Commit graph

1207 commits

Author SHA1 Message Date
Patrick J Volkerding
f27add7577 Mon Feb 20 19:41:06 UTC 2023
patches/packages/curl-7.88.1-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
2023-02-21 13:30:37 +01:00
Patrick J Volkerding
f3eb859afc Sat Feb 18 02:04:34 UTC 2023
patches/packages/kernel-firmware-20230214_a253a37-noarch-1.txz:  Upgraded.
patches/packages/linux-5.15.80/*:  Upgraded.
  These updates fix various bugs and security issues.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 5.15.81:
    https://www.cve.org/CVERecord?id=CVE-2022-47519
    https://www.cve.org/CVERecord?id=CVE-2022-47518
    https://www.cve.org/CVERecord?id=CVE-2022-47520
    https://www.cve.org/CVERecord?id=CVE-2022-47521
    https://www.cve.org/CVERecord?id=CVE-2022-3344
    Fixed in 5.15.82:
    https://www.cve.org/CVERecord?id=CVE-2022-45869
    https://www.cve.org/CVERecord?id=CVE-2022-4378
    Fixed in 5.15.83:
    https://www.cve.org/CVERecord?id=CVE-2022-3643
    Fixed in 5.15.84:
    https://www.cve.org/CVERecord?id=CVE-2022-3545
    Fixed in 5.15.85:
    https://www.cve.org/CVERecord?id=CVE-2022-45934
    Fixed in 5.15.86:
    https://www.cve.org/CVERecord?id=CVE-2022-3534
    https://www.cve.org/CVERecord?id=CVE-2022-3424
    Fixed in 5.15.87:
    https://www.cve.org/CVERecord?id=CVE-2022-41218
    https://www.cve.org/CVERecord?id=CVE-2023-23455
    https://www.cve.org/CVERecord?id=CVE-2023-23454
    https://www.cve.org/CVERecord?id=CVE-2023-0045
    https://www.cve.org/CVERecord?id=CVE-2023-0210
    https://www.cve.org/CVERecord?id=CVE-2022-36280
    Fixed in 5.15.88:
    https://www.cve.org/CVERecord?id=CVE-2023-0266
    https://www.cve.org/CVERecord?id=CVE-2022-47929
    Fixed in 5.15.89:
    https://www.cve.org/CVERecord?id=CVE-2023-0179
    https://www.cve.org/CVERecord?id=CVE-2023-0394
    Fixed in 5.15.90:
    https://www.cve.org/CVERecord?id=CVE-2022-4382
    https://www.cve.org/CVERecord?id=CVE-2022-4842
    Fixed in 5.15.91:
    https://www.cve.org/CVERecord?id=CVE-2022-4129
    https://www.cve.org/CVERecord?id=CVE-2023-23559
  (* Security fix *)
2023-02-18 13:30:11 +01:00
Patrick J Volkerding
1ae65ae489 Thu Feb 16 22:07:06 UTC 2023
patches/packages/mozilla-thunderbird-102.8.0-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.8.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/
    https://www.cve.org/CVERecord?id=CVE-2023-0616
    https://www.cve.org/CVERecord?id=CVE-2023-25728
    https://www.cve.org/CVERecord?id=CVE-2023-25730
    https://www.cve.org/CVERecord?id=CVE-2023-0767
    https://www.cve.org/CVERecord?id=CVE-2023-25735
    https://www.cve.org/CVERecord?id=CVE-2023-25737
    https://www.cve.org/CVERecord?id=CVE-2023-25738
    https://www.cve.org/CVERecord?id=CVE-2023-25739
    https://www.cve.org/CVERecord?id=CVE-2023-25729
    https://www.cve.org/CVERecord?id=CVE-2023-25732
    https://www.cve.org/CVERecord?id=CVE-2023-25734
    https://www.cve.org/CVERecord?id=CVE-2023-25742
    https://www.cve.org/CVERecord?id=CVE-2023-25746
  (* Security fix *)
2023-02-17 13:30:05 +01:00
Patrick J Volkerding
9b5b70af5b Wed Feb 15 19:48:10 UTC 2023
patches/packages/curl-7.88.0-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  HTTP multi-header compression denial of service.
  HSTS amnesia with --parallel.
  HSTS ignored on multiple requests.
  For more information, see:
    https://curl.se/docs/CVE-2023-23916.html
    https://curl.se/docs/CVE-2023-23915.html
    https://curl.se/docs/CVE-2023-23914.html
    https://www.cve.org/CVERecord?id=CVE-2023-23916
    https://www.cve.org/CVERecord?id=CVE-2023-23915
    https://www.cve.org/CVERecord?id=CVE-2023-23914
  (* Security fix *)
patches/packages/git-2.35.7-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Using a specially-crafted repository, Git can be tricked into using
  its local clone optimization even when using a non-local transport.
  Though Git will abort local clones whose source $GIT_DIR/objects
  directory contains symbolic links (c.f., CVE-2022-39253), the objects
  directory itself may still be a symbolic link.
  These two may be combined to include arbitrary files based on known
  paths on the victim's filesystem within the malicious repository's
  working copy, allowing for data exfiltration in a similar manner as
  CVE-2022-39253.
  By feeding a crafted input to "git apply", a path outside the
  working tree can be overwritten as the user who is running "git
  apply".
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-22490
    https://www.cve.org/CVERecord?id=CVE-2023-23946
  (* Security fix *)
2023-02-16 13:30:35 +01:00
Patrick J Volkerding
ad9ea8bf78 Wed Feb 15 03:05:40 UTC 2023
extra/php80/php80-8.0.28-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
extra/php81/php81-8.1.16-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
patches/packages/hwdata-0.367-noarch-1_slack15.0.txz:  Upgraded.
  Upgraded to get information for newer hardware.
  Requested by kingbeowulf on LQ.
patches/packages/mozilla-firefox-102.8.0esr-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.8.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/
    https://www.cve.org/CVERecord?id=CVE-2023-25728
    https://www.cve.org/CVERecord?id=CVE-2023-25730
    https://www.cve.org/CVERecord?id=CVE-2023-25743
    https://www.cve.org/CVERecord?id=CVE-2023-0767
    https://www.cve.org/CVERecord?id=CVE-2023-25735
    https://www.cve.org/CVERecord?id=CVE-2023-25737
    https://www.cve.org/CVERecord?id=CVE-2023-25738
    https://www.cve.org/CVERecord?id=CVE-2023-25739
    https://www.cve.org/CVERecord?id=CVE-2023-25729
    https://www.cve.org/CVERecord?id=CVE-2023-25732
    https://www.cve.org/CVERecord?id=CVE-2023-25734
    https://www.cve.org/CVERecord?id=CVE-2023-25742
    https://www.cve.org/CVERecord?id=CVE-2023-25746
  (* Security fix *)
patches/packages/php-7.4.33-x86_64-3_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
2023-02-16 01:30:36 +01:00
Patrick J Volkerding
57c03ef31c Fri Feb 10 20:08:41 UTC 2023
patches/packages/gnutls-3.7.9-x86_64-1_slack15.0.txz:  Upgraded.
  libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange.
  Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin.
  [GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361]
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0361
  (* Security fix *)
2023-02-11 13:30:32 +01:00
Patrick J Volkerding
5951c7a965 Thu Feb 9 00:59:27 UTC 2023
patches/packages/mozilla-thunderbird-102.7.2-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.7.2/releasenotes/
2023-02-09 13:30:28 +01:00
Patrick J Volkerding
4b5e1863bb Tue Feb 7 20:48:57 UTC 2023
patches/packages/openssl-1.1.1t-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  X.400 address type confusion in X.509 GeneralName.
  Timing Oracle in RSA Decryption.
  Use-after-free following BIO_new_NDEF.
  Double free after calling PEM_read_bio_ex.
  For more information, see:
    https://www.openssl.org/news/secadv/20230207.txt
    https://www.cve.org/CVERecord?id=CVE-2023-0286
    https://www.cve.org/CVERecord?id=CVE-2022-4304
    https://www.cve.org/CVERecord?id=CVE-2023-0215
    https://www.cve.org/CVERecord?id=CVE-2022-4450
  (* Security fix *)
patches/packages/openssl-solibs-1.1.1t-x86_64-1_slack15.0.txz:  Upgraded.
patches/packages/xorg-server-1.20.14-x86_64-7_slack15.0.txz:  Rebuilt.
  [PATCH] Xi: fix potential use-after-free in DeepCopyPointerClasses.
  Also merged another patch to prevent crashes when using a compositor with
  the NVIDIA blob. Thanks to mdinslage, willysr, and Daedra.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0494
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-6_slack15.0.txz:  Rebuilt.
  [PATCH] Xi: fix potential use-after-free in DeepCopyPointerClasses.
  Also merged another patch to prevent crashes when using a compositor with
  the NVIDIA blob. Thanks to mdinslage, willysr, and Daedra.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0494
  (* Security fix *)
2023-02-08 13:30:32 +01:00
Patrick J Volkerding
ad40d2a62a Thu Feb 2 22:52:48 UTC 2023
patches/packages/openssh-9.2p1-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains fixes for two security problems and a memory safety
  problem. The memory safety problem is not believed to be exploitable, but
  upstream reports most network-reachable memory faults as security bugs.
  This update contains some potentially incompatible changes regarding the
  scp utility. For more information, see:
    https://www.openssh.com/releasenotes.html#9.0
  For more information, see:
    https://www.openssh.com/releasenotes.html#9.2
  (* Security fix *)
2023-02-03 13:30:32 +01:00
Patrick J Volkerding
7453cf8b30 Wed Feb 1 22:27:31 UTC 2023
patches/packages/apr-1.7.2-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Integer Overflow or Wraparound vulnerability in apr_encode functions of
  Apache Portable Runtime (APR) allows an attacker to write beyond bounds
  of a buffer. (CVE-2022-24963)
  Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
  (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
  later 1.6.x releases, but was missing in 1.7.0.) (CVE-2021-35940)
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-24963
    https://www.cve.org/CVERecord?id=CVE-2021-35940
    https://www.cve.org/CVERecord?id=CVE-2017-12613
  (* Security fix *)
patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Integer Overflow or Wraparound vulnerability in apr_base64 functions
  of Apache Portable Runtime Utility (APR-util) allows an attacker to
  write beyond bounds of a buffer. (CVE-2022-25147)
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-25147
  (* Security fix *)
patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.7.1/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-04/
    https://www.cve.org/CVERecord?id=CVE-2023-0430
  (* Security fix *)
2023-02-02 13:30:30 +01:00
Patrick J Volkerding
139b76eee4 Thu Jan 26 00:34:41 UTC 2023
patches/packages/bind-9.16.37-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and the following security issues:
  An UPDATE message flood could cause :iscman:`named` to exhaust all
  available memory. This flaw was addressed by adding a new
  :any:`update-quota` option that controls the maximum number of
  outstanding DNS UPDATE messages that :iscman:`named` can hold in a
  queue at any given time (default: 100).
  :iscman:`named` could crash with an assertion failure when an RRSIG
  query was received and :any:`stale-answer-client-timeout` was set to a
  non-zero value. This has been fixed.
  :iscman:`named` running as a resolver with the
  :any:`stale-answer-client-timeout` option set to any value greater
  than ``0`` could crash with an assertion failure, when the
  :any:`recursive-clients` soft quota was reached. This has been fixed.
  For more information, see:
    https://kb.isc.org/docs/cve-2022-3094
    https://kb.isc.org/docs/cve-2022-3736
    https://kb.isc.org/docs/cve-2022-3924
    https://www.cve.org/CVERecord?id=CVE-2022-3094
    https://www.cve.org/CVERecord?id=CVE-2022-3736
    https://www.cve.org/CVERecord?id=CVE-2022-3924
  (* Security fix *)
patches/packages/vim-9.0.1241-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed a security issue:
  Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0433
  (* Security fix *)
patches/packages/vim-gvim-9.0.1241-x86_64-1_slack15.0.txz:  Upgraded.
testing/packages/bind-9.18.11-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and the following security issues:
  An UPDATE message flood could cause :iscman:`named` to exhaust all
  available memory. This flaw was addressed by adding a new
  :any:`update-quota` option that controls the maximum number of
  outstanding DNS UPDATE messages that :iscman:`named` can hold in a
  queue at any given time (default: 100).
  :iscman:`named` could crash with an assertion failure when an RRSIG
  query was received and :any:`stale-answer-client-timeout` was set to a
  non-zero value. This has been fixed.
  :iscman:`named` running as a resolver with the
  :any:`stale-answer-client-timeout` option set to any value greater
  than ``0`` could crash with an assertion failure, when the
  :any:`recursive-clients` soft quota was reached. This has been fixed.
  For more information, see:
    https://kb.isc.org/docs/cve-2022-3094
    https://kb.isc.org/docs/cve-2022-3736
    https://kb.isc.org/docs/cve-2022-3924
    https://www.cve.org/CVERecord?id=CVE-2022-3094
    https://www.cve.org/CVERecord?id=CVE-2022-3736
    https://www.cve.org/CVERecord?id=CVE-2022-3924
  (* Security fix *)
2023-01-26 13:30:28 +01:00
Patrick J Volkerding
3a08b95c50 Fri Jan 20 23:58:24 UTC 2023
patches/packages/mozilla-thunderbird-102.7.0-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.7.0/releasenotes/
    https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird102.7
  (* Security fix *)
patches/packages/seamonkey-2.53.15-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.seamonkey-project.org/releases/seamonkey2.53.15
  (* Security fix *)
2023-01-21 13:30:30 +01:00
Patrick J Volkerding
19e28b847b Thu Jan 19 00:40:12 UTC 2023
patches/packages/sudo-1.9.12p2-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes a flaw in sudo's -e option (aka sudoedit) that could allow
  a malicious user with sudoedit privileges to edit arbitrary files.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-22809
  (* Security fix *)
2023-01-19 13:30:28 +01:00
Patrick J Volkerding
7793836a6d Fri Jan 13 20:29:55 UTC 2023
patches/packages/netatalk-3.1.14-x86_64-1_slack15.0.txz:  Upgraded.
  Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow
  resulting in code execution via a crafted .appl file.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-45188
  (* Security fix *)
2023-01-14 13:30:29 +01:00
Patrick J Volkerding
4c8bd06faa Tue Jan 10 21:32:00 UTC 2023
patches/packages/ca-certificates-20221205-noarch-2_slack15.0.txz:  Rebuilt.
  Make sure that if we're installing this package on another partition (such as
  when using installpkg with a --root parameter) that the updates are done on
  that partition. Thanks to fulalas.
2023-01-11 13:30:25 +01:00
Patrick J Volkerding
585883b9b5 Sat Jan 7 01:50:00 UTC 2023
extra/php80/php80-8.0.27-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  PDO::quote() may return unquoted string.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31631
  (* Security fix *)
extra/php81/php81-8.1.14-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and a security issue:
  PDO::quote() may return unquoted string.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31631
  (* Security fix *)
patches/packages/mozilla-nss-3.87-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures.
  For more information, see:
    https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
    https://www.cve.org/CVERecord?id=CVE-2021-43527
  (* Security fix *)
patches/packages/php-7.4.33-x86_64-2_slack15.0.txz:  Rebuilt.
  This update fixes a security issue:
  PDO::quote() may return unquoted string.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31631
  (* Security fix *)
2023-01-07 13:30:29 +01:00
Patrick J Volkerding
7920ad758b Thu Jan 5 03:09:24 UTC 2023
patches/packages/vim-9.0.1146-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed security issues:
  Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
  Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0049
    https://www.cve.org/CVERecord?id=CVE-2023-0051
  (* Security fix *)
patches/packages/vim-gvim-9.0.1146-x86_64-1_slack15.0.txz:  Upgraded.
2023-01-06 13:30:24 +01:00
Patrick J Volkerding
e054e8d54f Wed Jan 4 02:18:08 UTC 2023
patches/packages/libtiff-4.4.0-x86_64-1_slack15.0.txz:  Upgraded.
  Patched various security bugs.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-2056
    https://www.cve.org/CVERecord?id=CVE-2022-2057
    https://www.cve.org/CVERecord?id=CVE-2022-2058
    https://www.cve.org/CVERecord?id=CVE-2022-3970
    https://www.cve.org/CVERecord?id=CVE-2022-34526
  (* Security fix *)
patches/packages/rxvt-unicode-9.26-x86_64-3_slack15.0.txz:  Rebuilt.
  When the "background" extension was loaded, an attacker able to control the
  data written to the terminal would be able to execute arbitrary code as the
  terminal's user. Thanks to David Leadbeater and Ben Collver.
  For more information, see:
    https://www.openwall.com/lists/oss-security/2022/12/05/1
    https://www.cve.org/CVERecord?id=CVE-2022-4170
  (* Security fix *)
patches/packages/whois-5.5.15-x86_64-1_slack15.0.txz:  Upgraded.
  Updated the .bd, .nz and .tv TLD servers.
  Added the .llyw.cymru, .gov.scot and .gov.wales SLD servers.
  Updated the .ac.uk and .gov.uk SLD servers.
  Recursion has been enabled for whois.nic.tv.
  Updated the list of new gTLDs with four generic TLDs assigned in October 2013
  which were missing due to a bug.
  Removed 4 new gTLDs which are no longer active.
  Added the Georgian translation, contributed by Temuri Doghonadze.
  Updated the Finnish translation, contributed by Lauri Nurmi.
2023-01-04 13:30:28 +01:00
Patrick J Volkerding
d404417adc Fri Dec 23 02:37:47 UTC 2022
testing/packages/bind-9.18.10-x86_64-1_slack15.0.txz:  Upgraded.
2022-12-23 13:30:29 +01:00
Patrick J Volkerding
a5dc0f82be Tue Dec 20 20:40:18 UTC 2022
patches/packages/libksba-1.6.3-x86_64-1_slack15.0.txz:  Upgraded.
  Fix another integer overflow in the CRL's signature parser.
  (* Security fix *)
patches/packages/sdl-1.2.15-x86_64-13_slack15.0.txz:  Rebuilt.
  This update fixes a heap overflow problem in video/SDL_pixels.c in SDL.
  By crafting a malicious .BMP file, an attacker can cause the application
  using this library to crash, denial of service, or code execution.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2021-33657
  (* Security fix *)
2022-12-21 13:30:32 +01:00
Patrick J Volkerding
15705ea3bc Mon Dec 19 21:18:22 UTC 2022
patches/packages/xorg-server-1.20.14-x86_64-6_slack15.0.txz:  Rebuilt.
  This release fixes an invalid event type mask in XTestSwapFakeInput which
  was inadvertently changed from octal 0177 to hexadecimal 0x177 in the fix
  for CVE-2022-46340.
patches/packages/xorg-server-xephyr-1.20.14-x86_64-6_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-6_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-6_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-5_slack15.0.txz:  Rebuilt.
  This release fixes an invalid event type mask in XTestSwapFakeInput which
  was inadvertently changed from octal 0177 to hexadecimal 0x177 in the fix
  for CVE-2022-46340.
2022-12-20 13:30:29 +01:00
Patrick J Volkerding
3c02d6f8a1 Sun Dec 18 20:28:03 UTC 2022
patches/packages/libarchive-3.6.2-x86_64-2_slack15.0.txz:  Rebuilt.
  This update fixes a regression causing a failure to compile against
  libarchive: don't include iconv in libarchive.pc.
2022-12-19 13:30:36 +01:00
Patrick J Volkerding
373b059753 Sat Dec 17 21:14:11 UTC 2022
patches/packages/samba-4.15.13-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of
  Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.
  A Samba Active Directory DC will issue weak rc4-hmac session keys for
  use between modern clients and servers despite all modern Kerberos
  implementations supporting the aes256-cts-hmac-sha1-96 cipher.
  On Samba Active Directory DCs and members
  'kerberos encryption types = legacy'
  would force rc4-hmac as a client even if the server supports
  aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
  This is the Samba CVE for the Windows Kerberos Elevation of Privilege
  Vulnerability disclosed by Microsoft on Nov 8 2022.
  A service account with the special constrained delegation permission
  could forge a more powerful ticket than the one it was presented with.
  The "RC4" protection of the NetLogon Secure channel uses the same
  algorithms as rc4-hmac cryptography in Kerberos, and so must also be
  assumed to be weak.
  Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
  was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed
  that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue
  rc4-hmac encrypted tickets despite the target server supporting better
  encryption (eg aes256-cts-hmac-sha1-96).
  Note that there are several important behavior changes included in this
  release, which may cause compatibility problems interacting with system
  still expecting the former behavior.
  Please read the advisories of CVE-2022-37966, CVE-2022-37967 and
  CVE-2022-38023 carefully!
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-37966.html
    https://www.samba.org/samba/security/CVE-2022-37967.html
    https://www.samba.org/samba/security/CVE-2022-38023.html
    https://www.samba.org/samba/security/CVE-2022-45141.html
    https://www.cve.org/CVERecord?id=CVE-2022-37966
    https://www.cve.org/CVERecord?id=CVE-2022-37967
    https://www.cve.org/CVERecord?id=CVE-2022-38023
    https://www.cve.org/CVERecord?id=CVE-2022-45141
  (* Security fix *)
2022-12-18 13:30:08 +01:00
Patrick J Volkerding
b5eac9957b Wed Dec 14 21:19:34 UTC 2022
patches/packages/mozilla-firefox-102.6.0esr-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.6.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/
    https://www.cve.org/CVERecord?id=CVE-2022-46880
    https://www.cve.org/CVERecord?id=CVE-2022-46872
    https://www.cve.org/CVERecord?id=CVE-2022-46881
    https://www.cve.org/CVERecord?id=CVE-2022-46874
    https://www.cve.org/CVERecord?id=CVE-2022-46875
    https://www.cve.org/CVERecord?id=CVE-2022-46882
    https://www.cve.org/CVERecord?id=CVE-2022-46878
  (* Security fix *)
patches/packages/mozilla-thunderbird-102.6.0-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.6.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/
    https://www.cve.org/CVERecord?id=CVE-2022-46880
    https://www.cve.org/CVERecord?id=CVE-2022-46872
    https://www.cve.org/CVERecord?id=CVE-2022-46881
    https://www.cve.org/CVERecord?id=CVE-2022-46874
    https://www.cve.org/CVERecord?id=CVE-2022-46875
    https://www.cve.org/CVERecord?id=CVE-2022-46882
    https://www.cve.org/CVERecord?id=CVE-2022-46878
  (* Security fix *)
patches/packages/xorg-server-1.20.14-x86_64-5_slack15.0.txz:  Rebuilt.
  This release fixes 6 recently reported security vulnerabilities in
  various extensions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2022-December/003302.html
    https://www.cve.org/CVERecord?id=CVE-2022-46340
    https://www.cve.org/CVERecord?id=CVE-2022-46341
    https://www.cve.org/CVERecord?id=CVE-2022-46342
    https://www.cve.org/CVERecord?id=CVE-2022-46343
    https://www.cve.org/CVERecord?id=CVE-2022-46344
    https://www.cve.org/CVERecord?id=CVE-2022-4283
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-4_slack15.0.txz:  Rebuilt.
  This release fixes 6 recently reported security vulnerabilities in
  various extensions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2022-December/003302.html
    https://www.cve.org/CVERecord?id=CVE-2022-46340
    https://www.cve.org/CVERecord?id=CVE-2022-46341
    https://www.cve.org/CVERecord?id=CVE-2022-46342
    https://www.cve.org/CVERecord?id=CVE-2022-46343
    https://www.cve.org/CVERecord?id=CVE-2022-46344
    https://www.cve.org/CVERecord?id=CVE-2022-4283
  (* Security fix *)
2022-12-15 13:30:52 +01:00
Patrick J Volkerding
012399c1c5 Fri Dec 9 19:43:46 UTC 2022
patches/packages/libarchive-3.6.2-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix and security release.
  Relevant bugfixes:
    rar5 reader: fix possible garbled output with bsdtar -O (#1745)
    mtree reader: support reading mtree files with tabs (#1783)
  Security fixes:
    various small fixes for issues found by CodeQL
  (* Security fix *)
2022-12-10 13:30:31 +01:00
Patrick J Volkerding
d17567f359 Thu Dec 8 22:48:34 UTC 2022
patches/packages/emacs-27.2-x86_64-2_slack15.0.txz:  Rebuilt.
  GNU Emacs through 28.2 allows attackers to execute commands via shell
  metacharacters in the name of a source-code file, because lib-src/etags.c
  uses the system C library function in its implementation of the ctags
  program. For example, a victim may use the "ctags *" command (suggested in
  the ctags documentation) in a situation where the current working directory
  has contents that depend on untrusted input.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-45939
  (* Security fix *)
patches/packages/vim-9.0.1034-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes various security issues such as a heap-based buffer
  overflow and use after free.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-4141
    https://www.cve.org/CVERecord?id=CVE-2022-3591
    https://www.cve.org/CVERecord?id=CVE-2022-3520
    https://www.cve.org/CVERecord?id=CVE-2022-3491
    https://www.cve.org/CVERecord?id=CVE-2022-4292
    https://www.cve.org/CVERecord?id=CVE-2022-4293
  (* Security fix *)
patches/packages/vim-gvim-9.0.1034-x86_64-1_slack15.0.txz:  Upgraded.
2022-12-09 13:30:05 +01:00
Patrick J Volkerding
7add5d2865 Wed Dec 7 18:48:07 UTC 2022
patches/packages/python3-3.9.16-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680
  (heap use-after-free).
  gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio
  related name resolution functions no longer involves a quadratic algorithm
  to fix CVE-2022-45061. This prevents a potential CPU denial of service if an
  out-of-spec excessive length hostname involving bidirectional characters were
  decoded. Some protocols such as urllib http 3xx redirects potentially allow
  for an attacker to supply such a name.
  gh-100001: python -m http.server no longer allows terminal control characters
  sent within a garbage request to be printed to the stderr server log.
  gh-87604: Avoid publishing list of active per-interpreter audit hooks via the
  gc module.
  gh-97514: On Linux the multiprocessing module returns to using filesystem
  backed unix domain sockets for communication with the forkserver process
  instead of the Linux abstract socket namespace. Only code that chooses to use
  the "forkserver" start method is affected. This prevents Linux CVE-2022-42919
  (potential privilege escalation) as abstract sockets have no permissions and
  could allow any user on the system in the same network namespace (often the
  whole system) to inject code into the multiprocessing forkserver process.
  Filesystem based socket permissions restrict this to the forkserver process
  user as was the default in Python 3.8 and earlier.
  gh-98517: Port XKCP's fix for the buffer overflows in SHA-3 to fix
  CVE-2022-37454.
  gh-68966: The deprecated mailcap module now refuses to inject unsafe text
  (filenames, MIME types, parameters) into shell commands to address
  CVE-2015-20107. Instead of using such text, it will warn and act as if a
  match was not found (or for test commands, as if the test failed).
  For more information, see:
    https://pythoninsider.blogspot.com/2022/12/python-3111-3109-3916-3816-3716-and.html
    https://www.cve.org/CVERecord?id=CVE-2022-43680
    https://www.cve.org/CVERecord?id=CVE-2022-45061
    https://www.cve.org/CVERecord?id=CVE-2022-42919
    https://www.cve.org/CVERecord?id=CVE-2022-37454
    https://www.cve.org/CVERecord?id=CVE-2015-20107
  (* Security fix *)
2022-12-08 13:30:30 +01:00
Patrick J Volkerding
c3b931c533 Mon Dec 5 21:00:46 UTC 2022
patches/packages/ca-certificates-20221205-noarch-1_slack15.0.txz:  Upgraded.
  This update provides the latest CA certificates to check for the
  authenticity of SSL connections.
patches/packages/glibc-zoneinfo-2022g-noarch-1_slack15.0.txz:  Upgraded.
  This package provides the latest timezone updates.
2022-12-06 13:30:35 +01:00
Patrick J Volkerding
f2cf8c475b Fri Dec 2 20:58:24 UTC 2022
patches/packages/krusader-2.8.0-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
patches/packages/mozilla-thunderbird-102.5.1-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.5.1/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/
    https://www.cve.org/CVERecord?id=CVE-2022-45414
  (* Security fix *)
2022-12-03 13:30:20 +01:00
Patrick J Volkerding
cd369db342 Tue Nov 29 20:56:03 UTC 2022
patches/packages/kernel-firmware-20221123_cdf9499-noarch-1.txz:  Upgraded.
patches/packages/linux-5.15.80/*:  Upgraded.
  These updates fix various bugs and security issues.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 5.15.63:
    https://www.cve.org/CVERecord?id=CVE-2022-3629
    https://www.cve.org/CVERecord?id=CVE-2022-3635
    https://www.cve.org/CVERecord?id=CVE-2022-3633
    https://www.cve.org/CVERecord?id=CVE-2022-3625
    Fixed in 5.15.64:
    https://www.cve.org/CVERecord?id=CVE-2022-39190
    https://www.cve.org/CVERecord?id=CVE-2022-3028
    https://www.cve.org/CVERecord?id=CVE-2022-2905
    Fixed in 5.15.65:
    https://www.cve.org/CVERecord?id=CVE-2022-42703
    https://www.cve.org/CVERecord?id=CVE-2022-3176
    Fixed in 5.15.66:
    https://www.cve.org/CVERecord?id=CVE-2022-4095
    https://www.cve.org/CVERecord?id=CVE-2022-20421
    Fixed in 5.15.68:
    https://www.cve.org/CVERecord?id=CVE-2022-3303
    https://www.cve.org/CVERecord?id=CVE-2022-2663
    https://www.cve.org/CVERecord?id=CVE-2022-40307
    https://www.cve.org/CVERecord?id=CVE-2022-3586
    Fixed in 5.15.70:
    https://www.cve.org/CVERecord?id=CVE-2022-0171
    https://www.cve.org/CVERecord?id=CVE-2022-39842
    https://www.cve.org/CVERecord?id=CVE-2022-3061
    Fixed in 5.15.72:
    https://www.cve.org/CVERecord?id=CVE-2022-2308
    Fixed in 5.15.73:
    https://www.cve.org/CVERecord?id=CVE-2022-2978
    https://www.cve.org/CVERecord?id=CVE-2022-43750
    Fixed in 5.15.74:
    https://www.cve.org/CVERecord?id=CVE-2022-40768
    https://www.cve.org/CVERecord?id=CVE-2022-42721
    https://www.cve.org/CVERecord?id=CVE-2022-3621
    https://www.cve.org/CVERecord?id=CVE-2022-42722
    https://www.cve.org/CVERecord?id=CVE-2022-42719
    https://www.cve.org/CVERecord?id=CVE-2022-41674
    https://www.cve.org/CVERecord?id=CVE-2022-3649
    https://www.cve.org/CVERecord?id=CVE-2022-3646
    https://www.cve.org/CVERecord?id=CVE-2022-42720
    Fixed in 5.15.75:
    https://www.cve.org/CVERecord?id=CVE-2022-43945
    https://www.cve.org/CVERecord?id=CVE-2022-41849
    https://www.cve.org/CVERecord?id=CVE-2022-3535
    https://www.cve.org/CVERecord?id=CVE-2022-3594
    https://www.cve.org/CVERecord?id=CVE-2022-2602
    https://www.cve.org/CVERecord?id=CVE-2022-41850
    https://www.cve.org/CVERecord?id=CVE-2022-3565
    https://www.cve.org/CVERecord?id=CVE-2022-3542
    Fixed in 5.15.77:
    https://www.cve.org/CVERecord?id=CVE-2022-3524
    Fixed in 5.15.78:
    https://www.cve.org/CVERecord?id=CVE-2022-3628
    https://www.cve.org/CVERecord?id=CVE-2022-3623
    https://www.cve.org/CVERecord?id=CVE-2022-42896
    https://www.cve.org/CVERecord?id=CVE-2022-42895
    https://www.cve.org/CVERecord?id=CVE-2022-3543
    https://www.cve.org/CVERecord?id=CVE-2022-3564
    https://www.cve.org/CVERecord?id=CVE-2022-3619
    Fixed in 5.15.80:
    https://www.cve.org/CVERecord?id=CVE-2022-3521
    https://www.cve.org/CVERecord?id=CVE-2022-3169
  (* Security fix *)
patches/packages/openssl-1.1.1s-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
patches/packages/openssl-solibs-1.1.1s-x86_64-1_slack15.0.txz:  Upgraded.
2022-11-30 13:30:31 +01:00
Patrick J Volkerding
52b2b8f314 Thu Nov 24 20:55:37 UTC 2022
patches/packages/ruby-3.0.5-x86_64-1_slack15.0.txz:  Upgraded.
  This release includes a security fix:
  HTTP response splitting in CGI.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2021-33621
  (* Security fix *)
2022-11-25 13:30:58 +01:00
Patrick J Volkerding
860213618e Thu Nov 17 20:02:33 UTC 2022
patches/packages/freerdp-2.9.0-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed multiple client side input validation issues.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-39316
    https://www.cve.org/CVERecord?id=CVE-2022-39317
    https://www.cve.org/CVERecord?id=CVE-2022-39318
    https://www.cve.org/CVERecord?id=CVE-2022-39319
    https://www.cve.org/CVERecord?id=CVE-2022-39320
    https://www.cve.org/CVERecord?id=CVE-2022-41877
    https://www.cve.org/CVERecord?id=CVE-2022-39347
  (* Security fix *)
2022-11-18 13:30:33 +01:00
Patrick J Volkerding
45ec128def Thu Nov 17 01:49:28 UTC 2022
patches/packages/krb5-1.19.2-x86_64-3_slack15.0.txz:  Rebuilt.
  Fixed integer overflows in PAC parsing.
  Fixed memory leak in OTP kdcpreauth module.
  Fixed PKCS11 module path search.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-42898
  (* Security fix *)
patches/packages/mozilla-firefox-102.5.0esr-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.5.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2022-48/
    https://www.cve.org/CVERecord?id=CVE-2022-45403
    https://www.cve.org/CVERecord?id=CVE-2022-45404
    https://www.cve.org/CVERecord?id=CVE-2022-45405
    https://www.cve.org/CVERecord?id=CVE-2022-45406
    https://www.cve.org/CVERecord?id=CVE-2022-45408
    https://www.cve.org/CVERecord?id=CVE-2022-45409
    https://www.cve.org/CVERecord?id=CVE-2022-45410
    https://www.cve.org/CVERecord?id=CVE-2022-45411
    https://www.cve.org/CVERecord?id=CVE-2022-45412
    https://www.cve.org/CVERecord?id=CVE-2022-45416
    https://www.cve.org/CVERecord?id=CVE-2022-45418
    https://www.cve.org/CVERecord?id=CVE-2022-45420
    https://www.cve.org/CVERecord?id=CVE-2022-45421
  (* Security fix *)
patches/packages/mozilla-thunderbird-102.5.0-x86_64-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.5.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/
    https://www.cve.org/CVERecord?id=CVE-2022-45403
    https://www.cve.org/CVERecord?id=CVE-2022-45404
    https://www.cve.org/CVERecord?id=CVE-2022-45405
    https://www.cve.org/CVERecord?id=CVE-2022-45406
    https://www.cve.org/CVERecord?id=CVE-2022-45408
    https://www.cve.org/CVERecord?id=CVE-2022-45409
    https://www.cve.org/CVERecord?id=CVE-2022-45410
    https://www.cve.org/CVERecord?id=CVE-2022-45411
    https://www.cve.org/CVERecord?id=CVE-2022-45412
    https://www.cve.org/CVERecord?id=CVE-2022-45416
    https://www.cve.org/CVERecord?id=CVE-2022-45418
    https://www.cve.org/CVERecord?id=CVE-2022-45420
    https://www.cve.org/CVERecord?id=CVE-2022-45421
  (* Security fix *)
patches/packages/samba-4.15.12-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed a security issue where Samba's Kerberos libraries and AD DC failed
  to guard against integer overflows when parsing a PAC on a 32-bit system,
  which allowed an attacker with a forged PAC to corrupt the heap.
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-42898.html
    https://www.cve.org/CVERecord?id=CVE-2022-42898
  (* Security fix *)
patches/packages/xfce4-settings-4.16.5-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes regressions in the previous security fix:
  mime-settings: Properly quote command parameters.
  Revert "Escape characters which do not belong into an URI/URL (Issue #390)."
2022-11-17 13:30:31 +01:00
Patrick J Volkerding
68513bbb1b Thu Nov 10 19:47:59 UTC 2022
patches/packages/php-7.4.33-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
2022-11-11 13:30:28 +01:00
Patrick J Volkerding
ff521ad792 Wed Nov 9 22:16:30 UTC 2022
patches/packages/sysstat-12.7.1-x86_64-1_slack15.0.txz:  Upgraded.
  On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1,
  allocate_structures contains a size_t overflow in sa_common.c. The
  allocate_structures function insufficiently checks bounds before arithmetic
  multiplication, allowing for an overflow in the size allocated for the
  buffer representing system activities.
  This issue may lead to Remote Code Execution (RCE).
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-39377
  (* Security fix *)
patches/packages/xfce4-settings-4.16.4-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed an argument injection vulnerability in xfce4-mime-helper.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-45062
  (* Security fix *)
2022-11-10 13:30:32 +01:00
Patrick J Volkerding
9cbb8ffdbc Tue Nov 8 22:21:43 UTC 2022
patches/packages/glibc-zoneinfo-2022f-noarch-1_slack15.0.txz:  Upgraded.
  This package provides the latest timezone updates.
patches/packages/mariadb-10.5.18-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://mariadb.com/kb/en/mariadb-10-5-18-release-notes
2022-11-09 13:30:19 +01:00
Patrick J Volkerding
2d3e95aa33 Sat Nov 5 19:18:19 UTC 2022
patches/packages/sudo-1.9.12p1-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed a potential out-of-bounds write for passwords smaller than 8
  characters when passwd authentication is enabled.
  This does not affect configurations that use other authentication
  methods such as PAM, AIX authentication or BSD authentication.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-43995
  (* Security fix *)
2022-11-06 13:30:38 +01:00
Patrick J Volkerding
44df9c66d8 Fri Nov 4 19:29:28 UTC 2022
patches/packages/mozilla-thunderbird-102.4.2-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.4.2/releasenotes/
2022-11-05 13:30:36 +01:00
Patrick J Volkerding
bcdf30a8fe Mon Oct 31 23:31:36 UTC 2022
extra/php80/php80-8.0.25-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
extra/php81/php81-8.1.12-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
patches/packages/mozilla-thunderbird-102.4.1-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.4.1/releasenotes/
patches/packages/vim-9.0.0814-x86_64-1_slack15.0.txz:  Upgraded.
  A vulnerability was found in vim and classified as problematic. Affected by
  this issue is the function qf_update_buffer of the file quickfix.c of the
  component autocmd Handler. The manipulation leads to use after free. The
  attack may be launched remotely. Upgrading to version 9.0.0805 is able to
  address this issue.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-3705
  (* Security fix *)
patches/packages/vim-gvim-9.0.0814-x86_64-1_slack15.0.txz:  Upgraded.
2022-11-01 13:30:36 +01:00
Patrick J Volkerding
af0a59722c Thu Oct 27 02:30:15 UTC 2022
patches/packages/curl-7.86.0-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  HSTS bypass via IDN.
  HTTP proxy double-free.
  .netrc parser out-of-bounds access.
  POST following PUT confusion.
  For more information, see:
    https://curl.se/docs/CVE-2022-42916.html
    https://curl.se/docs/CVE-2022-42915.html
    https://curl.se/docs/CVE-2022-35260.html
    https://curl.se/docs/CVE-2022-32221.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42916
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35260
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221
  (* Security fix *)
2022-10-28 13:30:09 +02:00
Patrick J Volkerding
6e7a178c9a Tue Oct 25 18:38:58 UTC 2022
patches/packages/expat-2.5.0-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Fix heap use-after-free after overeager destruction of a shared DTD in
  function XML_ExternalEntityParserCreate in out-of-memory situations.
  Expected impact is denial of service or potentially arbitrary code
  execution.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680
  (* Security fix *)
patches/packages/samba-4.15.11-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes the following security issue:
  There is a limited write heap buffer overflow in the GSSAPI unwrap_des()
  and unwrap_des3() routines of Heimdal (included in Samba).
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-3437.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3437
  (* Security fix *)
2022-10-26 13:30:34 +02:00
Patrick J Volkerding
f9f39a199c Fri Oct 21 18:19:00 UTC 2022
patches/packages/rsync-3.2.7-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  Notably, this addresses some regressions caused by the file-list validation
  fix in rsync-3.2.5.
  Thanks to llgar.
2022-10-22 13:30:46 +02:00
Patrick J Volkerding
1f4633ae9c Thu Oct 20 18:39:03 UTC 2022
patches/packages/mozilla-thunderbird-102.4.0-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.4.0/releasenotes/
patches/packages/whois-5.5.14-x86_64-1_slack15.0.txz:  Upgraded.
  This update adds the .bf and .sd TLD servers, removes the .gu TLD server,
  updates the .dm, .fj, .mt and .pk TLD servers, updates the charset for
  whois.nic.tr, updates the list of new gTLDs, removes whois.nic.fr from the
  list of RIPE-like servers (because it is not one anymore), renames
  whois.arnes.si to whois.register.si in the list of RIPE-like servers, and
  adds the hiding string for whois.auda.org.au.
2022-10-21 13:30:04 +02:00
Patrick J Volkerding
58fac6b4a4 Wed Oct 19 20:06:33 UTC 2022
patches/packages/samba-4.15.10-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.samba.org/samba/history/samba-4.15.10.html
2022-10-20 13:30:54 +02:00
Patrick J Volkerding
f6bba8a1d2 Tue Oct 18 20:29:54 UTC 2022
patches/packages/git-2.35.5-x86_64-1_slack15.0.txz:  Upgraded.
  This release fixes two security issues:
  * CVE-2022-39253:
  When relying on the `--local` clone optimization, Git dereferences
  symbolic links in the source repository before creating hardlinks
  (or copies) of the dereferenced link in the destination repository.
  This can lead to surprising behavior where arbitrary files are
  present in a repository's `$GIT_DIR` when cloning from a malicious
  repository.
  Git will no longer dereference symbolic links via the `--local`
  clone mechanism, and will instead refuse to clone repositories that
  have symbolic links present in the `$GIT_DIR/objects` directory.
  Additionally, the value of `protocol.file.allow` is changed to be
  "user" by default.
  * CVE-2022-39260:
  An overly-long command string given to `git shell` can result in
  overflow in `split_cmdline()`, leading to arbitrary heap writes and
  remote code execution when `git shell` is exposed and the directory
  `$HOME/git-shell-commands` exists.
  `git shell` is taught to refuse interactive commands that are
  longer than 4MiB in size. `split_cmdline()` is hardened to reject
  inputs larger than 2GiB.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
  (* Security fix *)
patches/packages/mozilla-firefox-102.4.0esr-x86_64-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.4.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2022-45/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932
  (* Security fix *)
2022-10-19 13:30:12 +02:00
Patrick J Volkerding
2559feca78 Mon Oct 17 19:31:45 UTC 2022
patches/packages/xorg-server-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  xquartz: Fix a possible crash when editing the Application menu due
  to mutating immutable arrays.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3553
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-3_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
  (* Security fix *)
2022-10-18 13:30:33 +02:00
Patrick J Volkerding
a37e7d6f03 Mon Oct 17 00:42:43 UTC 2022
patches/packages/glibc-zoneinfo-2022e-noarch-1_slack15.0.txz:  Upgraded.
  This package provides the latest timezone updates.
2022-10-17 13:30:32 +02:00
Patrick J Volkerding
da8b549669 Sat Oct 15 20:28:34 UTC 2022
patches/packages/zlib-1.2.13-x86_64-1_slack15.0.txz:  Upgraded.
  Fixed a bug when getting a gzip header extra field with inflateGetHeader().
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434
  (* Security fix *)
2022-10-16 13:30:55 +02:00
Patrick J Volkerding
00cb38d107 Fri Oct 14 01:39:37 UTC 2022
patches/packages/mozilla-thunderbird-102.3.3-x86_64-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.3.3/releasenotes/
patches/packages/python3-3.9.15-x86_64-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Bundled libexpat was upgraded from 2.4.7 to 2.4.9 which fixes a heap
  use-after-free vulnerability in function doContent.
  gh-97616: a fix for a possible buffer overflow in list *= int.
  gh-97612: a fix for possible shell injection in the example script
  get-remote-certificate.py.
  gh-96577: a fix for a potential buffer overrun in msilib.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674
  (* Security fix *)
2022-10-14 13:30:41 +02:00
Patrick J Volkerding
46235d1ce0 Sat Oct 8 19:23:31 UTC 2022
patches/packages/libksba-1.6.2-x86_64-1_slack15.0.txz:  Upgraded.
  Detect a possible overflow directly in the TLV parser.
  This patch detects possible integer overflows immmediately when creating
  the TI object.
  Reported-by: ZDI-CAN-18927, ZDI-CAN-18928, ZDI-CAN-18929
  (* Security fix *)
2022-10-09 13:31:06 +02:00