patches/packages/netatalk-3.1.17-x86_64-1_slack15.0.txz: Upgraded.
This update fixes bugs and a security issue:
Validate data type in dalloc_value_for_key(). This flaw could allow a
malicious actor to cause Netatalk's afpd daemon to crash, or possibly to
execute arbitrary code.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-42464
(* Security fix *)
patches/packages/python3-3.9.18-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass
of the TLS handshake and included protections (like certificate verification)
and treating sent unencrypted data as if it were post-handshake TLS encrypted
data. Security issue reported by Aapo Oksman; patch by Gregory P. Smith.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-40217
(* Security fix *)
extra/php80/php80-8.0.30-x86_64-1_slack15.0.txz: Upgraded.
This update fixes bugs and security issues:
Security issue with external entity loading in XML without enabling it.
Missing error check and insufficient random bytes in HTTP Digest
authentication for SOAP.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3823https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3247
(* Security fix *)
patches/packages/vim-9.0.1678-x86_64-1_slack15.0.txz: Upgraded.
Applied the last patches from Bram Moolenaar.
RIP Bram, and thanks for your great work on VIM and your kindness to the
orphan children in Uganda.
If you'd like to honor Bram with a donation to his charity, please visit:
https://iccf-holland.org/
patches/packages/vim-gvim-9.0.1678-x86_64-1_slack15.0.txz: Upgraded.
patches/packages/curl-8.2.1-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
testing/packages/mozilla-firefox-115.0.3esr-x86_64-1_slack15.0.txz: Added.
This seems good to go, but a little testing won't hurt.
testing/packages/mozilla-thunderbird-115.0.1-x86_64-1_slack15.0.txz: Added.
Here, like in -current, we're going to wait until upstream deems this ready
to trigger the automatic update from earlier versions.
testing/packages/rust-1.70.0-x86_64-1_slack15.0.txz: Added.
This will replace the package in /extra/rust-for-mozilla/ when the 115.x
versions of Firefox and Thunderbird become the main ones in Slackware 15.0.
patches/packages/kernel-firmware-20230724_59fbffa-noarch-1.txz: Upgraded.
AMD microcode updated to fix a use-after-free in AMD Zen2 processors.
From Tavis Ormandy's annoucement of the issue:
"The practical result here is that you can spy on the registers of other
processes. No system calls or privileges are required.
It works across virtual machines and affects all operating systems.
I have written a poc for this issue that's fast enough to reconstruct
keys and passwords as users log in."
For more information, see:
https://seclists.org/oss-sec/2023/q3/59https://www.cve.org/CVERecord?id=CVE-2023-20593
(* Security fix *)
patches/packages/whois-5.5.18-x86_64-1_slack15.0.txz: Upgraded.
Updated the .ga TLD server.
Added new recovered IPv4 allocations.
Removed the delegation of 43.0.0.0/8 to JPNIC.
Removed 12 new gTLDs which are no longer active.
Improved the man page source, courtesy of Bjarni Ingi Gislason.
Added the .edu.za SLD server.
Updated the .alt.za SLD server.
Added the -ru and -su NIC handles servers.
patches/packages/ca-certificates-20230721-noarch-1_slack15.0.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
patches/packages/curl-8.2.0-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
fopen race condition.
For more information, see:
https://curl.se/docs/CVE-2023-32001.htmlhttps://www.cve.org/CVERecord?id=CVE-2023-32001
(* Security fix *)
patches/packages/openssh-9.3p2-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
ssh-agent(1) in OpenSSH between and 5.5 and 9.3p1 (inclusive): remote code
execution relating to PKCS#11 providers.
The PKCS#11 support ssh-agent(1) could be abused to achieve remote code
execution via a forwarded agent socket if the following conditions are met:
* Exploitation requires the presence of specific libraries on the victim
system.
* Remote exploitation requires that the agent was forwarded to an
attacker-controlled system.
Exploitation can also be prevented by starting ssh-agent(1) with an empty
PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring an allowlist that
contains only specific provider libraries.
This vulnerability was discovered and demonstrated to be exploitable by the
Qualys Security Advisory team.
Potentially-incompatible changes:
* ssh-agent(8): the agent will now refuse requests to load PKCS#11 modules
issued by remote clients by default. A flag has been added to restore the
previous behaviour: "-Oallow-remote-pkcs11".
For more information, see:
https://www.openssh.com/txt/release-9.3p2https://www.cve.org/CVERecord?id=CVE-2023-38408
(* Security fix *)
patches/packages/krb5-1.19.2-x86_64-4_slack15.0.txz: Rebuilt.
Fix potential uninitialized pointer free in kadm5 XDR parsing.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-36054
(* Security fix *)
patches/packages/sudo-1.9.14p1-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/network-scripts-15.0-noarch-19_slack15.0.txz: Rebuilt.
This update fixes a bug and adds a new feature:
Re-add support for the DHCP_IPADDR parameter from rc.inet1.conf.
Expand the help text for DHCP_IPADDR in rc.inet1.conf.
Add support for a DHCP_OPTS parameter.
Thanks to ljb643 and Darren 'Tadgy' Austin.
patches/packages/vim-9.0.1667-x86_64-1_slack15.0.txz: Upgraded.
This fixes a rare divide-by-zero bug that could cause vim to crash. In an
interactive program such as vim, I can't really see this qualifying as a
security issue, but since it was brought up as such on LQ we'll just go
along with it this time. :)
Thanks to marav for the heads-up.
(* Security fix *)
patches/packages/vim-gvim-9.0.1667-x86_64-1_slack15.0.txz: Upgraded.
patches/packages/linux-5.15.117/*: Upgraded.
We're going to back up one version to avoid an amdgpu regression in 5.15.118.
If you're already using 5.15.118 without issues, feel free to stick with it.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
patches/packages/cups-2.4.6-x86_64-1_slack15.0.txz: Upgraded.
Fixed use-after-free when logging warnings in case of failures
in cupsdAcceptClient().
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-34241
(* Security fix *)
patches/packages/libX11-1.8.6-x86_64-1_slack15.0.txz: Upgraded.
This update fixes buffer overflows in InitExt.c that could at least cause
the client to crash due to memory corruption.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-3138
(* Security fix *)
patches/packages/cups-2.4.5-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/ksh93-1.0.6-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
extra/php81/php81-8.1.20-x86_64-1_slack15.0.txz: Upgraded.
This update fixes bugs and security issues.
For more information, see:
https://www.php.net/ChangeLog-8.php#8.1.20
(* Security fix *)
patches/packages/mozilla-thunderbird-102.12.0-x86_64-1_slack15.0.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/102.12.0/releasenotes/
(* Security fix *)
patches/packages/python3-3.9.17-x86_64-1_slack15.0.txz: Upgraded.
This update fixes bugs and a security issue:
urllib.parse.urlsplit() now strips leading C0 control and space characters
following the specification for URLs defined by WHATWG.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-24329
(* Security fix *)
patches/packages/cups-2.4.4-x86_64-1_slack15.0.txz: Upgraded.
This update is a hotfix for a segfault in cupsGetNamedDest(), when caller
tries to find the default destination and the default destination is not set
on the machine.
patches/packages/ksh93-1.0.5_20230607_9b251344-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix and robustness enhancement release.
Thanks to McDutchie for the great work!
Thanks to pghvlaans for improvements to the build script.
extra/sendmail/sendmail-8.17.2-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
extra/sendmail/sendmail-cf-8.17.2-noarch-1_slack15.0.txz: Upgraded.
patches/packages/libmilter-8.17.2-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/curl-8.1.2-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/openssl-1.1.1u-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
Possible DoS translating ASN.1 object identifiers.
For more information, see:
https://www.openssl.org/news/secadv/20230530.txthttps://www.cve.org/CVERecord?id=CVE-2023-2650
(* Security fix *)
patches/packages/openssl-solibs-1.1.1u-x86_64-1_slack15.0.txz: Upgraded.
patches/packages/curl-8.1.1-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/texlive-2023.230322-x86_64-1_slack15.0.txz: Upgraded.
This update patches a security issue:
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when
compiling a TeX file obtained from an untrusted source. This occurs
because luatex-core.lua lets the original io.popen be accessed. This also
affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
Thanks to Johannes Schoepfer.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-32700
(* Security fix *)
patches/packages/cups-filters-1.28.17-x86_64-1_slack15.0.txz: Upgraded.
[PATCH] Merge pull request from GHSA-gpxc-v2m8-fr3x.
With execv() command line arguments are passed as separate strings and
not the full command line in a single string. This prevents arbitrary
command execution by escaping the quoting of the arguments in a job
with forged job title.
Thanks to marav.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-24805
(* Security fix *)
extra/php80/php80-8.0.28-x86_64-2_slack15.0.txz: Rebuilt.
This update removes extension=xmlrpc from the php.ini files.
extra/php81/php81-8.1.19-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.php.net/ChangeLog-8.php#8.1.19
patches/packages/ca-certificates-20230506-noarch-1_slack15.0.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
patches/packages/libssh-0.10.5-x86_64-1_slack15.0.txz: Upgraded.
This update fixes security issues:
A NULL dereference during rekeying with algorithm guessing.
A possible authorization bypass in pki_verify_data_signature under
low-memory conditions.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-1667https://www.cve.org/CVERecord?id=CVE-2023-2283
(* Security fix *)
patches/packages/whois-5.5.17-x86_64-1_slack15.0.txz: Upgraded.
Added the .cd TLD server.
Updated the -kg NIC handles server name.
Removed 2 new gTLDs which are no longer active.
patches/packages/netatalk-3.1.15-x86_64-1_slack15.0.txz: Upgraded.
This update fixes security issues, including a critical vulnerability that
allows remote attackers to execute arbitrary code on affected installations
of Netatalk. Authentication is not required to exploit this vulnerability.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2022-43634https://www.cve.org/CVERecord?id=CVE-2022-45188
(* Security fix *)
patches/packages/git-2.35.8-x86_64-1_slack15.0.txz: Upgraded.
This update fixes security issues:
By feeding specially crafted input to `git apply --reject`, a
path outside the working tree can be overwritten with partially
controlled contents (corresponding to the rejected hunk(s) from
the given patch).
When Git is compiled with runtime prefix support and runs without
translated messages, it still used the gettext machinery to
display messages, which subsequently potentially looked for
translated messages in unexpected places. This allowed for
malicious placement of crafted messages.
When renaming or deleting a section from a configuration file,
certain malicious configuration values may be misinterpreted as
the beginning of a new configuration section, leading to arbitrary
configuration injection.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-25652https://www.cve.org/CVERecord?id=CVE-2023-25815https://www.cve.org/CVERecord?id=CVE-2023-29007
(* Security fix *)
patches/packages/mozilla-thunderbird-102.10.1-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
For more information, see:
https://www.mozilla.org/en-US/thunderbird/102.10.1/releasenotes/
patches/packages/bind-9.16.40-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
testing/packages/bind-9.18.14-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
