mirror of
git://slackware.nl/current.git
synced 2025-02-11 08:48:30 +01:00
39f1d1796b
a/lzlib-1.15-x86_64-1.txz: Upgraded.
a/plzip-1.12-x86_64-1.txz: Upgraded.
d/llvm-19.1.7-x86_64-1.txz: Upgraded.
l/libqalculate-5.5.0-x86_64-1.txz: Upgraded.
n/gnupg2-2.5.3-x86_64-1.txz: Upgraded.
n/rsync-3.4.0-x86_64-1.txz: Upgraded.
This is a security release, fixing several important security vulnerabilities:
Heap Buffer Overflow in Checksum Parsing.
Info Leak via uninitialized Stack contents defeats ASLR.
Server leaks arbitrary client files.
Server can make client write files outside of destination directory using symbolic links.
--safe-links Bypass.
Symlink race condition.
Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at
Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for
discovering these vulnerabilities and working with the rsync project
to develop and test fixes.
For more information, see:
https://kb.cert.org/vuls/id/952657
https://www.cve.org/CVERecord?id=CVE-2024-12084
https://www.cve.org/CVERecord?id=CVE-2024-12085
https://www.cve.org/CVERecord?id=CVE-2024-12086
https://www.cve.org/CVERecord?id=CVE-2024-12087
https://www.cve.org/CVERecord?id=CVE-2024-12088
https://www.cve.org/CVERecord?id=CVE-2024-12747
(* Security fix *)
xap/qalculate-gtk-5.5.0-x86_64-1.txz: Upgraded.
xap/qalculate-qt-5.5.0-x86_64-1.txz: Upgraded.
|
||
|---|---|---|
| .. | ||
| a | ||
| ap | ||
| d | ||
| e | ||
| f | ||
| installer | ||
| k | ||
| kde | ||
| l | ||
| n | ||
| t | ||
| tcl | ||
| x | ||
| xap | ||
| xfce | ||
| y | ||
| buildlist-from-changelog.sh | ||
| make_world.sh | ||
| README.TXT | ||
This is the source used for Slackware. To look for a particular bit of source (let's say for 'cp'), first you would look for the full path: fuzzy:~# which cp /bin/cp Then, you grep for the package it came from. Note that the leading '/' is removed, and ^ and $ mark the beginning and end of the pattern to match: fuzzy:~# grep ^bin/cp$ /var/lib/pkgtools/packages/* /var/lib/pkgtools/packages/coreutils-9.0-x86_64-3:bin/cp From this, you can see that 'cp' came from the coreutils-9.0-x86_64-3 package. The source will be found in a corresponding subdirectory. In this case, that would be ./a/coreutils/. All of these packages have scripts that extract, patch, and compile the source automatically. These are the 'SlackBuild' scripts. Have fun! --- Patrick J. Volkerding volkerdi@slackware.com