LinuxQuestions.org - [LATEST CHANGELOG] Slackware-15.0

- Slackware (https://www.linuxquestions.org/questions/slackware-14/)

- - [LATEST CHANGELOG] Slackware-15.0 (https://www.linuxquestions.org/questions/slackware-14/%5Blatest-changelog%5D-slackware-15-0-a-4175720091/)

1 updates (x86_64). Including 1 (* Security fix *)! : 1 Rebuilt

Code:

Thu Apr 25 17:58:17 UTC 2024

patches/packages/libarchive-3.7.3-x86_64-2_slack15.0.txz:  Rebuilt.

  Patched an out-of-bound error in the rar e8 filter that could allow for

  the execution of arbitrary code.

  Thanks to gmgf for the heads-up.

  For more information, see:

    https://github.com/advisories/GHSA-2jc9-36w4-pmqw

    https://www.cve.org/CVERecord?id=CVE-2024-26256

  (* Security fix *)

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64) : 1 Rebuilt

Code:

Thu May  9 19:26:51 UTC 2024

patches/packages/sg3_utils-1.47-x86_64-2_slack15.0.txz:  Rebuilt.

  This is a bugfix release to fix a regression in rescan-scsi-bus.sh that

  causes all SCSI devices to be removed from the system when the '-r'

  option is used. Thanks to jwoithe for the link to the upstream patch.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64) : 1 Upgraded

Code:

Sun May 12 19:10:12 UTC 2024

patches/packages/whois-5.5.23-x86_64-1_slack15.0.txz:  Upgraded.

  Updated the .sc, .********* (.xn--yfro4i67o, Singapore)

  and .********************************* (.xn--clchc0ea0b2g2a9gcd, Singapore)

  TLD servers.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

Rather, for Slackware users reading Chinese and/or Tamil as UTF-8 is good for them (actually, for every one I think):
Update the .新加坡 (.xn--yfro4i67o, Singapore) TLD server
Update the .சிங்கப்பூர் (.xn--clchc0ea0b2g2a9gcd, Singapore) TLD server

1 updates (x86_64). Including 1 (* Security fix *)! : 1 Upgraded

Code:

Mon May 13 18:22:20 UTC 2024

patches/packages/libxml2-2.11.8-x86_64-1_slack15.0.txz:  Upgraded.

  Fix buffer overread with "xmllint --htmlout".

  xmllint: Fix --pedantic option.

  save: Handle invalid parent pointers in xhtmlNodeDumpOutput.

  For more information, see:

    https://www.cve.org/CVERecord?id=CVE-2024-34459

  (* Security fix *)

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64). Including 1 (* Security fix *)! : 1 Upgraded

Code:

Tue May 14 19:07:51 UTC 2024

patches/packages/mozilla-firefox-115.11.0esr-x86_64-1_slack15.0.txz:  Upgraded.

  This update contains security fixes and improvements.

  For more information, see:

    https://www.mozilla.org/en-US/firefox/115.11.0/releasenotes/

    https://www.mozilla.org/security/advisories/mfsa2024-22/

    https://www.cve.org/CVERecord?id=CVE-2024-4367

    https://www.cve.org/CVERecord?id=CVE-2024-4767

    https://www.cve.org/CVERecord?id=CVE-2024-4768

    https://www.cve.org/CVERecord?id=CVE-2024-4769

    https://www.cve.org/CVERecord?id=CVE-2024-4770

    https://www.cve.org/CVERecord?id=CVE-2024-4777

  (* Security fix *)

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

4 updates (x86_64). Including 2 (* Security fix *)! : 3 Upgraded, 1 Rebuilt

Code:

Thu May 16 02:31:40 UTC 2024

patches/packages/gdk-pixbuf2-2.42.12-x86_64-1_slack15.0.txz:  Upgraded.

  ani: Reject files with multiple INA or IART chunks.

  ani: Reject files with multiple anih chunks.

  ani: validate chunk size.

  Thanks to 0xvhp, pedrib, and Benjamin Gilbert.

  For more information, see:

    https://www.cve.org/CVERecord?id=CVE-2022-48622

  (* Security fix *)

patches/packages/git-2.39.4-x86_64-1_slack15.0.txz:  Upgraded.

  This update fixes security issues:

  Recursive clones on case-insensitive filesystems that support symbolic

  links are susceptible to case confusion that can be exploited to

  execute just-cloned code during the clone operation.

  Repositories can be configured to execute arbitrary code during local

  clones. To address this, the ownership checks introduced in v2.30.3

  are now extended to cover cloning local repositories.

  Local clones may end up hardlinking files into the target repository's

  object database when source and target repository reside on the same

  disk. If the source repository is owned by a different user, then

  those hardlinked files may be rewritten at any point in time by the

  untrusted user.

  When cloning a local source repository that contains symlinks via the

  filesystem, Git may create hardlinks to arbitrary user-readable files

  on the same filesystem as the target repository in the objects/

  directory.

  It is supposed to be safe to clone untrusted repositories, even those

  unpacked from zip archives or tarballs originating from untrusted

  sources, but Git can be tricked to run arbitrary code as part of the

  clone.

  For more information, see:

    https://www.cve.org/CVERecord?id=CVE-2024-32002

    https://www.cve.org/CVERecord?id=CVE-2024-32004

    https://www.cve.org/CVERecord?id=CVE-2024-32020

    https://www.cve.org/CVERecord?id=CVE-2024-32021

    https://www.cve.org/CVERecord?id=CVE-2024-32465

  (* Security fix *)

patches/packages/popa3d-1.0.3-x86_64-7_slack15.0.txz:  Rebuilt.

  This is a bugfix release:

  Build with AUTH_PAM, not AUTH_SHADOW.

  Thanks to jayjwa.

testing/packages/bind-9.18.27-x86_64-1_slack15.0.txz:  Upgraded.

  This is a bugfix release.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64). Including 1 (* Security fix *)! : 1 Upgraded

Code:

Mon May 20 18:42:49 UTC 2024

patches/packages/mariadb-10.5.25-x86_64-1_slack15.0.txz:  Upgraded.

  This update fixes bugs and a security issue:

  Difficult to exploit vulnerability allows unauthenticated attacker with

  logon to the infrastructure where MariaDB Server executes to compromise the

  server. This could result in unauthorized update, insert or delete access

  to some of the data as well as unauthorized read access to a subset of the

  data and unauthorized ability to cause a partial denial of service.

  For more information, see:

    https://www.cve.org/CVERecord?id=CVE-2024-21096

  (* Security fix *)

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64) : 1 Upgraded

Code:

Wed May 22 18:57:13 UTC 2024

patches/packages/curl-8.8.0-x86_64-1_slack15.0.txz:  Upgraded.

  This is a bugfix release.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64) : 1 Upgraded

Code:

Sun May 26 00:07:39 UTC 2024

patches/packages/ntp-4.2.8p18-x86_64-1_slack15.0.txz:  Upgraded.

  This is a bugfix release.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt

1 updates (x86_64) : 1 Rebuilt

Code:

Sat Jun  1 19:52:37 UTC 2024

patches/packages/ntp-4.2.8p18-x86_64-2_slack15.0.txz:  Rebuilt.

  This is a bugfix release to fix a possible regression. In some cases ntpd

  gets an error on mixed ipv4/ipv6 networks, so we'll make it possible to

  easily configure ntpd to use ipv4 only or ipv6 only (as well as to change

  any other ntpd options).

  rc.ntp: properly create the PID file on start.

  Add /etc/default/ntp to configure ntpd startup options since some people are

  needing to add -4 to avoid an error.

  Thanks to rkelsen and teoberi.

Provided by http://matoda.pw/report/slack-15.0-x86_64.txt