Slackware Security Advisories (sigurnosne nadogradnje)

Novosti u vezi Slackware Linuxa

Moderator: Urednik

Locked

Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:45


14.07.2017.

Sveži mariadb paketi za Slackware 14.1, 14.2 i -current:

Code: Select all

patches/packages/mariadb-10.0.31-i586-1_slack14.2.txz:  Upgraded.
  This update fixes bugs and security issues.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3308
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3309
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3453
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3456
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3464
  (* Security fix *)
Sveži samba paketi za Slackware 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/samba-4.4.15-i586-1_slack14.2.txz:  Upgraded.
  This update fixes an authentication validation bypass security issue:
  "Orpheus' Lyre mutual authentication validation bypass"
  All versions of Samba from 4.0.0 onwards using embedded Heimdal
  Kerberos are vulnerable to a man-in-the-middle attack impersonating
  a trusted server, who may gain elevated access to the domain by
  returning malicious replication or authorization data.
  Samba binaries built against MIT Kerberos are not vulnerable.
  For more information, see:
    https://www.samba.org/samba/security/CVE-2017-11103.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:49


18.07.2017.

Sveži expat paketi za Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/expat-2.2.2-i586-1_slack14.2.txz:  Upgraded.
  Fixes security issues including:
  External entity infinite loop DoS
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233
    https://libexpat.github.io/doc/cve-2017-9233/
  (* Security fix *)
Sveži gd paketi za Slackware 14.2 i -current:

Code: Select all

patches/packages/gd-2.2.4-i586-1_slack14.2.txz:  Upgraded.
  Fixes security issues:
  gdImageCreate() doesn't check for oversized images and as such is prone to
  DoS vulnerabilities. (CVE-2016-9317)
  double-free in gdImageWebPtr() (CVE-2016-6912)
  potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
  DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
  Signed Integer Overflow gd_io.c (CVE-2016-10168)
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9317
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6912
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10166
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10167
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10168
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:50


21.07.2017.

Sveži tcpdump paketi za Slackware 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/tcpdump-4.9.1-i586-1_slack14.2.txz:  Upgraded.
  This update fixes an issue where tcpdump 4.9.0 allows remote attackers
  to cause a denial of service (heap-based buffer over-read and application
  crash) via crafted packet data.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11108
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:52


02.08.2017.

Sveži gnupg paketi za Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/gnupg-1.4.22-i586-1_slack14.2.txz:  Upgraded.
  Mitigate a flush+reload side-channel attack on RSA secret keys dubbed
  "Sliding right into disaster".
  For more information, see:
    https://eprint.iacr.org/2017/627
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:54


09.08.2017.

Sveži curl paketi za Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/curl-7.55.0-i586-1_slack14.2.txz:  Upgraded.
  This update fixes three security issues:
  URL globbing out of bounds read
  TFTP sends more than buffer size
  FILE buffer read out of bounds
  For more information, see:
    https://curl.haxx.se/docs/adv_20170809A.html
    https://curl.haxx.se/docs/adv_20170809B.html
    https://curl.haxx.se/docs/adv_20170809C.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000099
  (* Security fix *)
Sveži mozilla-firefox za Slackware 14.2 i -current:

Code: Select all

patches/packages/mozilla-firefox-52.3.0esr-i586-1_slack14.2.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 18:58


11.08.2017.

Sveži git paketi za Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/git-2.14.1-i586-1_slack14.2.txz:  Upgraded.
  Fixes security issues:
  A "ssh://..." URL can result in a "ssh" command line with a hostname that
  begins with a dash "-", which would cause the "ssh" command to instead
  (mis)treat it as an option. This is now prevented by forbidding such a
  hostname (which should not impact any real-world usage).
  Similarly, when GIT_PROXY_COMMAND is configured, the command is run with
  host and port that are parsed out from "ssh://..." URL; a poorly written
  GIT_PROXY_COMMAND could be tricked into treating a string that begins with a
  dash "-" as an option. This is now prevented by forbidding such a hostname
  and port number (again, which should not impact any real-world usage).
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000117
  (* Security fix *)
Sveži libsoup paketi za Slackware 14.1, 14.2 i -current:

Code: Select all

patches/packages/libsoup-2.52.2-i586-3_slack14.2.txz:  Rebuilt.
  Fixed a chunked decoding buffer overrun that could be exploited against
  either clients or servers.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2885
  (* Security fix *)
Sveži mercurial i subversion paketi za Slackware 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/mercurial-4.3.1-i586-1_slack14.2.txz:  Upgraded.
  Fixes security issues:
  Mercurial's symlink auditing was incomplete prior to 4.3, and could
  be abused to write to files outside the repository.
  Mercurial was not sanitizing hostnames passed to ssh, allowing
  shell injection attacks on clients by specifying a hostname starting
  with -oProxyCommand.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000115
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000116
  (* Security fix *)

Code: Select all

patches/packages/subversion-1.9.7-i586-1_slack14.2.txz:  Upgraded.
  Fixed client side arbitrary code execution vulnerability.
  For more information, see:
    https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9800
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 19:01


15.08.2017.

Sveži xorg-server paketi za Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/xorg-server-1.18.3-i586-3_slack14.2.txz:  Rebuilt.
  This update fixes two security issues:
  A user authenticated to an X Session could crash or execute code in the
  context of the X Server by exploiting a stack overflow in the endianness
  conversion of X Events.
  Uninitialized data in endianness conversion in the XEvent handling of the
  X.Org X Server allowed authenticated malicious users to access potentially
  privileged data from the X server.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10971
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10972
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.18.3-i586-3_slack14.2.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.18.3-i586-3_slack14.2.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.18.3-i586-3_slack14.2.txz:  Rebuilt.
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Aug 2017, 19:02


21.08.2017.

Sveži seamonkey paketi za Slackware 14.2 i -current:

Code: Select all

patches/packages/seamonkey-2.48-i586-1_slack14.2.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    http://www.seamonkey-project.org/releases/seamonkey2.48
  (* Security fix *)
patches/packages/seamonkey-solibs-2.48-i586-1_slack14.2.txz:  Upgraded.
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 17 Sep 2017, 09:40


08.09.2017.

Sveži bash paketi za Slackware 13.1, 13.37, 14.0, 14.1 i 14.2:

Code: Select all

patches/packages/bash-4.3.048-i586-1_slack14.2.txz:  Upgraded.
  This update fixes two security issues found in bash before 4.4:
  The expansion of '\h' in the prompt string allows remote authenticated users
  to execute arbitrary code via shell metacharacters placed in 'hostname' of a
  machine. The theoretical attack vector is a hostile DHCP server providing a
  crafted hostname, but this is unlikely to occur in a normal Slackware
  configuration as we ignore the hostname provided by DHCP.
  Specially crafted SHELLOPTS+PS4 environment variables used against bogus
  setuid binaries using system()/popen() allowed local attackers to execute
  arbitrary code as root.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0634
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7543
  (* Security fix *)
Sveži mariadb paketi za Slackware 14.1 i 14.2:

Code: Select all

patches/packages/mariadb-10.0.32-i586-1_slack14.2.txz:  Upgraded.
  This update fixes bugs and security issues.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3636
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3641
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3653
  (* Security fix *)
Sveži tcpdump paketi za Slackware 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/tcpdump-4.9.2-i586-1_slack14.2.txz:  Upgraded.
  This update fixes bugs and many security issues (see the included
  CHANGES file).
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12893
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12894
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12895
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12896
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12897
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12898
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12899
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12900
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12901
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12902
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12985
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12986
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12987
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12988
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12989
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12990
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12991
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12992
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12993
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12994
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12995
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12996
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12997
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12998
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12999
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13000
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13001
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13002
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13003
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13004
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13005
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13006
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13007
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13008
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13009
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13010
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13011
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13012
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13013
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13014
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13015
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13016
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13017
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13018
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13019
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13020
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13021
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13022
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13023
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13024
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13025
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13026
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13027
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13028
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13029
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13030
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13031
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13032
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13033
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13034
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13035
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13036
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13037
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13038
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13039
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13040
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13041
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13042
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13043
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13044
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13045
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13046
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13047
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13048
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13049
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13050
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13051
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13052
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13053
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13054
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13055
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13687
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13688
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13689
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13690
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13725
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 17 Sep 2017, 09:42


12.09.2017.

Sveži emacs paketi za lackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2 i -current:

Code: Select all

patches/packages/emacs-25.3-i586-1_slack14.2.txz:  Upgraded.
  This update fixes a security vulnerability in Emacs. Gnus no longer
  supports "richtext" and "enriched" inline MIME objects. This support
  was disabled to avoid evaluation of arbitrary Lisp code contained in
  email messages and news articles.
  For more information, see:
    http://seclists.org/oss-sec/2017/q3/422
    https://bugs.gnu.org/28350
  (* Security fix *)
Sveži libzip paketi za Slackware 14.2 i -current:

Code: Select all

patches/packages/libzip-1.0.1-i586-3_slack14.2.txz:  Rebuilt.
  Fix a denial of service security issue.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14107
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


Locked

Who is online

Users browsing this forum: No registered users and 43 guests