Slackware Security Advisories (sigurnosne nadogradnje)

Novosti u vezi Slackware Linuxa

Moderator: Urednik

Locked

stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 05 Feb 2023, 16:58

02. II 2023.

Sveži openssh paketi Slackware 15.0 i -current:

Code: Select all

patches/packages/openssh-9.2p1-i586-1_slack15.0.txz:  Upgraded.
  This release contains fixes for two security problems and a memory safety
  problem. The memory safety problem is not believed to be exploitable, but
  upstream reports most network-reachable memory faults as security bugs.
  This update contains some potentially incompatible changes regarding the
  scp utility. For more information, see:
    https://www.openssh.com/releasenotes.html#9.0
  For more information, see:
    https://www.openssh.com/releasenotes.html#9.2
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Feb 2023, 17:51

07. II 2023.

Sveži openssl i xorg-server paketi Slackware 15.0 i -current:

Code: Select all

patches/packages/openssl-1.1.1t-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  X.400 address type confusion in X.509 GeneralName.
  Timing Oracle in RSA Decryption.
  Use-after-free following BIO_new_NDEF.
  Double free after calling PEM_read_bio_ex.
  For more information, see:
    https://www.openssl.org/news/secadv/20230207.txt
    https://www.cve.org/CVERecord?id=CVE-2023-0286
    https://www.cve.org/CVERecord?id=CVE-2022-4304
    https://www.cve.org/CVERecord?id=CVE-2023-0215
    https://www.cve.org/CVERecord?id=CVE-2022-4450
  (* Security fix *)
patches/packages/openssl-solibs-1.1.1t-i586-1_slack15.0.txz:  Upgraded.

Code: Select all

patches/packages/xorg-server-1.20.14-i586-7_slack15.0.txz:  Rebuilt.
  [PATCH] Xi: fix potential use-after-free in DeepCopyPointerClasses.
  Also merged another patch to prevent crashes when using a compositor with
  the NVIDIA blob. Thanks to mdinslage, willysr, and Daedra.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0494
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-7_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-6_slack15.0.txz:  Rebuilt.
  [PATCH] Xi: fix potential use-after-free in DeepCopyPointerClasses.
  Also merged another patch to prevent crashes when using a compositor with
  the NVIDIA blob. Thanks to mdinslage, willysr, and Daedra.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0494
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 11 Feb 2023, 17:52

10. II 2023.

Sveži gnutls paketi Slackware 15.0 i -current:

Code: Select all

patches/packages/gnutls-3.7.9-i586-1_slack15.0.txz:  Upgraded.
  libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange.
  Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin.
  [GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361]
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0361
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Feb 2023, 23:49

14. II 2023.

Sveži mozilla-firefox i php paketi Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-firefox-102.8.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.8.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-06/
    https://www.cve.org/CVERecord?id=CVE-2023-25728
    https://www.cve.org/CVERecord?id=CVE-2023-25730
    https://www.cve.org/CVERecord?id=CVE-2023-25743
    https://www.cve.org/CVERecord?id=CVE-2023-0767
    https://www.cve.org/CVERecord?id=CVE-2023-25735
    https://www.cve.org/CVERecord?id=CVE-2023-25737
    https://www.cve.org/CVERecord?id=CVE-2023-25738
    https://www.cve.org/CVERecord?id=CVE-2023-25739
    https://www.cve.org/CVERecord?id=CVE-2023-25729
    https://www.cve.org/CVERecord?id=CVE-2023-25732
    https://www.cve.org/CVERecord?id=CVE-2023-25734
    https://www.cve.org/CVERecord?id=CVE-2023-25742
    https://www.cve.org/CVERecord?id=CVE-2023-25746
  (* Security fix *)

Code: Select all

patches/packages/php-7.4.33-i586-3_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
extra/php80/php80-8.0.28-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
extra/php81/php81-8.1.16-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Core: Password_verify() always return true with some hash.
  Core: 1-byte array overrun in common path resolve code.
  SAPI: DOS vulnerability when parsing multipart request body.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-0567
    https://www.cve.org/CVERecord?id=CVE-2023-0568
    https://www.cve.org/CVERecord?id=CVE-2023-0662
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Feb 2023, 23:51

15. II 2023.

Sveži curl i git paketi Slackware 14.0, 14.1, 14.2, 15.0 i current:

Code: Select all

patches/packages/curl-7.88.0-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  HTTP multi-header compression denial of service.
  HSTS amnesia with --parallel.
  HSTS ignored on multiple requests.
  For more information, see:
    https://curl.se/docs/CVE-2023-23916.html
    https://curl.se/docs/CVE-2023-23915.html
    https://curl.se/docs/CVE-2023-23914.html
    https://www.cve.org/CVERecord?id=CVE-2023-23916
    https://www.cve.org/CVERecord?id=CVE-2023-23915
    https://www.cve.org/CVERecord?id=CVE-2023-23914
  (* Security fix *)

Code: Select all

patches/packages/git-2.35.7-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Using a specially-crafted repository, Git can be tricked into using
  its local clone optimization even when using a non-local transport.
  Though Git will abort local clones whose source $GIT_DIR/objects
  directory contains symbolic links (c.f., CVE-2022-39253), the objects
  directory itself may still be a symbolic link.
  These two may be combined to include arbitrary files based on known
  paths on the victim's filesystem within the malicious repository's
  working copy, allowing for data exfiltration in a similar manner as
  CVE-2022-39253.
  By feeding a crafted input to "git apply", a path outside the
  working tree can be overwritten as the user who is running "git
  apply".
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2023-22490
    https://www.cve.org/CVERecord?id=CVE-2023-23946
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Feb 2023, 23:52

16. II 2023.

Sveži mozilla-thunderbird paketi Slackware 15.0 i current:

Code: Select all

patches/packages/mozilla-thunderbird-102.8.0-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.8.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-07/
    https://www.cve.org/CVERecord?id=CVE-2023-0616
    https://www.cve.org/CVERecord?id=CVE-2023-25728
    https://www.cve.org/CVERecord?id=CVE-2023-25730
    https://www.cve.org/CVERecord?id=CVE-2023-0767
    https://www.cve.org/CVERecord?id=CVE-2023-25735
    https://www.cve.org/CVERecord?id=CVE-2023-25737
    https://www.cve.org/CVERecord?id=CVE-2023-25738
    https://www.cve.org/CVERecord?id=CVE-2023-25739
    https://www.cve.org/CVERecord?id=CVE-2023-25729
    https://www.cve.org/CVERecord?id=CVE-2023-25732
    https://www.cve.org/CVERecord?id=CVE-2023-25734
    https://www.cve.org/CVERecord?id=CVE-2023-25742
    https://www.cve.org/CVERecord?id=CVE-2023-25746
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 20 Feb 2023, 23:53

17. II 2023.

Sveži kernel paketi Slackware 15.0 i current:

Code: Select all

patches/packages/linux-5.15.80/*:  Upgraded.
  These updates fix various bugs and security issues.
  Be sure to upgrade your initrd after upgrading the kernel packages.
  If you use lilo to boot your machine, be sure lilo.conf points to the correct
  kernel and initrd and run lilo as root to update the bootloader.
  If you use elilo to boot your machine, you should run eliloconfig to copy the
  kernel and initrd to the EFI System Partition.
  For more information, see:
    Fixed in 5.15.81:
    https://www.cve.org/CVERecord?id=CVE-2022-47519
    https://www.cve.org/CVERecord?id=CVE-2022-47518
    https://www.cve.org/CVERecord?id=CVE-2022-47520
    https://www.cve.org/CVERecord?id=CVE-2022-47521
    https://www.cve.org/CVERecord?id=CVE-2022-3344
    Fixed in 5.15.82:
    https://www.cve.org/CVERecord?id=CVE-2022-45869
    https://www.cve.org/CVERecord?id=CVE-2022-4378
    Fixed in 5.15.83:
    https://www.cve.org/CVERecord?id=CVE-2022-3643
    Fixed in 5.15.84:
    https://www.cve.org/CVERecord?id=CVE-2022-3545
    Fixed in 5.15.85:
    https://www.cve.org/CVERecord?id=CVE-2022-45934
    Fixed in 5.15.86:
    https://www.cve.org/CVERecord?id=CVE-2022-3534
    https://www.cve.org/CVERecord?id=CVE-2022-3424
    Fixed in 5.15.87:
    https://www.cve.org/CVERecord?id=CVE-2022-41218
    https://www.cve.org/CVERecord?id=CVE-2023-23455
    https://www.cve.org/CVERecord?id=CVE-2023-23454
    https://www.cve.org/CVERecord?id=CVE-2023-0045
    https://www.cve.org/CVERecord?id=CVE-2023-0210
    https://www.cve.org/CVERecord?id=CVE-2022-36280
    Fixed in 5.15.88:
    https://www.cve.org/CVERecord?id=CVE-2023-0266
    https://www.cve.org/CVERecord?id=CVE-2022-47929
    Fixed in 5.15.89:
    https://www.cve.org/CVERecord?id=CVE-2023-0179
    https://www.cve.org/CVERecord?id=CVE-2023-0394
    Fixed in 5.15.90:
    https://www.cve.org/CVERecord?id=CVE-2022-4382
    https://www.cve.org/CVERecord?id=CVE-2022-4842
    Fixed in 5.15.91:
    https://www.cve.org/CVERecord?id=CVE-2022-4129
    https://www.cve.org/CVERecord?id=CVE-2023-23559
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 13 Mar 2023, 17:49

08. III 2023.

Sveži httpd paketi za Slackware 14.0, 14.1, 14.2, 15.0 i -current:

Code: Select all

patches/packages/httpd-2.4.56-i586-1_slack15.0.txz:  Upgraded.
  This update fixes two security issues:
  HTTP Response Smuggling vulnerability via mod_proxy_uwsgi.
  HTTP Request Smuggling attack via mod_rewrite and mod_proxy.
  For more information, see:
    https://downloads.apache.org/httpd/CHANGES_2.4.56
    https://www.cve.org/CVERecord?id=CVE-2023-27522
    https://www.cve.org/CVERecord?id=CVE-2023-25690
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 19 Mar 2023, 19:42

14. III 2023.

Sveži mozilla-firefox paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-firefox-102.9.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/102.9.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-10
    https://www.cve.org/CVERecord?id=CVE-2023-25751
    https://www.cve.org/CVERecord?id=CVE-2023-28164
    https://www.cve.org/CVERecord?id=CVE-2023-28162
    https://www.cve.org/CVERecord?id=CVE-2023-25752
    https://www.cve.org/CVERecord?id=CVE-2023-28163
    https://www.cve.org/CVERecord?id=CVE-2023-28176
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”


stereo
Administrator
Administrator
offline
User avatar

Posts: 3268
Joined: 01 Apr 2012, 13:50
Location: Mlečni put

Post Napisano: 19 Mar 2023, 19:42

16. III 2023.

Sveži mozilla-thunderbird i openssh paketi za Slackware 15.0 i -current:

Code: Select all

patches/packages/mozilla-thunderbird-102.9.0-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/102.9.0/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-11/
    https://www.cve.org/CVERecord?id=CVE-2023-25751
    https://www.cve.org/CVERecord?id=CVE-2023-28164
    https://www.cve.org/CVERecord?id=CVE-2023-28162
    https://www.cve.org/CVERecord?id=CVE-2023-25752
    https://www.cve.org/CVERecord?id=CVE-2023-28163
    https://www.cve.org/CVERecord?id=CVE-2023-28176
  (* Security fix *)

Code: Select all

patches/packages/openssh-9.3p1-i586-1_slack15.0.txz:  Upgraded.
  This release contains fixes for a security problem and a memory
  safety problem. The memory safety problem is not believed to be
  exploitable, but we report most network-reachable memory faults as
  security bugs.
  For more information, see:
    https://www.openssh.com/txt/release-9.3
  (* Security fix *)
Top
Use the source, Luke
SSZ irc kanal
Spread the Word, “CHOOSE SLACK! and Don’t look back.”

Locked

Return to “Novosti”

Who is online

Users browsing this forum: No registered users and 2 guests