txz: Upgraded.
l/glib-networking-2.60.1-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_36-x86_64-1.txz: Upgraded.
l/python-pillow-6.0.0-x86_64-1.txz: Upgraded.
n/wget-1.20.2-x86_64-1.txz: Upgraded.
Fixed an unspecified buffer overflow vulnerability.
(* Security fix *)
a/kernel-generic-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.32-x86_64-1.txz: Upgraded.
ap/hplip-3.19.3-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.32-x86-1.txz: Upgraded.
d/python3-3.7.3-x86_64-1.txz: Upgraded.
Fixed bugs and the following security issues:
bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
characters that decompose under IDNA encoding (NFKC-normalization) into
characters that affect how the URL is parsed.
bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.
bpo-35121: Don't send cookies of domain A without Domain attribute to
domain B when domain A is a suffix match of domain B while using a
cookiejar with http.cookiejar.DefaultCookiePolicy policy.
Patch by Karthikeyan Singaravelan.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(* Security fix *)
d/scons-3.0.5-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.32-noarch-1.txz: Upgraded.
n/curl-7.64.1-x86_64-1.txz: Upgraded.
n/gnutls-3.6.7-x86_64-1.txz: Upgraded.
Fixes security issues:
libgnutls, gnutls tools: Every gnutls_free() will automatically set
the free'd pointer to NULL. This prevents possible use-after-free and
double free issues. Use-after-free will be turned into NULL dereference.
The counter-measure does not extend to applications using gnutls_free().
libgnutls: Fixed a memory corruption (double free) vulnerability in the
certificate verification API. Reported by Tavis Ormandy; addressed with
the change above. [GNUTLS-SA-2019-03-27, #694]
libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async
messages; Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704]
libgnutls: enforce key usage limitations on certificates more actively.
Previously we would enforce it for TLS1.2 protocol, now we enforce it
even when TLS1.3 is negotiated, or on client certificates as well. When
an inappropriate for TLS1.3 certificate is seen on the credentials
structure GnuTLS will disable TLS1.3 support for that session (#690).
libgnutls: enforce the equality of the two signature parameters fields
in a certificate. We were already enforcing the signature algorithm,
but there was a bug in parameter checking code.
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
Saint Patrick was a gentleman
Who through strategy and stealth
Drove all the snakes from Ireland
Here's toasting to his health -
But not too many toastings
Lest you lose yourself, and then,
Forget the good Saint Patrick
And see all those snakes again.
a/eudev-3.2.7-x86_64-3.txz: Rebuilt.
Added tqmx86_wdt to watchdog.conf. Thanks to Robby Workman.
d/vala-0.44.1-x86_64-1.txz: Upgraded.
kde/ktorrent-4.3.1-x86_64-4.txz: Rebuilt.
Embed a copy of the GeoIP database since the download link no longer works.
l/glibmm-2.58.1-x86_64-1.txz: Upgraded.
l/mozilla-nss-3.43-x86_64-1.txz: Upgraded.
x/imake-1.0.8-x86_64-1.txz: Upgraded.
x/libXdmcp-1.1.3-x86_64-1.txz: Upgraded.
x/libXext-1.3.4-x86_64-1.txz: Upgraded.
x/libXft-2.3.3-x86_64-1.txz: Upgraded.
x/libXmu-1.1.3-x86_64-1.txz: Upgraded.
x/libXrandr-1.5.2-x86_64-1.txz: Upgraded.
x/libXvMC-1.0.11-x86_64-1.txz: Upgraded.
x/libXxf86dga-1.1.5-x86_64-1.txz: Upgraded.
x/libxkbfile-1.1.0-x86_64-1.txz: Upgraded.
x/makedepend-1.0.6-x86_64-1.txz: Upgraded.
x/x11perf-1.6.1-x86_64-1.txz: Upgraded.
x/xf86-video-intel-20190301_6afed33b-x86_64-1.txz: Upgraded.
x/xf86-video-savage-20190128_8579718-x86_64-1.txz: Upgraded.
x/xf86-video-sis-20181217_22d3c79-x86_64-1.txz: Upgraded.
x/xtrans-1.4.0-noarch-1.txz: Upgraded.
ap/cgmanager-0.42-x86_64-1.txz: Upgraded.
d/cmake-3.14.0-x86_64-1.txz: Upgraded.
l/gexiv2-0.12.0-x86_64-1.txz: Upgraded.
l/gsettings-desktop-schemas-3.32.0-x86_64-2.txz: Rebuilt.
Don't override the system font defaults (especially with fonts that we don't
include). Thanks to Markus Wiesner.
l/libyaml-0.2.2-x86_64-1.txz: Upgraded.
l/libzip-1.5.2-x86_64-1.txz: Upgraded.
a/hwdata-0.321-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.27-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.27-x86-1.txz: Upgraded.
k/kernel-source-4.19.27-noarch-1.txz: Upgraded.
l/M2Crypto-0.32.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_32-x86_64-1.txz: Upgraded.
n/dovecot-2.3.5-x86_64-1.txz: Upgraded.
x/xdm-1.1.11-x86_64-9.txz: Rebuilt.
Reverted to xdm-1.1.11, as the new release after 7 years has some issues.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/mkinitrd-1.4.11-x86_64-12.txz: Rebuilt.
Updated to busybox-1.30.1.
mkinitrd: allow a colon-delimited list of kernel versions with -k
mkinitrd_command_generator.sh: allow a colon-delimited list of kernel
versions with -k
setup.01.mkinitrd: simplify script by using -k with a version list
ap/pamixer-1.4-x86_64-1.txz: Upgraded.
d/python-2.7.16-x86_64-1.txz: Upgraded.
Updated to the latest 2.7.x release, which fixes a few security issues.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(* Security fix *)
d/vala-0.42.6-x86_64-1.txz: Upgraded.
l/gegl-0.4.14-x86_64-1.txz: Upgraded.
l/libsecret-0.18.8-x86_64-1.txz: Upgraded.
l/xapian-core-1.4.11-x86_64-1.txz: Upgraded.
x/mkfontscale-1.2.0-x86_64-1.txz: Upgraded.
x/xditview-1.0.5-x86_64-1.txz: Upgraded.
x/xdm-1.1.12-x86_64-1.txz: Upgraded.
a/btrfs-progs-4.20.2-x86_64-1.txz: Upgraded.
a/openssl-solibs-1.1.1b-x86_64-1.txz: Upgraded.
ap/ddrescue-1.24-x86_64-1.txz: Upgraded.
ap/sqlite-3.27.2-x86_64-1.txz: Upgraded.
l/libssh-0.8.7-x86_64-1.txz: Upgraded.
l/talloc-2.1.16-x86_64-1.txz: Upgraded.
l/tdb-1.3.18-x86_64-1.txz: Upgraded.
l/tevent-0.9.39-x86_64-1.txz: Upgraded.
n/ca-certificates-20181210-noarch-2.txz: Rebuilt.
Use "c_rehash" rather than "openssl rehash" for compatibility with all
versions of OpenSSL.
n/epic5-2.1.1-x86_64-1.txz: Upgraded.
n/openssl-1.1.1b-x86_64-1.txz: Upgraded.
x/xorg-server-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xephyr-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xnest-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xvfb-1.20.4-x86_64-1.txz: Upgraded.
xap/mozilla-thunderbird-60.5.2-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/60.5.2/releasenotes/
a/glibc-solibs-2.29-x86_64-3.txz: Rebuilt.
ap/texinfo-6.6-x86_64-1.txz: Upgraded.
l/elfutils-0.176-x86_64-1.txz: Upgraded.
l/glibc-2.29-x86_64-3.txz: Rebuilt.
l/glibc-i18n-2.29-x86_64-3.txz: Rebuilt.
Go back to using the glibc.locale.no-archive.diff patch rather than the new
built-in no-archive locale target. Avoiding hardlinks is not worth 700MB of
useless bloat. Thanks to baldzhang.
l/glibc-profile-2.29-x86_64-3.txz: Rebuilt.
l/librsvg-2.44.13-x86_64-1.txz: Upgraded.
x/xf86-video-chips-1.4.0-x86_64-1.txz: Upgraded.
x/xf86-video-tdfx-1.5.0-x86_64-1.txz: Upgraded.
a/hwdata-0.320-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.20-x86_64-1.txz: Upgraded.
a/mcelog-162-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.20-x86-1.txz: Upgraded.
d/opencl-headers-2.2-noarch-2.txz: Rebuilt.
Don't trigger "#pragma message" in cl_version.h when falling back on a
default version of OpenCL to target. Applications such as ffmpeg detect
this as an error and fail to compile.
k/kernel-source-4.19.20-noarch-1.txz: Upgraded.
l/ffmpeg-3.4.5-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
Reenabled libsmbclient support.
l/gst-plugins-good-1.14.4-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
l/libvpx-1.8.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
n/curl-7.64.0-x86_64-1.txz: Upgraded.
This release fixes the following security issues:
NTLM type-2 out-of-bounds buffer read.
NTLMv2 type-3 header stack buffer overflow.
SMTP end-of-response out-of-bounds read.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3822https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3823
(* Security fix *)
n/samba-4.9.4-x86_64-2.txz: Rebuilt.
Added time.h to libsmbclient.h to fix ffmpeg compatibility.
Thanks to USUARIONUEVO.
xap/xine-lib-1.2.9-x86_64-4.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
d/bison-3.3.2-x86_64-1.txz: Upgraded.
n/dovecot-2.3.4-x86_64-2.txz: Rebuilt.
Patched double free when used with MariaDB 10.3.x. Thanks to Thom1b.
x/xkeyboard-config-2.26-noarch-1.txz: Upgraded.
extra/bittorrent/bittorrent-4.4.0-noarch-4.txz: Removed.
a/glibc-solibs-2.29-x86_64-2.txz: Rebuilt.
d/opencl-headers-2.2-noarch-1.txz: Upgraded.
Thanks to Heinz Wiesinger.
l/glibc-2.29-x86_64-2.txz: Rebuilt.
l/glibc-i18n-2.29-x86_64-2.txz: Rebuilt.
Reverted en_US.UTF8 date(1) format back to 24 hour. I'm pretty sure that
the majority of people here in this locale will agree.
l/glibc-profile-2.29-x86_64-2.txz: Rebuilt.
a/mkinitrd-1.4.11-x86_64-11.txz: Rebuilt.
setup.01.mkinitrd: revert to the previous command line for
mkinitrd_command_generator.sh (the new one fails when called from the
installer).
a/hwdata-0.319-noarch-1.txz: Upgraded.
d/doxygen-1.8.14-x86_64-3.txz: Upgraded.
Reverted (for now) to avoid segfault in doxygen-1.8.15.
l/libwpg-0.3.3-x86_64-1.txz: Upgraded.
l/libxml2-2.9.9-x86_64-1.txz: Upgraded.
l/libxslt-1.1.33-x86_64-1.txz: Upgraded.
l/python-pillow-5.4.0-x86_64-1.txz: Upgraded.
x/xterm-342-x86_64-1.txz: Upgraded.
testing/packages/wpa_supplicant-2.7-x86_64-3.txz: Rebuilt.
Apply TLSv1 patch from Debian and make some config changes to fix
WPA2-Enterprise. Once we have some testing results on this we'll consider
moving it back into the main tree. Thanks to gablek.
a/coreutils-8.30-x86_64-4.txz: Rebuilt.
Added xterm-new to DIR_COLORS.
a/ed-1.15-x86_64-1.txz: Upgraded.
a/smartmontools-7.0-x86_64-1.txz: Upgraded.
a/sysvinit-2.93-x86_64-1.txz: Upgraded.
ap/diffutils-3.7-x86_64-1.txz: Upgraded.
ap/mc-4.8.22-x86_64-1.txz: Upgraded.
l/gexiv2-0.10.10-x86_64-1.txz: Upgraded.
l/libgphoto2-2.5.22-x86_64-1.txz: Upgraded.
l/libwpd-0.10.3-x86_64-1.txz: Upgraded.
x/xterm-341-x86_64-3.txz: Rebuilt.
Append new app-defaults for XTerm rather than replacing the upstream file.
Use 'xterm' rather than 'xterm-new' for termName to avoid surprises, but
leave the other choice commented out.
Install XTerm as XTerm.new to avoid wiping out a locally modified file.
Still not sure we'll be able to stick with this as a default due to Terminus
possibly not being available on a remote X server. Sure looks nice though.
Thanks to GazL.
a/gzip-1.10-x86_64-1.txz: Upgraded.
a/lvm2-2.03.02-x86_64-1.txz: Upgraded.
a/os-prober-1.77-x86_64-1.txz: Upgraded.
a/sysvinit-scripts-2.1-noarch-24.txz: Rebuilt.
rc.6: Don't umount /dev/shm or tmpfs mounts under /run as it causes long
warnings/timeouts at shutdown/reboot on systems using LVM.
Don't use --ignorelockingfailure when deactivating LVM.
l/gc-8.0.2-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_21-x86_64-1.txz: Upgraded.
l/libclc-20181127_1ecb16d-x86_64-1.txz: Upgraded.
l/librsvg-2.44.11-x86_64-1.txz: Upgraded.
l/zstd-1.3.8-x86_64-1.txz: Upgraded.
xap/blueman-2.0.7-x86_64-1.txz: Upgraded.
xap/xscreensaver-5.42-x86_64-1.txz: Upgraded.
xfce/xfce4-taskmanager-1.2.2-x86_64-1.txz: Upgraded.
a/kernel-generic-4.19.13-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.13-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.13-x86_64-1.txz: Upgraded.
d/doxygen-1.8.15-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.13-x86-1.txz: Upgraded.
k/kernel-source-4.19.13-noarch-1.txz: Upgraded.
FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER y -> n
l/libsecret-0.18.7-x86_64-1.txz: Upgraded.
n/wpa_supplicant-2.6-x86_64-6.txz: Upgraded.
It seems we're not the only ones with broken WPA2-Enterprise support
with wpa_supplicant-2.7, so we'll fix it the same way as everyone else -
by reverting to wpa_supplicant-2.6 for now.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
testing/packages/wpa_supplicant-2.7-x86_64-2.txz: Upgraded.
Applied a patch from Gentoo to allow building CONFIG_IEEE80211X=y without
the experimental CONFIG_FILS=y option.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/btrfs-progs-v4.19.1-x86_64-1.txz: Upgraded.
a/dbus-1.12.12-x86_64-1.txz: Upgraded.
ap/cups-2.2.10-x86_64-1.txz: Upgraded.
ap/cups-filters-1.21.5-x86_64-1.txz: Upgraded.
ap/hplip-3.18.12-x86_64-1.txz: Upgraded.
d/mercurial-4.8.1-x86_64-1.txz: Upgraded.
d/rust-1.31.0-x86_64-1.txz: Upgraded.
l/libpng-1.6.36-x86_64-1.txz: Upgraded.
l/python-idna-2.8-x86_64-1.txz: Upgraded.
n/ntp-4.2.8p12-x86_64-5.txz: Rebuilt.
Fixed logrotate file. Thanks to allend and rworkman.
n/php-7.2.13-x86_64-1.txz: Upgraded.
This is a security release which also contains several minor bug fixes.
For more information, see:
https://php.net/ChangeLog-7.php#7.2.13
(* Security fix *)
n/wpa_supplicant-2.7-x86_64-1.txz: Upgraded.
x/mesa-18.3.0-x86_64-1.txz: Upgraded.
x/xf86-video-i740-1.4.0-x86_64-1.txz: Upgraded.
xap/mozilla-thunderbird-60.3.3-x86_64-1.txz: Upgraded.
This is a bugfix release. For more information, see:
https://www.mozilla.org/en-US/thunderbird/60.3.3/releasenotes/
xfce/thunar-volman-0.9.1-x86_64-1.txz: Upgraded.
