Differences

This shows you the differences between two versions of the page.

--- changelog_14.2 [2023/10/20 03:03] – [2023-10-16] connie
+++ changelog_14.2 [2023/12/20 12:57] – [2023-12-13] connie
@@ Line 2: / Line 2: @@
 Slackware upstream ChangeLog entries are courtesy of Patrick Volkerding.
+==== 2023-12-20 ====
+**libssh-0.10.6**:  Upgraded.
+This update fixes security issues:
+Command injection using proxycommand.
+Potential downgrade attack using strict kex.
+Missing checks for return values of MD functions.
+For more information, see:
+  * https://www.cve.org/CVERecord?id=CVE-2023-6004
+  * https://www.cve.org/CVERecord?id=CVE-2023-48795
+  * https://www.cve.org/CVERecord?id=CVE-2023-6918
+(**Security fix**)
+**sudo-1.9.15p4**:  Upgraded.
+This is a bugfix release.
+**libxml2-2.11.6**:  Upgraded.
+We're going to drop back to the 2.11 branch here on the stable releases
+since it has all of the relevant security fixes and better compatibility.
+**sudo-1.9.15p3**:  Upgraded.
+This is a bugfix release.
+==== 2023-12-13 ====
+**libxml2-2.12.3**:  Upgraded.
+This update addresses regressions when building against libxml2 that were
+due to header file refactoring.
+**libxml2-2.12.2**:  Upgraded.
+Add --sysconfdir=/etc option so that this can find the xml catalog.
+Thanks to SpiderTux.
+Fix the following security issues:
+Fix integer overflows with XML_PARSE_HUGE.
+Fix dict corruption caused by entity reference cycles.
+Hashing of empty dict strings isn't deterministic.
+Fix null deref in xmlSchemaFixupComplexType.
+For more information, see:
+  * https://www.cve.org/CVERecord?id=CVE-2022-40303
+  * https://www.cve.org/CVERecord?id=CVE-2022-40304
+  * https://www.cve.org/CVERecord?id=CVE-2023-29469
+  * https://www.cve.org/CVERecord?id=CVE-2023-28484
+(**Security fix**)
+**ca-certificates-20231117**:  Upgraded.
+This update provides the latest CA certificates to check for the
+authenticity of SSL connections.
+**sudo-1.9.15p1**:  Upgraded.
+This is a bugfix release:
+Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers
+from being able to read the ldap.conf file.
+==== 2023-11-08 ====
+**sudo-1.9.15**:  Upgraded.
+The sudoers plugin has been modified to make it more resilient to ROWHAMMER
+attacks on authentication and policy matching.
+The sudoers plugin now constructs the user time stamp file path name using
+the user-ID instead of the user name. This avoids a potential problem with
+user names that contain a path separator ('/') being interpreted as part of
+the path name.
+For more information, see:
+  * https://www.cve.org/CVERecord?id=CVE-2023-42465
+  * https://www.cve.org/CVERecord?id=CVE-2023-42456
+(**Security fix**)
 ==== 2023-10-20 ====