ap/tmux-2.9a-x86_64-1.txz: Upgraded.
n/dovecot-2.3.6-x86_64-1.txz: Upgraded.
This update fixes two security issues:
Submission-login crashed with signal 11 due to null pointer access when
authentication was aborted by disconnecting.
Submission-login crashed when authentication was started over TLS secured
channel and invalid authentication message was sent.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11494https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11499
(* Security fix *)
n/php-7.2.18-x86_64-1.txz: Upgraded.
This update fixes bugs and a security issue
Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11036
(* Security fix *)
xfce/exo-0.12.5-x86_64-1.txz: Upgraded.
ap/vim-8.1.1239-x86_64-1.txz: Upgraded.
l/python-urllib3-1.25.2-x86_64-1.txz: Upgraded.
xap/easytag-2.4.3-x86_64-2.txz: Rebuilt.
Upgraded (again) to easytag-2.4.3.
Reverted the upstream commit that was corrupting ogg and opus files.
In a new configuration, don't add freedb.musicbrainz.org as an automatic
CDDB server. Musicbrainz shut down this service permanently on March 18
and easytag breaks/hangs if it attempts to contact it. If your account
has already run easytag previously, you should go to Edit -> Preferences ->
CDDB and blank out the hostname field containing "freedb.musicbrainz.org".
xap/vim-gvim-8.1.1239-x86_64-1.txz: Upgraded.
ap/nano-4.1-x86_64-1.txz: Upgraded.
l/giflib-5.1.9-x86_64-2.txz: Rebuilt.
Restore GifQuantizeBuffer and other deprecated functions to the shared
library. Thanks to Skaendo.
l/glib2-2.60.1-x86_64-1.txz: Upgraded.
l/orc-0.4.29-x86_64-1.txz: Upgraded.
a/glibc-zoneinfo-2019a-noarch-1.txz: Upgraded.
a/grub-2.02-x86_64-5.txz: Rebuilt.
Support F2FS filesystem. Thanks to Nille_kungen.
ap/cups-filters-1.22.5-x86_64-1.txz: Upgraded.
ap/itstool-2.0.6-x86_64-1.txz: Upgraded.
d/python-setuptools-41.0.0-x86_64-1.txz: Upgraded.
l/gobject-introspection-1.60.1-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_39-x86_64-1.txz: Upgraded.
l/libcroco-0.6.13-x86_64-1.txz: Upgraded.
l/libnotify-0.7.8-x86_64-1.txz: Upgraded.
n/cifs-utils-6.9-x86_64-1.txz: Upgraded.
n/nfs-utils-2.3.3-x86_64-2.txz: Rebuilt.
Include recovery directory. Thanks to upnort.
n/samba-4.10.2-x86_64-1.txz: Upgraded.
This is a security release in order to address the following defects:
World writable files in Samba AD DC private/ dir.
Save registry file outside share as unprivileged user.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3870https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3880
(* Security fix *)
x/libva-2.4.1-x86_64-1.txz: Upgraded.
x/pixman-0.38.2-x86_64-1.txz: Upgraded.
xap/gimp-2.10.10-x86_64-1.txz: Upgraded.
ap/ghostscript-9.27-x86_64-1.txz: Upgraded.
d/python-setuptools-40.9.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_37-x86_64-1.txz: Upgraded.
l/readline-8.0.000-x86_64-2.txz: Rebuilt.
Recompiled to link rlfe against the new libreadline. Thanks to Toutatis.
a/hwdata-0.322-noarch-1.txz: Upgraded.
a/kernel-firmware-20190402_67b7579-noarch-1.txz: Upgraded.
a/shadow-4.6-x86_64-2.txz: Rebuilt.
adduser: reprompt on invalid user input. Thanks to ttk.
ap/ghostscript-9.26-x86_64-2.txz: Rebuilt.
Fixes security issues:
A specially crafted PostScript file could have access to the file system
outside of the constrains imposed by -dSAFER.
Transient procedures can allow access to system operators, leading to
remote code execution.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6116
(* Security fix *)
d/vala-0.44.2-x86_64-1.txz: Upgraded.
l/glib-networking-2.60.1-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_36-x86_64-1.txz: Upgraded.
l/python-pillow-6.0.0-x86_64-1.txz: Upgraded.
n/wget-1.20.2-x86_64-1.txz: Upgraded.
Fixed an unspecified buffer overflow vulnerability.
(* Security fix *)
a/kernel-generic-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.32-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.32-x86_64-1.txz: Upgraded.
ap/hplip-3.19.3-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.32-x86-1.txz: Upgraded.
d/python3-3.7.3-x86_64-1.txz: Upgraded.
Fixed bugs and the following security issues:
bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
characters that decompose under IDNA encoding (NFKC-normalization) into
characters that affect how the URL is parsed.
bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.
bpo-35121: Don't send cookies of domain A without Domain attribute to
domain B when domain A is a suffix match of domain B while using a
cookiejar with http.cookiejar.DefaultCookiePolicy policy.
Patch by Karthikeyan Singaravelan.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(* Security fix *)
d/scons-3.0.5-x86_64-1.txz: Upgraded.
k/kernel-source-4.19.32-noarch-1.txz: Upgraded.
n/curl-7.64.1-x86_64-1.txz: Upgraded.
n/gnutls-3.6.7-x86_64-1.txz: Upgraded.
Fixes security issues:
libgnutls, gnutls tools: Every gnutls_free() will automatically set
the free'd pointer to NULL. This prevents possible use-after-free and
double free issues. Use-after-free will be turned into NULL dereference.
The counter-measure does not extend to applications using gnutls_free().
libgnutls: Fixed a memory corruption (double free) vulnerability in the
certificate verification API. Reported by Tavis Ormandy; addressed with
the change above. [GNUTLS-SA-2019-03-27, #694]
libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async
messages; Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704]
libgnutls: enforce key usage limitations on certificates more actively.
Previously we would enforce it for TLS1.2 protocol, now we enforce it
even when TLS1.3 is negotiated, or on client certificates as well. When
an inappropriate for TLS1.3 certificate is seen on the credentials
structure GnuTLS will disable TLS1.3 support for that session (#690).
libgnutls: enforce the equality of the two signature parameters fields
in a certificate. We were already enforcing the signature algorithm,
but there was a bug in parameter checking code.
(* Security fix *)
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
Saint Patrick was a gentleman
Who through strategy and stealth
Drove all the snakes from Ireland
Here's toasting to his health -
But not too many toastings
Lest you lose yourself, and then,
Forget the good Saint Patrick
And see all those snakes again.
a/eudev-3.2.7-x86_64-3.txz: Rebuilt.
Added tqmx86_wdt to watchdog.conf. Thanks to Robby Workman.
d/vala-0.44.1-x86_64-1.txz: Upgraded.
kde/ktorrent-4.3.1-x86_64-4.txz: Rebuilt.
Embed a copy of the GeoIP database since the download link no longer works.
l/glibmm-2.58.1-x86_64-1.txz: Upgraded.
l/mozilla-nss-3.43-x86_64-1.txz: Upgraded.
x/imake-1.0.8-x86_64-1.txz: Upgraded.
x/libXdmcp-1.1.3-x86_64-1.txz: Upgraded.
x/libXext-1.3.4-x86_64-1.txz: Upgraded.
x/libXft-2.3.3-x86_64-1.txz: Upgraded.
x/libXmu-1.1.3-x86_64-1.txz: Upgraded.
x/libXrandr-1.5.2-x86_64-1.txz: Upgraded.
x/libXvMC-1.0.11-x86_64-1.txz: Upgraded.
x/libXxf86dga-1.1.5-x86_64-1.txz: Upgraded.
x/libxkbfile-1.1.0-x86_64-1.txz: Upgraded.
x/makedepend-1.0.6-x86_64-1.txz: Upgraded.
x/x11perf-1.6.1-x86_64-1.txz: Upgraded.
x/xf86-video-intel-20190301_6afed33b-x86_64-1.txz: Upgraded.
x/xf86-video-savage-20190128_8579718-x86_64-1.txz: Upgraded.
x/xf86-video-sis-20181217_22d3c79-x86_64-1.txz: Upgraded.
x/xtrans-1.4.0-noarch-1.txz: Upgraded.
ap/cgmanager-0.42-x86_64-1.txz: Upgraded.
d/cmake-3.14.0-x86_64-1.txz: Upgraded.
l/gexiv2-0.12.0-x86_64-1.txz: Upgraded.
l/gsettings-desktop-schemas-3.32.0-x86_64-2.txz: Rebuilt.
Don't override the system font defaults (especially with fonts that we don't
include). Thanks to Markus Wiesner.
l/libyaml-0.2.2-x86_64-1.txz: Upgraded.
l/libzip-1.5.2-x86_64-1.txz: Upgraded.
a/hwdata-0.321-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.27-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.27-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.27-x86-1.txz: Upgraded.
k/kernel-source-4.19.27-noarch-1.txz: Upgraded.
l/M2Crypto-0.32.0-x86_64-1.txz: Upgraded.
l/imagemagick-6.9.10_32-x86_64-1.txz: Upgraded.
n/dovecot-2.3.5-x86_64-1.txz: Upgraded.
x/xdm-1.1.11-x86_64-9.txz: Rebuilt.
Reverted to xdm-1.1.11, as the new release after 7 years has some issues.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
a/mkinitrd-1.4.11-x86_64-12.txz: Rebuilt.
Updated to busybox-1.30.1.
mkinitrd: allow a colon-delimited list of kernel versions with -k
mkinitrd_command_generator.sh: allow a colon-delimited list of kernel
versions with -k
setup.01.mkinitrd: simplify script by using -k with a version list
ap/pamixer-1.4-x86_64-1.txz: Upgraded.
d/python-2.7.16-x86_64-1.txz: Upgraded.
Updated to the latest 2.7.x release, which fixes a few security issues.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(* Security fix *)
d/vala-0.42.6-x86_64-1.txz: Upgraded.
l/gegl-0.4.14-x86_64-1.txz: Upgraded.
l/libsecret-0.18.8-x86_64-1.txz: Upgraded.
l/xapian-core-1.4.11-x86_64-1.txz: Upgraded.
x/mkfontscale-1.2.0-x86_64-1.txz: Upgraded.
x/xditview-1.0.5-x86_64-1.txz: Upgraded.
x/xdm-1.1.12-x86_64-1.txz: Upgraded.
a/btrfs-progs-4.20.2-x86_64-1.txz: Upgraded.
a/openssl-solibs-1.1.1b-x86_64-1.txz: Upgraded.
ap/ddrescue-1.24-x86_64-1.txz: Upgraded.
ap/sqlite-3.27.2-x86_64-1.txz: Upgraded.
l/libssh-0.8.7-x86_64-1.txz: Upgraded.
l/talloc-2.1.16-x86_64-1.txz: Upgraded.
l/tdb-1.3.18-x86_64-1.txz: Upgraded.
l/tevent-0.9.39-x86_64-1.txz: Upgraded.
n/ca-certificates-20181210-noarch-2.txz: Rebuilt.
Use "c_rehash" rather than "openssl rehash" for compatibility with all
versions of OpenSSL.
n/epic5-2.1.1-x86_64-1.txz: Upgraded.
n/openssl-1.1.1b-x86_64-1.txz: Upgraded.
x/xorg-server-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xephyr-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xnest-1.20.4-x86_64-1.txz: Upgraded.
x/xorg-server-xvfb-1.20.4-x86_64-1.txz: Upgraded.
xap/mozilla-thunderbird-60.5.2-x86_64-1.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/60.5.2/releasenotes/
a/glibc-solibs-2.29-x86_64-3.txz: Rebuilt.
ap/texinfo-6.6-x86_64-1.txz: Upgraded.
l/elfutils-0.176-x86_64-1.txz: Upgraded.
l/glibc-2.29-x86_64-3.txz: Rebuilt.
l/glibc-i18n-2.29-x86_64-3.txz: Rebuilt.
Go back to using the glibc.locale.no-archive.diff patch rather than the new
built-in no-archive locale target. Avoiding hardlinks is not worth 700MB of
useless bloat. Thanks to baldzhang.
l/glibc-profile-2.29-x86_64-3.txz: Rebuilt.
l/librsvg-2.44.13-x86_64-1.txz: Upgraded.
x/xf86-video-chips-1.4.0-x86_64-1.txz: Upgraded.
x/xf86-video-tdfx-1.5.0-x86_64-1.txz: Upgraded.
a/hwdata-0.320-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.20-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.20-x86_64-1.txz: Upgraded.
a/mcelog-162-x86_64-1.txz: Upgraded.
d/kernel-headers-4.19.20-x86-1.txz: Upgraded.
d/opencl-headers-2.2-noarch-2.txz: Rebuilt.
Don't trigger "#pragma message" in cl_version.h when falling back on a
default version of OpenCL to target. Applications such as ffmpeg detect
this as an error and fail to compile.
k/kernel-source-4.19.20-noarch-1.txz: Upgraded.
l/ffmpeg-3.4.5-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
Reenabled libsmbclient support.
l/gst-plugins-good-1.14.4-x86_64-2.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
l/libvpx-1.8.0-x86_64-1.txz: Upgraded.
Shared library .so-version bump.
n/curl-7.64.0-x86_64-1.txz: Upgraded.
This release fixes the following security issues:
NTLM type-2 out-of-bounds buffer read.
NTLMv2 type-3 header stack buffer overflow.
SMTP end-of-response out-of-bounds read.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3822https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3823
(* Security fix *)
n/samba-4.9.4-x86_64-2.txz: Rebuilt.
Added time.h to libsmbclient.h to fix ffmpeg compatibility.
Thanks to USUARIONUEVO.
xap/xine-lib-1.2.9-x86_64-4.txz: Rebuilt.
Recompiled against libvpx-1.8.0.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
d/bison-3.3.2-x86_64-1.txz: Upgraded.
n/dovecot-2.3.4-x86_64-2.txz: Rebuilt.
Patched double free when used with MariaDB 10.3.x. Thanks to Thom1b.
x/xkeyboard-config-2.26-noarch-1.txz: Upgraded.
extra/bittorrent/bittorrent-4.4.0-noarch-4.txz: Removed.
a/glibc-solibs-2.29-x86_64-2.txz: Rebuilt.
d/opencl-headers-2.2-noarch-1.txz: Upgraded.
Thanks to Heinz Wiesinger.
l/glibc-2.29-x86_64-2.txz: Rebuilt.
l/glibc-i18n-2.29-x86_64-2.txz: Rebuilt.
Reverted en_US.UTF8 date(1) format back to 24 hour. I'm pretty sure that
the majority of people here in this locale will agree.
l/glibc-profile-2.29-x86_64-2.txz: Rebuilt.
a/mkinitrd-1.4.11-x86_64-11.txz: Rebuilt.
setup.01.mkinitrd: revert to the previous command line for
mkinitrd_command_generator.sh (the new one fails when called from the
installer).
a/hwdata-0.319-noarch-1.txz: Upgraded.
d/doxygen-1.8.14-x86_64-3.txz: Upgraded.
Reverted (for now) to avoid segfault in doxygen-1.8.15.
l/libwpg-0.3.3-x86_64-1.txz: Upgraded.
l/libxml2-2.9.9-x86_64-1.txz: Upgraded.
l/libxslt-1.1.33-x86_64-1.txz: Upgraded.
l/python-pillow-5.4.0-x86_64-1.txz: Upgraded.
x/xterm-342-x86_64-1.txz: Upgraded.
testing/packages/wpa_supplicant-2.7-x86_64-3.txz: Rebuilt.
Apply TLSv1 patch from Debian and make some config changes to fix
WPA2-Enterprise. Once we have some testing results on this we'll consider
moving it back into the main tree. Thanks to gablek.
a/coreutils-8.30-x86_64-4.txz: Rebuilt.
Added xterm-new to DIR_COLORS.
a/ed-1.15-x86_64-1.txz: Upgraded.
a/smartmontools-7.0-x86_64-1.txz: Upgraded.
a/sysvinit-2.93-x86_64-1.txz: Upgraded.
ap/diffutils-3.7-x86_64-1.txz: Upgraded.
ap/mc-4.8.22-x86_64-1.txz: Upgraded.
l/gexiv2-0.10.10-x86_64-1.txz: Upgraded.
l/libgphoto2-2.5.22-x86_64-1.txz: Upgraded.
l/libwpd-0.10.3-x86_64-1.txz: Upgraded.
x/xterm-341-x86_64-3.txz: Rebuilt.
Append new app-defaults for XTerm rather than replacing the upstream file.
Use 'xterm' rather than 'xterm-new' for termName to avoid surprises, but
leave the other choice commented out.
Install XTerm as XTerm.new to avoid wiping out a locally modified file.
Still not sure we'll be able to stick with this as a default due to Terminus
possibly not being available on a remote X server. Sure looks nice though.
Thanks to GazL.
