Sveži mozilla-nss paketi za Slackware 14.0, 14.1, 14.2 i -current:
Code: Select all
patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz: Rebuilt.
This update fixes a critical security issue:
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded within
CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
using NSS for certificate validation or other TLS, X.509, OCSP or CRL
functionality may be impacted, depending on how they configure NSS.
Note: This vulnerability does NOT impact Mozilla Firefox. However, email
clients and PDF viewers that use NSS for signature verification, such as
Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
Thanks to Tavis Ormandy of Google Project Zero.
For more information, see:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
(* Security fix *)
Sveži xorg-server paketi za Slackware 14.0, 14.1, 14.2 i -current:
Code: Select all
patches/packages/xorg-server-1.18.3-i586-6_slack14.2.txz: Rebuilt.
Fixes for multiple input validation failures in X server extensions:
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
(* Security fix *)
patches/packages/xorg-server-xephyr-1.18.3-i586-6_slack14.2.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.18.3-i586-6_slack14.2.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.18.3-i586-6_slack14.2.txz: Rebuilt.
Sveži httpd paketi za Slackware 14.0, 14.1, 14.2 i -current:
Code: Select all
patches/packages/httpd-2.4.52-i586-1_slack14.2.txz: Upgraded.
SECURITY: CVE-2021-44790: Possible buffer overflow when parsing
multipart content in mod_lua of Apache HTTP Server 2.4.51 and
earlier (cve.mitre.org)
A carefully crafted request body can cause a buffer overflow in
the mod_lua multipart parser (r:parsebody() called from Lua
scripts).
The Apache httpd team is not aware of an exploit for the
vulnerabilty though it might be possible to craft one.
This issue affects Apache HTTP Server 2.4.51 and earlier.
Credits: Chamal
SECURITY: CVE-2021-44224: Possible NULL dereference or SSRF in
forward proxy configurations in Apache HTTP Server 2.4.51 and
earlier (cve.mitre.org)
A crafted URI sent to httpd configured as a forward proxy
(ProxyRequests on) can cause a crash (NULL pointer dereference)
or, for configurations mixing forward and reverse proxy
declarations, can allow for requests to be directed to a
declared Unix Domain Socket endpoint (Server Side Request
Forgery).
This issue affects Apache HTTP Server 2.4.7 up to 2.4.51
(included).
Credits: ae 1/4*a-o(R)e 1/4
TengMA(@Te3t123)
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
(* Security fix *)
Sveži wpa_supplicant paketi za Slackware 14.0, 14.1, 14.2 i -current:
Code: Select all
patches/packages/wpa_supplicant-2.9-i586-1_slack14.2.txz: Upgraded.
This update fixes the following security issues:
AP mode PMF disconnection protection bypass.
UPnP SUBSCRIBE misbehavior in hostapd WPS AP.
P2P group information processing vulnerability.
P2P provision discovery processing vulnerability.
ASN.1: Validate DigestAlgorithmIdentifier parameters.
Flush pending control interface message for an interface to be removed.
These issues could result in a denial-of-service, privilege escalation,
arbitrary code execution, or other unexpected behavior.
Thanks to nobodino for pointing out the patches.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0326
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0535
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12695
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16275
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27803
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30004
(* Security fix *)