Differences

This shows you the differences between two versions of the page.

--- changelog_14.2 [2019/11/12 18:45] – connie
+++ changelog_14.2 [2019/12/21 21:41] – connie
@@ Line 2: / Line 2: @@
 Slackware upstream ChangeLog entries are courtesy of Patrick Volkerding.
+==== 2019-12-21 ====
+**openssl-1.0.2u**:  Upgraded.
+This update fixes a low severity security issue:
+Fixed an an overflow bug in the x86_64 Montgomery squaring procedure used in
+exponentiation with 512-bit moduli.
+For more information, see:
+  * https://www.openssl.org/news/secadv/20191206.txt
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551
+(**Security fix**)
+**openssl-solibs-1.0.2u**:  Upgraded.
+**tigervnc-1.10.1**:  Upgraded.
+From tigervnc.org: "This is a security release to fix a number of issues
+that were found by Kaspersky Lab. These issues affect both the client and
+server and could theoretically allow a malicious peer to take control
+over the software on the other side. No working exploit is known at this
+time, and the issues require the peer to first be authenticated. We still
+urge users to upgrade when possible."
+(**Security fix**)
+==== 2019-12-19 ====
+**bind-9.11.14**:  Upgraded.
+This is a bugfix release:
+Fixed a bug that caused named to leak memory on reconfiguration when
+any GeoIP2 database was in use. [GL #1445]
+Fixed several possible race conditions discovered by Thread Sanitizer.
+**wavpack-5.2.0**:  Upgraded.
+Fixed denial-of-service and other potential security issues.
+For more information, see:
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19840
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19841
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767
+(**Security fix**)
+**ca-certificates-20191130**:  Upgraded.
+This update provides the latest CA certificates to check for the
+authenticity of SSL connections.
+==== 2019-11-21 ====
+**bind-9.11.13**:  Upgraded.
+This update fixes a security issue:
+Set a limit on the number of concurrently served pipelined TCP queries.
+For more information, see:
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477
+(**Security fix**)
+==== 2019-11-17 ====
+**linux-libre-*-4.4.202**:  Upgraded.
+  * CRYPTO_CRC32C_INTEL m -> y
+  * +X86_INTEL_TSX_MODE_AUTO n
+  * +X86_INTEL_TSX_MODE_OFF y
+  * +X86_INTEL_TSX_MODE_ON n
+These updates fix various bugs and security issues, including mitigation for
+the TSX Asynchronous Abort condition on some CPUs.
+Be sure to upgrade your initrd after upgrading the kernel packages.
+If you use lilo to boot your machine, be sure lilo.conf points to the correct
+kernel and initrd and run lilo as root to update the bootloader.
+If you use elilo to boot your machine, you should run eliloconfig to copy the
+kernel and initrd to the EFI System Partition.
+For more information, see:
+Fixed in 4.4.201:
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0155
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0154
+Fixed in 4.4.202:
+  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11135
+(**Security fix**)
 ==== 2019-11-12 ====