changelog_14.2
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
changelog_14.2 [2020/01/11 13:09] – [ChangeLog 14.2] connie | changelog_14.2 [2020/08/21 18:29] – [2020-08-19] connie | ||
---|---|---|---|
Line 3: | Line 3: | ||
Slackware upstream ChangeLog entries are courtesy of Patrick Volkerding. | Slackware upstream ChangeLog entries are courtesy of Patrick Volkerding. | ||
- | ===== 2020-01-11 ===== | + | ==== 2020-08-21 ==== |
+ | **bind-9.11.22**: | ||
+ | This update fixes three security issues: | ||
+ | " | ||
+ | " | ||
+ | names outside of the specified subdomains. The problem was fixed by making | ||
+ | sure " | ||
+ | When BIND 9 was compiled with native PKCS#11 support, it was possible to | ||
+ | trigger an assertion failure in code determining the number of bits in the | ||
+ | PKCS#11 RSA public key with a specially crafted packet. | ||
+ | It was possible to trigger an assertion failure when verifying the response | ||
+ | to a TSIG-signed request. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | ==== 2020-08-19 ==== | ||
+ | |||
+ | **curl-7.72.0**: | ||
+ | This update fixes a security issue: | ||
+ | libcurl: wrong connect-only connection [98] | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **httpd-2.4.46**: | ||
+ | This is the latest release from the Apache HTTP Server 2.4.x stable branch. | ||
+ | |||
+ | ==== 2020-07-23 ==== | ||
+ | |||
+ | **libreoffice-6.2.8.2**: | ||
+ | |||
+ | ==== 2020-07-06 ==== | ||
+ | |||
+ | **libvorbis-1.3.7**: | ||
+ | Fix out-of-bounds read encoding very low sample rates. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **ca-certificates-20200630**: | ||
+ | This update provides the latest CA certificates to check for the | ||
+ | authenticity of SSL connections. | ||
+ | |||
+ | ==== 2020-06-24 ==== | ||
+ | |||
+ | **curl-7.71.0**: | ||
+ | This update fixes security issues: | ||
+ | curl overwrite local file with -J [111] | ||
+ | Partial password leak over DNS on HTTP redirect [48] | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **libjpeg-turbo-2.0.5**: | ||
+ | This update fixes bugs and a security issue: | ||
+ | Fixed an issue in the PPM reader that caused a buffer overrun in cjpeg, | ||
+ | TJBench, or the `tjLoadImage()` function if one of the values in a binary | ||
+ | PPM/PGM input file exceeded the maximum value defined in the file's header | ||
+ | and that maximum value was less than 255. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-06-23 ==== | ||
+ | |||
+ | **ntp-4.2.8p15**: | ||
+ | This release fixes one vulnerability: | ||
+ | authentication between ntpd from versions 4.2.8p11/ | ||
+ | 4.2.8p14/ | ||
+ | Eventually, ntpd will run out of memory and abort. | ||
+ | (**Security fix**) | ||
+ | |||
+ | **sudo-1.8.31p2**: | ||
+ | This is a bugfix release. For more information, | ||
+ | * https:// | ||
+ | |||
+ | ==== 2020-06-18 ==== | ||
+ | |||
+ | **bind-9.11.20**: | ||
+ | This update fixes a security issue: | ||
+ | It was possible to trigger an INSIST in lib/ | ||
+ | a particular zone content and query patterns. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-06-14 ==== | ||
+ | |||
+ | **R-4.0.1**: | ||
+ | |||
+ | **pcre2-10.35**: | ||
+ | |||
+ | **fuse-exfat-1.3.0**: | ||
+ | |||
+ | **linux-libre-*-4.4.227**: | ||
+ | These updates fix various bugs and security issues, including a mitigation | ||
+ | for SRBDS (Special Register Buffer Data Sampling). SRBDS is an MDS-like | ||
+ | speculative side channel that can leak bits from the random number generator | ||
+ | (RNG) across cores and threads. | ||
+ | Be sure to upgrade your initrd after upgrading the kernel packages. | ||
+ | If you use lilo to boot your machine, be sure lilo.conf points to the correct | ||
+ | kernel and initrd and run lilo as root to update the bootloader. | ||
+ | If you use elilo to boot your machine, you should run eliloconfig to copy the | ||
+ | kernel and initrd to the EFI System Partition. | ||
+ | For more information, | ||
+ | |||
+ | Fixed in 4.4.218: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.219: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.220: | ||
+ | * https:// | ||
+ | Fixed in 4.4.221: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.222: | ||
+ | * https:// | ||
+ | Fixed in 4.4.224: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.225: | ||
+ | * https:// | ||
+ | Fixed in 4.4.226: | ||
+ | * https:// | ||
+ | Fixed in 4.4.227: | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **gnutls-3.6.14**: | ||
+ | Fixed insecure session ticket key construction, | ||
+ | would not bind the session ticket encryption key with a value supplied by | ||
+ | the application until the initial key rotation, allowing attacker to bypass | ||
+ | authentication in TLS 1.3 and recover previous conversations in TLS 1.2. | ||
+ | [GNUTLS-SA-2020-06-03, | ||
+ | (**Security fix**) | ||
+ | |||
+ | **ca-certificates-20200602**: | ||
+ | This update provides the latest CA certificates to check for the | ||
+ | authenticity of SSL connections. | ||
+ | |||
+ | **proftpd-1.3.6d**: | ||
+ | This is a bugfix release: | ||
+ | Fixed issue with FTPS uploads of large files using TLSv1.3 (Issue #959). | ||
+ | |||
+ | ==== 2020-05-19 ==== | ||
+ | |||
+ | **bind-9.11.19**: | ||
+ | This update fixes security issues: | ||
+ | A malicious actor who intentionally exploits the lack of effective | ||
+ | limitation on the number of fetches performed when processing referrals | ||
+ | can, through the use of specially crafted referrals, cause a recursing | ||
+ | server to issue a very large number of fetches in an attempt to process | ||
+ | the referral. This has at least two potential effects: The performance of | ||
+ | the recursing server can potentially be degraded by the additional work | ||
+ | required to perform these fetches, and the attacker can exploit this | ||
+ | behavior to use the recursing server as a reflector in a reflection attack | ||
+ | with a high amplification factor. | ||
+ | Replaying a TSIG BADTIME response as a request could trigger an assertion | ||
+ | failure. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **libexif-0.6.22**: | ||
+ | This update fixes bugs and security issues: | ||
+ | * CVE-2018-20030: | ||
+ | * CVE-2020-13114: | ||
+ | * CVE-2020-13113: | ||
+ | * CVE-2020-13112: | ||
+ | * CVE-2020-0093: | ||
+ | * CVE-2019-9278: | ||
+ | * CVE-2020-12767: | ||
+ | * CVE-2016-6328: | ||
+ | * CVE-2017-7544: | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-05-18 ==== | ||
+ | |||
+ | **sane-1.0.30**: | ||
+ | This update fixes several security issues. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **glibc-zoneinfo-2020a**: | ||
+ | This package provides the latest timezone updates. | ||
+ | |||
+ | ==== 2020-04-21 ==== | ||
+ | |||
+ | **git-2.17.5**: | ||
+ | This update fixes a security issue: | ||
+ | With a crafted URL that contains a newline or empty host, or lacks | ||
+ | a scheme, the credential helper machinery can be fooled into | ||
+ | providing credential information that is not appropriate for the | ||
+ | protocol in use and host being contacted. | ||
+ | Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the | ||
+ | credentials are not for a host of the attacker' | ||
+ | they are for some unspecified host (based on how the configured | ||
+ | credential helper handles an absent " | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-04-17 ==== | ||
+ | |||
+ | **openvpn-2.4.9**: | ||
+ | This update fixes a security issue: | ||
+ | Fix illegal client float. Thanks to Lev Stipakov. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-04-15 ==== | ||
+ | |||
+ | **bind-9.11.18**: | ||
+ | This update fixes a security issue: | ||
+ | DNS rebinding protection was ineffective when BIND 9 is configured as a | ||
+ | forwarding DNS server. Found and responsibly reported by Tobias Klein. | ||
+ | [GL #1574] | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-04-14 ==== | ||
+ | |||
+ | **git-2.17.4**: | ||
+ | This update fixes a security issue: | ||
+ | With a crafted URL that contains a newline in it, the credential helper | ||
+ | machinery can be fooled to give credential information for a wrong host. | ||
+ | The attack has been made impossible by forbidding a newline character in | ||
+ | any value passed via the credential protocol. Credit for finding the | ||
+ | vulnerability goes to Felix Wilhelm of Google Project Zero. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-03-31 ==== | ||
+ | |||
+ | **gnutls-3.6.13**: | ||
+ | This update fixes a security issue: | ||
+ | libgnutls: Fix a DTLS-protocol regression (caused by TLS1.3 support), | ||
+ | since 3.6.3. The DTLS client would not contribute any randomness to the | ||
+ | DTLS negotiation, | ||
+ | [GNUTLS-SA-2020-03-31, | ||
+ | (**Security fix**) | ||
+ | |||
+ | **httpd-2.4.43**: | ||
+ | This release contains security fixes (since 2.4.39) and improvements. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | |||
+ | ==== 2020-03-27 ==== | ||
+ | |||
+ | **linux-libre-*-4.4.217**: | ||
+ | These updates fix various bugs and security issues. | ||
+ | Be sure to upgrade your initrd after upgrading the kernel packages. | ||
+ | If you use lilo to boot your machine, be sure lilo.conf points to the correct | ||
+ | kernel and initrd and run lilo as root to update the bootloader. | ||
+ | If you use elilo to boot your machine, you should run eliloconfig to copy the | ||
+ | kernel and initrd to the EFI System Partition. | ||
+ | For more information, | ||
+ | |||
+ | Fixed in 4.4.209: | ||
+ | * https:// | ||
+ | Fixed in 4.4.210: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.211: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.212: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.215: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.216: | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | Fixed in 4.4.217: | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-03-23 ==== | ||
+ | |||
+ | **gd-2.3.0**: | ||
+ | This update fixes bugs and security issues: | ||
+ | * Potential double-free in gdImage*Ptr(). | ||
+ | * gdImageColorMatch() out of bounds write on heap. | ||
+ | * Uninitialized read in gdImageCreateFromXbm(). | ||
+ | * Double-free in gdImageBmp. | ||
+ | * Potential NULL pointer dereference in gdImageClone(). | ||
+ | * Potential infinite loop in gdImageCreateFromGifCtx(). | ||
+ | For more information, | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **NetworkManager-1.8.4**: | ||
+ | Recompiled to get PPP working again with the new pppd. Thanks to longus. | ||
+ | |||
+ | **sudo-1.8.31p1**: | ||
+ | This is a bugfix release: | ||
+ | Sudo once again ignores a failure to restore the RLIMIT_CORE resource limit, | ||
+ | as it did prior to version 1.8.29. Linux containers don't allow RLIMIT_CORE | ||
+ | to be set back to RLIM_INFINITY if we set the limit to zero, even for root, | ||
+ | which resulted in a warning from sudo. | ||
+ | |||
+ | **rp-pppoe-3.13**: | ||
+ | This needed a rebuild for ppp-2.4.8. Thanks to regdub. | ||
+ | |||
+ | ==== 2020-03-04 ==== | ||
+ | |||
+ | **ppp-2.4.8**: | ||
+ | This update fixes a security issue: | ||
+ | By sending an unsolicited EAP packet to a vulnerable ppp client or server, | ||
+ | an unauthenticated remote attacker could cause memory corruption in the | ||
+ | pppd process, which may allow for arbitrary code execution. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-02-20 ==== | ||
+ | |||
+ | **proftpd-1.3.6c**: | ||
+ | No CVEs assigned, but this sure looks like a security issue: | ||
+ | Use-after-free vulnerability in memory pools during data transfer. | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-02-14 ==== | ||
+ | |||
+ | **libarchive-3.4.2**: | ||
+ | This update includes security fixes in the RAR5 reader. | ||
+ | (**Security fix**) | ||
+ | |||
+ | ==== 2020-01-31 ==== | ||
+ | |||
+ | **sudo-1.8.31**: | ||
+ | This update fixes a security issue: | ||
+ | In Sudo before 1.8.31, if pwfeedback is enabled in / | ||
+ | trigger a stack-based buffer overflow in the privileged sudo process. | ||
+ | (pwfeedback is a default setting in some Linux distributions; | ||
+ | is not the default for upstream or in Slackware, and would exist only if | ||
+ | enabled by an administrator.) The attacker needs to deliver a long string | ||
+ | to the stdin of getln() in tgetpass.c. | ||
+ | For more information, | ||
+ | * https:// | ||
+ | (**Security fix**) | ||
+ | |||
+ | **bind-9.11.15**: | ||
+ | This is a bugfix release: | ||
+ | With some libmaxminddb versions, named could erroneously match an IP address | ||
+ | not belonging to any subnet defined in a given GeoIP2 database to one of the | ||
+ | existing entries in that database. [GL #1552] | ||
+ | Fix line spacing in `rndc secroots`. Thanks to Tony Finch. [GL #2478] | ||
+ | |||
+ | ==== 2020-01-11 ==== | ||
+ | |||
+ | **p7zip-16.02**: | ||
==== 2020-01-09 ==== | ==== 2020-01-09 ==== | ||
changelog_14.2.txt · Last modified: 2023/12/23 13:40 by connie