A few weeks ago I found ways to infiltrate/compromise a Slackware system. I was not actively looking for weaknesses but stumbled upon it, by chance. I know you are all eagerly awaiting 15 to release but this issue should be addressed ASAP.

I am not going to disclose any details, yet, in order to minimize chances of exploitation of the vulnerability. I am, however, willing to work with anyone closely involved in the development of Slackware (except AlienBob) and provide instructions on how to confirm the vulnerability.
I am also willing to cooperate with any maintainer of a derivative of Slackware and check if those systems are affected, too.

I have patches ready for Slackware 14.2. With minor adjustments they should also work for other versions.

This'll only cause panic, and for what? Which package's affected?
Just notify the OPs on IRC freenode ##slackware or use burner email to disclose.

3 members found this post helpful.

Is this a Slackware vulnerability or a vulnerability upstream that exists on Slackware?

But if you want to talk directly to Pat, his email is available on the installation media (as well as the email sent to root upon install -- login as root and run mail, open up the "Welcome to Linux (Slackware 14.2)!" email, then scroll to the bottom for Pat's email).

This is the thread for such discussion
https://www.linuxquestions.org/quest...-a-4175489800/

1 members found this post helpful.

Fortunately, not everyone reports vulnerabilities this way

7 members found this post helpful.

Agreed. I don't see the point of the first post.
If there is a real vulnerability in all versions of Slackware then the OP should privately disclose the vulnerability to our maintainer, Mr. Volkerding. Mr. Volkerding is best qualified to determine if the threat requires action on his part.

P.S. The criticism leveled at Eric H. is completely unnecessary and unprofessional. Eric is one of our trusted, senior developers.

6 members found this post helpful.

Um - I find the phrase "except AlienBob" to be the decider here.

15 members found this post helpful.

That's not relevant until the component is specified, it makes huge difference if it's the roof or the base that is compromised.

In construction, these sort of reports go through the contractors' office and straight to chief architect's desk.
One does not put a sign on the street saying the building has cracked and the whole block's affected, prior to that.

3 members found this post helpful.

Maybe the OP is the president of Mr. Workman's Fan Club?

Let's hope that's a false alarm, thought...

LMAO... OP is acting like an Immature Crybaby! Just file a bug report and let the Adults figure out your "so called" Vulnerability..

Well, if we think sober, the Slackware (even the -current) uses suid root for the Xorg program - meaning that we run always as root a program which is historically known as full of security issues like a Swiss cheese is of holes.

Also, the suid root binary of Xorg was historically a fancy way to "get root" - then for local privilege escalation exploits.

So, honestly, I do not exclude that could be on the wild an unpatched X11 (or Xorg) flaw which can affect all versions of Slackware since 1.0 and ending with -current. Heck, happened that they fixed a security issue on Xorg after 17 years, if I remember right.

BUT, at least in the Slackware-current and the future 15.0 we can cover definitively (on a preventive way) this pit hole by building the Xorg without suid root but with logind support, like the systemd based distributions do - but we will need an elogind patch for.

The fact that systemd based distributions (which are almost any other major distro) may be largely not affected (because they do not use that suid root for the Xorg program) may be an explanation why people do not bother so much about it, but it can affect badly us.

3 members found this post helpful.

I don't even know you, so I guess I offended one of your friends? Anyway, I don't feel offended if you don't work with me; the remark is a tad childish don't you think?
Anyway, if you want to report a critical vulnerability, the thing not to do is announce it in a post like you just made.
You have not reached out to any Slackware team member including Patrick Volkerding. It's not like Pat's email address is completely unknown.

19 members found this post helpful.

Good job Alien Bob!!! Me and you exchanged some harsh words in the past and had some misunderstandings but we've passed that. Not the type to hold grudges and you don't seem to either. I respect and appreciate your contributions. Hope whatever it is gets fix immediately.

"I've found something, but I cannot share it with you"

It made me think about this:

https://img2.freepng.fr/20180606/uhb...8280618339.jpg

2 members found this post helpful.

Good call. I agree.