Slackware Security Advisories (sigurnosne nadogradnje)

Novosti u vezi Slackware Linuxa

Moderator: Urednik

Locked

Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 24 Oct 2022, 06:44


17.10.2022.

Sveži xorg-server paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/xorg-server-1.20.14-i586-4_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  xquartz: Fix a possible crash when editing the Application menu due
  to mutating immutable arrays.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3553
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-4_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-3_slack15.0.txz:  Rebuilt.
  xkb: proof GetCountedString against request length attacks.
  xkb: fix some possible memleaks in XkbGetKbdByName.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 24 Oct 2022, 06:45


18.10.2022.

Sveži git paketi za Slackware 14.0, 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/git-2.35.5-i586-1_slack15.0.txz:  Upgraded.
  This release fixes two security issues:
  * CVE-2022-39253:
  When relying on the `--local` clone optimization, Git dereferences
  symbolic links in the source repository before creating hardlinks
  (or copies) of the dereferenced link in the destination repository.
  This can lead to surprising behavior where arbitrary files are
  present in a repository's `$GIT_DIR` when cloning from a malicious
  repository.
  Git will no longer dereference symbolic links via the `--local`
  clone mechanism, and will instead refuse to clone repositories that
  have symbolic links present in the `$GIT_DIR/objects` directory.
  Additionally, the value of `protocol.file.allow` is changed to be
  "user" by default.
  * CVE-2022-39260:
  An overly-long command string given to `git shell` can result in
  overflow in `split_cmdline()`, leading to arbitrary heap writes and
  remote code execution when `git shell` is exposed and the directory
  `$HOME/git-shell-commands` exists.
  `git shell` is taught to refuse interactive commands that are
  longer than 4MiB in size. `split_cmdline()` is hardened to reject
  inputs larger than 2GiB.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
  (* Security fix *)
Sveži mozilla-firefox paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-firefox-102.4.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.4.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2022-45/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 29 Oct 2022, 21:57


25.10.2022.

Sveži expat paketi za Slackware 14.0, 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/expat-2.5.0-i586-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Fix heap use-after-free after overeager destruction of a shared DTD in
  function XML_ExternalEntityParserCreate in out-of-memory situations.
  Expected impact is denial of service or potentially arbitrary code
  execution.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680
  (* Security fix *)
Sveži samba paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/samba-4.15.11-i586-1_slack15.0.txz:  Upgraded.
  This update fixes the following security issue:
  There is a limited write heap buffer overflow in the GSSAPI unwrap_des()
  and unwrap_des3() routines of Heimdal (included in Samba).
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-3437.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3437
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 29 Oct 2022, 21:58


26.10.2022.

Sveži curl paketi za Slackware 14.0, 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/curl-7.86.0-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  HSTS bypass via IDN.
  HTTP proxy double-free.
  .netrc parser out-of-bounds access.
  POST following PUT confusion.
  For more information, see:
    https://curl.se/docs/CVE-2022-42916.html
    https://curl.se/docs/CVE-2022-42915.html
    https://curl.se/docs/CVE-2022-35260.html
    https://curl.se/docs/CVE-2022-32221.html
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42916
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35260
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 06 Nov 2022, 22:29


31. X 2022.

Sveži vim i php80/php81 paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/vim-9.0.0814-i586-1_slack15.0.txz:  Upgraded.
  A vulnerability was found in vim and classified as problematic. Affected by
  this issue is the function qf_update_buffer of the file quickfix.c of the
  component autocmd Handler. The manipulation leads to use after free. The
  attack may be launched remotely. Upgrading to version 9.0.0805 is able to
  address this issue.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-3705
  (* Security fix *)
patches/packages/vim-gvim-9.0.0814-i586-1_slack15.0.txz:  Upgraded.

Code: Select all

extra/php80/php80-8.0.25-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
extra/php81/php81-8.1.12-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 06 Nov 2022, 22:30


3. XI 2022.

Sveži mozilla-nss paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-nss-3.84-i586-1_slack15.0.txz:  Upgraded.
  Fixed a segmentation fault when the server requests a client auth cert but
  the client has no certs in its database.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-3479
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 06 Nov 2022, 22:31


5. XI 2022.

Sveži sudo paketi za Slackware 14.0, 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/sudo-1.9.12p1-i586-1_slack15.0.txz:  Upgraded.
  Fixed a potential out-of-bounds write for passwords smaller than 8
  characters when passwd authentication is enabled.
  This does not affect configurations that use other authentication
  methods such as PAM, AIX authentication or BSD authentication.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-43995
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Nov 2022, 22:48


9. XI 2022.

Sveži sysstat paketi za Slackware 14.2, 15.0 i -current:

Code: Select all

patches/packages/sysstat-12.7.1-i586-1_slack15.0.txz:  Upgraded.
  On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1,
  allocate_structures contains a size_t overflow in sa_common.c. The
  allocate_structures function insufficiently checks bounds before arithmetic
  multiplication, allowing for an overflow in the size allocated for the
  buffer representing system activities.
  This issue may lead to Remote Code Execution (RCE).
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-39377
  (* Security fix *)
Sveži xfce4-settings paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/xfce4-settings-4.16.4-i586-1_slack15.0.txz:  Upgraded.
  Fixed an argument injection vulnerability in xfce4-mime-helper.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-45062
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Nov 2022, 22:48


10. XI 2022.

Sveži php paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/php-7.4.33-i586-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  GD: OOB read due to insufficient input validation in imageloadfont().
  Hash: buffer overflow in hash_update() on long parameter.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-31630
    https://www.cve.org/CVERecord?id=CVE-2022-37454
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”



Administrator
Administrator
offline
User avatar

Posts: 3235
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 22 Nov 2022, 20:33


16.XI 2022.

Sveži krb5, mozilla-firefox, mozilla-thunderbird i samba paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/krb5-1.19.2-i586-3_slack15.0.txz:  Rebuilt.
  Fixed integer overflows in PAC parsing.
  Fixed memory leak in OTP kdcpreauth module.
  Fixed PKCS11 module path search.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-42898
  (* Security fix *)

Code: Select all

patches/packages/mozilla-firefox-102.5.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.5.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2022-48/
    https://www.cve.org/CVERecord?id=CVE-2022-45403
    https://www.cve.org/CVERecord?id=CVE-2022-45404
    https://www.cve.org/CVERecord?id=CVE-2022-45405
    https://www.cve.org/CVERecord?id=CVE-2022-45406
    https://www.cve.org/CVERecord?id=CVE-2022-45408
    https://www.cve.org/CVERecord?id=CVE-2022-45409
    https://www.cve.org/CVERecord?id=CVE-2022-45410
    https://www.cve.org/CVERecord?id=CVE-2022-45411
    https://www.cve.org/CVERecord?id=CVE-2022-45412
    https://www.cve.org/CVERecord?id=CVE-2022-45416
    https://www.cve.org/CVERecord?id=CVE-2022-45418
    https://www.cve.org/CVERecord?id=CVE-2022-45420
    https://www.cve.org/CVERecord?id=CVE-2022-45421
  (* Security fix *)

Code: Select all

patches/packages/mozilla-thunderbird-102.5.0-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.5.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/
    https://www.cve.org/CVERecord?id=CVE-2022-45403
    https://www.cve.org/CVERecord?id=CVE-2022-45404
    https://www.cve.org/CVERecord?id=CVE-2022-45405
    https://www.cve.org/CVERecord?id=CVE-2022-45406
    https://www.cve.org/CVERecord?id=CVE-2022-45408
    https://www.cve.org/CVERecord?id=CVE-2022-45409
    https://www.cve.org/CVERecord?id=CVE-2022-45410
    https://www.cve.org/CVERecord?id=CVE-2022-45411
    https://www.cve.org/CVERecord?id=CVE-2022-45412
    https://www.cve.org/CVERecord?id=CVE-2022-45416
    https://www.cve.org/CVERecord?id=CVE-2022-45418
    https://www.cve.org/CVERecord?id=CVE-2022-45420
    https://www.cve.org/CVERecord?id=CVE-2022-45421
  (* Security fix *)

Code: Select all

patches/packages/samba-4.15.12-i586-1_slack15.0.txz:  Upgraded.
  Fixed a security issue where Samba's Kerberos libraries and AD DC failed
  to guard against integer overflows when parsing a PAC on a 32-bit system,
  which allowed an attacker with a forged PAC to corrupt the heap.
  For more information, see:
    https://www.samba.org/samba/security/CVE-2022-42898.html
    https://www.cve.org/CVERecord?id=CVE-2022-42898
  (* Security fix *)
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


Locked

Who is online

Users browsing this forum: No registered users and 1 guest