Slackware Security Advisories (sigurnosne nadogradnje)

Novosti u vezi Slackware Linuxa

Moderator: Urednik

Locked

Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 22 Nov 2022, 20:33


17.XI 2022.

Sveži freerdp paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/freerdp-2.9.0-i586-1_slack15.0.txz:  Upgraded.
  Fixed multiple client side input validation issues.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-39316
    https://www.cve.org/CVERecord?id=CVE-2022-39317
    https://www.cve.org/CVERecord?id=CVE-2022-39318
    https://www.cve.org/CVERecord?id=CVE-2022-39319
    https://www.cve.org/CVERecord?id=CVE-2022-39320
    https://www.cve.org/CVERecord?id=CVE-2022-41877
    https://www.cve.org/CVERecord?id=CVE-2022-39347
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 27 Nov 2022, 22:37


24. XI 2022.

Sveži ruby paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/ruby-3.0.5-i586-1_slack15.0.txz:  Upgraded.
  This release includes a security fix:
  HTTP response splitting in CGI.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2021-33621
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 04 Dec 2022, 21:58


29. XI 2022.

Sveži kernel paketi za Slackware 15.0:

Code: Select all

patches/packages/linux-5.15.80/*:  Upgraded.
  These updates fix various bugs and security issues.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 5.15.63:
    https://www.cve.org/CVERecord?id=CVE-2022-3629
    https://www.cve.org/CVERecord?id=CVE-2022-3635
    https://www.cve.org/CVERecord?id=CVE-2022-3633
    https://www.cve.org/CVERecord?id=CVE-2022-3625
    Fixed in 5.15.64:
    https://www.cve.org/CVERecord?id=CVE-2022-39190
    https://www.cve.org/CVERecord?id=CVE-2022-3028
    https://www.cve.org/CVERecord?id=CVE-2022-2905
    Fixed in 5.15.65:
    https://www.cve.org/CVERecord?id=CVE-2022-42703
    https://www.cve.org/CVERecord?id=CVE-2022-3176
    Fixed in 5.15.66:
    https://www.cve.org/CVERecord?id=CVE-2022-4095
    https://www.cve.org/CVERecord?id=CVE-2022-20421
    Fixed in 5.15.68:
    https://www.cve.org/CVERecord?id=CVE-2022-3303
    https://www.cve.org/CVERecord?id=CVE-2022-2663
    https://www.cve.org/CVERecord?id=CVE-2022-40307
    https://www.cve.org/CVERecord?id=CVE-2022-3586
    Fixed in 5.15.70:
    https://www.cve.org/CVERecord?id=CVE-2022-0171
    https://www.cve.org/CVERecord?id=CVE-2022-39842
    https://www.cve.org/CVERecord?id=CVE-2022-3061
    Fixed in 5.15.72:
    https://www.cve.org/CVERecord?id=CVE-2022-2308
    Fixed in 5.15.73:
    https://www.cve.org/CVERecord?id=CVE-2022-2978
    https://www.cve.org/CVERecord?id=CVE-2022-43750
    Fixed in 5.15.74:
    https://www.cve.org/CVERecord?id=CVE-2022-40768
    https://www.cve.org/CVERecord?id=CVE-2022-42721
    https://www.cve.org/CVERecord?id=CVE-2022-3621
    https://www.cve.org/CVERecord?id=CVE-2022-42722
    https://www.cve.org/CVERecord?id=CVE-2022-42719
    https://www.cve.org/CVERecord?id=CVE-2022-41674
    https://www.cve.org/CVERecord?id=CVE-2022-3649
    https://www.cve.org/CVERecord?id=CVE-2022-3646
    https://www.cve.org/CVERecord?id=CVE-2022-42720
    Fixed in 5.15.75:
    https://www.cve.org/CVERecord?id=CVE-2022-43945
    https://www.cve.org/CVERecord?id=CVE-2022-41849
    https://www.cve.org/CVERecord?id=CVE-2022-3535
    https://www.cve.org/CVERecord?id=CVE-2022-3594
    https://www.cve.org/CVERecord?id=CVE-2022-2602
    https://www.cve.org/CVERecord?id=CVE-2022-41850
    https://www.cve.org/CVERecord?id=CVE-2022-3565
    https://www.cve.org/CVERecord?id=CVE-2022-3542
    Fixed in 5.15.77:
    https://www.cve.org/CVERecord?id=CVE-2022-3524
    Fixed in 5.15.78:
    https://www.cve.org/CVERecord?id=CVE-2022-3628
    https://www.cve.org/CVERecord?id=CVE-2022-3623
    https://www.cve.org/CVERecord?id=CVE-2022-42896
    https://www.cve.org/CVERecord?id=CVE-2022-42895
    https://www.cve.org/CVERecord?id=CVE-2022-3543
    https://www.cve.org/CVERecord?id=CVE-2022-3564
    https://www.cve.org/CVERecord?id=CVE-2022-3619
    Fixed in 5.15.80:
    https://www.cve.org/CVERecord?id=CVE-2022-3521
    https://www.cve.org/CVERecord?id=CVE-2022-3169
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 04 Dec 2022, 21:59


02.XII 2022.

Sveži mozilla-thunderbird paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-thunderbird-102.5.1-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.5.1/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/
    https://www.cve.org/CVERecord?id=CVE-2022-45414
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Dec 2022, 22:20


07. XII 2022.

Sveži python3 paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/python3-3.9.16-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680
  (heap use-after-free).
  gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio
  related name resolution functions no longer involves a quadratic algorithm
  to fix CVE-2022-45061. This prevents a potential CPU denial of service if an
  out-of-spec excessive length hostname involving bidirectional characters were
  decoded. Some protocols such as urllib http 3xx redirects potentially allow
  for an attacker to supply such a name.
  gh-100001: python -m http.server no longer allows terminal control characters
  sent within a garbage request to be printed to the stderr server log.
  gh-87604: Avoid publishing list of active per-interpreter audit hooks via the
  gc module.
  gh-97514: On Linux the multiprocessing module returns to using filesystem
  backed unix domain sockets for communication with the forkserver process
  instead of the Linux abstract socket namespace. Only code that chooses to use
  the "forkserver" start method is affected. This prevents Linux CVE-2022-42919
  (potential privilege escalation) as abstract sockets have no permissions and
  could allow any user on the system in the same network namespace (often the
  whole system) to inject code into the multiprocessing forkserver process.
  Filesystem based socket permissions restrict this to the forkserver process
  user as was the default in Python 3.8 and earlier.
  gh-98517: Port XKCP's fix for the buffer overflows in SHA-3 to fix
  CVE-2022-37454.
  gh-68966: The deprecated mailcap module now refuses to inject unsafe text
  (filenames, MIME types, parameters) into shell commands to address
  CVE-2015-20107. Instead of using such text, it will warn and act as if a
  match was not found (or for test commands, as if the test failed).
  For more information, see:
    https://pythoninsider.blogspot.com/2022/12/python-3111-3109-3916-3816-3716-and.html
    https://www.cve.org/CVERecord?id=CVE-2022-43680
    https://www.cve.org/CVERecord?id=CVE-2022-45061
    https://www.cve.org/CVERecord?id=CVE-2022-42919
    https://www.cve.org/CVERecord?id=CVE-2022-37454
    https://www.cve.org/CVERecord?id=CVE-2015-20107
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Dec 2022, 22:21


08. XII 2022.

Sveži emacs i vim paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/emacs-27.2-i586-2_slack15.0.txz:  Rebuilt.
  GNU Emacs through 28.2 allows attackers to execute commands via shell
  metacharacters in the name of a source-code file, because lib-src/etags.c
  uses the system C library function in its implementation of the ctags
  program. For example, a victim may use the "ctags *" command (suggested in
  the ctags documentation) in a situation where the current working directory
  has contents that depend on untrusted input.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-45939
  (* Security fix *)

Code: Select all

patches/packages/vim-9.0.1034-i586-1_slack15.0.txz:  Upgraded.
  This update fixes various security issues such as a heap-based buffer
  overflow and use after free.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-4141
    https://www.cve.org/CVERecord?id=CVE-2022-3591
    https://www.cve.org/CVERecord?id=CVE-2022-3520
    https://www.cve.org/CVERecord?id=CVE-2022-3491
    https://www.cve.org/CVERecord?id=CVE-2022-4292
    https://www.cve.org/CVERecord?id=CVE-2022-4293
  (* Security fix *)
patches/packages/vim-gvim-9.0.1034-i586-1_slack15.0.txz:  Upgraded.
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Dec 2022, 22:22


09. XII 2022.

Sveži libarchive paketi za Slackware 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/libarchive-3.6.2-i586-1_slack15.0.txz:  Upgraded.
  This is a bugfix and security release.
  Relevant bugfixes:
    rar5 reader: fix possible garbled output with bsdtar -O (#1745)
    mtree reader: support reading mtree files with tabs (#1783)
  Security fixes:
    various small fixes for issues found by CodeQL
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 19 Dec 2022, 22:46


14. XII 2022.

Sveži mozila-firefox paketi za Slackware 15.0:

Code: Select all

patches/packages/mozilla-firefox-102.6.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.6.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/
    https://www.cve.org/CVERecord?id=CVE-2022-46880
    https://www.cve.org/CVERecord?id=CVE-2022-46872
    https://www.cve.org/CVERecord?id=CVE-2022-46881
    https://www.cve.org/CVERecord?id=CVE-2022-46874
    https://www.cve.org/CVERecord?id=CVE-2022-46875
    https://www.cve.org/CVERecord?id=CVE-2022-46882
    https://www.cve.org/CVERecord?id=CVE-2022-46878
  (* Security fix *)
Sveži mozilla-thunderbird i xorg-server paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-thunderbird-102.6.0-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.6.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/
    https://www.cve.org/CVERecord?id=CVE-2022-46880
    https://www.cve.org/CVERecord?id=CVE-2022-46872
    https://www.cve.org/CVERecord?id=CVE-2022-46881
    https://www.cve.org/CVERecord?id=CVE-2022-46874
    https://www.cve.org/CVERecord?id=CVE-2022-46875
    https://www.cve.org/CVERecord?id=CVE-2022-46882
    https://www.cve.org/CVERecord?id=CVE-2022-46878
  (* Security fix *)

Code: Select all

patches/packages/xorg-server-1.20.14-i586-5_slack15.0.txz:  Rebuilt.
  This release fixes 6 recently reported security vulnerabilities in
  various extensions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2022-December/003302.html
    https://www.cve.org/CVERecord?id=CVE-2022-46340
    https://www.cve.org/CVERecord?id=CVE-2022-46341
    https://www.cve.org/CVERecord?id=CVE-2022-46342
    https://www.cve.org/CVERecord?id=CVE-2022-46343
    https://www.cve.org/CVERecord?id=CVE-2022-46344
    https://www.cve.org/CVERecord?id=CVE-2022-4283
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-5_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-4_slack15.0.txz:  Rebuilt.
  This release fixes 6 recently reported security vulnerabilities in
  various extensions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2022-December/003302.html
    https://www.cve.org/CVERecord?id=CVE-2022-46340
    https://www.cve.org/CVERecord?id=CVE-2022-46341
    https://www.cve.org/CVERecord?id=CVE-2022-46342
    https://www.cve.org/CVERecord?id=CVE-2022-46343
    https://www.cve.org/CVERecord?id=CVE-2022-46344
    https://www.cve.org/CVERecord?id=CVE-2022-4283
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 19 Dec 2022, 22:48


17. XII 2022.

Sveži samba paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/samba-4.15.13-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  This is the Samba CVE for the Windows Kerberos RC4-HMAC Elevation of
  Privilege Vulnerability disclosed by Microsoft on Nov 8 2022.
  A Samba Active Directory DC will issue weak rc4-hmac session keys for
  use between modern clients and servers despite all modern Kerberos
  implementations supporting the aes256-cts-hmac-sha1-96 cipher.
  On Samba Active Directory DCs and members
  'kerberos encryption types = legacy'
  would force rc4-hmac as a client even if the server supports
  aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
  This is the Samba CVE for the Windows Kerberos Elevation of Privilege
  Vulnerability disclosed by Microsoft on Nov 8 2022.
  A service account with the special constrained delegation permission
  could forge a more powerful ticket than the one it was presented with.
  The "RC4" protection of the NetLogon Secure channel uses the same
  algorithms as rc4-hmac cryptography in Kerberos, and so must also be
  assumed to be weak.
  Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
  was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed
  that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue
  rc4-hmac encrypted tickets despite the target server supporting better
  encryption (eg aes256-cts-hmac-sha1-96).
  Note that there are several important behavior changes included in this
  release, which may cause compatibility problems interacting with system
  still expecting the former behavior.
  Please read the advisories of CVE-2022-37966, CVE-2022-37967 and
  CVE-2022-38023 carefully!
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-37966.html
    https://www.samba.org/samba/security/CVE-2022-37967.html
    https://www.samba.org/samba/security/CVE-2022-38023.html
    https://www.samba.org/samba/security/CVE-2022-45141.html
    https://www.cve.org/CVERecord?id=CVE-2022-37966
    https://www.cve.org/CVERecord?id=CVE-2022-37967
    https://www.cve.org/CVERecord?id=CVE-2022-38023
    https://www.cve.org/CVERecord?id=CVE-2022-45141
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3451
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 25 Dec 2022, 09:41


20. XII 2022.

Sveži libksba i sdl paketi za Slackware 14.2, 15.0 i -current:

Code: Select all

patches/packages/libksba-1.6.3-i586-1_slack15.0.txz:  Upgraded.
  Fix another integer overflow in the CRL's signature parser.
  (* Security fix *)

Code: Select all

patches/packages/sdl-1.2.15-i586-13_slack15.0.txz:  Rebuilt.
  This update fixes a heap overflow problem in video/SDL_pixels.c in SDL.
  By crafting a malicious .BMP file, an attacker can cause the application
  using this library to crash, denial of service, or code execution.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2021-33657
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


Locked

Who is online

Users browsing this forum: No registered users and 36 guests