a/lzlib-1.15-x86_64-1.txz: Upgraded.
a/plzip-1.12-x86_64-1.txz: Upgraded.
d/llvm-19.1.7-x86_64-1.txz: Upgraded.
l/libqalculate-5.5.0-x86_64-1.txz: Upgraded.
n/gnupg2-2.5.3-x86_64-1.txz: Upgraded.
n/rsync-3.4.0-x86_64-1.txz: Upgraded.
This is a security release, fixing several important security vulnerabilities:
Heap Buffer Overflow in Checksum Parsing.
Info Leak via uninitialized Stack contents defeats ASLR.
Server leaks arbitrary client files.
Server can make client write files outside of destination directory using symbolic links.
--safe-links Bypass.
Symlink race condition.
Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at
Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for
discovering these vulnerabilities and working with the rsync project
to develop and test fixes.
For more information, see:
https://kb.cert.org/vuls/id/952657https://www.cve.org/CVERecord?id=CVE-2024-12084https://www.cve.org/CVERecord?id=CVE-2024-12085https://www.cve.org/CVERecord?id=CVE-2024-12086https://www.cve.org/CVERecord?id=CVE-2024-12087https://www.cve.org/CVERecord?id=CVE-2024-12088https://www.cve.org/CVERecord?id=CVE-2024-12747
(* Security fix *)
xap/qalculate-gtk-5.5.0-x86_64-1.txz: Upgraded.
xap/qalculate-qt-5.5.0-x86_64-1.txz: Upgraded.
39f1d1796b