patches/packages/openssl-1.1.1zb-x86_64-1_slack15.0.txz: Upgraded.
Apply patch to fix a security issue:
Harden BN_GF2m_poly2arr against misuse.
This CVE was fixed by the 1.1.1zb release that is only available to
subscribers to OpenSSL's premium extended support. The patch was prepared
by backporting from the OpenSSL-3.0 repo. The reported version number has
been updated so that vulnerability scanners calm down.
Thanks to Ken Zalewski for the patch!
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-9143
(* Security fix *)
patches/packages/openssl-solibs-1.1.1zb-x86_64-1_slack15.0.txz: Upgraded.
testing/packages/llvm-19.1.2-x86_64-1_slack15.0.txz: Upgraded.
Shared library .so-version bump.
Chromium requires either a patched LLVM18, or LLVM19, so we're upgrading.
Thanks to alienBOB.
patches/packages/libarchive-3.7.7-x86_64-1_slack15.0.txz: Upgraded.
This update fixes bug and the following security issues:
gzip: prevent a hang when processing a malformed gzip inside a gzip.
tar: don't crash on truncated tar archives.
tar: fix two leaks in tar header parsing.
(* Security fix *)
patches/packages/openssh-9.9p1-x86_64-1_slack15.0.txz: Upgraded.
This update is primarily to address a regression that prevents using
inetd or xinetd with sshd. Thanks to a_biardi for the bug report.
Future deprecation notice: OpenSSH plans to remove support for the DSA
signature algorithm in early 2025. For now, this package retains DSA
support, but plan accordingly.
Several ELF objects were found to have rpaths pointing into /tmp, a world
writable directory. This could have allowed a local attacker to launch denial
of service attacks or execute arbitrary code when the affected binaries are
run by placing crafted ELF objects in the /tmp rpath location. All rpaths with
an embedded /tmp path have been scrubbed from the binaries, and makepkg has
gained a lint feature to detect these so that they won't creep back in.
extra/llvm-17.0.6-x86_64-2_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/cryfs-0.10.3-x86_64-5_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/cups-filters-1.28.17-x86_64-2_slack15.0.txz: Rebuilt.
Mitigate security issue that could lead to a denial of service or
the execution of arbitrary code.
Rebuilt with --with-browseremoteprotocols=none to disable incoming
connections, since this daemon has been shown to be insecure. If you
actually use cups-browsed, be sure to install the new
/etc/cups/cups-browsed.conf.new containing this line:
BrowseRemoteProtocols none
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-47176
(* Security fix *)
patches/packages/espeak-ng-1.50-x86_64-4_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/libvncserver-0.9.13-x86_64-4_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/marisa-0.2.6-x86_64-5_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/mlt-7.4.0-x86_64-2_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/mozilla-firefox-115.16.0esr-x86_64-1_slack15.0.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
https://www.mozilla.org/en-US/firefox/115.16.0/releasenotes/https://www.mozilla.org/security/advisories/mfsa2024-48https://www.cve.org/CVERecord?id=CVE-2024-9392https://www.cve.org/CVERecord?id=CVE-2024-9393https://www.cve.org/CVERecord?id=CVE-2024-9394https://www.cve.org/CVERecord?id=CVE-2024-9401
(* Security fix *)
patches/packages/openobex-1.7.2-x86_64-6_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/pkgtools-15.0-noarch-44_slack15.0.txz: Rebuilt.
makepkg: when looking for ELF objects with --remove-rpaths or
--remove-tmp-rpaths, avoid false hits on files containing 'ELF' as part
of the directory or filename.
Also warn about /tmp rpaths after the package is built.
patches/packages/spirv-llvm-translator-13.0.0-x86_64-2_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
testing/packages/llvm-18.1.8-x86_64-2_slack15.0.txz: Rebuilt.
Remove rpaths from binaries.
(* Security fix *)
patches/packages/pkgtools-15.0-noarch-43_slack15.0.txz: Rebuilt.
This update adds new makepkg options and fixes a bug:
makepkg: added options --remove-rpaths, --remove-tmp-rpaths.
Thanks to Petri Kaukasoina for code examples.
makepkg: chown root:root, not root.root.
patches/packages/boost-1.78.0-x86_64-3_slack15.0.txz: Rebuilt.
Get rid of hardcoded temporary paths in the cmake files.
Since these paths point to a location that an unprivileged user could
create and populate with files that could be picked up during a build,
it's possible this bug could be used for malicious purposes.
Thanks to jmacloue.
(* Security fix *)
patches/packages/git-2.46.2-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
Some projects are requiring newer git features than git-2.39.4 provides,
so have an upgrade. Thanks to lancsuk for the suggestion.
patches/packages/libssh2-1.11.0-x86_64-1_slack15.0.txz: Upgraded.
This update adds support for rsa-sha2-512 and rsa-sha2-256, which are needed
to connect to servers that use a recent version of OpenSSH.
Thanks to Jonathan Woithe.
patches/packages/libpcap-1.10.5-x86_64-1_slack15.0.txz: Upgraded.
This update fixes security issues:
Clean up sock_initaddress() and its callers to avoid double frees
in some cases.
Fix pcap_findalldevs_ex() not to crash if passed a file:// URL with a
path to a directory that cannot be opened.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-7256https://www.cve.org/CVERecord?id=CVE-2024-8006
(* Security fix *)
patches/packages/ca-certificates-20240830-noarch-1_slack15.0.txz: Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
patches/packages/libX11-1.8.10-x86_64-1_slack15.0.txz: Upgraded.
This is a bug fix release, correcting an empty XKeysymDB file.
Thanks to Jonathan Woithe for the bug report.
patches/packages/dovecot-2.3.21.1-x86_64-1_slack15.0.txz: Upgraded.
This update fixes security issues:
A large number of address headers in email resulted in excessive CPU usage.
Abnormally large email headers are now truncated or discarded, with a limit
of 10MB on a single header and 50MB for all the headers of all the parts of
an email.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-23184https://www.cve.org/CVERecord?id=CVE-2024-23185
(* Security fix *)
These are needed to build Chromium. Thanks to alienBOB.
We'll probably move them to /extra once the Mozilla stuff needs it.
Please note that if upgrading to the new llvm, you'll need the llvm13-compat
package from /extra.
testing/packages/llvm-18.1.8-x86_64-1_slack15.0.txz: Added.
testing/packages/rust-1.80.1-x86_64-1_slack15.0.txz: Added.
testing/packages/rust-bindgen-0.69.4-x86_64-1_slack15.0.txz: Added.
patches/packages/curl-8.9.0-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/htdig-3.2.0b6-x86_64-10_slack15.0.txz: Rebuilt.
Patch XSS vulnerability. Thanks to jayjwa.
Get this out of cgi-bin. Thanks to LuckyCyborg.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2007-6110
(* Security fix *)
patches/packages/libxml2-2.11.9-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
Fix XXE protection in downstream code.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-40896
(* Security fix *)
patches/packages/xorg-server-1.20.14-x86_64-13_slack15.0.txz: Rebuilt.
This is a bugfix update to fix X server crashes:
[PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs()
Thanks to typbigoh and Petri Kaukasoina.
patches/packages/xorg-server-xephyr-1.20.14-x86_64-13_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-13_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-13_slack15.0.txz: Rebuilt.
patches/packages/netatalk-3.2.2-x86_64-1_slack15.0.txz: Upgraded.
This is a bugfix release.
patches/packages/openssh-9.8p1-x86_64-3_slack15.0.txz: Rebuilt.
As upstream refactors this into smaller binaries, we could easily run into
another update that causes an sshd lockout if the listener process isn't
restarted. So, let's try to prevent that. After the package is upgraded,
we'll use "sshd -t" to make sure that we have a sane configuration, and if
so then we'll restart the listener process automatically.
If you don't like this idea, you may turn it off in /etc/default/sshd.
patches/packages/openssh-9.8p1-x86_64-2_slack15.0.txz: Rebuilt.
rc.sshd: also shut down sshd-session processes with "stop" function.
This shuts down connections cleanly instead of them having to time out.
Thanks to Petri Kaukasoina.
patches/packages/httpd-2.4.60-x86_64-1_slack15.0.txz: Upgraded.
This is the latest release from the Apache HTTP Server 2.4.x stable branch.
patches/packages/openssh-9.8p1-x86_64-1_slack15.0.txz: Upgraded.
This update fixes a security issue:
Fix race condition resulting in potential remote code execution.
For more information, see:
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txthttps://www.cve.org/CVERecord?id=CVE-2024-6387
(* Security fix *)
patches/packages/bluez-5.71-x86_64-3_slack15.0.txz: Rebuilt.
Fix a regression in bluez-5.71:
[PATCH] audio: transport: Fix crash on A2DP suspend.
Thanks to coltfire.
patches/packages/xcb-util-cursor-0.1.5-x86_64-1.txz: Upgraded.
This is a bugfix release.
Thanks to Lockywolf.
