Slackwarearm-15.0 ChangeLog

Sat Jul 11 08:08:08 UTC 2026

Sat, 11 Jul 2026 10:08:08 +0200

extra/tigervnc/tigervnc-1.16.2-arm-4_slack15.0.txz:  Rebuilt.
  Recompiled against xorg-server-1.20.14, including patches for
  security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)
patches/packages/glibc-zoneinfo-2026c-noarch-1_slack15.0.txz:  Upgraded.
  This package provides the latest timezone updates.
patches/packages/p11-kit-0.26.4-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  server: fixed stack exhaustion via unbounded recursion in RPC attribute
  parsing by enforcing a recursion depth limit.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-13757
  (* Security fix *)

Thu Jul 09 08:08:08 UTC 2026

Thu, 09 Jul 2026 10:08:08 +0200

testing/packages/autoconf-2.73-noarch-1_slack15.0.txz:  Added.
patches/packages/c-ares-1.34.8-arm-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
patches/packages/libXfont2-2.0.8-arm-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow.
  PCF Font Parsing Heap Buffer Overflow.
  computeProps Property Buffer Heap Buffer Overflow.
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062253.html
    https://www.cve.org/CVERecord?id=CVE-2026-56001
    https://www.cve.org/CVERecord?id=CVE-2026-56002
    https://www.cve.org/CVERecord?id=CVE-2026-56003
  (* Security fix *)
patches/packages/proftpd-1.3.9c-arm-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  ExecEnviron values not passed due to regression since 1.3.8.d.
  Stack buffer overflow in MLSD/MLST handling for long path names.
  MaxTransfersPerUser no longer enforces configured limits.
  AdminControlsACLs for config, get actions not honored as they should be.
  Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
  buffers without bounds checking.
  RewriteMap unescape builtin use causes one-byte out-of-bounds write,
  fails to reject illegal characters.
  SQL group name lookup concatenates client-provided group names without
  escaping.
  Authenticated SFTP sessions can overflow the SFTP packet buffer.
  Default Controls socket ACLs unintentionally allow all users access for
  sending Controls requests.
  (* Security fix *)
patches/packages/tftp-hpa-5.4-arm-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  Fix several security-relevant bugs in path validation
  (tftpd/path.c): an uninitialized buffer read and a broken
  path tokenizer could let a crafted or unlucky request bypass
  path restrictions or crash the daemon.
  Fix buffer overflows in the tftp client: an unbounded strcpy()
  when building requests, an out-of-bounds write when putting
  multiple files to a remote directory, and an unbounded write
  into the interactive command-line argument array.
  Fix an out-of-bounds read while scanning request fields in
  tftpd, and an incorrect address family used when creating the
  per-transfer socket on platforms without recvmsg().
  (* Security fix *)
patches/packages/xorg-server-1.20.14-arm-21_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-arm-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-arm-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-arm-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-arm-13_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)

Tue Jul 07 08:08:08 UTC 2026

Tue, 07 Jul 2026 10:08:08 +0200

extra/php82/php82-8.2.32-arm-1.txz:  Upgraded.
  This update fixes a security issue:
  OpenSSL: Fixed memory corruption (zend_mm_heap corrupted) in
  openssl_encrypt with AES-WRAP-PAD.
  For more information, see:
    https://www.php.net/ChangeLog-8.php#8.2.32
    https://www.cve.org/CVERecord?id=CVE-2026-14355
  (* Security fix *)
patches/packages/c-ares-1.34.7-arm-1_slack15.0.txz:  Upgraded.
  This release fixes the following security issues:
  Use-after-free / double-free in c-ares' query-completion handling, remotely
  triggerable via ares_getaddrinfo() over TCP.
  CPU-exhaustion denial of service via unbounded DNS name compression pointer
  chains.
  Memory-amplification denial of service via unvalidated DNS header record
  counts.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-33630
    https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
    https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76
    https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
  (* Security fix *)
patches/packages/mutt-2.4.1-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Prevent unsigned int overflow in imap_cmd_step buffer growth.
  The idata->blen field is unsigned int (32-bit) while the companion
  variable len is size_t (64-bit on LP64). When a malicious IMAP server
  sends a response line longer than UINT_MAX bytes without newline, the
  expression wraps to a small value, causing safe_realloc() to shrink the
  buffer while len retains its original huge value. The subsequent
  mutt_socket_readln() then writes far past the shrunken allocation.
  Fix by changing idata->blen from unsigned int to size_t, matching the
  type of len and preventing the overflow on all platforms.
  (* Security fix *)
patches/packages/openssh-10.4p1-arm-1_slack15.0.txz:  Upgraded.
  This release contains a number of security fixes:
  sftp(1): when downloading files on the command-line using
  "sftp host:/path .", a malicious server could cause the file to
  be downloaded to an unexpected location. This issue was identified
  by the Swival Security Scanner.
  scp(1): when copying files between two remote destinations, do
  not allow a malicious server to write files to the parent
  directory of the intended target directory.  This issue was
  identified by the Swival Security Scanner.
  sshd(8): when using the "internal-sftp" SFTP server implementation
  (this is not the default), long command lines were previously
  truncated silently after the 9th argument. If a security-relevant
  option was in the 10th or later position, it would be discarded.
  Reported by Steve Caffrey.
  sshd(8): add a documentation note to mention that the
  GSSAPIStrictAcceptorCheck option is ineffective when the server
  is joined to a Windows Active Directory. Reported by Yarin Aharoni
  of Safebreach.
  sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
  as it was documented to do. Note that PermitTunnel is not enabled
  by default. Reported independently by Huzaifa Sidhpurwala of
  Redhat and Marko Jevtic.
  sshd(8): avoid a potential pre-authentication denial of service
  when GSSAPIAuthentication was enabled (this feature is off by
  default). This was not mitigated by MaxAuthTries, but would be
  penalised by PerSourcePenalties. This was reported by Manfred
  Kaiser of the milCERT AT (Austrian Ministry of Defence).
  sshd(8): fix a number of cases where the minimum authentication
  delay was not being enforced. Reported by the Orange Cyberdefense
  Vulnerability Team.
  ssh(1): fix a possible client-side use-after-free if the server
  changes its host key during a key reexchange. This was reported by
  Zhenpeng (Leo) Lin of Depthfirst.
  For more information, see:
    https://www.openssh.org/releasenotes.html#10.4
  (* Security fix *)

Sat Jul 04 08:08:08 UTC 2026

Sat, 04 Jul 2026 10:08:08 +0200

patches/packages/libseccomp-2.6.1-arm-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  Fix incorrect 64-bit comparison merge that can weaken libseccomp filters.
  Fix issue where oversized libseccomp filters can trigger a double free.
  Fix issue where oversized libseccomp filters can trigger a heap corruption.
  For more information, see:
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm`
  (* Security fix *)

Fri Jul 03 08:08:08 UTC 2026

Fri, 03 Jul 2026 10:08:08 +0200

patches/packages/gmime-3.2.15-arm-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  Thanks to Lockywolf.
patches/packages/libevent-2.1.13-arm-1_slack15.0.txz:  Upgraded.
  This release contains several security fixes, affecting users of the
  following modules: evbuffer, bufferevent, evtag, evrpc, evdns, evhttp.
  If you have a program that uses one of those modules you should upgrade.
  (* Security fix *)

Mon Jun 29 08:08:08 UTC 2026

Mon, 29 Jun 2026 10:08:08 +0200

patches/packages/fetchmail-6.4.27-arm-3_slack15.0.txz:  Rebuilt.
  This release contains an important bugfix:
  The IMAP client, which has always used message indexes for the selected
  mailbox, did not abort when receiving an EXPUNGE response - which changes
  message numbers inside the mailbox.  Unlike UIDs, the message numbers are
  not stable and fetchmail does not have internal interfaces to track which
  messages are deleted, and adding those to a 6.6.X release would be too
  risky, and switching to UID is also too big a change, so we have no
  choice but to abort the session when seeing an EXPUNGE response without
  our own EXPUNGE request, to avoid marking the wrong message as seen/deleted
  or skip the wrong one, or assume the wrong message size.
  Earl Chew reported this versus Yahoo Mail via Gitlab Work Item #91, which
  automatically expunges messages that are marked with the \Deleted flag.

Wed Jun 24 08:08:08 UTC 2026

Wed, 24 Jun 2026 10:08:08 +0200

If you appreciate what we're doing with Slackware Linux on ARM, please consider
making a donation to support the project. Contributions go directly toward
maintaining essential build hardware, covering electricity costs, and keeping
this long-running labour of love alive and moving forward.
Every bit helps and is genuinely appreciated.

You can find out how to contribute here:
  https://arm.slackware.com/sponsor/

Thank you for your continued support!

  Stuart Winter

patches/packages/libarchive-3.8.8-arm-1_slack15.0.txz:  Upgraded.
  Libarchive 3.8.8 is a security, bugfix and minor feature release.
  For more information, see:
    https://github.com/libarchive/libarchive/releases/tag/v3.8.8
  (* Security fix *)

Thu Jun 18 08:08:08 UTC 2026

Thu, 18 Jun 2026 10:08:08 +0200

patches/packages/bind-9.18.50-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Fix DNS64 owner case after DNAME restart.
  When BIND 9 is configured to use DNS64 and encounters a DNAME
  redirect, it could end up using freed memory for the DNS response
  owner name. This caused the response to contain corrupted data. This
  fix ensures the correct owner name is used when constructing the
  synthesized response after a DNAME redirect.
  ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
  (* Security fix *)
patches/packages/ca-certificates-20260616-noarch-1_slack15.0.txz:  Upgraded.
  This update provides the latest CA certificates to check for the
  authenticity of SSL connections.
patches/packages/libidn-1.44-arm-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  libidn: Fix read-out-of-bounds error in ToUnicode APIs.
  examples: Fix strcpy buffer overflow.
  For more information, see:
    https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html
    https://lists.gnu.org/archive/html/help-libidn/2025-06/msg00000.html
  (* Security fix *)
patches/packages/libinput-1.30.4-arm-1_slack15.0.txz:  Upgraded.
  Switch to libinput-1.30.4 which contains the recent CVE fix, but does
  not break the API so that wlroots won't build.
  Thanks to falcon314.
patches/packages/net-tools-20181103_0eebece-arm-4_slack15.0.txz:  Rebuilt.
  The upstream patch for CVE-2025-46836 introduced a regression that broke
  packet and byte reporting. Thanks to jtsn for a working alternate patch.
patches/packages/openssl-1.1.1zh-arm-1_slack15.0.txz:  Upgraded.
  Apply patch to fix the following security issues:
  Heap Buffer Over-read in ASN.1 Content Parsing.
  Possible NULL Dereference in Password-Based CMS Decryption.
  Heap Use-After-Free in the PKCS7_verify() Function.
  Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.
  Out-of-Bounds Read in CMS Password-Based Decryption.
  These CVEs were fixed by the 1.1.1zh release that is only available to
  subscribers to OpenSSL's premium extended support. The patch was prepared
  by backporting from the OpenSSL-3.0 repo.
  Thanks to Ken Zalewski for the patch!
  For more information, see:
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-34180
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
    https://www.cve.org/CVERecord?id=CVE-2026-34180
    https://www.cve.org/CVERecord?id=CVE-2026-42766
    https://www.cve.org/CVERecord?id=CVE-2026-45447
    https://www.cve.org/CVERecord?id=CVE-2026-7383
    https://www.cve.org/CVERecord?id=CVE-2026-9076
  (* Security fix *)
patches/packages/openssl-solibs-1.1.1zh-arm-1_slack15.0.txz:  Upgraded.

Fri Jun 12 08:08:08 UTC 2026

Fri, 12 Jun 2026 10:08:08 +0200

If you appreciate what we're doing with Slackware Linux on ARM, please consider
making a donation to support the project. Contributions go directly toward
maintaining essential build hardware, covering electricity costs, and keeping
this long-running labour of love alive and moving forward.
Every bit helps and is genuinely appreciated.

You can find out how to contribute here:
  https://arm.slackware.com/sponsor/

Thank you for your continued support!

  Stuart Winter

patches/packages/httpd-2.4.68-arm-1_slack15.0.txz:  Upgraded.
  This is a bugfix release (CVE-2026-49975 was already patched here.)
  For more information, see:
    https://downloads.apache.org/httpd/CHANGES_2.4.68

Tue Jun 09 08:08:08 UTC 2026

Tue, 09 Jun 2026 10:08:08 +0200

extra/samba/samba-4.22.10-arm-1.txz:  Upgraded.
  This is a security release in order to address the following defects:
  Missing access checks on reparse point operations.
  WORM vfs module does not block overwrites.
  auto-enrolment GPO installing CA certificate over http without verification.
  Denial of service against AD DC WINS server.
  Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR server.
  Unauthenticated Remote Code Execution in Samba printing subsystem.
  For more information, see:
    https://www.samba.org/samba/security/CVE-2026-1933.html
    https://www.samba.org/samba/security/CVE-2026-2340.html
    https://www.samba.org/samba/security/CVE-2026-3012.html
    https://www.samba.org/samba/security/CVE-2026-3238.html
    https://www.samba.org/samba/security/CVE-2026-4408.html
    https://www.samba.org/samba/security/CVE-2026-4480.html
    https://www.cve.org/CVERecord?id=CVE-2026-1933
    https://www.cve.org/CVERecord?id=CVE-2026-2340
    https://www.cve.org/CVERecord?id=CVE-2026-3012
    https://www.cve.org/CVERecord?id=CVE-2026-3238
    https://www.cve.org/CVERecord?id=CVE-2026-4408
    https://www.cve.org/CVERecord?id=CVE-2026-4480
  (* Security fix *)
patches/packages/rsync-3.4.4-arm-1_slack15.0.txz:  Upgraded.
  Rsync version 3.4.4 has been released. This is a regression fix release for
  the issues that have been reported with the 3.4.3 security release. Many
  thanks to everyone who reported the issues (see NEWS.md for credits).
  The 3.4.3 release had so many issues for two main reasons:
  * the 3.4 testsuite did not have broad enough coverage to catch the
    regressions noticed by users
  * the nature of a security release prevents wide beta testing, resulting in
    not enough manual testing in disparate environments
  To fix this for future releases we have greatly expanded the test suite for
  3.5 (currently in master) and grown the development team, especially with
  more people with security expertise. Thanks for your patience!

Fri Jun 05 08:08:08 UTC 2026

Fri, 05 Jun 2026 10:08:08 +0200

patches/packages/dnsmasq-2.93-arm-1_slack15.0.txz:  Upgraded.
  Rework storage allocation for domain names. This fixes a security bug that
  can cause heap-overwrite with long domain names.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-2291
  (* Security fix *)
patches/packages/libinput-1.31.3-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  libinput-device-group unescaped phys output can inject udev properties
  leading to arbitrary root code execution.
  Note that since /dev/uinput and /dev/uhid are only accessible by root on
  Slackware (and unlike some other distributions we make no exceptions), we
  were not vulnerable to this flaw.
  (* Security fix *)
patches/packages/meson-1.11.1-arm-1_slack15.0.txz:  Upgraded.
  This is needed to compile libinput-1.31.3.

Thu Jun 04 08:08:08 UTC 2026

Thu, 04 Jun 2026 10:08:08 +0200

extra/tigervnc/tigervnc-1.16.2-arm-3_slack15.0.txz:  Rebuilt.
  Patched with fixes for the following xorg-server security issues:
  Font Alias Stack-based Buffer Overflow.
  XSYNC Use-After-Free in miSyncDestroyFence().
  XKB Key Types Stack-based Buffer Overflow.
  XKB SetMap Request Stack-based Buffer Overflow.
  XSYNC Use-After-Free in FreeCounter().
  XSYNC Use-After-Free in SyncChangeCounter().
  GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write.
  CreateSaverWindow Use-After-Free Information Disclosure.
  DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write.
  For more information, see:
    https://lists.x.org/archives/xorg/2026-June/062239.html
    Zero Day Initiative identifiers:
    ZDI-CAN-30136
    ZDI-CAN-30159
    ZDI-CAN-30160
    ZDI-CAN-30161
    ZDI-CAN-30163
    ZDI-CAN-30164
    ZDI-CAN-30165
    ZDI-CAN-30168
  (* Security fix *)
patches/packages/httpd-2.4.67-arm-2_slack15.0.txz:  Rebuilt.
  This update fixes "HTTP/2 Bomb", a resource exhaustion denial-of-service
  attack against HTTP/2.
  For more information, see:
    https://seclists.org/oss-sec/2026/q2/790
    https://www.cve.org/CVERecord?id=CVE-2026-49975
  (* Security fix *)
patches/packages/net-tools-20181103_0eebece-arm-3_slack15.0.txz:  Rebuilt.
  This update fixes a security issue:
  interface.c: Stack-based Buffer Overflow in get_name().
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2025-46836
  (* Security fix *)
patches/packages/proftpd-1.3.9b-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Additional fixes for SQL injection, notably for handling `%{env:...}`
  and `%{note:...}` variables.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-42167
  (* Security fix *)
patches/packages/xorg-server-1.20.14-arm-20_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  Font Alias Stack-based Buffer Overflow.
  XSYNC Use-After-Free in miSyncDestroyFence().
  XKB Key Types Stack-based Buffer Overflow.
  XKB SetMap Request Stack-based Buffer Overflow.
  XSYNC Use-After-Free in FreeCounter().
  XSYNC Use-After-Free in SyncChangeCounter().
  GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write.
  CreateSaverWindow Use-After-Free Information Disclosure.
  DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write.
  For more information, see:
    https://lists.x.org/archives/xorg/2026-June/062239.html
    Zero Day Initiative identifiers:
    ZDI-CAN-30136
    ZDI-CAN-30159
    ZDI-CAN-30160
    ZDI-CAN-30161
    ZDI-CAN-30163
    ZDI-CAN-30164
    ZDI-CAN-30165
    ZDI-CAN-30168
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-arm-20_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-arm-20_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-arm-20_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-arm-12_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  Font Alias Stack-based Buffer Overflow.
  XSYNC Use-After-Free in miSyncDestroyFence().
  XKB Key Types Stack-based Buffer Overflow.
  XKB SetMap Request Stack-based Buffer Overflow.
  XSYNC Use-After-Free in FreeCounter().
  XSYNC Use-After-Free in SyncChangeCounter().
  GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write.
  CreateSaverWindow Use-After-Free Information Disclosure.
  For more information, see:
    https://lists.x.org/archives/xorg/2026-June/062239.html
    Zero Day Initiative identifiers:
    ZDI-CAN-30136
    ZDI-CAN-30159
    ZDI-CAN-30160
    ZDI-CAN-30161
    ZDI-CAN-30163
    ZDI-CAN-30164
    ZDI-CAN-30165
    ZDI-CAN-30168
  (* Security fix *)

Tue Jun 02 08:08:08 UTC 2026

Tue, 02 Jun 2026 10:08:08 +0200

patches/packages/linux-5.15.209/*:  Upgraded.
  This update fixes security issues:
  rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
  rxrpc: Fix anonymous key handling
  rxrpc: only handle RESPONSE during service challenge
  rxrpc: Fix recvmsg() unconditional requeue
  rxrpc: reject undecryptable rxkad response tickets
  rxrpc: Fix call removal to use RCU safe deletion
  rxrpc: Fix key quota calculation for multitoken keys
  rxrpc: proc: size address buffers for %pISpc output
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-31696
    https://www.cve.org/CVERecord?id=CVE-2026-31676
    https://www.cve.org/CVERecord?id=CVE-2026-23066
    https://www.cve.org/CVERecord?id=CVE-2026-31637
    https://www.cve.org/CVERecord?id=CVE-2026-31642
    https://www.cve.org/CVERecord?id=CVE-2026-31630
  (* Security fix *)

Tue May 26 08:08:08 UTC 2026

Tue, 26 May 2026 10:08:08 +0200

Hello!

If you appreciate what we're doing with Slackware Linux on ARM, please consider
making a donation to support the project. Contributions go directly toward
maintaining essential build hardware, covering electricity costs, and keeping
this long-running labour of love alive and moving forward.
Every bit helps and is genuinely appreciated.

You can find out how to contribute here:
  https://arm.slackware.com/sponsor/

Thank you for your continued support!

  Stuart Winter

patches/packages/lxc-4.0.12-arm-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  Thanks to fourtysixandtwo.

Mon May 25 08:08:08 UTC 2026

Mon, 25 May 2026 10:08:08 +0200

patches/packages/linux-5.15.208/*:  Upgraded.
  This update fixes security issues:
  net: skbuff: propagate shared-frag marker through frag-transfer helpers.
  net: skbuff: preserve shared-frag marker during coalescing.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-43503
    https://www.cve.org/CVERecord?id=CVE-2026-46300
  (* Security fix *)

Thu May 21 08:08:08 UTC 2026

Thu, 21 May 2026 10:08:08 +0200

patches/packages/bind-9.18.49-arm-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  Fix outgoing zone transfers' quota issue.
  Limit resolver server list size.
  Fix GSS-API resource leak.
  Avoid unbounded recursion loop.
  Disable recursion, UPDATE, and NOTIFY for non-IN views.
  For more information, see:
    https://kb.isc.org/docs/CVE-2026-3592
    https://kb.isc.org/docs/CVE-2026-3039
    https://kb.isc.org/docs/CVE-2026-5947
    https://kb.isc.org/docs/CVE-2026-5950
    https://kb.isc.org/docs/CVE-2026-5946
    https://www.cve.org/CVERecord?id=CVE-2026-3592
    https://www.cve.org/CVERecord?id=CVE-2026-3039
    https://www.cve.org/CVERecord?id=CVE-2026-5947
    https://www.cve.org/CVERecord?id=CVE-2026-5950
    https://www.cve.org/CVERecord?id=CVE-2026-5946
  (* Security fix *)
patches/packages/rsync-3.4.3-arm-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  TOCTOU symlink race condition allowing local privilege escalation in daemon
  mode without chroot.
  Hostname/ACL bypass on an rsync daemon configured with `daemon chroot = /X`
  in rsyncd.conf when the chroot tree lacks DNS resolution support.
  Integer overflow in the compressed-token decoder enabling remote memory
  disclosure to an authenticated daemon peer.
  Symlink races on path-based system calls in "use chroot = no" daemon mode.
  Out-of-bounds read in the receiver's recv_files() enabling remote
  denial-of-service of any client pulling from a malicious server.
  Off-by-one out-of-bounds stack write in the rsync client's HTTP CONNECT proxy
  handler (`establish_proxy_connection()` in `socket.c`).
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-29518
    https://www.cve.org/CVERecord?id=CVE-2026-43617
    https://www.cve.org/CVERecord?id=CVE-2026-43618
    https://www.cve.org/CVERecord?id=CVE-2026-43619
    https://www.cve.org/CVERecord?id=CVE-2026-43620
    https://www.cve.org/CVERecord?id=CVE-2026-45232
  (* Security fix *)

Wed May 20 08:08:08 UTC 2026

Wed, 20 May 2026 10:08:08 +0200

patches/packages/dcron-4.5-arm-9_slack15.0.txz:  Rebuilt.
  This is a bugfix release.
  Rebase the run-parts script on the latest version from Fedora's crontabs
  package. Thanks to avian.
  rc.crond: ensure world-writable permissions on /run/cron, needed for
  crontab -e with some editors. Thanks to lostintime.
  Add /etc/default/run-parts. Thanks to lostintime.
  run-parts: don't redirect stderr to stdout. Thanks to Thom1b.
  run-parts: skip *.orig files. Thanks to metaed.
  run-parts.8: document skiping *.orig files. Thanks to metaed.
  /etc/default/crond: Set the same minimal PATH that's provided by sysvinit at
  boot time to keep things consistent when using rc.crond restart. This PATH
  will be used both at boot and with a restart through rc.crond. Feel free to
  adjust it if needed. Thanks to Ken Zalewski.
patches/packages/haveged-1.9.21-arm-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Missing exit out of permission check could lead to root exploit.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-41054
  (* Security fix *)

Sun May 17 08:08:08 UTC 2026

Sun, 17 May 2026 10:08:08 +0200

patches/packages/linux-5.15.207/*:  Upgraded.
  This update fixes a security issue:
  ptrace: slightly saner 'get_dumpable()' logic.
  For more information, see:
    https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
    https://www.cve.org/CVERecord?id=CVE-2026-46333
  (* Security fix *)

Sat May 16 08:08:08 UTC 2026

Sat, 16 May 2026 10:08:08 +0200

patches/packages/dnsmasq-2.92rel2-arm-1_slack15.0.txz:  Upgraded.
  This update fixes security issues.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-2291
    https://www.cve.org/CVERecord?id=CVE-2026-4890
    https://www.cve.org/CVERecord?id=CVE-2026-4891
    https://www.cve.org/CVERecord?id=CVE-2026-4892
    https://www.cve.org/CVERecord?id=CVE-2026-4893
    https://www.cve.org/CVERecord?id=CVE-2026-5172
  (* Security fix *)

Wed May 13 08:08:08 UTC 2026

Wed, 13 May 2026 10:08:08 +0200

patches/packages/expat-2.7.5-arm-2_slack15.0.txz:  Rebuilt.
  This update fixes a security issue:
  Fix quadratic runtime from attribute name collision checks that allowed
  denial of service attacks through moderately sized crafted XML input
  (CWE-407). Please note that a layer of compression around XML can
  significantly reduce the minimum attack payload size.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-45186
  (* Security fix *)