Moderatore: Staff
Codice: Seleziona tutto
Thu Oct 8 23:09:33 UTC 2015
patches/packages/mozilla-thunderbird-38.3.0-x86_64-2_slack14.1.txz: Rebuilt.
Recompiled with --enable-calendar.
+--------------------------+Codice: Seleziona tutto
Thu Oct 29 20:12:14 UTC 2015
patches/packages/curl-7.45.0-x86_64-1_slack14.1.txz: Upgraded.
Fixes some security issues.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3145
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3236
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3237
(* Security fix *)
patches/packages/jasper-1.900.1-x86_64-4_slack14.1.txz: Rebuilt.
Applied many security and bug fixes.
Thanks to Heinz Wiesinger.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8137
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8157
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9029
(* Security fix *)
patches/packages/ntp-4.2.8p4-x86_64-1_slack14.1.txz: Upgraded.
In addition to bug fixes and enhancements, this release fixes
several low and medium severity vulnerabilities.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9750
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7851
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7852
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7853
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7854
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7855
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7871
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Fri Nov 6 01:15:43 UTC 2015
patches/packages/mozilla-firefox-38.4.0esr-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
patches/packages/mozilla-nss-3.20.1-x86_64-1_slack14.1.txz: Upgraded.
Upgraded to nss-3.20.1 and nspr-4.10.10.
This release contains security fixes and improvements.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7181
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7183
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Sat Nov 14 21:35:57 UTC 2015
patches/packages/seamonkey-2.39-x86_64-1_slack14.1.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html
(* Security fix *)
patches/packages/seamonkey-solibs-2.39-x86_64-1_slack14.1.txz: Upgraded.
+--------------------------+Codice: Seleziona tutto
Wed Nov 25 06:36:06 UTC 2015
patches/packages/pcre-8.38-x86_64-1_slack14.1.txz: Upgraded.
Fixed overflows that could lead to a denial of service or the execution
of arbitrary code.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3210
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Thu Dec 3 07:28:30 UTC 2015
patches/packages/libpng-1.4.17-x86_64-1_slack14.1.txz: Upgraded.
Fixed buffer overflows in the png_set_PLTE(), png_get_PLTE(),
png_set_tIME(), and png_convert_to_rfc1123() functions that allow
attackers to cause a denial of service (application crash) or
possibly have unspecified other impact via a small bit-depth value
in an IHDR (aka image header) chunk in a PNG image.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7981
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126.
(* Security fix *)
patches/packages/mozilla-thunderbird-38.4.0-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Wed Dec 16 04:21:07 UTC 2015
patches/packages/bind-9.9.8_P2-x86_64-1_slack14.1.txz: Upgraded.
This update fixes three security issues:
Update allowed OpenSSL versions as named is potentially vulnerable
to CVE-2015-3193.
Insufficient testing when parsing a message allowed records with an
incorrect class to be be accepted, triggering a REQUIRE failure when
those records were subsequently cached. (CVE-2015-8000)
Address fetch context reference count handling error on socket error.
(CVE-2015-8461)
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8461
(* Security fix *)
patches/packages/libpng-1.4.18-x86_64-1_slack14.1.txz: Upgraded.
Fixed incorrect implementation of png_set_PLTE() that uses png_ptr
not info_ptr, that left png_set_PLTE() open to the CVE-2015-8126
vulnerability.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472
(* Security fix *)
patches/packages/mozilla-firefox-38.5.0esr-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
patches/packages/openssl-1.0.1q-x86_64-1_slack14.1.txz: Upgraded.
This update fixes the following security issues:
BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193).
Certificate verify crash with missing PSS parameter (CVE-2015-3194).
X509_ATTRIBUTE memory leak (CVE-2015-3195).
Race condition handling PSK identify hint (CVE-2015-3196).
Anon DH ServerKeyExchange with 0 p parameter (CVE-2015-1794).
For more information, see:
https://openssl.org/news/secadv_20151203.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1794
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3193
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3194
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3196
(* Security fix *)
patches/packages/openssl-solibs-1.0.1q-x86_64-1_slack14.1.txz: Upgraded.
+--------------------------+Codice: Seleziona tutto
Fri Dec 18 05:28:25 UTC 2015
patches/packages/grub-2.00-x86_64-3_slack14.1.txz: Rebuilt.
Patched bug where password protection during system startup may be
bypassed by hitting the backspace key 28 times giving a rescue shell.
Thanks to Hector Marco and Ismael Ripoll.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8370
(* Security fix *)
patches/packages/libpng-1.4.19-x86_64-1_slack14.1.txz: Upgraded.
Fixed an out-of-range read in png_check_keyword(). Thanks to Qixue Xiao.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Wed Dec 23 22:44:58 UTC 2015
patches/packages/mozilla-thunderbird-38.5.0-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
(* Security fix *)
+--------------------------+
Wed Dec 23 05:20:09 UTC 2015
patches/packages/blueman-r708-x86_64-4_slack14.1.txz: Rebuilt.
This update fixes a local privilege escalation vulnerability.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8612
(* Security fix *)
patches/packages/mozilla-firefox-38.5.2esr-x86_64-1_slack14.1.txz: Upgraded.
This is a bugfix release.
+--------------------------+Codice: Seleziona tutto
Wed Jan 13 00:01:23 UTC 2016
patches/packages/dhcp-4.3.3_P1-x86_64-1_slack14.1.txz: Upgraded.
This update fixes a denial-of-service vulnerability.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8605
(* Security fix *)
patches/packages/mozilla-thunderbird-38.5.1-x86_64-1_slack14.1.txz: Upgraded.
This is a bugfix release.
patches/packages/xscreensaver-5.34-x86_64-1_slack14.1.txz: Upgraded.
I promised jwz that I'd keep this updated in -stable when I removed (against
his wishes) the nag screen that complains if a year has passed since that
version was released. So, here's the latest one.
+--------------------------+Codice: Seleziona tutto
Fri Jan 15 02:29:54 UTC 2016
patches/packages/openssh-7.1p2-x86_64-1_slack14.1.txz: Upgraded.
This update fixes an information leak and a buffer overflow. In particular,
the information leak allows a malicious SSH server to steal the client's
private keys. Thanks to Qualys for reporting this issue.
For more information, see:
https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0778
*****************************************************************
* IMPORTANT: READ BELOW ABOUT POTENTIALLY INCOMPATIBLE CHANGES *
*****************************************************************
Rather than backport the fix for the information leak (which is the only
hazardous flaw), we have upgraded to the latest OpenSSH. As of version
7.0, OpenSSH has deprecated some older (and presumably less secure)
algorithms, and also (by default) only allows root login by public-key,
hostbased and GSSAPI authentication. Make sure that your keys and
authentication method will allow you to continue accessing your system
after the upgrade.
The release notes for OpenSSH 7.0 list the following incompatible changes
to be aware of:
* Support for the legacy SSH version 1 protocol is disabled by
default at compile time.
* Support for the 1024-bit diffie-hellman-group1-sha1 key exchange
is disabled by default at run-time. It may be re-enabled using
the instructions at http://www.openssh.com/legacy.html
* Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled
by default at run-time. These may be re-enabled using the
instructions at http://www.openssh.com/legacy.html
* Support for the legacy v00 cert format has been removed.
* The default for the sshd_config(5) PermitRootLogin option has
changed from "yes" to "prohibit-password".
* PermitRootLogin=without-password/prohibit-password now bans all
interactive authentication methods, allowing only public-key,
hostbased and GSSAPI authentication (previously it permitted
keyboard-interactive and password-less authentication if those
were enabled).
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Wed Feb 3 22:39:25 UTC 2016
patches/packages/glibc-zoneinfo-2016a-noarch-1_slack14.1.txz: Upgraded.
This package provides the latest timezone updates.
patches/packages/mozilla-firefox-38.6.0esr-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
patches/packages/MPlayer-1.2_20160125-x86_64-1_slack14.1.txz: Upgraded.
This is the latest MPlayer-1.2 branch, identical to the 1.2.1 stable release.
The bundled ffmpeg has been upgraded to 2.8.5, which fixes two security
issues by which a remote attacker may conduct a cross-origin attack and read
arbitrary files on the system.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1897
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1898
(* Security fix *)
patches/packages/openssl-1.0.1r-x86_64-1_slack14.1.txz: Upgraded.
This update fixes the following security issue:
SSLv2 doesn't block disabled ciphers (CVE-2015-3197).
For more information, see:
https://openssl.org/news/secadv/20160128.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197
(* Security fix *)
patches/packages/openssl-solibs-1.0.1r-x86_64-1_slack14.1.txz: Upgraded.
patches/packages/php-5.6.17-x86_64-1_slack14.1.txz: Upgraded.
This release fixes bugs and security issues.
*****************************************************************
* IMPORTANT: READ BELOW ABOUT POTENTIALLY INCOMPATIBLE CHANGES *
*****************************************************************
PHP 5.4.x has been declared EOL (end of life) and is no longer receiving
upstream support. PHP 5.5.x is also no longer on active support status and
security fixes will continue only until 5 months from now. For this reason
we have provided PHP 5.6 packages as security updates. Be aware that PHP
5.6 is not 100% compatible with PHP 5.4, and some changes may be required
to existing web pages written for PHP 5.4.
For information on how to migrate from PHP 5.4, please see:
http://php.net/manual/en/migration55.php
http://php.net/manual/en/migration56.php
The final PHP 5.4 packages may be found in /pasture in case there is a need
to revert this update.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1903
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Mon Feb 8 22:08:35 UTC 2016
patches/packages/curl-7.47.1-x86_64-1_slack14.1.txz: Upgraded.
This update fixes a security issue where NTLM credentials are not checked
for proxy connection reuse. The effects of this flaw is that the application
could be reusing a proxy connection using the previously used credentials
and thus it could be given to or prevented access from resources that it
wasn't intended to. Thanks to Isaac Boukris.
For more information, see:
https://curl.haxx.se/docs/adv_20160127A.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0755
(* Security fix *)
patches/packages/flac-1.3.1-x86_64-1_slack14.1.txz: Upgraded.
This update is needed by the latest version of libsndfile.
patches/packages/libsndfile-1.0.26-x86_64-1_slack14.1.txz: Upgraded.
This release fixes security issues which may allow attackers to cause
a denial of service, or possibly execute arbitrary code.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9756
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7805
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Thu Feb 11 21:56:21 UTC 2016
patches/packages/mozilla-firefox-38.6.1esr-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
(* Security fix *)
+--------------------------+Codice: Seleziona tutto
Sun Feb 14 19:40:04 UTC 2016
patches/packages/mozilla-thunderbird-38.6.0-x86_64-1_slack14.1.txz: Upgraded.
This release contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
(* Security fix *)
+--------------------------+