l/aom-3.10.0-x86_64-1.txz: Upgraded.
l/libpcap-1.10.5-x86_64-1.txz: Upgraded.
This update fixes security issues:
Clean up sock_initaddress() and its callers to avoid double frees
in some cases.
Fix pcap_findalldevs_ex() not to crash if passed a file:// URL with a
path to a directory that cannot be opened.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-7256https://www.cve.org/CVERecord?id=CVE-2024-8006
(* Security fix *)
l/mozilla-nss-3.104-x86_64-1.txz: Upgraded.
n/tcpdump-4.99.5-x86_64-1.txz: Upgraded.
x/wayland-protocols-1.37-noarch-1.txz: Upgraded.
a/aaa_glibc-solibs-2.40-x86_64-5.txz: Rebuilt.
a/kernel-firmware-20240828_335a1de-noarch-1.txz: Upgraded.
a/kernel-generic-6.10.7-x86_64-1.txz: Upgraded.
a/kernel-huge-6.10.7-x86_64-1.txz: Upgraded.
a/kernel-modules-6.10.7-x86_64-1.txz: Upgraded.
a/userspace-rcu-0.14.1-x86_64-1.txz: Upgraded.
ap/man-db-2.13.0-x86_64-1.txz: Upgraded.
ap/screen-5.0.0-x86_64-1.txz: Upgraded.
ap/vim-9.1.0702-x86_64-1.txz: Upgraded.
d/cmake-3.30.3-x86_64-1.txz: Upgraded.
d/gcc-14.2.0-x86_64-2.txz: Rebuilt.
Merge in parts of alienBOB's multilib build script, generalize the script
to work with both --enable-multilib and --disable-multilib, and otherwise
clean things up. Go ahead and build it multilib on 64-bit, because why not?
It's worth the bit of bloat to no longer have this package need to be
maintained separately and kept in sync. Thanks to alienBOB.
d/gcc-g++-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-gdc-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-gfortran-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-gm2-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-gnat-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-go-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-objc-14.2.0-x86_64-2.txz: Rebuilt.
d/gcc-rust-14.2.0-x86_64-2.txz: Rebuilt.
d/kernel-headers-6.10.7-x86-1.txz: Upgraded.
d/python-setuptools-73.0.1-x86_64-1.txz: Rebuilt.
Reverted due to regression: breaks g-ir-scanner
k/kernel-source-6.10.7-noarch-1.txz: Upgraded.
l/glibc-2.40-x86_64-5.txz: Rebuilt.
Enable multilib on 64-bit. Thanks to alienBOB.
Note that Slackware 64-bit can now run a 32-bit "Hello World!" but there
are no immediate plans to add additional multilib support by default.
Maybe down the road when bare metal 32-bit support goes away.
l/glibc-i18n-2.40-x86_64-5.txz: Rebuilt.
l/glibc-profile-2.40-x86_64-5.txz: Rebuilt.
l/gtk4-4.15.6-x86_64-1.txz: Upgraded.
l/libssh-0.11.1-x86_64-1.txz: Upgraded.
l/protobuf-28.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/python-certifi-2024.8.30-x86_64-1.txz: Upgraded.
l/qt6-6.7.2_20240610_3f005f1e-x86_64-6.txz: Rebuilt.
Recompiled against protobuf-28.0.
n/ca-certificates-20240830-noarch-1.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
n/mosh-1.4.0-x86_64-4.txz: Rebuilt.
Recompiled against protobuf-28.0.
n/php-8.3.11-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.php.net/ChangeLog-8.php#8.3.11
x/mesa-24.2.1-x86_64-1.txz: Upgraded.
Thanks to lucabon for the rust-bindgen patch.
xap/vim-gvim-9.1.0702-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
ap/vim-9.1.0686-x86_64-1.txz: Upgraded.
Build with --with-python3-stable-abi=no (which was the default until
recently). This fixes segfaults when python3 is used from vim.
Thanks to audriusk.
d/luajit-2.1.1724232689-x86_64-1.txz: Upgraded.
d/parallel-20240822-noarch-1.txz: Upgraded.
l/gst-plugins-bad-free-1.24.7-x86_64-1.txz: Upgraded.
l/gst-plugins-base-1.24.7-x86_64-1.txz: Upgraded.
l/gst-plugins-good-1.24.7-x86_64-1.txz: Upgraded.
l/gst-plugins-libav-1.24.7-x86_64-1.txz: Upgraded.
l/gstreamer-1.24.7-x86_64-1.txz: Upgraded.
l/nodejs-20.17.0-x86_64-1.txz: Upgraded.
l/pipewire-1.2.3-x86_64-1.txz: Upgraded.
n/bind-9.18.29-x86_64-1.txz: Upgraded.
n/nfs-utils-2.7.1-x86_64-1.txz: Upgraded.
xap/mozilla-thunderbird-128.1.1esr-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/128.1.1esr/releasenotes/
xap/vim-gvim-9.1.0686-x86_64-1.txz: Upgraded.
d/python-setuptools-73.0.1-x86_64-1.txz: Upgraded.
d/rust-bindgen-0.70.1-x86_64-1.txz: Upgraded.
n/ModemManager-1.22.0-x86_64-1.txz: Upgraded.
n/dhcpcd-10.0.10-x86_64-1.txz: Upgraded.
n/epic5-2.4-x86_64-1.txz: Upgraded.
n/libqmi-1.34.0-x86_64-2.txz: Rebuilt.
Build against libqrtr-glib with -Dqrtr=true.
n/libqrtr-glib-1.2.2-x86_64-1.txz: Added.
ModemManager-1.22.0 needs libqmi to be linked with this.
x/xorg-server-21.1.13-x86_64-3.txz: Rebuilt.
Patched changing a type from unsigned long to unsigned long long which fixes
the black screen seen on 32-bit with the modesetting driver. Seems fine on
64-bit as well, so the patch is applied for all builds. The patch to default
to modesetting for Intel graphics is restored (and the one for nouveau is kept
as well).
Thanks to Lenard Spencer for reporting that nouveau was also hitting this.
Thanks to Petri Kaukasoina for the patch.
x/xorg-server-xephyr-21.1.13-x86_64-3.txz: Rebuilt.
x/xorg-server-xnest-21.1.13-x86_64-3.txz: Rebuilt.
x/xorg-server-xvfb-21.1.13-x86_64-3.txz: Rebuilt.
a/libbytesize-2.11-x86_64-1.txz: Upgraded.
d/python-setuptools-73.0.0-x86_64-1.txz: Upgraded.
l/python-importlib_metadata-8.4.0-x86_64-1.txz: Upgraded.
n/epic5-2.2-x86_64-1.txz: Upgraded.
n/netatalk-3.2.7-x86_64-1.txz: Upgraded.
x/xorg-server-21.1.13-x86_64-2.txz: Rebuilt.
On 32-bit, using the modesetting driver with Intel graphics is resulting in
a black screen (observed here with CoffeeLake-H GT2), so on 32-bit only let's
stop applying the patch that was making xorg-server use modesetting by
default. Thanks to LuckyCyborg and Petri Kaukasoina.
Fix build with gcc-14.2.
x/xorg-server-xephyr-21.1.13-x86_64-2.txz: Rebuilt.
x/xorg-server-xnest-21.1.13-x86_64-2.txz: Rebuilt.
x/xorg-server-xvfb-21.1.13-x86_64-2.txz: Rebuilt.
xfce/xfce4-screenshooter-1.11.1-x86_64-1.txz: Upgraded.
a/kernel-generic-6.10.5-x86_64-1.txz: Upgraded.
a/kernel-huge-6.10.5-x86_64-1.txz: Upgraded.
a/kernel-modules-6.10.5-x86_64-1.txz: Upgraded.
d/kernel-headers-6.10.5-x86-1.txz: Upgraded.
d/python-setuptools-72.2.0-x86_64-1.txz: Upgraded.
k/kernel-source-6.10.5-noarch-1.txz: Upgraded.
kde/okteta-0.26.16-x86_64-1.txz: Upgraded.
n/dovecot-2.3.21.1-x86_64-1.txz: Upgraded.
This update fixes security issues:
A large number of address headers in email resulted in excessive CPU usage.
Abnormally large email headers are now truncated or discarded, with a limit
of 10MB on a single header and 50MB for all the headers of all the parts of
an email.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-23184https://www.cve.org/CVERecord?id=CVE-2024-23185
(* Security fix *)
n/lynx-2.9.2-x86_64-1.txz: Upgraded.
x/mesa-24.2.0-x86_64-1.txz: Upgraded.
xfce/xfce4-notifyd-0.9.5-x86_64-1.txz: Upgraded.
extra/tigervnc/tigervnc-1.14.0-x86_64-3.txz: Rebuilt.
Recompiled against ffmpeg-7.0.2.
Thanks to Petri Kaukasoina.
extra/xv/xv-6.0.0-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/bash-5.2.032-x86_64-1.txz: Upgraded.
d/mercurial-6.8.1-x86_64-1.txz: Upgraded.
l/pipewire-1.2.2-x86_64-1.txz: Upgraded.
l/spirv-llvm-translator-18.1.3-x86_64-1.txz: Upgraded.
n/php-8.3.10-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.php.net/ChangeLog-8.php#8.3.10
d/meson-1.5.1-x86_64-1.txz: Upgraded.
l/imagemagick-7.1.1_36-x86_64-1.txz: Upgraded.
l/python-alabaster-1.0.0-x86_64-1.txz: Upgraded.
n/wpa_supplicant-2.11-x86_64-2.txz: Rebuilt.
[PATCH] nl80211: add extra-ies only if allowed by driver.
This fixes using broadcom-wl based adapters.
Thanks to Stuart Winter.
x/OpenCC-1.1.8-x86_64-1.txz: Upgraded.
x/xfs-1.2.2-x86_64-1.txz: Upgraded.
Well folks, we have some more interesting stuff in /testing now.
Our good friend LuckyCyborg posted a while back about our trials with
GRUB2, and that we were banging our heads against a wall for no reason
trying to bend GRUB2 with our 09_slackware_linux grub.d script instead
of changing our kernel/initrd naming scheme to vmlinux-6.10.1-generic
and initrd-6.10.1-generic.img. And, as is often the case, our friend is
exactly correct. Once we stopped trying to swim against the current, GRUB2
started behaving as it should.
The updates in /testing change the kernel naming scheme thusly, and modify
the geninitrd script in the mkinitrd package to also use this naming
scheme. And, of course, 09_slackware_linux is removed from GRUB2, and the
10_linux script is only lightly modified.
Because lilo and elilo work with the symlinks to the kernel and initrd,
they shouldn't care anout this change.
We've probably got 6.9.11 coming tomorrow. Unless I hear that I should stop
the presses on this change, it's likely that those kernels will be updated
using the new naming scheme and the mkinitrd and grub updates will be moved
into the main tree from /testing.
We'll stick with 6.9 in the main tree for now because I'm still encountering
suspend failure with the 6.10 kernel here.
Enjoy! :-)
a/kernel-firmware-20240723_b37d247-noarch-1.txz: Upgraded.
ap/mpg123-1.32.6-x86_64-2.txz: Rebuilt.
l/libxml2-2.13.3-x86_64-1.txz: Upgraded.
This update fixes a security issue:
Fix XXE protection in downstream code.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-40896
(* Security fix *)
l/mozilla-nss-3.102.1-x86_64-1.txz: Upgraded.
l/nodejs-20.16.0-x86_64-1.txz: Upgraded.
l/python-importlib_metadata-8.2.0-x86_64-1.txz: Upgraded.
l/v4l-utils-1.28.1-x86_64-1.txz: Upgraded.
n/c-ares-1.32.3-x86_64-1.txz: Upgraded.
n/curl-8.9.0-x86_64-1.txz: Upgraded.
n/htdig-3.2.0b6-x86_64-10.txz: Rebuilt.
Patch XSS vulnerability. Thanks to jayjwa.
Get this out of cgi-bin. Thanks to LuckyCyborg.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2007-6110
(* Security fix *)
n/libtirpc-1.3.5-x86_64-1.txz: Upgraded.
extra/fltk/fltk-1.3.9-x86_64-2.txz: Rebuilt.
extra/tigervnc/tigervnc-1.13.1-x86_64-6.txz: Rebuilt.
Not sure why 1.14.0 isn't compiling, but we'll rebuild this for now.
testing/packages/grub-2.12-x86_64-12.txz: Upgraded.
Remove 09_slackware_linux.
10_linux: don't rename Slackware ;-)
This should configure the renamed kernel/initrd perfectly.
Perhaps 10_linux should no longer accept initrd.gz as a valid name?
For now it is accepted to avoid disrupting existing workflows.
testing/packages/kernel-generic-6.10.1-x86_64-1.txz: Upgraded.
testing/packages/kernel-headers-6.10.1-x86-1.txz: Upgraded.
testing/packages/kernel-huge-6.10.1-x86_64-1.txz: Upgraded.
testing/packages/kernel-modules-6.10.1-x86_64-1.txz: Upgraded.
testing/packages/kernel-source-6.10.1-noarch-1.txz: Upgraded.
testing/packages/mkinitrd-1.4.11-x86_64-35.txz: Upgraded.
geninitrd: create initrd with initrd-version-name.img filename.
Make compat symlinks by default.
Always add LVM (I've seen it mistakenly skipped... if we can get to the
bottom of that then we'll stop always adding it)
Add /etc/default/geninitrd for configuration.
Hey folks, we got a new glibc and are beginning the process of baking the new
default compile flags into the toolchain, the graphics stack, and whatever else
happens along. Enjoy! :-)
a/aaa_glibc-solibs-2.40-x86_64-1.txz: Upgraded.
a/libblockdev-3.1.1_1-x86_64-2.txz: Rebuilt.
Fix build against recent ext2fs.h. Thanks to shipujin.
a/xfsprogs-6.9.0-x86_64-1.txz: Upgraded.
ap/rpm-4.19.1.1-x86_64-3.txz: Rebuilt.
ap/slackpkg-15.0.10-noarch-4.txz: Rebuilt.
Prefer gpg1 again. Going with the modern gpg with more dependencies was
a mistake in this case. (now we know why gnupg-1 is still around :-)
Thanks to Petri Kaukasoina.
d/binutils-2.42-x86_64-3.txz: Rebuilt.
d/cargo-vendor-filterer-0.5.14-x86_64-2.txz: Rebuilt.
d/cbindgen-0.26.0-x86_64-2.txz: Rebuilt.
d/ccache-4.10.2-x86_64-1.txz: Upgraded.
d/cmake-3.30.1-x86_64-2.txz: Rebuilt.
d/gcc-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-g++-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-gdc-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-gfortran-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-gm2-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-gnat-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-go-14.1.0-x86_64-2.txz: Rebuilt.
d/gcc-objc-14.1.0-x86_64-2.txz: Rebuilt.
d/libgccjit-14.1.0-x86_64-2.txz: Rebuilt.
d/libtool-2.4.7-x86_64-8.txz: Rebuilt.
d/parallel-20240722-noarch-1.txz: Upgraded.
d/pkg-config-0.29.2-x86_64-5.txz: Rebuilt.
d/python-setuptools-71.1.0-x86_64-1.txz: Upgraded.
d/ruby-3.3.4-x86_64-2.txz: Rebuilt.
d/rust-bindgen-0.69.4-x86_64-2.txz: Rebuilt.
d/strace-6.10-x86_64-1.txz: Upgraded.
d/subversion-1.14.3-x86_64-3.txz: Rebuilt.
e/emacs-29.4-x86_64-2.txz: Rebuilt.
l/PyQt-builder-1.16.4-x86_64-2.txz: Rebuilt.
l/PyQt5-5.15.11-x86_64-1.txz: Upgraded.
l/PyQt5_sip-12.15.0-x86_64-2.txz: Rebuilt.
l/argon2-20190702-x86_64-6.txz: Rebuilt.
l/ffmpeg-6.1.1-x86_64-5.txz: Rebuilt.
l/glibc-2.40-x86_64-1.txz: Upgraded.
This update fixes security issues:
nscd: Stack-based buffer overflow in netgroup cache.
nscd: Null pointer crash after notfound response.
nscd: netgroup cache may terminate daemon on memory allocation failure.
nscd: netgroup cache assumes NSS callback uses in-buffer strings.
These vulnerabilities were only present in the nscd binary.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-33599https://www.cve.org/CVERecord?id=CVE-2024-33600https://www.cve.org/CVERecord?id=CVE-2024-33601https://www.cve.org/CVERecord?id=CVE-2024-33602
(* Security fix *)
l/glibc-i18n-2.40-x86_64-1.txz: Upgraded.
l/glibc-profile-2.40-x86_64-1.txz: Upgraded.
l/gst-plugins-good-1.24.5-x86_64-2.txz: Rebuilt.
l/libcdio-paranoia-10.2+2.0.2-x86_64-1.txz: Upgraded.
l/libclc-18.1.8-x86_64-3.txz: Rebuilt.
l/libproxy-0.5.8-x86_64-1.txz: Upgraded.
l/lz4-1.10.0-x86_64-1.txz: Upgraded.
l/poppler-24.07.0-x86_64-2.txz: Rebuilt.
l/python-importlib_metadata-8.1.0-x86_64-1.txz: Upgraded.
l/python-sphinx-7.4.7-x86_64-1.txz: Upgraded.
l/qt5-5.15.14_20240716_ae0c8451-x86_64-1.txz: Upgraded.
l/qt5-webkit-5.212.0_alpha4-x86_64-13.txz: Rebuilt.
l/qt6-6.7.2_20240610_3f005f1e-x86_64-3.txz: Rebuilt.
l/sip-6.8.6-x86_64-2.txz: Rebuilt.
l/spirv-llvm-translator-18.1.2-x86_64-2.txz: Rebuilt.
l/v4l-utils-1.28.0-x86_64-1.txz: Upgraded.
n/bind-9.18.28-x86_64-1.txz: Upgraded.
This update fixes security issues:
Remove SIG(0) support from named as a countermeasure for CVE-2024-1975.
qctx-zversion was not being cleared when it should have been leading to
an assertion failure if it needed to be reused.
An excessively large number of rrtypes per owner can slow down database query
processing, so a limit has been placed on the number of rrtypes that can be
stored per owner (node) in a cache or zone database. This is configured with
the new "max-rrtypes-per-name" option, and defaults to 100.
Excessively large rdatasets can slow down database query processing, so a
limit has been placed on the number of records that can be stored per
rdataset in a cache or zone database. This is configured with the new
"max-records-per-type" option, and defaults to 100.
Malicious DNS client that sends many queries over TCP but never reads
responses can cause server to respond slowly or not respond at all for other
clients.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-1975https://www.cve.org/CVERecord?id=CVE-2024-4076https://www.cve.org/CVERecord?id=CVE-2024-1737https://www.cve.org/CVERecord?id=CVE-2024-0760
(* Security fix *)
n/fetchmail-6.4.39-x86_64-1.txz: Upgraded.
n/obexftp-0.24.2-x86_64-13.txz: Rebuilt.
n/pinentry-1.3.1-x86_64-2.txz: Rebuilt.
n/wpa_supplicant-2.11-x86_64-1.txz: Upgraded.
x/fcitx5-qt-5.1.6-x86_64-3.txz: Rebuilt.
x/ibus-m17n-1.4.30-x86_64-1.txz: Upgraded.
x/libdrm-2.4.122-x86_64-2.txz: Rebuilt.
x/marisa-0.2.6-x86_64-10.txz: Rebuilt.
x/mesa-24.1.4-x86_64-2.txz: Rebuilt.
x/vulkan-sdk-1.3.275.0-x86_64-3.txz: Rebuilt.
xap/audacious-4.4-x86_64-2.txz: Rebuilt.
xap/audacious-plugins-4.4-x86_64-2.txz: Rebuilt.
xap/mozilla-thunderbird-128.0.1esr-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/128.0.1esr/releasenotes/
xap/xaos-4.3.2-x86_64-2.txz: Rebuilt.
extra/emacs-regular-build/emacs-29.4-x86_64-2_regular.txz: Rebuilt.
a/kernel-firmware-20240718_058deb9-noarch-1.txz: Upgraded.
a/kernel-generic-6.9.10-x86_64-1.txz: Upgraded.
a/kernel-huge-6.9.10-x86_64-1.txz: Upgraded.
a/kernel-modules-6.9.10-x86_64-1.txz: Upgraded.
d/cmake-3.30.1-x86_64-1.txz: Upgraded.
d/kernel-headers-6.9.10-x86-1.txz: Upgraded.
d/python-setuptools-71.0.3-x86_64-1.txz: Upgraded.
k/kernel-source-6.9.10-noarch-1.txz: Upgraded.
kde/labplot-2.11.1-x86_64-1.txz: Upgraded.
l/python-sphinx-7.4.6-x86_64-1.txz: Upgraded.
l/sof-firmware-2024.06-noarch-1.txz: Upgraded.
n/httpd-2.4.62-x86_64-1.txz: Upgraded.
This release contains security fixes and improvements.
The first CVE is for Windows, but the second one is an additional fix for
the source code disclosure regression when using AddType.
Users are recommended to upgrade to version 2.4.62 which fixes this issue.
For more information, see:
https://downloads.apache.org/httpd/CHANGES_2.4.62https://www.cve.org/CVERecord?id=CVE-2024-40898https://www.cve.org/CVERecord?id=CVE-2024-40725
(* Security fix *)
n/openvpn-2.6.12-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/openssl11-solibs-1.1.1za-x86_64-1.txz: Upgraded.
ap/vim-9.1.0595-x86_64-1.txz: Upgraded.
l/python-sphinx-7.4.5-x86_64-1.txz: Upgraded.
n/iproute2-6.10.0-x86_64-1.txz: Upgraded.
n/nftables-1.1.0-x86_64-1.txz: Upgraded.
n/openssl11-1.1.1za-x86_64-1.txz: Upgraded.
Apply patches to fix CVEs that were fixed by the 1.1.1{x,y,za} releases that
were only available to subscribers to OpenSSL's premium extended support.
These patches were prepared by backporting commits from the OpenSSL-3.0 repo.
The reported version number has been updated so that vulnerability scanners
calm down. All of these issues were considered to be of low severity.
We probably won't keep 1.1.1 in -current for long anyway, but might as well
patch it first. :-)
Thanks to Ken Zalewski for the patches!
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-5678https://www.cve.org/CVERecord?id=CVE-2024-0727https://www.cve.org/CVERecord?id=CVE-2024-2511https://www.cve.org/CVERecord?id=CVE-2024-4741https://www.cve.org/CVERecord?id=CVE-2024-5535
(* Security fix *)
x/mesa-24.1.4-x86_64-1.txz: Upgraded.
xap/vim-gvim-9.1.0595-x86_64-1.txz: Upgraded.
n/curl-8.8.0-x86_64-3.txz: Rebuilt.
Recompiled using --with-openssl-quic to enable HTTP3.
This is (unsurprisingly) considered experimental, but should be fine.
Thanks to marav.
Thanks for the Slackiversary wishes!
a/bcachefs-tools-1.9.4-x86_64-1.txz: Upgraded.
a/sysklogd-2.6.0-x86_64-1.txz: Upgraded.
l/dbus-python-1.3.2-x86_64-3.txz: Rebuilt.
Build with meson, which fixes pulseaudio's qpaeq.
Thanks to gmgf and USUARIONUEVO.
l/nodejs-20.15.1-x86_64-2.txz: Rebuilt.
Recompiled using --shared-nghttp3.
l/python-sphinx-7.4.4-x86_64-1.txz: Upgraded.
n/c-ares-1.32.2-x86_64-1.txz: Upgraded.
n/curl-8.8.0-x86_64-2.txz: Rebuilt.
Recompiled using --with-nghttp2=/usr and --with-nghttp3=/usr.
n/libnftnl-1.2.7-x86_64-1.txz: Upgraded.
n/nghttp3-1.4.0-x86_64-1.txz: Added.
Thanks to pbslxw and Lockywolf.
n/ntp-4.2.8p18-x86_64-5.txz: Rebuilt.
This is a bugfix release to fix a regression in ntp-4.2.8p18:
If the IPv6 link-local interface was not ready for binding on the first
attempt, ntpd would segfault in update_interfaces().
Thanks to Jonathan Woithe for the bug report and fix.
a/cracklib-2.10.0-x86_64-1.txz: Upgraded.
kde/digikam-8.4.0-x86_64-1.txz: Upgraded.
l/PyQt5_sip-12.15.0-x86_64-1.txz: Upgraded.
n/gnupg2-2.4.5-x86_64-2.txz: Rebuilt.
Make a /usr/bin/gpgv symlink to gpgv2. Thanks to GazL ;-)
n/netatalk-3.2.3-x86_64-1.txz: Upgraded.
l/gtk+3-3.24.43-x86_64-1.txz: Upgraded.
n/netatalk-3.2.2-x86_64-2.txz: Rebuilt.
Build using -Dwith-pam-config-path=/etc/pam.d. Thanks to Petri Kaukasoina.
d/gdb-15.1-x86_64-1.txz: Upgraded.
n/openssh-9.8p1-x86_64-3.txz: Rebuilt.
As upstream refactors this into smaller binaries, we could easily run into
another update that causes an sshd lockout if the listener process isn't
restarted. So, let's try to prevent that. After the package is upgraded,
we'll use "sshd -t" to make sure that we have a sane configuration, and if
so then we'll restart the listener process automatically.
If you don't like this idea, you may turn it off in /etc/default/sshd.
n/wpa_supplicant-2.10-x86_64-5.txz: Rebuilt.
Use more normal permissions for the documentation and examples.
Thanks to Didier Spaier.
n/openssh-9.8p1-x86_64-2.txz: Rebuilt.
rc.sshd: also shut down sshd-session processes with "stop" function.
This shuts down connections cleanly instead of them having to time out.
Thanks to Petri Kaukasoina.
ap/sysstat-12.7.6-x86_64-1.txz: Upgraded.
d/cmake-3.30.0-x86_64-1.txz: Upgraded.
l/libass-0.17.3-x86_64-1.txz: Upgraded.
n/ca-certificates-20240703-noarch-1.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
n/gnutls-3.8.6-x86_64-1.txz: Upgraded.
n/netatalk-3.2.1-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
Fixed security issues that could lead to a denial of service or the
execution of arbitrary code.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-38439https://www.cve.org/CVERecord?id=CVE-2024-38440https://www.cve.org/CVERecord?id=CVE-2024-38441
(* Security fix *)
n/p11-kit-0.25.4-x86_64-1.txz: Upgraded.
n/pinentry-1.3.1-x86_64-1.txz: Upgraded.
x/mesa-24.1.3-x86_64-1.txz: Upgraded.
ap/ksh93-1.0.9-x86_64-1.txz: Upgraded.
kde/calligra-3.2.1-x86_64-42.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/cantor-23.08.5-x86_64-8.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/kfilemetadata-5.116.0-x86_64-4.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/kile-2.9.93-x86_64-35.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/kitinerary-23.08.5-x86_64-6.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/krita-5.2.3-x86_64-2.txz: Rebuilt.
Recompiled against poppler-24.07.0.
kde/okular-23.08.5-x86_64-6.txz: Rebuilt.
Recompiled against poppler-24.07.0.
l/ffmpeg-6.1.1-x86_64-4.txz: Rebuilt.
Recompiled against libplacebo-7.349.0.
l/gdbm-1.24-x86_64-1.txz: Upgraded.
l/libplacebo-7.349.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/poppler-24.07.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/python-trove-classifiers-2024.7.2-x86_64-1.txz: Upgraded.
n/getmail-6.19.02-x86_64-1.txz: Upgraded.
n/httpd-2.4.60-x86_64-2.txz: Rebuilt.
This update is to fix a regression and to note security issues that were not
listed in the CHANGES file included with the source code.
Fixed a regression where a config file using AddType rather than AddHandler
could cause raw PHP files to be downloaded rather than processed.
Thanks to Nobby6.
For more information, see:
https://downloads.apache.org/httpd/CHANGES_2.4.60https://www.cve.org/CVERecord?id=CVE-2024-39573https://www.cve.org/CVERecord?id=CVE-2024-38477https://www.cve.org/CVERecord?id=CVE-2024-38476https://www.cve.org/CVERecord?id=CVE-2024-38475https://www.cve.org/CVERecord?id=CVE-2024-38474https://www.cve.org/CVERecord?id=CVE-2024-38473https://www.cve.org/CVERecord?id=CVE-2024-38472https://www.cve.org/CVERecord?id=CVE-2024-36387
(* Security fix *)
xap/mpv-0.38.0-x86_64-4.txz: Rebuilt.
Recompiled against libplacebo-7.349.0.
a/sysvinit-scripts-15.1-noarch-20.txz: Rebuilt.
rc.M: fix typo when starting local LDAP name service daemon.
Thanks to tcanich.
ap/lxc-6.0.1-x86_64-2.txz: Rebuilt.
Update the ca-certificates as part of lxc-create.
l/gvfs-1.54.2-x86_64-1.txz: Upgraded.
l/wireplumber-0.5.5-x86_64-1.txz: Upgraded.
n/s-nail-14.9.25-x86_64-1.txz: Upgraded.
x/ibus-table-1.17.6-x86_64-1.txz: Upgraded.
a/grub-2.12-x86_64-6.txz: Rebuilt.
Added update-grub script. Thanks to LuckyCyborg.
Also add grub-update symlink.
Disable the submenus. Thanks to LuckyCyborg.
Also find initrd-${tag}-${version}.gz and initrd-${tag}.gz. Thanks to gwhl.
Support kernel symlinks/files named vmlinu[xz]-generic, vmlinu[xz]-custom,
and vmlinu[xz]-huge. Thanks to Petri Kaukasoina.
Enabled os-prober again. It works here, and (at least with lilo) we've always
been friendly to dual-booting. It's easy to disable if you don't like it.
Sorry to LuckyCyborg. ;-)
d/parallel-20240622-noarch-1.txz: Upgraded.
kde/qca-2.3.9-x86_64-1.txz: Upgraded.
l/imagemagick-7.1.1_34-x86_64-1.txz: Upgraded.
n/NetworkManager-1.48.2-x86_64-1.txz: Upgraded.
n/ntp-4.2.8p18-x86_64-4.txz: Rebuilt.
In ntp.conf, don't use direct logging to /var/log/ntp. Instead use the syslog
facility to avoid having to restart ntpd when the logs are rotated.
We'll still rotate /var/log/ntp if we see it, though.
Thanks to Petri Kaukasoina.
xap/NetworkManager-openvpn-1.12.0-x86_64-1.txz: Upgraded.
a/kernel-firmware-20240614_d95dff8-noarch-1.txz: Upgraded.
a/sysvinit-scripts-15.1-noarch-19.txz: Rebuilt.
rc.S: add special case for mounting root bcachefs partition(s).
Thanks to 0XBF.
ap/man-pages-6.9-noarch-1.txz: Upgraded.
l/libxslt-1.1.40-x86_64-2.txz: Rebuilt.
[PATCH] runtest: Print output causing failure.
[PATCH] tests: Fix tests for libxml2 fix.
Thanks to USUARIONUEVO.
n/ca-certificates-20240615-noarch-1.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
a/kernel-firmware-20240604_22643bb-noarch-1.txz: Upgraded.
a/less-657-x86_64-1.txz: Upgraded.
a/openssl-solibs-3.3.1-x86_64-1.txz: Upgraded.
d/cmake-3.29.4-x86_64-1.txz: Upgraded.
l/poppler-24.06.0-x86_64-1.txz: Upgraded.
l/protobuf-27.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
l/python-zipp-3.19.2-x86_64-1.txz: Upgraded.
l/qt6-6.7.1_20240516_6977d02f-x86_64-2.txz: Rebuilt.
Recompiled against protobuf-27.0.
n/ca-certificates-20240604-noarch-1.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
n/mosh-1.4.0-x86_64-2.txz: Rebuilt.
Recompiled against protobuf-27.0.
n/openssl-3.3.1-x86_64-1.txz: Upgraded.
This update fixes bugs and one low severity security issue:
Calling the OpenSSL API function SSL_free_buffers may cause memory to be
accessed that was previously freed in some situations. Our investigations
indicate that this function is rarely used by applications.
For more information, see:
https://www.openssl.org/news/secadv/20240528.txthttps://www.cve.org/CVERecord?id=CVE-2024-4741
(* Security fix *)
a/findutils-4.10.0-x86_64-1.txz: Upgraded.
a/logrotate-3.22.0-x86_64-1.txz: Upgraded.
Thanks to opty for getting our changes accepted upstream.
a/sysvinit-scripts-15.1-noarch-18.txz: Rebuilt.
rc.M: start dnsmasq before ntpd. Thanks to lostintime.
d/git-2.45.2-x86_64-1.txz: Upgraded.
d/poke-4.1-x86_64-1.txz: Upgraded.
kde/fcitx5-configtool-5.1.6-x86_64-1.txz: Upgraded.
kde/kwin-5.27.11-x86_64-2.txz: Rebuilt.
Recompiled against wayland-1.23.0 since it seems they broke the ABI.
Let me know if anything else needs help.
kde/libindi-2.0.8-x86_64-1.txz: Upgraded.
l/mujs-1.3.4-x86_64-1.txz: Added.
l/python-zipp-3.19.1-x86_64-1.txz: Upgraded.
n/ntp-4.2.8p18-x86_64-2.txz: Rebuilt.
rc.ntp: properly create the PID file on start.
Add /etc/default/ntp to configure ntpd startup options since some people are
needing to add -4 to avoid an error.
Thanks to rkelsen and teoberi.
x/fcitx5-5.1.10-x86_64-1.txz: Upgraded.
x/fcitx5-chinese-addons-5.1.6-x86_64-1.txz: Upgraded.
x/fcitx5-hangul-5.1.4-x86_64-1.txz: Upgraded.
x/fcitx5-kkc-5.1.4-x86_64-1.txz: Upgraded.
x/fcitx5-table-extra-5.1.6-x86_64-1.txz: Upgraded.
x/fcitx5-table-other-5.1.3-x86_64-1.txz: Upgraded.
x/libime-1.1.8-x86_64-1.txz: Upgraded.
x/xcb-imdkit-1.0.9-x86_64-1.txz: Upgraded.
xap/blueman-2.4.2-x86_64-1.txz: Upgraded.
xap/mpv-0.38.0-x86_64-3.txz: Rebuilt.
Recompiled against mujs-1.3.4.
d/luajit-2.0.1716656478-x86_64-1.txz: Added.
Thanks to Erik Falor.
n/proftpd-1.3.8b-x86_64-4.txz: Rebuilt.
Build with mod_wrap2 and mod_wrap2_file instead of mod_wrap, which has
problems with ipv6. Thanks to jayjwa.
xap/mpv-0.38.0-x86_64-2.txz: Rebuilt.
[PATCH 1/4] av_common: parent mp_get_lavf_demuxer contents to the list.
[PATCH 2/4] stream: implement get_protocols method for stream_lavf.
[PATCH 3/4] build: dynamically generate mpv.desktop file protocols.
[PATCH 4/4] stream_lavf: don't add ffmpeg bluray or dvd protocols.
Thanks to gmgf.
Build against luajit. Thanks to pm_a_cup_of_tea.
a/hwdata-0.383-noarch-1.txz: Upgraded.
a/pciutils-3.13.0-x86_64-1.txz: Upgraded.
d/ccache-4.10-x86_64-1.txz: Upgraded.
d/meson-1.4.1-x86_64-1.txz: Upgraded.
d/ruby-3.3.2-x86_64-1.txz: Upgraded.
kde/plasma-sdk-5.27.11.1-x86_64-1.txz: Upgraded.
kde/plasma-workspace-5.27.11.1-x86_64-1.txz: Upgraded.
kde/tokodon-23.08.5-x86_64-1.txz: Added.
l/libvpx-1.14.1-x86_64-1.txz: Upgraded.
l/python-requests-2.32.3-x86_64-1.txz: Upgraded.
n/NetworkManager-1.48.0-x86_64-1.txz: Upgraded.
n/getmail-6.19.00-x86_64-1.txz: Upgraded.
x/libevdev-1.13.2-x86_64-1.txz: Upgraded.
x/wayland-1.23.0-x86_64-1.txz: Upgraded.
xap/gnuplot-6.0.1-x86_64-1.txz: Upgraded.
xap/mpv-0.38.0-x86_64-1.txz: Added.
Evidently we need one more media player. ;-)
Thanks to John Vogel Corning, Andreas Guldstrand, and Christoph Willing.
ap/sqlite-3.46.0-x86_64-1.txz: Upgraded.
l/gvfs-1.54.1-x86_64-1.txz: Upgraded.
l/python-requests-2.32.2-x86_64-1.txz: Upgraded.
n/c-ares-1.29.0-x86_64-1.txz: Upgraded.
n/dhcpcd-10.0.8-x86_64-1.txz: Upgraded.
n/wsdd2-1.8.7-x86_64-1.txz: Added.
Needed by Samba to enable share discovery.
Thanks to mistfire and Tim Dickson.
a/bcachefs-tools-1.7.0-x86_64-1.txz: Added.
a/kernel-generic-6.9.0-x86_64-2.txz: Upgraded.
a/kernel-huge-6.9.0-x86_64-2.txz: Upgraded.
a/kernel-modules-6.9.0-x86_64-2.txz: Upgraded.
d/git-2.45.1-x86_64-1.txz: Upgraded.
This update fixes security issues:
Recursive clones on case-insensitive filesystems that support symbolic
links are susceptible to case confusion that can be exploited to
execute just-cloned code during the clone operation.
Repositories can be configured to execute arbitrary code during local
clones. To address this, the ownership checks introduced in v2.30.3
are now extended to cover cloning local repositories.
Local clones may end up hardlinking files into the target repository's
object database when source and target repository reside on the same
disk. If the source repository is owned by a different user, then
those hardlinked files may be rewritten at any point in time by the
untrusted user.
When cloning a local source repository that contains symlinks via the
filesystem, Git may create hardlinks to arbitrary user-readable files
on the same filesystem as the target repository in the objects/
directory.
It is supposed to be safe to clone untrusted repositories, even those
unpacked from zip archives or tarballs originating from untrusted
sources, but Git can be tricked to run arbitrary code as part of the
clone.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-32002https://www.cve.org/CVERecord?id=CVE-2024-32004https://www.cve.org/CVERecord?id=CVE-2024-32020https://www.cve.org/CVERecord?id=CVE-2024-32021https://www.cve.org/CVERecord?id=CVE-2024-32465
(* Security fix *)
d/kernel-headers-6.9.0-x86-2.txz: Upgraded.
d/strace-6.9-x86_64-1.txz: Upgraded.
k/kernel-source-6.9.0-noarch-2.txz: Upgraded.
BCACHEFS_FS m -> y
CRYPTO_CHACHA20 m -> y
CRYPTO_LIB_CHACHA_GENERIC m -> y
CRYPTO_LIB_POLY1305_GENERIC m -> y
CRYPTO_POLY1305 m -> y
MITIGATION_GDS_FORCE y -> n
kde/wcslib-8.3-x86_64-1.txz: Upgraded.
l/gdk-pixbuf2-2.42.12-x86_64-1.txz: Upgraded.
ani: Reject files with multiple INA or IART chunks.
ani: Reject files with multiple anih chunks.
ani: validate chunk size.
Thanks to 0xvhp, pedrib, and Benjamin Gilbert.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2022-48622
(* Security fix *)
l/gtk+3-3.24.42-x86_64-1.txz: Upgraded.
n/bind-9.18.27-x86_64-1.txz: Upgraded.
This is a bugfix release.
n/popa3d-1.0.3-x86_64-8.txz: Rebuilt.
This is a bugfix release:
Build with AUTH_PAM, not AUTH_SHADOW.
Thanks to jayjwa.
x/xorg-server-xwayland-23.2.7-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
