https://www.sya54m.eu Latest 20 entries in the Slackware-15.0 ChangeLog https://www.sya54m.eu/immagini/s256.png https://www.sya54m.eu en Mon, 13 Jul 2026 01:23:28 +0200 Wed, 15 Jul 2026 18:30:09 +0200 www.sya54m.eu https://www.sya54m.eu Mon, 13 Jul 2026 01:23:28 +0200 1783898608 testing/packages/rust-1.97.0-i686-1_slack15.0.txz:  Upgraded.
  Add rustdoc to tools= in the bootstrap.toml because it no longer gets
  installed otherwise.
  Thanks to ZlatkO.
]]> https://www.sya54m.eu Sat, 11 Jul 2026 00:25:39 +0200 1783722339 patches/packages/p11-kit-0.26.4-i586-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  server: fixed stack exhaustion via unbounded recursion in RPC attribute
  parsing by enforcing a recursion depth limit.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-13757
  (* Security fix *)
]]> https://www.sya54m.eu Fri, 10 Jul 2026 01:55:49 +0200 1783641349 patches/packages/glibc-zoneinfo-2026c-noarch-1_slack15.0.txz:  Upgraded.
  This package provides the latest timezone updates.
extra/tigervnc/tigervnc-1.16.2-i586-4_slack15.0.txz:  Rebuilt.
  Recompiled against xorg-server-1.20.14, including patches for
  security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)
]]> https://www.sya54m.eu Wed, 08 Jul 2026 23:48:24 +0200 1783547304 patches/packages/c-ares-1.34.8-i586-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
patches/packages/libXfont2-2.0.8-i586-1_slack15.0.txz:  Upgraded.
  This update fixes security issues:
  BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow.
  PCF Font Parsing Heap Buffer Overflow.
  computeProps Property Buffer Heap Buffer Overflow.
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062253.html
    https://www.cve.org/CVERecord?id=CVE-2026-56001
    https://www.cve.org/CVERecord?id=CVE-2026-56002
    https://www.cve.org/CVERecord?id=CVE-2026-56003
  (* Security fix *)
patches/packages/proftpd-1.3.9c-i586-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  ExecEnviron values not passed due to regression since 1.3.8.d.
  Stack buffer overflow in MLSD/MLST handling for long path names.
  MaxTransfersPerUser no longer enforces configured limits.
  AdminControlsACLs for config, get actions not honored as they should be.
  Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
  buffers without bounds checking.
  RewriteMap unescape builtin use causes one-byte out-of-bounds write,
  fails to reject illegal characters.
  SQL group name lookup concatenates client-provided group names without
  escaping.
  Authenticated SFTP sessions can overflow the SFTP packet buffer.
  Default Controls socket ACLs unintentionally allow all users access for
  sending Controls requests.
  (* Security fix *)
patches/packages/xorg-server-1.20.14-i586-21_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-21_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-19_slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  glamor Font Atlas Heap Buffer Overflow.
  GLX contextTags Use-After-Free in CommonMakeCurrent().
  For more information, see:
    https://lists.x.org/archives/xorg/2026-July/062255.html
    https://www.cve.org/CVERecord?id=CVE-2026-55999
    https://www.cve.org/CVERecord?id=CVE-2026-56000
  (* Security fix *)
]]> https://www.sya54m.eu Tue, 07 Jul 2026 23:49:57 +0200 1783460997 patches/packages/tftp-hpa-5.4-i586-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  Fix several security-relevant bugs in path validation
  (tftpd/path.c): an uninitialized buffer read and a broken
  path tokenizer could let a crafted or unlucky request bypass
  path restrictions or crash the daemon.
  Fix buffer overflows in the tftp client: an unbounded strcpy()
  when building requests, an out-of-bounds write when putting
  multiple files to a remote directory, and an unbounded write
  into the interactive command-line argument array.
  Fix an out-of-bounds read while scanning request fields in
  tftpd, and an incorrect address family used when creating the
  per-transfer socket on platforms without recvmsg().
  (* Security fix *)
]]> https://www.sya54m.eu Tue, 07 Jul 2026 00:46:09 +0200 1783377969 patches/packages/c-ares-1.34.7-i586-1_slack15.0.txz:  Upgraded.
  This release fixes the following security issues:
  Use-after-free / double-free in c-ares' query-completion handling, remotely
  triggerable via ares_getaddrinfo() over TCP.
  CPU-exhaustion denial of service via unbounded DNS name compression pointer
  chains.
  Memory-amplification denial of service via unvalidated DNS header record
  counts.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-33630
    https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
    https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76
    https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
  (* Security fix *)
patches/packages/openssh-10.4p1-i586-1_slack15.0.txz:  Upgraded.
  This release contains a number of security fixes:
  sftp(1): when downloading files on the command-line using
  "sftp host:/path .", a malicious server could cause the file to
  be downloaded to an unexpected location. This issue was identified
  by the Swival Security Scanner.
  scp(1): when copying files between two remote destinations, do
  not allow a malicious server to write files to the parent
  directory of the intended target directory.  This issue was
  identified by the Swival Security Scanner.
  sshd(8): when using the "internal-sftp" SFTP server implementation
  (this is not the default), long command lines were previously
  truncated silently after the 9th argument. If a security-relevant
  option was in the 10th or later position, it would be discarded.
  Reported by Steve Caffrey.
  sshd(8): add a documentation note to mention that the
  GSSAPIStrictAcceptorCheck option is ineffective when the server
  is joined to a Windows Active Directory. Reported by Yarin Aharoni
  of Safebreach.
  sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
  as it was documented to do. Note that PermitTunnel is not enabled
  by default. Reported independently by Huzaifa Sidhpurwala of
  Redhat and Marko Jevtic.
  sshd(8): avoid a potential pre-authentication denial of service
  when GSSAPIAuthentication was enabled (this feature is off by
  default). This was not mitigated by MaxAuthTries, but would be
  penalised by PerSourcePenalties. This was reported by Manfred
  Kaiser of the milCERT AT (Austrian Ministry of Defence).
  sshd(8): fix a number of cases where the minimum authentication
  delay was not being enforced. Reported by the Orange Cyberdefense
  Vulnerability Team.
  ssh(1): fix a possible client-side use-after-free if the server
  changes its host key during a key reexchange. This was reported by
  Zhenpeng (Leo) Lin of Depthfirst.
  For more information, see:
    https://www.openssh.org/releasenotes.html#10.4
  (* Security fix *)
]]> https://www.sya54m.eu Mon, 06 Jul 2026 00:39:09 +0200 1783291149 extra/php82/php82-8.2.32-i586-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  OpenSSL: Fixed memory corruption (zend_mm_heap corrupted) in
  openssl_encrypt with AES-WRAP-PAD.
  For more information, see:
    https://www.php.net/ChangeLog-8.php#8.2.32
    https://www.cve.org/CVERecord?id=CVE-2026-14355
  (* Security fix *)
]]> https://www.sya54m.eu Sun, 05 Jul 2026 23:18:31 +0200 1783286311 patches/packages/mutt-2.4.1-i586-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Prevent unsigned int overflow in imap_cmd_step buffer growth.
  The idata->blen field is unsigned int (32-bit) while the companion
  variable len is size_t (64-bit on LP64). When a malicious IMAP server
  sends a response line longer than UINT_MAX bytes without newline, the
  expression wraps to a small value, causing safe_realloc() to shrink the
  buffer while len retains its original huge value. The subsequent
  mutt_socket_readln() then writes far past the shrunken allocation.
  Fix by changing idata->blen from unsigned int to size_t, matching the
  type of len and preventing the overflow on all platforms.
  (* Security fix *)
]]> https://www.sya54m.eu Sat, 04 Jul 2026 00:58:14 +0200 1783119494 patches/packages/libseccomp-2.6.1-i586-1_slack15.0.txz:  Upgraded.
  This update fixes bugs and security issues:
  Fix incorrect 64-bit comparison merge that can weaken libseccomp filters.
  Fix issue where oversized libseccomp filters can trigger a double free.
  Fix issue where oversized libseccomp filters can trigger a heap corruption.
  For more information, see:
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx
    https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm`
  (* Security fix *)
]]> https://www.sya54m.eu Thu, 02 Jul 2026 01:55:11 +0200 1782950111 patches/packages/libevent-2.1.13-i586-1_slack15.0.txz:  Upgraded.
  This release contains several security fixes, affecting users of the
  following modules: evbuffer, bufferevent, evtag, evrpc, evdns, evhttp.
  If you have a program that uses one of those modules you should upgrade.
  (* Security fix *)
patches/packages/mozilla-thunderbird-140.12.1esr-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/140.12.1esr/releasenotes/
  (* Security fix *)
]]> https://www.sya54m.eu Wed, 01 Jul 2026 01:25:25 +0200 1782861925 patches/packages/gmime-3.2.15-i586-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
  Thanks to Lockywolf.
]]> https://www.sya54m.eu Thu, 25 Jun 2026 23:03:32 +0200 1782421412 patches/packages/fetchmail-6.4.27-i586-3_slack15.0.txz:  Rebuilt.
  This release contains an important bugfix:
  The IMAP client, which has always used message indexes for the selected
  mailbox, did not abort when receiving an EXPUNGE response - which changes
  message numbers inside the mailbox.  Unlike UIDs, the message numbers are
  not stable and fetchmail does not have internal interfaces to track which
  messages are deleted, and adding those to a 6.6.X release would be too
  risky, and switching to UID is also too big a change, so we have no
  choice but to abort the session when seeing an EXPUNGE response without
  our own EXPUNGE request, to avoid marking the wrong message as seen/deleted
  or skip the wrong one, or assume the wrong message size.
  Earl Chew reported this versus Yahoo Mail via Gitlab Work Item #91, which
  automatically expunges messages that are marked with the \Deleted flag.
]]> https://www.sya54m.eu Wed, 24 Jun 2026 01:52:16 +0200 1782258736 patches/packages/libarchive-3.8.8-i586-1_slack15.0.txz:  Upgraded.
  Libarchive 3.8.8 is a security, bugfix and minor feature release.
  For more information, see:
    https://github.com/libarchive/libarchive/releases/tag/v3.8.8
  (* Security fix *)
]]> https://www.sya54m.eu Sat, 20 Jun 2026 23:07:46 +0200 1781989666 patches/packages/ffmpeg-4.4.7-i586-1_slack15.0.txz:  Upgraded.
  This is a bugfix release.
]]> https://www.sya54m.eu Thu, 18 Jun 2026 23:09:08 +0200 1781816948 patches/packages/libidn-1.44-i586-1_slack15.0.txz:  Upgraded.
  Looks like I typoed the $BUILD number on the previous packages (1-slack15.0
  instead of 1_slack15.0). That extra dash made it a malformed package name
  and prevented it from being recognized as an upgrade to the libidn package.
  This has been corrected.
  Thanks to drumz for the report.
]]> https://www.sya54m.eu Thu, 18 Jun 2026 01:29:52 +0200 1781738992 patches/packages/libinput-1.30.4-i586-1_slack15.0.txz:  Upgraded.
  Switch to libinput-1.30.4 which contains the recent CVE fix, but does
  not break the API so that wlroots won't build.
  Thanks to falcon314.  
]]> https://www.sya54m.eu Wed, 17 Jun 2026 23:45:03 +0200 1781732703 patches/packages/bind-9.18.50-i586-1_slack15.0.txz:  Upgraded.
  This update fixes a security issue:
  Fix DNS64 owner case after DNAME restart.
  When BIND 9 is configured to use DNS64 and encounters a DNAME
  redirect, it could end up using freed memory for the DNS response
  owner name. This caused the response to contain corrupted data. This
  fix ensures the correct owner name is used when constructing the
  synthesized response after a DNAME redirect.
  ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
  (* Security fix *)
patches/packages/libidn-1.44-i586-1-slack15.0.txz:  Rebuilt.
  This update fixes security issues:
  libidn: Fix read-out-of-bounds error in ToUnicode APIs.
  examples: Fix strcpy buffer overflow.
  For more information, see:
    https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html
    https://lists.gnu.org/archive/html/help-libidn/2025-06/msg00000.html
  (* Security fix *)
patches/packages/mozilla-firefox-140.12.0esr-i686-1_slack15.0.txz:  Upgraded.
  This update contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/firefox/140.12.0/releasenotes/
    https://www.mozilla.org/security/advisories/mfsa2026-58
    https://www.cve.org/CVERecord?id=CVE-2026-12289
    https://www.cve.org/CVERecord?id=CVE-2026-12290
    https://www.cve.org/CVERecord?id=CVE-2026-12291
    https://www.cve.org/CVERecord?id=CVE-2026-12292
    https://www.cve.org/CVERecord?id=CVE-2026-12294
    https://www.cve.org/CVERecord?id=CVE-2026-12295
    https://www.cve.org/CVERecord?id=CVE-2026-12298
    https://www.cve.org/CVERecord?id=CVE-2026-12296
    https://www.cve.org/CVERecord?id=CVE-2026-12297
    https://www.cve.org/CVERecord?id=CVE-2026-12299
    https://www.cve.org/CVERecord?id=CVE-2026-12329
    https://www.cve.org/CVERecord?id=CVE-2026-12302
    https://www.cve.org/CVERecord?id=CVE-2026-12304
    https://www.cve.org/CVERecord?id=CVE-2026-12305
    https://www.cve.org/CVERecord?id=CVE-2026-12306
    https://www.cve.org/CVERecord?id=CVE-2026-12307
    https://www.cve.org/CVERecord?id=CVE-2026-12308
    https://www.cve.org/CVERecord?id=CVE-2026-12309
    https://www.cve.org/CVERecord?id=CVE-2026-12310
    https://www.cve.org/CVERecord?id=CVE-2026-12311
    https://www.cve.org/CVERecord?id=CVE-2026-12312
    https://www.cve.org/CVERecord?id=CVE-2026-12313
    https://www.cve.org/CVERecord?id=CVE-2026-12314
    https://www.cve.org/CVERecord?id=CVE-2026-12315
    https://www.cve.org/CVERecord?id=CVE-2026-12330
    https://www.cve.org/CVERecord?id=CVE-2026-12324
    https://www.cve.org/CVERecord?id=CVE-2026-12325
    https://www.cve.org/CVERecord?id=CVE-2026-12327
    https://www.cve.org/CVERecord?id=CVE-2026-12328
  (* Security fix *)
patches/packages/mozilla-thunderbird-140.12.0esr-i686-1_slack15.0.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    https://www.mozilla.org/en-US/thunderbird/140.12.0esr/releasenotes/
    https://www.mozilla.org/en-US/security/advisories/mfsa2026-61/
    https://www.cve.org/CVERecord?id=CVE-2026-12289
    https://www.cve.org/CVERecord?id=CVE-2026-12290
    https://www.cve.org/CVERecord?id=CVE-2026-12291
    https://www.cve.org/CVERecord?id=CVE-2026-12292
    https://www.cve.org/CVERecord?id=CVE-2026-12294
    https://www.cve.org/CVERecord?id=CVE-2026-12295
    https://www.cve.org/CVERecord?id=CVE-2026-12298
    https://www.cve.org/CVERecord?id=CVE-2026-12296
    https://www.cve.org/CVERecord?id=CVE-2026-12297
    https://www.cve.org/CVERecord?id=CVE-2026-12299
    https://www.cve.org/CVERecord?id=CVE-2026-12329
    https://www.cve.org/CVERecord?id=CVE-2026-12302
    https://www.cve.org/CVERecord?id=CVE-2026-12304
    https://www.cve.org/CVERecord?id=CVE-2026-12305
    https://www.cve.org/CVERecord?id=CVE-2026-12306
    https://www.cve.org/CVERecord?id=CVE-2026-12307
    https://www.cve.org/CVERecord?id=CVE-2026-12308
    https://www.cve.org/CVERecord?id=CVE-2026-12309
    https://www.cve.org/CVERecord?id=CVE-2026-12310
    https://www.cve.org/CVERecord?id=CVE-2026-12311
    https://www.cve.org/CVERecord?id=CVE-2026-12312
    https://www.cve.org/CVERecord?id=CVE-2026-12313
    https://www.cve.org/CVERecord?id=CVE-2026-12314
    https://www.cve.org/CVERecord?id=CVE-2026-12315
    https://www.cve.org/CVERecord?id=CVE-2026-12330
    https://www.cve.org/CVERecord?id=CVE-2026-12324
    https://www.cve.org/CVERecord?id=CVE-2026-12325
    https://www.cve.org/CVERecord?id=CVE-2026-12327
    https://www.cve.org/CVERecord?id=CVE-2026-12328
  (* Security fix *)
patches/packages/net-tools-20181103_0eebece-i586-5_slack15.0.txz:  Rebuilt.
  The upstream patch for CVE-2025-46836 introduced a regression that broke
  packet and byte reporting. Thanks to jtsn for a working alternate patch.
patches/packages/openssl-1.1.1zh-i586-1_slack15.0.txz:  Upgraded.
  Apply patch to fix the following security issues:
  Heap Buffer Over-read in ASN.1 Content Parsing.
  Possible NULL Dereference in Password-Based CMS Decryption.
  Heap Use-After-Free in the PKCS7_verify() Function.
  Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion.
  Out-of-Bounds Read in CMS Password-Based Decryption.
  These CVEs were fixed by the 1.1.1zh release that is only available to
  subscribers to OpenSSL's premium extended support. The patch was prepared
  by backporting from the OpenSSL-3.0 repo.
  Thanks to Ken Zalewski for the patch!
  For more information, see:
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-34180
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
    https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
    https://www.cve.org/CVERecord?id=CVE-2026-34180
    https://www.cve.org/CVERecord?id=CVE-2026-42766
    https://www.cve.org/CVERecord?id=CVE-2026-45447
    https://www.cve.org/CVERecord?id=CVE-2026-7383
    https://www.cve.org/CVERecord?id=CVE-2026-9076
  (* Security fix *)
patches/packages/openssl-solibs-1.1.1zh-i586-1_slack15.0.txz:  Upgraded.
]]> https://www.sya54m.eu Tue, 16 Jun 2026 23:35:01 +0200 1781645701 patches/packages/ca-certificates-20260616-noarch-1_slack15.0.txz:  Upgraded.
  This update provides the latest CA certificates to check for the
  authenticity of SSL connections.
]]> https://www.sya54m.eu Tue, 16 Jun 2026 01:27:31 +0200 1781566051 patches/packages/dev86-0.16.21-i586-5_slack15.0.txz:  Rebuilt.
  bcc: patched to account for ${LIBDIRSUFFIX}.
  Thanks to tauon.
]]> https://www.sya54m.eu Wed, 10 Jun 2026 22:15:05 +0200 1781122505 patches/packages/httpd-2.4.68-i586-1_slack15.0.txz:  Upgraded.
  This is a bugfix release (CVE-2026-49975 was already patched here.)
  For more information, see:
    https://downloads.apache.org/httpd/CHANGES_2.4.68
]]>