Freenix Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== ChangeLog 14.2 =====

Slackware upstream ChangeLog entries are courtesy of Patrick Volkerding.


==== 2023-12-23 ====

**proftpd-1.3.8b**:  Upgraded.
This update fixes a security issue:
mod_sftp: implemented mitigations for "Terrapin" SSH attack.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-48795
(**Security fix**)


==== 2023-12-20 ====

**libssh-0.10.6**:  Upgraded.
This update fixes security issues:
Command injection using proxycommand.
Potential downgrade attack using strict kex.
Missing checks for return values of MD functions.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-6004
  * https://www.cve.org/CVERecord?id=CVE-2023-48795
  * https://www.cve.org/CVERecord?id=CVE-2023-6918
(**Security fix**)

**sudo-1.9.15p4**:  Upgraded.
This is a bugfix release.

**libxml2-2.11.6**:  Upgraded.
We're going to drop back to the 2.11 branch here on the stable releases
since it has all of the relevant security fixes and better compatibility.

**sudo-1.9.15p3**:  Upgraded.
This is a bugfix release.


==== 2023-12-13 ====

**libxml2-2.12.3**:  Upgraded.
This update addresses regressions when building against libxml2 that were
due to header file refactoring.

**libxml2-2.12.2**:  Upgraded.
Add --sysconfdir=/etc option so that this can find the xml catalog.
Thanks to SpiderTux.
Fix the following security issues:
Fix integer overflows with XML_PARSE_HUGE.
Fix dict corruption caused by entity reference cycles.
Hashing of empty dict strings isn't deterministic.
Fix null deref in xmlSchemaFixupComplexType.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-40303
  * https://www.cve.org/CVERecord?id=CVE-2022-40304
  * https://www.cve.org/CVERecord?id=CVE-2023-29469
  * https://www.cve.org/CVERecord?id=CVE-2023-28484
(**Security fix**)

**ca-certificates-20231117**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**sudo-1.9.15p1**:  Upgraded.
This is a bugfix release:
Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers
from being able to read the ldap.conf file.

==== 2023-11-08 ====

**sudo-1.9.15**:  Upgraded.
The sudoers plugin has been modified to make it more resilient to ROWHAMMER
attacks on authentication and policy matching.
The sudoers plugin now constructs the user time stamp file path name using
the user-ID instead of the user name. This avoids a potential problem with
user names that contain a path separator ('/') being interpreted as part of
the path name.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-42465
  * https://www.cve.org/CVERecord?id=CVE-2023-42456
(**Security fix**)


==== 2023-10-20 ====

**httpd-2.4.58**:  Upgraded.
This update fixes bugs and security issues:
moderate: Apache HTTP Server: HTTP/2 stream memory not reclaimed
right away on RST.
low: mod_macro buffer over-read.
low: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0.
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.58
  * https://www.cve.org/CVERecord?id=CVE-2023-45802
  * https://www.cve.org/CVERecord?id=CVE-2023-31122
  * https://www.cve.org/CVERecord?id=CVE-2023-43622
(**Security fix**)

==== 2023-10-16 ====

**curl-8.4.0**:  Upgraded.
This update fixes security issues:
Cookie injection with none file.
SOCKS5 heap buffer overflow.
For more information, see:
  * https://curl.se/docs/CVE-2023-38546.html
  * https://curl.se/docs/CVE-2023-38545.html
  * https://www.cve.org/CVERecord?id=CVE-2023-38546
  * https://www.cve.org/CVERecord?id=CVE-2023-38545
(**Security fix**)

<code>
Mon Oct  9 18:10:01 UTC 2023
####################################################################
# NOTICE OF INPENDING EOL (END OF LIFE) FOR OLD SLACKWARE VERSIONS #
#                                                                  #
# Effective January 1, 2024, security patches will no longer be    #
# provided for the following versions of Slackware (which will all #
# be more than 7 years old at that time):                          #
#   Slackware 14.0, Slackware 14.1, Slackware 14.2.                #
# If you are still running these versions you should consider      #
# migrating to a newer version (preferably as recent as possible). #
# Alternately, you may make arrangements to handle your own        #
# security patches.                                                #
####################################################################
</code>

==== 2023-10-04 ====

**libX11-1.8.7**:  Upgraded.
This update fixes security issues:
libX11: out-of-bounds memory access in _XkbReadKeySyms().
libX11: stack exhaustion from infinite recursion in PutSubImage().
libX11: integer overflow in XCreateImage() leading to a heap overflow.
For more information, see:
  * https://lists.x.org/archives/xorg-announce/2023-October/003424.html
  * https://www.cve.org/CVERecord?id=CVE-2023-43785
  * https://www.cve.org/CVERecord?id=CVE-2023-43786
  * https://www.cve.org/CVERecord?id=CVE-2023-43787
(**Security fix**)

**libXpm-3.5.17**:  Upgraded.
This update fixes security issues:
libXpm: out of bounds read in XpmCreateXpmImageFromBuffer().
libXpm: out of bounds read on XPM with corrupted colormap.
For more information, see:
  * https://lists.x.org/archives/xorg-announce/2023-October/003424.html
  * https://www.cve.org/CVERecord?id=CVE-2023-43788
  * https://www.cve.org/CVERecord?id=CVE-2023-43789
(**Security fix**)

**cups-2.1.4**:  Rebuilt.
This update fixes bugs and a security issue:
Fixed Heap-based buffer overflow when reading Postscript in PPD files.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-4504
(**Security fix**)

**netatalk-3.1.17**:  Upgraded.
This update fixes bugs and a security issue:
Validate data type in dalloc_value_for_key(). This flaw could allow a
malicious actor to cause Netatalk's afpd daemon to crash, or possibly to
execute arbitrary code.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-42464
(**Security fix**)

**curl-8.3.0**:  Upgraded.
This update fixes a security issue:
HTTP headers eat all memory.
  * https://curl.se/docs/CVE-2023-38039.html
  * https://www.cve.org/CVERecord?id=CVE-2023-38039
(**Security fix**)

**libarchive-3.7.2**:  Upgraded.
This update fixes multiple security vulnerabilities in the PAX writer:
Heap overflow in url_encode() in archive_write_set_format_pax.c.
NULL dereference in archive_write_pax_header_xattrs().
Another NULL dereference in archive_write_pax_header_xattrs().
NULL dereference in archive_write_pax_header_xattr().
(**Security fix**)

**netatalk-3.1.16**:  Upgraded.
This update fixes bugs and security issues.
Shared library .so-version bump.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-23121
  * https://www.cve.org/CVERecord?id=CVE-2022-23123
(**Security fix**)

**curl-8.2.1**:  Upgraded.
This is a bugfix release.

**whois-5.5.18**:  Upgraded.
Updated the .ga TLD server.
Added new recovered IPv4 allocations.
Removed the delegation of 43.0.0.0/8 to JPNIC.
Removed 12 new gTLDs which are no longer active.
Improved the man page source, courtesy of Bjarni Ingi Gislason.
Added the .edu.za SLD server.
Updated the .alt.za SLD server.
Added the -ru and -su NIC handles servers.

**ca-certificates-20230721**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**curl-8.2.0**:  Upgraded.
This update fixes a security issue:
fopen race condition.
For more information, see:
  * https://curl.se/docs/CVE-2023-32001.html
  * https://www.cve.org/CVERecord?id=CVE-2023-32001
(**Security fix**)

**sudo-1.9.14p2**:  Upgraded.
This is a bugfix release.

**sudo-1.9.14p1**:  Upgraded.
This is a bugfix release.

**cups-2.1.4**:  Rebuilt.
Fixed use-after-free when logging warnings in case of failures
in cupsdAcceptClient().
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-34241
(**Security fix**)

==== 2023-06-15 ====

**libX11-1.8.6**:  Upgraded.
This update fixes buffer overflows in InitExt.c that could at least cause
the client to crash due to memory corruption.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-3138
(**Security fix**)

**ntp-4.2.8p17**:  Upgraded.
This is a bugfix release.


==== 2023-06-06 ====

**cups-2.1.4**:  Rebuilt.
Fixed a heap buffer overflow in _cups_strlcpy(), when the configuration file
cupsd.conf sets the value of loglevel to DEBUG, that could allow a remote
attacker to launch a denial of service (DoS) attack, or possibly execute
arbirary code.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-32324
(**Security fix**)

**ntp-4.2.8p16**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-26551
  * https://www.cve.org/CVERecord?id=CVE-2023-26552
  * https://www.cve.org/CVERecord?id=CVE-2023-26553
  * https://www.cve.org/CVERecord?id=CVE-2023-26554
  * https://www.cve.org/CVERecord?id=CVE-2023-26555
(**Security fix**)

**curl-8.1.2**:  Upgraded.
This is a bugfix release.

==== 2023-05-26 ====

**ntfs-3g-2022.10.3**:  Upgraded.
Fixed vulnerabilities that may allow an attacker using a maliciously
crafted NTFS-formatted image file or external storage to potentially
execute arbitrary privileged code or cause a denial of service.
Thanks to opty.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40284
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30789
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30788
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30787
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30786
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30785
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30784
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30783
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46790
(**Security fix**)

**curl-8.1.1**:  Upgraded.
This is a bugfix release.


==== 2023-05-18 ====

**curl-8.1.0**:  Upgraded.
This update fixes security issues:
more POST-after-PUT confusion.
IDN wildcard match.
siglongjmp race condition.
UAF in SSH sha256 fingerprint check.
For more information, see:
  * https://curl.se/docs/CVE-2023-28322.html
  * https://curl.se/docs/CVE-2023-28321.html
  * https://curl.se/docs/CVE-2023-28320.html
  * https://curl.se/docs/CVE-2023-28319.html
  * https://www.cve.org/CVERecord?id=CVE-2023-28322
  * https://www.cve.org/CVERecord?id=CVE-2023-28321
  * https://www.cve.org/CVERecord?id=CVE-2023-28320
  * https://www.cve.org/CVERecord?id=CVE-2023-28319
(**Security fix**)

**ca-certificates-20230506**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2023-05-05 ====

**libssh-0.10.5**:  Upgraded.
This update fixes security issues:
A NULL dereference during rekeying with algorithm guessing.
A possible authorization bypass in pki_verify_data_signature under
low-memory conditions.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-1667
  * https://www.cve.org/CVERecord?id=CVE-2023-2283
(**Security fix**)

**whois-5.5.17**:  Upgraded.
Added the .cd TLD server.
Updated the -kg NIC handles server name.
Removed 2 new gTLDs which are no longer active.


==== 2023-05-01 ====

**netatalk-3.1.15**:  Upgraded.
This update fixes security issues, including a critical vulnerability that
allows remote attackers to execute arbitrary code on affected installations
of Netatalk. Authentication is not required to exploit this vulnerability.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-43634
  * https://www.cve.org/CVERecord?id=CVE-2022-45188
(**Security fix**)

==== 2023-04-25 ====

**git-2.30.9**:  Upgraded.
This update fixes security issues:
By feeding specially crafted input to `git apply --reject`, a
path outside the working tree can be overwritten with partially
controlled contents (corresponding to the rejected hunk(s) from
the given patch).
When Git is compiled with runtime prefix support and runs without
translated messages, it still used the gettext machinery to
display messages, which subsequently potentially looked for
translated messages in unexpected places. This allowed for
malicious placement of crafted messages.
When renaming or deleting a section from a configuration file,
certain malicious configuration values may be misinterpreted as
the beginning of a new configuration section, leading to arbitrary
configuration injection.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-25652
  * https://www.cve.org/CVERecord?id=CVE-2023-25815
  * https://www.cve.org/CVERecord?id=CVE-2023-29007
(**Security fix**)

**httpd-2.4.57**:  Upgraded.
This is a bugfix release.
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.57

==== 2023-04-03 ====

**irssi-1.4.4**:  Upgraded.
Do not crash Irssi when one line is printed as the result of another line
being printed.
Also solve a memory leak while printing unformatted lines.
(**Security fix**)

**glibc-zoneinfo-2023c**:  Upgraded.
This package provides the latest timezone updates.

**tar-1.29**:  Rebuilt.
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use
of uninitialized memory for a conditional jump. Exploitation to change the
flow of control has not been demonstrated. The issue occurs in from_header
in list.c via a V7 archive in which mtime has approximately 11 whitespace
characters.
Thanks to marav for the heads-up.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-48303
(**Security fix**)


==== 2023-03-22 ====

**curl-8.0.1**:  Upgraded.
  * This update fixes security issues:
  * SSH connection too eager reuse still.
  * HSTS double-free.
  * GSS delegation too eager connection re-use.
  * FTP too eager connection reuse.
  * SFTP path ~ resolving discrepancy.
  * TELNET option IAC injection.
For more information, see:
  * https://curl.se/docs/CVE-2023-27538.html
  * https://curl.se/docs/CVE-2023-27537.html
  * https://curl.se/docs/CVE-2023-27536.html
  * https://curl.se/docs/CVE-2023-27535.html
  * https://curl.se/docs/CVE-2023-27534.html
  * https://curl.se/docs/CVE-2023-27533.html
  * https://www.cve.org/CVERecord?id=CVE-2023-27538
  * https://www.cve.org/CVERecord?id=CVE-2023-27537
  * https://www.cve.org/CVERecord?id=CVE-2023-27536
  * https://www.cve.org/CVERecord?id=CVE-2023-27535
  * https://www.cve.org/CVERecord?id=CVE-2023-27534
  * https://www.cve.org/CVERecord?id=CVE-2023-27533
(**Security fix**)

==== 2023-03-08 ====

**httpd-2.4.56**:  Upgraded.
This update fixes two security issues:
HTTP Response Smuggling vulnerability via mod_proxy_uwsgi.
HTTP Request Smuggling attack via mod_rewrite and mod_proxy.
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.56
  * https://www.cve.org/CVERecord?id=CVE-2023-27522
  * https://www.cve.org/CVERecord?id=CVE-2023-25690
(**Security fix**)

**sudo-1.9.13p3**:  Upgraded.
This is a bugfix release.

**whois-5.5.16**:  Upgraded.
Add bash completion support, courtesy of Ville Skytta.
Updated the .tr TLD server.
Removed support for -metu NIC handles.

**curl-7.88.1**:  Upgraded.
This is a bugfix release.

==== 2023-02-16 ====

**curl-7.88.0**:  Upgraded.
This update fixes security issues:
HTTP multi-header compression denial of service.
HSTS amnesia with --parallel.
HSTS ignored on multiple requests.
For more information, see:
  * https://curl.se/docs/CVE-2023-23916.html
  * https://curl.se/docs/CVE-2023-23915.html
  * https://curl.se/docs/CVE-2023-23914.html
  * https://www.cve.org/CVERecord?id=CVE-2023-23916
  * https://www.cve.org/CVERecord?id=CVE-2023-23915
  * https://www.cve.org/CVERecord?id=CVE-2023-23914
(**Security fix**)

**git-2.30.8**:  Upgraded.
This update fixes security issues:
Using a specially-crafted repository, Git can be tricked into using
its local clone optimization even when using a non-local transport.
Though Git will abort local clones whose source $GIT_DIR/objects
directory contains symbolic links (c.f., CVE-2022-39253), the objects
directory itself may still be a symbolic link.
These two may be combined to include arbitrary files based on known
paths on the victim's filesystem within the malicious repository's
working copy, allowing for data exfiltration in a similar manner as
CVE-2022-39253.
By feeding a crafted input to "git apply", a path outside the
working tree can be overwritten as the user who is running "git
apply".
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-22490
  * https://www.cve.org/CVERecord?id=CVE-2023-23946
(**Security fix**)

==== 2023-01-19 ====

**sudo-1.9.12p2**:  Upgraded.
This update fixes a flaw in sudo's -e option (aka sudoedit) that could allow
a malicious user with sudoedit privileges to edit arbitrary files.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2023-22809
(**Security fix**)

==== 2023-01-18 ====

**git-2.30.7**:  Upgraded.
This release fixes two security issues:
  * CVE-2022-41903:
git log has the ability to display commits using an arbitrary
format with its --format specifiers. This functionality is also
exposed to git archive via the export-subst gitattribute.
When processing the padding operators (e.g., %<(, %<|(, %>(,
%>>(, or %><( ), an integer overflow can occur in
pretty.c::format_and_pad_commit() where a size_t is improperly
stored as an int, and then added as an offset to a subsequent
memcpy() call.
This overflow can be triggered directly by a user running a
command which invokes the commit formatting machinery (e.g., git
log --format=...). It may also be triggered indirectly through
git archive via the export-subst mechanism, which expands format
specifiers inside of files within the repository during a git
archive.
This integer overflow can result in arbitrary heap writes, which
may result in remote code execution.
  * CVE-2022-23521:
gitattributes are a mechanism to allow defining attributes for
paths. These attributes can be defined by adding a `.gitattributes`
file to the repository, which contains a set of file patterns and
the attributes that should be set for paths matching this pattern.
When parsing gitattributes, multiple integer overflows can occur
when there is a huge number of path patterns, a huge number of
attributes for a single pattern, or when the declared attribute
names are huge.
These overflows can be triggered via a crafted `.gitattributes` file
that may be part of the commit history. Git silently splits lines
longer than 2KB when parsing gitattributes from a file, but not when
parsing them from the index. Consequentially, the failure mode
depends on whether the file exists in the working tree, the index or
both.
This integer overflow can result in arbitrary heap reads and writes,
which may result in remote code execution.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-41903
  * https://www.cve.org/CVERecord?id=CVE-2022-23521
(**Security fix**)

**httpd-2.4.55**:  Upgraded.
This update fixes bugs and the following security issues:
mod_proxy allows a backend to trigger HTTP response splitting.
mod_proxy_ajp possible request smuggling.
mod_dav out of bounds read, or write of zero byte.
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.55
  * https://www.cve.org/CVERecord?id=CVE-2022-37436
  * https://www.cve.org/CVERecord?id=CVE-2022-36760
  * https://www.cve.org/CVERecord?id=CVE-2006-20001
(**Security fix**)

**libXpm-3.5.15**:  Upgraded.
This update fixes security issues:
Infinite loop on unclosed comments.
Runaway loop with width of 0 and enormous height.
Compression commands depend on $PATH.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-46285
  * https://www.cve.org/CVERecord?id=CVE-2022-44617
  * https://www.cve.org/CVERecord?id=CVE-2022-4883
(**Security fix**)

==== 2023-01-15 ====

**netatalk-3.1.14**:  Upgraded.
Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow
resulting in code execution via a crafted .appl file.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-45188
(**Security fix**)

**ca-certificates-20221205**:  Rebuilt.
Make sure that if we're installing this package on another partition (such as
when using installpkg with a --root parameter) that the updates are done on
that partition. Thanks to fulalas.


==== 2023-01-04 ====

**libtiff-4.4.0**:  Upgraded.
Patched various security bugs.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-2056
  * https://www.cve.org/CVERecord?id=CVE-2022-2057
  * https://www.cve.org/CVERecord?id=CVE-2022-2058
  * https://www.cve.org/CVERecord?id=CVE-2022-3970
  * https://www.cve.org/CVERecord?id=CVE-2022-34526
(**Security fix**)

**whois-5.5.15**:  Upgraded.
Updated the .bd, .nz and .tv TLD servers.
Added the .llyw.cymru, .gov.scot and .gov.wales SLD servers.
Updated the .ac.uk and .gov.uk SLD servers.
Recursion has been enabled for whois.nic.tv.
Updated the list of new gTLDs with four generic TLDs assigned in October 2013
which were missing due to a bug.
Removed 4 new gTLDs which are no longer active.
Added the Georgian translation, contributed by Temuri Doghonadze.
Updated the Finnish translation, contributed by Lauri Nurmi.

==== 2022-12-22 ====

**curl-7.87.0**:  Upgraded.
This is a bugfix release.

**libksba-1.6.3**:  Upgraded.
Fix another integer overflow in the CRL's signature parser.
(**Security fix**)

**sdl-1.2.15**:  Rebuilt.
This update fixes a heap overflow problem in video/SDL_pixels.c in SDL.
By crafting a malicious .BMP file, an attacker can cause the application
using this library to crash, denial of service, or code execution.
Thanks to marav for the heads-up.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2021-33657
(**Security fix**)

**libarchive-3.6.2**:  Rebuilt.
This update fixes a regression causing a failure to compile against
libarchive: don't include iconv in libarchive.pc.

**libarchive-3.6.2**:  Upgraded.
This is a bugfix and security release.
Relevant bugfixes:
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
Security fixes:
  * various small fixes for issues found by CodeQL
(**Security fix**)

**ca-certificates-20221205**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**glibc-zoneinfo-2022g**:  Upgraded.
This package provides the latest timezone updates.

==== 2022-11-09 ====

**sysstat-12.7.1**:  Upgraded.
On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1,
allocate_structures contains a size_t overflow in sa_common.c. The
allocate_structures function insufficiently checks bounds before arithmetic
multiplication, allowing for an overflow in the size allocated for the
buffer representing system activities.
This issue may lead to Remote Code Execution (RCE).
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-39377
(**Security fix**)

**glibc-zoneinfo-2022f**:  Upgraded.
This package provides the latest timezone updates.

**sudo-1.9.12p1**:  Upgraded.
Fixed a potential out-of-bounds write for passwords smaller than 8
characters when passwd authentication is enabled.
This does not affect configurations that use other authentication
methods such as PAM, AIX authentication or BSD authentication.
For more information, see:
  * https://www.cve.org/CVERecord?id=CVE-2022-43995
(**Security fix**)

**curl-7.86.0**:  Upgraded.
This update fixes security issues:
HSTS bypass via IDN.
HTTP proxy double-free.
.netrc parser out-of-bounds access.
POST following PUT confusion. 
For more information, see:
  * https://curl.se/docs/CVE-2022-42916.html
  * https://curl.se/docs/CVE-2022-42915.html
  * https://curl.se/docs/CVE-2022-35260.html
  * https://curl.se/docs/CVE-2022-32221.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42916
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35260
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221
(**Security fix**)

**expat-2.4.3**:  Rebuilt.
This update fixes a security issue:
Fix heap use-after-free after overeager destruction of a shared DTD in
function XML_ExternalEntityParserCreate in out-of-memory situations.
Expected impact is denial of service or potentially arbitrary code
execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680
(**Security fix**)

**rsync-3.2.7**:  Rebuilt.
This is a bugfix release, fixing the list of supported auth checksums when
rsync is built against 1.0.x.
Thanks to niksoggia.

**rsync-3.2.7**:  Upgraded.
This is a bugfix release.
Notably, this addresses some regressions caused by the file-list validation
fix in rsync-3.2.5.
Thanks to llgar.

**whois-5.5.14**:  Upgraded.
This update adds the .bf and .sd TLD servers, removes the .gu TLD server,
updates the .dm, .fj, .mt and .pk TLD servers, updates the charset for
whois.nic.tr, updates the list of new gTLDs, removes whois.nic.fr from the
list of RIPE-like servers (because it is not one anymore), renames
whois.arnes.si to whois.register.si in the list of RIPE-like servers, and
adds the hiding string for whois.auda.org.au.

**git-2.30.6**:  Upgraded.
This release fixes two security issues:
  * CVE-2022-39253:
When relying on the `--local` clone optimization, Git dereferences
symbolic links in the source repository before creating hardlinks
(or copies) of the dereferenced link in the destination repository.
This can lead to surprising behavior where arbitrary files are
present in a repository's `$GIT_DIR` when cloning from a malicious
repository.
Git will no longer dereference symbolic links via the `--local`
clone mechanism, and will instead refuse to clone repositories that
have symbolic links present in the `$GIT_DIR/objects` directory.
Additionally, the value of `protocol.file.allow` is changed to be
"user" by default.
  * CVE-2022-39260:
An overly-long command string given to `git shell` can result in
overflow in `split_cmdline()`, leading to arbitrary heap writes and
remote code execution when `git shell` is exposed and the directory
`$HOME/git-shell-commands` exists.
`git shell` is taught to refuse interactive commands that are
longer than 4MiB in size. `split_cmdline()` is hardened to reject
inputs larger than 2GiB.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39253
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39260
(**Security fix**)

==== 2022-10-17 ====

**glibc-zoneinfo-2022e**:  Upgraded.
This package provides the latest timezone updates.

**zlib-1.2.13**:  Upgraded.
Fixed a bug when getting a gzip header extra field with inflateGetHeader().
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434
(**Security fix**)

**libksba-1.6.2**:  Upgraded.
Detect a possible overflow directly in the TLV parser.
This patch detects possible integer overflows immmediately when creating
the TI object.
Reported-by: ZDI-CAN-18927, ZDI-CAN-18928, ZDI-CAN-18929
(**Security fix**)


==== 2022-10-05 ====

**dhcp-4.4.3_P1**:  Upgraded.
This update fixes two security issues:
Corrected a reference count leak that occurs when the server builds
responses to leasequery packets.
Corrected a memory leak that occurs when unpacking a packet that has an
FQDN option (81) that contains a label with length greater than 63 bytes.
Thanks to VictorV of Cyber Kunlun Lab for reporting these issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2928
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2929
(**Security fix**)

**glibc-zoneinfo-2022d**:  Upgraded.
This package provides the latest timezone updates.

**dnsmasq-2.87**:  Upgraded.
Fix write-after-free error in DHCPv6 server code.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0934
(**Security fix**)

**ca-certificates-20220922**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**expat-2.4.3**:  Rebuilt.
This update fixes a security issue:
Heap use-after-free vulnerability in function doContent. Expected impact is
denial of service or potentially arbitrary code execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674
(**Security fix**)


==== 2022-09-01 ====

**curl-7.85.0**:  Upgraded.
This update fixes a security issue:
control code in cookie denial of service.
For more information, see:
  * https://curl.se/docs/CVE-2022-35252.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35252
(**Security fix**)

**glibc-zoneinfo-2022c**:  Upgraded.
This package provides the latest timezone updates.

==== 2022-08-15 ====

**rsync-3.2.5**:  Upgraded.
Added some file-list safety checking that helps to ensure that a rogue
sending rsync can't add unrequested top-level names and/or include recursive
names that should have been excluded by the sender. These extra safety
checks only require the receiver rsync to be updated. When dealing with an
untrusted sending host, it is safest to copy into a dedicated destination
directory for the remote content (i.e. don't copy into a destination
directory that contains files that aren't from the remote host unless you
trust the remote host).
For more information, see:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29154
(**Security fix**)

**glibc-zoneinfo-2022b**:  Upgraded.
This package provides the latest timezone updates.

**zlib-1.2.12**:  Rebuilt.
This is a bugfix update.
Applied an upstream patch to restore the handling of CRC inputs to be the
same as in previous releases of zlib. This fixes an issue with OpenJDK.
Thanks to alienBOB.


==== 2022-07-10 ====

**wavpack-5.5.0**:  Upgraded.
WavPack 5.5.0 contains a fix for CVE-2021-44269 wherein encoding a specially
crafted DSD file causes an out-of-bounds read exception.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44269
(**Security fix**)

==== 2022-06-30 ====

**curl-7.84.0**:  Upgraded.
This update fixes security issues:
Set-Cookie denial of service.
HTTP compression denial of service.
Unpreserved file permissions.
FTP-KRB bad message verification.
For more information, see:
  * https://curl.se/docs/CVE-2022-32205.html
  * https://curl.se/docs/CVE-2022-32206.html
  * https://curl.se/docs/CVE-2022-32207.html
  * https://curl.se/docs/CVE-2022-32208.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32205
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208
(**Security fix**)

**openssl-1.0.2u**:  Rebuilt.
We're sending out the Slackware 14.2 updates again because the package
build number wasn't incremented which caused slackpkg to not pick up the
updates. It's been bumped and the packages rebuilt - otherwise there are
no new changes. Thanks to John Jenkins for the report.
For reference, here's the information from the previous advisory:
In addition to the c_rehash shell command injection identified in
CVE-2022-1292, further circumstances where the c_rehash script does not
properly sanitise shell metacharacters to prevent command injection were
found by code review.
When the CVE-2022-1292 was fixed it was not discovered that there
are other places in the script where the file names of certificates
being hashed were possibly passed to a command executed through the shell.
For more information, see:
  * https://www.openssl.org/news/secadv/20220621.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2068
(**Security fix**)

**openssl-solibs-1.0.2u**:  Rebuilt.


==== 2022-06-28 ====

**ca-certificates-20220622**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**openssl-1.0.2u**:  Rebuilt.
In addition to the c_rehash shell command injection identified in
CVE-2022-1292, further circumstances where the c_rehash script does not
properly sanitise shell metacharacters to prevent command injection were
found by code review.
When the CVE-2022-1292 was fixed it was not discovered that there
are other places in the script where the file names of certificates
being hashed were possibly passed to a command executed through the shell.
For more information, see:
  * https://www.openssl.org/news/secadv/20220621.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2068
(**Security fix**)

**openssl-solibs-1.0.2u**:  Rebuilt.


==== 2022-06-09 ====

**httpd-2.4.54**:  Upgraded.
This update fixes bugs and the following security issues:
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism.
Information Disclosure in mod_lua with websockets.
mod_sed denial of service.
Denial of service in mod_lua r:parsebody.
Read beyond bounds in ap_strcmp_match().
Read beyond bounds via ap_rwrite().
Read beyond bounds in mod_isapi.
mod_proxy_ajp: Possible request smuggling.
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.54
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31813
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30556
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30522
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29404
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28615
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28614
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28330
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26377
(**Security fix**)

==== 2022-05-26 ====

**cups-2.1.4**:  Rebuilt.
Fixed certificate strings comparison for Local authorization.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26691
(**Security fix**)


==== 2022-05-11 ====

**curl-7.83.1**:  Upgraded.
This update fixes security issues:
HSTS bypass via trailing dot.
TLS and SSH connection too eager reuse.
CERTINFO never-ending busy-loop.
percent-encoded path separator in URL host.
cookie for trailing dot TLD.
curl removes wrong file on error.
For more information, see:
  * https://curl.se/docs/CVE-2022-30115.html
  * https://curl.se/docs/CVE-2022-27782.html
  * https://curl.se/docs/CVE-2022-27781.html
  * https://curl.se/docs/CVE-2022-27780.html
  * https://curl.se/docs/CVE-2022-27779.html
  * https://curl.se/docs/CVE-2022-27778.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30115
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27782
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27781
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27780
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27779
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27778
(**Security fix**)

==== 2022-05-03 ====

**openssl-1.0.2u**:  Rebuilt.
Fixed a bug in the c_rehash script which was not properly sanitising shell
metacharacters to prevent command injection.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1292
(**Security fix**)

**openssl-solibs-1.0.2u**:  Rebuilt.

==== 2022-05-03 ====

**libxml2-2.9.14**:  Upgraded.
This update fixes bugs and the following security issues:
Fix integer overflow in xmlBuf and xmlBuffer.
Fix potential double-free in xmlXPtrStringRangeFunction.
Fix memory leak in xmlFindCharEncodingHandler.
Normalize XPath strings in-place.
Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars().
Fix leak of xmlElementContent.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824
(**Security fix**)

==== 2022-04-02 ====

**pidgin-2.12.0**:  Rebuilt.
Mitigate the potential for a man in the middle attack via DNS spoofing by
removing the code that supported the _xmppconnect DNS TXT record.
For more information, see:
  * https://www.pidgin.im/about/security/advisories/cve-2022-26491/
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26491
(**Security fix**)

**xz-5.2.5**:  Rebuilt.
This update fixes a regression with the previous package leading to compile
failures due to a missing liblzma.la. Thanks to csking.

==== 2022-04-27 ====

**curl-7.83.0**:  Upgraded.
This update fixes security issues:
OAUTH2 bearer bypass in connection re-use.
Credential leak on redirect.
Bad local IPv6 connection reuse.
Auth/cookie leak on redirect.
For more information, see:
  * https://curl.se/docs/CVE-2022-22576.html
  * https://curl.se/docs/CVE-2022-27774.html
  * https://curl.se/docs/CVE-2022-27775.html
  * https://curl.se/docs/CVE-2022-27776.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776
(**Security fix**)


==== 2022-04-15 ====

**git-2.30.4**:  Upgraded.
This update fixes a security issue where a Git worktree created by another
user might be able to execute arbitrary code.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765
(**Security fix**)

**gzip-1.12**:  Upgraded.
This update fixes a security issue:
zgrep applied to a crafted file name with two or more newlines can no
longer overwrite an arbitrary, attacker-selected file.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271
(**Security fix**)

**xz-5.2.5**:  Upgraded.
This update fixes a security issue:
xzgrep applied to a crafted file name with two or more newlines can no
longer overwrite an arbitrary, attacker-selected file.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271
(**Security fix**)

**whois-5.5.13**:  Upgraded.
This update adds the .sd TLD server, updates the list of new gTLDs, and adds
a Turkish translation.

==== 2022-04-08 ====

**libarchive-3.6.1**:  Upgraded.
This is a bugfix and security release.
Security fixes:
  * 7zip reader: fix PPMD read beyond boundary.
  * ZIP reader: fix possible out of bounds read.
  * ISO reader: fix possible heap buffer overflow in read_children().
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0).
  * Fix heap use after free in archive_read_format_rar_read_data().
  * Fix null dereference in read_data_compressed().
  * Fix heap user after free in run_filters().
(**Security fix**)

**ca-certificates-20220403**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**whois-5.5.12**:  Upgraded.
This is a bugfix release. Thanks to Nobby6.

**zlib-1.2.12**:  Upgraded.
This update fixes memory corruption when deflating (i.e., when compressing)
if the input has many distant matches. Thanks to marav.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032
(**Security fix**)

**glibc-zoneinfo-2022a**:  Upgraded.
This package provides the latest timezone updates.

==== 2022-03-17 ====

**bind-9.11.37**:  Upgraded.
This update fixes bugs and the following security issue:
The rules for acceptance of records into the cache have been tightened to
prevent the possibility of poisoning if forwarders send records outside
the configured bailiwick.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25220
(**Security fix**)

**openssl-1.0.2u**:  Rebuilt.
This update fixes a high severity security issue:
The BN_mod_sqrt() function, which computes a modular square root, contains
a bug that can cause it to loop forever for non-prime moduli.
For more information, see:
  * https://www.openssl.org/news/secadv/20220315.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778
(**Security fix**)

**openssl-solibs-1.0.2u**:  Rebuilt.

==== 2022-03-15 ====

**httpd-2.4.53**:  Upgraded.
This update fixes bugs and the following security issues:
mod_sed: Read/write beyond bounds
core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody
HTTP request smuggling vulnerability
mod_lua: Use of uninitialized value in r:parsebody
For more information, see:
  * https://downloads.apache.org/httpd/CHANGES_2.4.53
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23943
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22721
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22719
(**Security fix**)

**ca-certificates-20220309**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**expat-2.4.3**:  Rebuilt.
This is a bugfix release:
Relax fix to CVE-2022-25236 (introduced with release 2.4.5) with regard to
all valid URI characters (RFC 3986).

==== 2022-03-01 ====

**libxml2-2.9.13**:  Upgraded.
This update fixes bugs and the following security issues:
Use-after-free of ID and IDREF attributes
(Thanks to Shinji Sato for the report)
Use-after-free in xmlXIncludeCopyRange (David Kilzer)
Fix Null-deref-in-xmlSchemaGetComponentTargetNs (huangduirong)
Fix memory leak in xmlXPathCompNodeTest
Fix null pointer deref in xmlStringGetNodeList
Fix several memory leaks found by Coverity (David King)
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308
(**Security fix**)

**libxslt-1.1.35**:  Upgraded.
This update fixes bugs and the following security issues:
Fix use-after-free in xsltApplyTemplates
Fix memory leak in xsltDocumentElem (David King)
Fix memory leak in xsltCompileIdKeyPattern (David King)
Fix double-free with stylesheets containing entity nodes
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30560
(**Security fix**)

**cyrus-sasl-2.1.28**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407
(**Security fix**)

==== 2022-02-22 ====

**expat-2.4.3**:  Rebuilt.
Fixed a regression introduced by the fix for CVE-2022-25313 that affects
applications that (1) call function XML_SetElementDeclHandler and (2) are
parsing XML that contains nested element declarations, e.g.
  "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"

**flac-1.3.4**:  Upgraded.
This update fixes overflow issues with encoding and decoding.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0499
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0561
(**Security fix**)

==== 2022-02-01 ====

**linux-libre-4.4.301**:  Upgraded.
These updates fix various bugs and security issues, including the recently
announced i915 issue that could lead to user-space gaining access to random
memory pages (CVE-2022-0330).
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://seclists.org/oss-sec/2022/q1/81
  Fixed in 4.4.277:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3679
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37576
  Fixed in 4.4.278:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21781
  Fixed in 4.4.281:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3732
  Fixed in 4.4.282:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3653
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
  Fixed in 4.4.283:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3753
  Fixed in 4.4.284:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
  Fixed in 4.4.285:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20320
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3655
  Fixed in 4.4.288:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4203
  Fixed in 4.4.289:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29374
  Fixed in 4.4.290:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3896
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
  Fixed in 4.4.291:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
  Fixed in 4.4.292:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37159
  Fixed in 4.4.293:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4202
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3752
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3640
  Fixed in 4.4.294:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
  Fixed in 4.4.295:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
  Fixed in 4.4.296:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28715
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28713
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28712
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28711
  Fixed in 4.4.299:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45095
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4155
  Fixed in 4.4.300:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43976
  Fixed in 4.4.301:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0330
(**Security fix**)


==== 2022-01-27 ====
**expat-2.4.3**:  Rebuilt.
Prevent integer overflow in doProlog.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990
(**Security fix**)

==== 2022-01-26 ====
**polkit-0.113**:  Rebuilt.
[PATCH] pkexec: local privilege escalation.
Thanks to Qualys Research Labs for reporting this issue.
For more information, see:
  * https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034
(**Security fix**)

==== 2022-01-25 ====

**expat-2.4.3**:  Rebuilt.
Fix signed integer overflow in function XML_GetBuffer for when
XML_CONTEXT_BYTES is defined to >0 (which is both common and
default). Impact is denial of service or other undefined behavior.
While we're here, also patch a memory leak on output file opening error.
Thanks to marav.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23852
(**Security fix**)

==== 2022-01-19 ====
**wpa_supplicant-2.9**:  Rebuilt.
This update contains patches for these security issues:
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant
before 2.10 are vulnerable to side-channel attacks as a result of cache
access patterns.
NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23303
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23304
(**Security fix**)

==== 2022-01-16 ====
**expat-2.4.3**:  Upgraded.
Fix issues with left shifts by >=29 places resulting in:
  a) realloc acting as free
  b) realloc allocating too few bytes
  c) undefined behavior
Fix integer overflow on variable m_groupSize in function doProlog leading
to realloc acting as free. Impact is denial of service or other undefined
behavior.
Prevent integer overflows near memory allocation at multiple places.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45960
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46143
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22822
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22823
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22824
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22825
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22826
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22827
(**Security fix**)


==== 2021-12-29 ====

**wpa_supplicant-2.9**:  Upgraded.
This update fixes the following security issues:
AP mode PMF disconnection protection bypass.
UPnP SUBSCRIBE misbehavior in hostapd WPS AP.
P2P group information processing vulnerability.
P2P provision discovery processing vulnerability.
ASN.1: Validate DigestAlgorithmIdentifier parameters.
Flush pending control interface message for an interface to be removed.
These issues could result in a denial-of-service, privilege escalation,
arbitrary code execution, or other unexpected behavior.
Thanks to nobodino for pointing out the patches.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0326
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0535
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12695
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16275
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27803
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30004
(**Security fix**)

==== 2021-12-20 ====

**httpd-2.4.52**:  Upgraded.
SECURITY: CVE-2021-44790: Possible buffer overflow when parsing
multipart content in mod_lua of Apache HTTP Server 2.4.51 and
earlier (cve.mitre.org)
A carefully crafted request body can cause a buffer overflow in
the mod_lua multipart parser (r:parsebody() called from Lua
scripts).
The Apache httpd team is not aware of an exploit for the
vulnerabilty though it might be possible to craft one.
This issue affects Apache HTTP Server 2.4.51 and earlier.
Credits: Chamal
SECURITY: CVE-2021-44224: Possible NULL dereference or SSRF in
forward proxy configurations in Apache HTTP Server 2.4.51 and
earlier (cve.mitre.org)
A crafted URI sent to httpd configured as a forward proxy
(ProxyRequests on) can cause a crash (NULL pointer dereference)
or, for configurations mixing forward and reverse proxy
declarations, can allow for requests to be directed to a
declared Unix Domain Socket endpoint (Server Side Request
Forgery).
This issue affects Apache HTTP Server 2.4.7 up to 2.4.51
(included).
Credits: ae 1/4*a-o(R)e 1/4
TengMA(@Te3t123)
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
(**Security fix**)

**ca-certificates-20211216**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.


==== 2021-12-16 ====

**xorg-server-1.18.3**:  Rebuilt.
Fixes for multiple input validation failures in X server extensions:
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
(**Security fix**)

**xorg-server-xephyr-1.18.3**:  Rebuilt.

**xorg-server-xnest-1.18.3**:  Rebuilt.

**xorg-server-xvfb-1.18.3**:  Rebuilt.

==== 2021-12-03 ====

**mozilla-nss-3.40.1**:  Rebuilt.
This update fixes a critical security issue:
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded within
CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
using NSS for certificate validation or other TLS, X.509, OCSP or CRL
functionality may be impacted, depending on how they configure NSS.
Note: This vulnerability does NOT impact Mozilla Firefox. However, email
clients and PDF viewers that use NSS for signature verification, such as
Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
Thanks to Tavis Ormandy of Google Project Zero.
For more information, see:
  * https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
(**Security fix**)

**mailx-12.5**:  Rebuilt.
Patched a bug where Heirloom mailx produces a "Date:" header that is
incorrect when the system is in the Europe/Dublin timezone (email appears
to have been sent 2 hours earlier).
Thanks to Andrea Biardi.

==== 2021-10-28 ====

**bind-9.11.36**:  Upgraded.
This update fixes bugs and the following security issue:
The "lame-ttl" option is now forcibly set to 0. This effectively disables
the lame server cache, as it could previously be abused by an attacker to
significantly degrade resolver performance.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
(**Security fix**)

**glibc-zoneinfo-2021e**:  Upgraded.
This package provides the latest timezone updates.

==== 2021-10-10 ====

**httpd-2.4.51**:  Upgraded.
SECURITY: CVE-2021-42013: Path Traversal and Remote Code
Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete
fix of CVE-2021-41773) (cve.mitre.org)
It was found that the fix for CVE-2021-41773 in Apache HTTP
Server 2.4.50 was insufficient.  An attacker could use a path
traversal attack to map URLs to files outside the directories
configured by Alias-like directives.
If files outside of these directories are not protected by the
usual default configuration "require all denied", these requests
can succeed. If CGI scripts are also enabled for these aliased
pathes, this could allow for remote code execution.
This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
earlier versions.
Credits: Reported by Juan Escobar from Dreamlab Technologies,
Fernando MuA+-oz from NULL Life CTF Team, and Shungo Kumasaka
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013
(**Security fix**)

==== 2021-10-05 ====

**httpd-2.4.50**:  Upgraded.
This release contains security fixes and improvements.
Fixed null pointer dereference in h2 fuzzing.
Fixed path traversal and file disclosure vulnerability.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41524
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
(**Security fix**)

**ca-certificates-20211005**  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.
Don't install /etc/ca-certificates.conf as a .new file - it's an auto-
generated list that will just end up suffering a mismatch with the files
included in the package. Thanks to Weber Kai.

**glibc-zoneinfo-2021**  Upgraded.
This package provides the latest timezone updates.

==== 2021-09-21 ====

**alpine-2.25**:  Upgraded.
Fixed a denial-of-service security issue where untagged responses from an
IMAP server are accepted before STARTTLS.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38370
(**Security fix**)

==== 2021-09-17 ====

**httpd-2.4.49**:  Upgraded.
This release contains security fixes and improvements.
mod_proxy: Server Side Request Forgery (SSRF) vulnerabilty [Yann Ylavic]
core: ap_escape_quotes buffer overflow
mod_proxy_uwsgi: Out of bound read vulnerability [Yann Ylavic]
core: null pointer dereference on malformed request
mod_http2: Request splitting vulnerability with mod_proxy [Stefan Eissing]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
(**Security fix**)

==== 2021-09-16 ====

**curl-7.79.0**:  Upgraded.
This update fixes security issues:
clear the leftovers pointer when sending succeeds.
do not ignore --ssl-reqd.
reject STARTTLS server response pipelining.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947
(**Security fix**)

==== 2021-09-01 ====

**ntfs-3g-2021.8.22**:  Upgraded.
Shared library .so-version bump.
Fixed vulnerabilities that may allow an attacker using a maliciously
crafted NTFS-formatted image file or external storage to potentially
execute arbitrary privileged code.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33285
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35269
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35268
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33289
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33286
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35266
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33287
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35267
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39251
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39252
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39253
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39254
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39255
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39256
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39257
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39258
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39259
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39260
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39261
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39262
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39263
(**Security fix**)

==== 2021-07-21 ====

**curl-7.78.0**:  Upgraded.
This update fixes security issues:
CURLOPT_SSLCERT mixup with Secure Transport
TELNET stack contents disclosure again
Bad connection reuse due to flawed path name checks
Metalink download sends credentials
Wrong content via metalink not discarded
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22926
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22923
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22922
(**Security fix**)

**linux-libre**:  Upgraded.
These updates fix various bugs and security issues, including the recently
announced local privilege escalation vulnerability in the filesystem layer
(CVE-2021-33909).
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt
Fixed in 4.4.262:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19060
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19061
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28660
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20261
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29265
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16232
Fixed in 4.4.263:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28964
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28972
Fixed in 4.4.264:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28688
Fixed in 4.4.265:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3483
Fixed in 4.4.266:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29154
Fixed in 4.4.267:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22555
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25672
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25673
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25670
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25671
Fixed in 4.4.269:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33034
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0605
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31916
Fixed in 4.4.270:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26558
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0129
Fixed in 4.4.271:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24587
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24586
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24588
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26139
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26147
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29650
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32399
Fixed in 4.4.272:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3564
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3573
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3587
Fixed in 4.4.274:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34693
Fixed in 4.4.276:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33909
(**Security fix**)

==== 2021-06-07 ====

**httpd-2.4.48**:  Upgraded.
This release contains security fixes and improvements.
mod_http2: Fix a potential NULL pointer dereference.
Unexpected <Location> section matching with 'MergeSlashes OFF'.
mod_auth_digest: possible stack overflow by one nul byte while validating
the Digest nonce.
mod_session: Fix possible crash due to NULL pointer dereference, which
could be used to cause a Denial of Service with a malicious backend
server and SessionHeader.
mod_session: Fix possible crash due to NULL pointer dereference, which
could be used to cause a Denial of Service.
mod_proxy_http: Fix possible crash due to NULL pointer dereference, which
could be used to cause a Denial of Service.
mod_proxy_wstunnel, mod_proxy_http: Handle Upgradable protocols end-to-end
negotiation.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31618
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35452
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26691
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26690
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13950
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
(**Security fix**)

**libX11-1.7.2**:  Upgraded.
This is a bug fix release, correcting a regression introduced by and
improving the checks from the fix for CVE-2021-31535.

**polkit-0.113**:  Rebuilt.
This update includes a mitigation for local privilege escalation using
polkit_system_bus_name_get_creds_sync().
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3560
(**Security fix**)

**dhcp-4.4.2_P1**:  Upgraded.
This update fixes a security issue:
Corrected a buffer overwrite possible when parsing hexadecimal
literals with more than 1024 octets. Reported by Jon Franklin from Dell,
and also by Pawel Wieczorkiewicz from Amazon Web Services. [Gitlab #182]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25217
(**Security fix**)

==== 2021-05-26 ====

**ca-certificates-20210526**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**curl-7.77.0**:  Upgraded.
This update fixes security issues:
schannel cipher selection surprise
TELNET stack contents disclosure
TLS session caching disaster
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22297
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22298
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22901
(**Security fix**)

==== 2021-05-25 ====

**gnutls-3.6.16**:  Upgraded.
Fixed potential miscalculation of ECDSA/EdDSA code backported from Nettle.
In GnuTLS, as long as it is built and linked against the fixed version of
Nettle, this only affects GOST curves.  [CVE-2021-20305]
Fixed potential use-after-free in sending "key_share" and "pre_shared_key"
extensions. When sending those extensions, the client may dereference a
pointer no longer valid after realloc. This happens only when the client
sends a large Client Hello message, e.g., when HRR is sent in a resumed
session previously negotiated large FFDHE parameters, because the initial
allocation of the buffer is large enough without having to call realloc
(#1151).  [GNUTLS-SA-2021-03-10, CVSS: low]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305
(**Security fix**)

==== 2021-05-23 ====

**expat-2.4.1**:  Upgraded.
This update provides new mitigations against the "billion laughs" denial
of service attack.
For more information, see:
  * https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0340
(**Security fix**)

==== 2021-05-19 ====

**libX11-1.7.1**:  Upgraded.
This update fixes missing request length checks in libX11 that can lead to
the emission of extra X protocol requests to the X server.
For more information, see:
  * https://lists.x.org/archives/xorg-announce/2021-May/003088.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31535
(**Security fix**)

==== 2021-05-15 ====

**libxml2-2.9.12**:  Upgraded.
This update fixes a denial-of-service security issue.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541
(**Security fix**)

==== 2021-04-29 ====

**bind-9.11.31**:  Upgraded.
This update fixes bugs and the following security issues:
A specially crafted GSS-TSIG query could cause a buffer overflow in the
ISC implementation of SPNEGO.
named crashed when a DNAME record placed in the ANSWER section during DNAME
chasing turned out to be the final answer to a client query.
Insufficient IXFR checks could result in named serving a zone without an SOA
record at the apex, leading to a RUNTIME_CHECK assertion failure when the
zone was subsequently refreshed. This has been fixed by adding an owner name
check for all SOA records which are included in a zone transfer.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25216
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25215
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25214
(**Security fix**)

==== 2021-04-12 ====

**dnsmasq-2.85**:  Upgraded.
Use random source ports where possible if source addresses/interfaces in use.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3448
(**Security fix**)

**irssi-1.2.3**:  Upgraded.
This update fixes bugs and security issues.
See the NEWS file for details.
(**Security fix**)

==== 2021-03-31 ====

**curl-7.76.0**:  Upgraded.
This update fixes security issues:
Authentication Bypass by Spoofing.
Exposure of Private Personal Information to an Unauthorized Actor.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22890
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22876
(**Security fix**)

==== 2021-03-28 ====

**xterm-367**:  Upgraded.
This update fixes a security issue:
xterm before Patch #366 allows remote attackers to execute arbitrary code or
cause a denial of service (segmentation fault) via a crafted UTF-8 combining
character sequence.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27135
(**Security fix**)

==== 2021-03-14 ====

**linux-libre-*-4.4.261**:  Upgraded.
These updates fix various bugs and security issues, including the recently
announced iSCSI vulnerabilities allowing local privilege escalation.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27364
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27365
(**Security fix**)

**git-2.17.6**:  Upgraded.
This update fixes a security issue:
On case-insensitive file systems with support for symbolic links, if Git is
configured globally to apply delay-capable clean/smudge filters (such as Git
LFS), Git could be fooled into running remote code during a clone. Credit for
finding and fixing this vulnerability goes to Matheus Tavares, helped by
Johannes Schindelin.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21300
(**Security fix**)

**ca-certificates-20210308**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2021-02-09 ====

**dnsmasq-2.84**:  Upgraded.
This update fixes bugs and remotely exploitable security issues:
  * Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code. Any  dnsmasq with DNSSEC compiled in and enabled is vulnerable to this,  referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683,  CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address  from which the query was originated. This keeps as much entropy  in the {query-ID, random-port} tuple as possible, to help defeat  cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers  received are for the questions originally asked. This replaces  the slightly insecure SHA-1 (when compiled with DNSSEC) or  the very insecure CRC32 (otherwise). Refer: CVE-2020-25685.
  * Handle multiple identical near simultaneous DNS queries better.  Previously, such queries would all be forwarded  independently. This is, in theory, inefficent but in practise  not a problem, _except_ that is means that an answer for any  of the forwarded queries will be accepted and cached.  An attacker can send a query multiple times, and for each repeat,  another {port, ID} becomes capable of accepting the answer he is  sending in the blind, to random IDs and ports. The chance of a  succesful attack is therefore multiplied by the number of repeats  of the query. The new behaviour detects repeated queries and  merely stores the clients sending repeats so that when the  first query completes, the answer can be sent to all the  clients who asked. Refer: CVE-2020-25686.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25681
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25682
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25683
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25684
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25685
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25686
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25687
(**Security fix**)


==== 2021-01-26 ====

**sudo-1.9.5p2**:  Upgraded.
When invoked as sudoedit, the same set of command line options
are now accepted as for "sudo -e". The -H and -P options are
now rejected for sudoedit and "sudo -e" which matches the sudo
1.7 behavior. This is part of the fix for CVE-2021-3156.
Fixed a potential buffer overflow when unescaping backslashes
in the command's arguments. Normally, sudo escapes special
characters when running a command via a shell (sudo -s or sudo
-i). However, it was also possible to run sudoedit with the -s
or -i flags in which case no escaping had actually been done,
making a buffer overflow possible. This fixes CVE-2021-3156.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156
(**Security fix**)

**glibc-zoneinfo-2021a**:  Upgraded.
This package provides the latest timezone updates.


==== 2021-01-14 ====

**wavpack-5.4.0**:  Upgraded.
WavPack 5.4.0 fixes an issue where a specially crafted WAV file could cause
the wavpack command-line program to crash with an out-of-bounds write.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35738
(**Security fix**)

**xscreensaver-5.45**:  Upgraded.
Here's an upgrade to the latest xscreensaver.
Thanks to drumz for the compile fix.

**sudo-1.9.5p1**:  Upgraded.
Fixed a regression introduced in sudo 1.9.5 where the editor run by sudoedit
was set-user-ID root unless SELinux RBAC was in use. The editor is now run
with the user's real and effective user-IDs.


==== 2021-01-11 ====

**sudo-1.9.5**:  Upgraded.
This update fixes security issues:
Potential information leak in sudoedit that could be used to test for
the existence of directories not normally accessible to the user.
Flaw in the temporary file handling of sudoedit's SELinux RBAC support.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23239
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23240
(**Security fix**)

**glibc-zoneinfo-2020f**:  Upgraded.
This package provides the latest timezone updates.

**ca-certificates-20201219**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2020-12-12 ====

**p11-kit-0.23.22**:  Upgraded.
Fix memory-safety issues that affect the RPC protocol.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29362
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363
(**Security fix**)

==== 2020-12-09 ====

**curl-7.74.0**:  Upgraded.
This release includes the following security related bugfixes:
  * Inferior OCSP verification [93]
  * FTP wildcard stack overflow [95]
  * Trusting FTP PASV responses [97]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284
(**Security fix**)

==== 2020-11-28 ====

**bind-9.11.25**:  Upgraded.
This update fixes bugs, including a denial-of-service security issue:
After a Negative Trust Anchor (NTA) is added, BIND performs periodic
checks to see if it is still necessary. If BIND encountered a failure
while creating a query to perform such a check, it attempted to
dereference a NULL pointer, resulting in a crash. [GL #2244]
(**Security fix**)

==== 2020-11-25 ====

**mutt-1.10.1**:  Rebuilt.
Mutt had incorrect error handling when initially connecting to an IMAP
server, which could result in an attempt to authenticate without enabling TLS.
For more information, see:
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28896
(**Security fix**)

**ca-certificates-20201105**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**glibc-zoneinfo-2020d**:  Upgraded.
This package provides the latest timezone updates.

**linux-libre-*-4.4.240**:  Upgraded.
These updates fix various bugs and security issues, including the recently
discovered "Bleeding Tooth" vulnerability in the Bluetooth subsystem
(CVE-2020-12351, CVE-2020-12352, and CVE-2020-24490).
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.228:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20810
Fixed in 4.4.229:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12771
Fixed in 4.4.230:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15393
Fixed in 4.4.232:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10323
Fixed in 4.4.233:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26088
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19054
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25212
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9445
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13094
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8043
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16166
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14331
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19448
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19074
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19073
Fixed in 4.4.234:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14314
Fixed in 4.4.236:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25285
Fixed in 4.4.237:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25284
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14390
Fixed in 4.4.238:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25643
Fixed in 4.4.239:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25211
Fixed in 4.4.240:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12351
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12352
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24490
(**Security fix**)

==== 2020-10-20 ====

**freetype-2.6.3**:  Rebuilt.
Fix heap buffer overflow in embedded PNG bitmap handling.
For more information, see
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999
(**Security fix**)

**glibc-zoneinfo-2020c**:  Upgraded.
This package provides the latest timezone updates.

**ca-certificates-20201016**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**rust-1.46.0**:  Upgraded.

==== 2020-09-23 ====

**linux-libre-image-4.4.27**: Removed (FXP). From now on, custom kernels will be distributed via Web.

**xonotic-0.8.2**: Removed (FXP). This low-quality package will be refactored before coming back.

==== 2020-09-18 ====

**avahi-0.7**: Added (FXP)

**libdaemon-0.14**: Added (FXP)

**libreoffice-6.2.8.2**: Rebuilt (FXP). Run ''freepkg ir avahi'' and then ''freepkg u libreoffice'' to upgrade.

==== 2020-09-05 ====

**gnutls-3.6.15**:  Upgraded.
libgnutls: Fixed "no_renegotiation" alert handling at incorrect timing,
which could lead to an application crash.
[GNUTLS-SA-2020-09-04, CVSS: medium]
(**Security fix**)

==== 2020-08-21 ====

**bind-9.11.22**:  Upgraded.
This update fixes three security issues:
"update-policy" rules of type "subdomain" were incorrectly treated as
"zonesub" rules, which allowed keys used in "subdomain" rules to update
names outside of the specified subdomains. The problem was fixed by making
sure "subdomain" rules are again processed as described in the ARM.
When BIND 9 was compiled with native PKCS#11 support, it was possible to
trigger an assertion failure in code determining the number of bits in the
PKCS#11 RSA public key with a specially crafted packet.
It was possible to trigger an assertion failure when verifying the response
to a TSIG-signed request.
For more information, see:
  * https://kb.isc.org/docs/cve-2020-8624
  * https://kb.isc.org/docs/cve-2020-8623
  * https://kb.isc.org/docs/cve-2020-8622
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8624
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8623
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8622
(**Security fix**)

==== 2020-08-19 ====

**curl-7.72.0**:  Upgraded.
This update fixes a security issue:
libcurl: wrong connect-only connection [98]
For more information, see:
  * https://curl.haxx.se/docs/CVE-2020-8231.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231
(**Security fix**)

**httpd-2.4.46**:  Upgraded.
This is the latest release from the Apache HTTP Server 2.4.x stable branch.

==== 2020-07-23 ====

**libreoffice-6.2.8.2**: Upgraded (FXP). The full collection of language packs and help packs is not supplied, but they can be installed via libreoffice extension manager.

==== 2020-07-06 ====

**libvorbis-1.3.7**:  Upgraded.
Fix out-of-bounds read encoding very low sample rates.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10393
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14160
(**Security fix**)

**ca-certificates-20200630**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2020-06-24 ====

**curl-7.71.0**:  Upgraded.
This update fixes security issues:
curl overwrite local file with -J [111]
Partial password leak over DNS on HTTP redirect [48]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8169
(**Security fix**)

**libjpeg-turbo-2.0.5**:  Upgraded.
This update fixes bugs and a security issue:
Fixed an issue in the PPM reader that caused a buffer overrun in cjpeg,
TJBench, or the `tjLoadImage()` function if one of the values in a binary
PPM/PGM input file exceeded the maximum value defined in the file's header
and that maximum value was less than 255.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13790
(**Security fix**)

==== 2020-06-23 ====

**ntp-4.2.8p15**:  Upgraded.
This release fixes one vulnerability: Associations that use CMAC
authentication between ntpd from versions 4.2.8p11/4.3.97 and
4.2.8p14/4.3.100 will leak a small amount of memory for each packet.
Eventually, ntpd will run out of memory and abort.
(**Security fix**)

**sudo-1.8.31p2**:  Upgraded.
This is a bugfix release. For more information, see:
  * https://www.sudo.ws/legacy.html#1.8.31p2

==== 2020-06-18 ====

**bind-9.11.20**:  Upgraded.
This update fixes a security issue:
It was possible to trigger an INSIST in lib/dns/rbtdb.c:new_reference() with
a particular zone content and query patterns.
For more information, see:
  * https://kb.isc.org/docs/cve-2020-8619
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8619
(**Security fix**)

==== 2020-06-14 ====

**R-4.0.1**: upgraded (FXP).

**pcre2-10.35**: added (FXP) as a new requirement for R.

**fuse-exfat-1.3.0**: added (FXP).

**linux-libre-*-4.4.227**:  Upgraded.
These updates fix various bugs and security issues, including a mitigation
for SRBDS (Special Register Buffer Data Sampling). SRBDS is an MDS-like
speculative side channel that can leak bits from the random number generator
(RNG) across cores and threads.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.218:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11668
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11608
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11609
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10942
Fixed in 4.4.219:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11494
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11565
Fixed in 4.4.220:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12826
Fixed in 4.4.221:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19319
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12464
Fixed in 4.4.222:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10751
Fixed in 4.4.224:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10711
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1749
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12769
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10690
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13143
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19768
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12770
Fixed in 4.4.225:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9517
Fixed in 4.4.226:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10732
Fixed in 4.4.227:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0543
(**Security fix**)

**gnutls-3.6.14**:  Upgraded.
Fixed insecure session ticket key construction, since 3.6.4. The TLS server
would not bind the session ticket encryption key with a value supplied by
the application until the initial key rotation, allowing attacker to bypass
authentication in TLS 1.3 and recover previous conversations in TLS 1.2.
[GNUTLS-SA-2020-06-03, CVSS: high]
(**Security fix**)

**ca-certificates-20200602**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**proftpd-1.3.6d**:  Upgraded.
This is a bugfix release:
Fixed issue with FTPS uploads of large files using TLSv1.3 (Issue #959).

==== 2020-05-19 ====

**bind-9.11.19**:  Upgraded.
This update fixes security issues:
A malicious actor who intentionally exploits the lack of effective
limitation on the number of fetches performed when processing referrals
can, through the use of specially crafted referrals, cause a recursing
server to issue a very large number of fetches in an attempt to process
the referral. This has at least two potential effects: The performance of
the recursing server can potentially be degraded by the additional work
required to perform these fetches, and the attacker can exploit this
behavior to use the recursing server as a reflector in a reflection attack
with a high amplification factor.
Replaying a TSIG BADTIME response as a request could trigger an assertion
failure.
For more information, see:
  * https://kb.isc.org/docs/cve-2020-8616
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616
  * https://kb.isc.org/docs/cve-2020-8617
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8617
(**Security fix**)

**libexif-0.6.22**:  Upgraded.
This update fixes bugs and security issues:
  * CVE-2018-20030: Fix for recursion DoS
  * CVE-2020-13114: Time consumption DoS when parsing canon array markers
  * CVE-2020-13113: Potential use of uninitialized memory
  * CVE-2020-13112: Various buffer overread fixes due to integer overflows in maker notes
  * CVE-2020-0093:  read overflow
  * CVE-2019-9278:  replaced integer overflow checks the compiler could optimize away by safer constructs
  * CVE-2020-12767: fixed division by zero
  * CVE-2016-6328:  fixed integer overflow when parsing maker notes
  * CVE-2017-7544:  fixed buffer overread
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20030
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13114
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13113
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13112
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0093
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9278
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12767
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6328
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7544
(**Security fix**)

==== 2020-05-18 ====

**sane-1.0.30**:  Upgraded.
This update fixes several security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12867
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12862
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12863
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12865
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12866
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12861
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12864
(**Security fix**)

**glibc-zoneinfo-2020a**:  Upgraded.
This package provides the latest timezone updates.

==== 2020-04-21 ====

**git-2.17.5**:  Upgraded.
This update fixes a security issue:
With a crafted URL that contains a newline or empty host, or lacks
a scheme, the credential helper machinery can be fooled into
providing credential information that is not appropriate for the
protocol in use and host being contacted.
Unlike the vulnerability CVE-2020-5260 fixed in v2.17.4, the
credentials are not for a host of the attacker's choosing; instead,
they are for some unspecified host (based on how the configured
credential helper handles an absent "host" parameter).
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11008
(**Security fix**)

==== 2020-04-17 ====

**openvpn-2.4.9**:  Upgraded.
This update fixes a security issue:
Fix illegal client float. Thanks to Lev Stipakov.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11810
(**Security fix**)

==== 2020-04-15 ====

**bind-9.11.18**:  Upgraded.
This update fixes a security issue:
DNS rebinding protection was ineffective when BIND 9 is configured as a
forwarding DNS server. Found and responsibly reported by Tobias Klein.
[GL #1574]
(**Security fix**)

==== 2020-04-14 ====

**git-2.17.4**:  Upgraded.
This update fixes a security issue:
With a crafted URL that contains a newline in it, the credential helper
machinery can be fooled to give credential information for a wrong host.
The attack has been made impossible by forbidding a newline character in
any value passed via the credential protocol. Credit for finding the
vulnerability goes to Felix Wilhelm of Google Project Zero.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5260
(**Security fix**)

==== 2020-03-31 ====

**gnutls-3.6.13**:  Upgraded.
This update fixes a security issue:
libgnutls: Fix a DTLS-protocol regression (caused by TLS1.3 support),
since 3.6.3. The DTLS client would not contribute any randomness to the
DTLS negotiation, breaking the security guarantees of the DTLS protocol.
[GNUTLS-SA-2020-03-31, CVSS: high]
(**Security fix**)

**httpd-2.4.43**:  Upgraded.
This release contains security fixes (since 2.4.39) and improvements.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10097
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9517
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10098
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10092
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10082
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10081
(**Security fix**)


==== 2020-03-27 ====

**linux-libre-*-4.4.217**:  Upgraded.
These updates fix various bugs and security issues.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.209:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19965
Fixed in 4.4.210:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19068
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14615
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14895
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19056
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19066
Fixed in 4.4.211:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15217
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21008
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15220
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15221
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5108
Fixed in 4.4.212:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14896
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14897
Fixed in 4.4.215:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9383
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2732
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16233
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0009
Fixed in 4.4.216:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11487
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8647
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8649
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16234
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8648
Fixed in 4.4.217:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14901
(**Security fix**)

==== 2020-03-23 ====

**gd-2.3.0**:  Upgraded.
This update fixes bugs and security issues:
  * Potential double-free in gdImage*Ptr().
  * gdImageColorMatch() out of bounds write on heap.
  * Uninitialized read in gdImageCreateFromXbm().
  * Double-free in gdImageBmp.
  * Potential NULL pointer dereference in gdImageClone().
  * Potential infinite loop in gdImageCreateFromGifCtx().
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6978
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6977
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11038
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000222
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14553
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5711
(**Security fix**)

**NetworkManager-1.8.4**:  Rebuilt.
Recompiled to get PPP working again with the new pppd. Thanks to longus.

**sudo-1.8.31p1**:  Upgraded.
This is a bugfix release:
Sudo once again ignores a failure to restore the RLIMIT_CORE resource limit,
as it did prior to version 1.8.29. Linux containers don't allow RLIMIT_CORE
to be set back to RLIM_INFINITY if we set the limit to zero, even for root,
which resulted in a warning from sudo.

**rp-pppoe-3.13**:  Upgraded.
This needed a rebuild for ppp-2.4.8. Thanks to regdub.

==== 2020-03-04 ====

**ppp-2.4.8**:  Upgraded.
This update fixes a security issue:
By sending an unsolicited EAP packet to a vulnerable ppp client or server,
an unauthenticated remote attacker could cause memory corruption in the
pppd process, which may allow for arbitrary code execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8597
(**Security fix**)

==== 2020-02-20 ====

**proftpd-1.3.6c**:  Upgraded.
No CVEs assigned, but this sure looks like a security issue:
Use-after-free vulnerability in memory pools during data transfer.
(**Security fix**)

==== 2020-02-14 ====

**libarchive-3.4.2**:  Upgraded.
This update includes security fixes in the RAR5 reader.
(**Security fix**)

==== 2020-01-31 ====

**sudo-1.8.31**:  Upgraded.
This update fixes a security issue:
In Sudo before 1.8.31, if pwfeedback is enabled in /etc/sudoers, users can
trigger a stack-based buffer overflow in the privileged sudo process.
(pwfeedback is a default setting in some Linux distributions; however, it
is not the default for upstream or in Slackware, and would exist only if
enabled by an administrator.) The attacker needs to deliver a long string
to the stdin of getln() in tgetpass.c.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634
(**Security fix**)

**bind-9.11.15**:  Upgraded.
This is a bugfix release:
With some libmaxminddb versions, named could erroneously match an IP address
not belonging to any subnet defined in a given GeoIP2 database to one of the
existing entries in that database. [GL #1552]
Fix line spacing in `rndc secroots`. Thanks to Tony Finch. [GL #2478]

==== 2020-01-11 ====

**p7zip-16.02**: Added (FXP)
==== 2020-01-09 ====

**linux-libre-*-4.4.208**:  Upgraded.
   IPV6_MULTIPLE_TABLES n -> y
  +IPV6_SUBTREES y
These updates fix various bugs and security issues.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.203:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19524
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15917
Fixed in 4.4.204:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18660
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15291
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18683
Fixed in 4.4.206:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12614
Fixed in 4.4.207:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19227
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19062
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19338
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19332
Fixed in 4.4.208:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19057
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19063
(**Security fix**)

**xfce4-weather-plugin-0.8.11**:  Upgraded.
Bugfix release to address the upcoming obsolescence of the
locationforecastLTS API from met.no. Thanks to Robby Workman.

**libwmf-0.2.8.4**:  Rebuilt.
This is a bugfix release to correct the path for the GDK_PIXBUF_DIR.
Thanks to B. Watson and Robby Workman.

==== 2019-12-21 ====

**openssl-1.0.2u**:  Upgraded.
This update fixes a low severity security issue:
Fixed an an overflow bug in the x86_64 Montgomery squaring procedure used in
exponentiation with 512-bit moduli.
For more information, see:
  * https://www.openssl.org/news/secadv/20191206.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551
(**Security fix**)

**openssl-solibs-1.0.2u**:  Upgraded.

**tigervnc-1.10.1**:  Upgraded.
From tigervnc.org: "This is a security release to fix a number of issues
that were found by Kaspersky Lab. These issues affect both the client and
server and could theoretically allow a malicious peer to take control
over the software on the other side. No working exploit is known at this
time, and the issues require the peer to first be authenticated. We still
urge users to upgrade when possible."
(**Security fix**)

==== 2019-12-19 ====

**bind-9.11.14**:  Upgraded.
This is a bugfix release:
Fixed a bug that caused named to leak memory on reconfiguration when
any GeoIP2 database was in use. [GL #1445]
Fixed several possible race conditions discovered by Thread Sanitizer.

**wavpack-5.2.0**:  Upgraded.
Fixed denial-of-service and other potential security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19840
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19841
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767
(**Security fix**)

**ca-certificates-20191130**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2019-11-21 ====

**bind-9.11.13**:  Upgraded.
This update fixes a security issue:
Set a limit on the number of concurrently served pipelined TCP queries.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477
(**Security fix**)

==== 2019-11-17 ====

**linux-libre-*-4.4.202**:  Upgraded.
  * CRYPTO_CRC32C_INTEL m -> y
  * +X86_INTEL_TSX_MODE_AUTO n
  * +X86_INTEL_TSX_MODE_OFF y
  * +X86_INTEL_TSX_MODE_ON n
These updates fix various bugs and security issues, including mitigation for
the TSX Asynchronous Abort condition on some CPUs.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.201:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0155
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0154
Fixed in 4.4.202:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11135
(**Security fix**)

==== 2019-11-12 ====

**kdelibs-4.14.38**:  Rebuilt.                                                                                                                                                           
Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.

**kdepim-4.14.10**:  Rebuilt.
Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.

**kdepimlibs-4.14.10**:  Rebuilt.
Remove hardcoded TLSv1 allowing TLSv1.1 and TLSv1.2. Thanks to PJ Beers.

**linux-libre-*-4.4.199**:  Upgraded.
These updates fix various bugs and security issues.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.191:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3900
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15118
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10906
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10905
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10638
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15117
Fixed in 4.4.193:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14835
Fixed in 4.4.194:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14816
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14814
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15505
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14821
Fixed in 4.4.195:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17053
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17052
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17056
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17055
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17054
Fixed in 4.4.196:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2215
Fixed in 4.4.197:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16746
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20976
Fixed in 4.4.198:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17075
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17133
Fixed in 4.4.199:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15098
(**Security fix**)

==== 2019-11-04 ====

**libtiff-4.1.0**:  Upgraded.
libtiff: fix integer overflow in _TIFFCheckMalloc() that could cause a crash.
tif_dir: unset transferfunction field if necessary.
pal2rgb: failed to free memory on a few errors.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14973
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19210
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6128
(**Security fix**)

==== 2019-10-21 ====

**python-2.7.17**:  Upgraded.
This update fixes bugs and security issues:
Update vendorized expat library version to 2.2.8.
Disallow URL paths with embedded whitespace or control characters into the
underlying http client request. Such potentially malicious header injection
URLs now cause an httplib.InvalidURL exception to be raised.
Avoid file reading by disallowing ``local-file://`` and ``local_file://``
URL schemes in :func:`urllib.urlopen`, :meth:`urllib.URLopener.open` and
:meth:`urllib.URLopener.retrieve`.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948
(**Security fix**)

**ca-certificates-20191018**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**sudo-1.8.28p1**:  Rebuilt.
This is a bugfix release:
Ensure that /etc/environment exists to prevent complaints from "sudo -i".

==== 2019-10-14 ====

**sudo-1.8.28**:  Upgraded.
Fixed a bug where an sudo user may be able to run a command as root when
the Runas specification explicitly disallows root access as long as the
ALL keyword is listed first.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287
(**Security fix**)

==== 2019-10-02 ====

**libpcap-1.9.1**:  Upgraded.
This update is required for the new version of tcpdump.

**tcpdump-4.9.3**:  Upgraded.
Fix buffer overflow/overread vulnerabilities and command line
argument/local issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16808
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14468
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14469
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14470
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14466
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14461
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14462
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14465
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14881
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14464
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14463
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10103
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10105
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14880
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16451
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14882
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16227
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16229
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16301
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16230
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16452
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16300
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16228
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15166
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15167
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14879
(**Security fix**)

==== 2019-09-16 ====

**expat-2.2.8**:  Upgraded.
Fix heap overflow triggered by XML_GetCurrentLineNumber (or
XML_GetCurrentColumnNumber), and deny internal entities closing the doctype.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903
(**Security fix**)

==== 2019-09-12 ====

**curl-7.66.0**:  Upgraded.
This update fixes security issues:
FTP-KRB double-free
TFTP small blocksize heap buffer overflow
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482
(**Security fix**)

**glibc-zoneinfo-2019c**:  Upgraded.
This package provides the latest timezone updates.

**openssl-1.0.2t**:  Upgraded.
This update fixes low severity security issues:
Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
Compute ECC cofactors if not provided during EC_GROUP construction
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547
(**Security fix**)

**openssl-solibs-1.0.2t**:  Upgraded.

**emacs-26.3**:  Upgraded.
This is a bugfix release.

==== 2019-08-27 ====

**linux-libre-*-4.4.190**:  Upgraded.
These updates fix various bugs and a minor local denial-of-service security
issue. They also change this option:
  * FANOTIFY_ACCESS_PERMISSIONS n -> y
This is needed by on-access virus scanning software.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see: Fixed in 4.4.190:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20961
(**Security fix**)

**ca-certificates-20190826**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**bind-9.11.9**:  Upgraded.
This update fixes various bugs and also updates the named.root file in
the caching-example configuration to the latest version.

==== 2019-08-14 ====

**linux-libre-*-4.4.189**:  Upgraded.
These updates fix various bugs and many security issues, and include the
Spectre v1 SWAPGS mitigations.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition. For more information, see:

Fixed in 4.4.187:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13631
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18509
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14283
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10207
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14284
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13648
Fixed in 4.4.189:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20856
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1125
(**Security fix**)

==== 2019-08-08 ====

**kdelibs-4.14.38**:  Upgraded.
kconfig: malicious .desktop files (and others) would execute code.
For more information, see:
  * https://mail.kde.org/pipermail/kde-announce/2019-August/000047.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14744
(**Security fix**)

==== 2019-07-25 ====

**R-3.6.1**: Upgraded (FXP)

==== 2019-07-22 ====

**linux-libre-*-4.4.186**:  Upgraded.
These updates fix various bugs and many minor security issues.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * Fixed in 4.4.183:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11599
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3892
  * Fixed in 4.4.185:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13272
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16597
  * Fixed in 4.4.186:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10126
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3846
(**Security fix**)

**curl-7.65.3**:  Upgraded.
This is a bugfix release:
Fix a regression that caused the progress meter not to appear.
For more information, see:
  * https://curl.haxx.se/changes.html

**emacs-26.2**:  Upgraded.
This is a bugfix release.
Patched package.el to obey buffer-file-coding-system (bug #35739), fixing
bad signature from GNU ELPA for archive-contents.
Thanks to Stefan Monnier and Eric Lindblad.

==== 2019-07-14 ====

**bzip2-1.0.8**:  Upgraded.                                                                                                                                           
Fixes security issues:                                                                                                                                                
bzip2recover: Fix use after free issue with outFile.                                                                                                                  
Make sure nSelectors is not out of range.                                                                                                                             
For more information, see:                                                                                                                                            
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3189                                                                                                      
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900                                                                                                     
(**Security fix**)

**glibc-zoneinfo-2019b**:  Upgraded.                                                                                                             
This package provides the latest timezone updates.                                                                                                                    
                                                                                                                                                                      
**rust-1.36.0**:  Upgraded.
Upgraded to the latest Rust compiler for Firefox 68.0.

**xscreensaver-5.43**:  Upgraded.
Here's an upgrade to the latest xscreensaver.

==== 2019-07-13 ====

**lincity-ng-2.0**: added (FXP). LinCity-NG is  a city simulation game.
It is a polished and improved
version of the classic LinCity game. In the game,you are required to
build and maintain a city. You can win the game either by building a
sustainable economy or by evacuating all citizens with spaceships.

**SDL_gfx-2.0.25**: added (FXP). SDL graphics drawing  primitives
and other support functions. The
SDL_gfx  library  evolved  out of the SDL_gfxPrimitives code which
provided basic drawing routines such as lines, circles or polygons
and SDL_rotozoom which  implemented a interpolating rotozoomer for
SDL surfaces.
  * homepage: http://www.ferzkopp.net/Software/SDL_gfx-2.0/

**jam-2.5**: added (FXP).
Jam is a program construction tool, like make(1). Jam recursively
builds target files from source files, using dependency information
and updating actions expressed in the Jambase file, which is written
in jam's own interpreted language. The default Jambase is compiled
into jam and provides a boilerplate for common use, relying on a
user-provide file "Jamfile" to enumerate actual targets and sources.
  * http://public.perforce.com/public/jam/src/Jam.html

==== 2019-07-02 ====

**icecat-60.7.0**: Upgraded (FXP). This update includes upstream features and patches.
  * https://www.mozilla.org/en-US/firefox/60.7.0/releasenotes/

(**Security fix**)

==== 2019-07-01 ====

**linux-libre-*-4.4.182**:  Upgraded.
These updates fix various bugs and many security issues, including the
"SACK Panic" remote denial-of-service issue.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:

Fixed in 4.4.174:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5391
Fixed in 4.4.175:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7222
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7221
Fixed in 4.4.176:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6974
Fixed in 4.4.177:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9213
Fixed in 4.4.178:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3459
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3460
Fixed in 4.4.179:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11486
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11810
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11815
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11190
Fixed in 4.4.180:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20836
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3882
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11884
Fixed in 4.4.181:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11833
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20510
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000026
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9503
Fixed in 4.4.182:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11477
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11478
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11479
(**Security fix**)

**irssi-1.1.3**:  Upgraded.
This update fixes a security issue: Use after free when sending SASL login
to the server found by ilbelkyr. May affect the stability of Irssi. SASL
logins may fail, especially during (manual and automated) reconnect.
For more information, see:
  * https://irssi.org/2019/06/29/irssi-1.2.1-1.1.3-1.0.8-released/
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13045
(**Security fix**)

==== 2019-06-20 ====

**bind-9.11.8**:  Upgraded.
Fixed a race condition in dns_dispatch_getnext() that could cause an
assertion failure if a significant number of incoming packets were rejected.
For more information, see:
  * https://kb.isc.org/docs/cve-2019-6471
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6471
(**Security fix**)

**ca-certificates-20190617**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

==== 2019-06-16 ====

**curl-7.65.1**:  Upgraded.
This is a bugfix release.
For more information, see:
  * https://curl.haxx.se/changes.html

**openssl-1.0.2s**:  Upgraded.
This is a bugfix release:
Change the default RSA, DSA and DH size to 2048 bit instead of 1024.
This changes the size when using the genpkey app when no size is given.
It fixes an omission in earlier changes that changed all RSA, DSA and DH
generation apps to use 2048 bits by default.  [Kurt Roeckx]

**openssl-solibs-1.0.2s**:  Upgraded.

**rdesktop-1.8.6**:  Upgraded.
This is a small bug fix release for rdesktop 1.8.5. An issue was discovered
soon after release where it was impossible to connect to some servers. This
issue has now been fixed, but otherwise this release is identical to 1.8.5.

==== 2019-05-23 ====

**curl-7.65.0**:  Upgraded.
This release fixes the following security issues:
Integer overflows in curl_url_set
tftp: use the current blksize for recvfrom()
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5435
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436
(**Security fix**)

==== 2019-05-16 ====

**rdesktop-1.8.5**:  Upgraded.
This update fixes security issues:
Add bounds checking to protocol handling in order to fix many
security problems when communicating with a malicious server.
(**Security fix**)

==== 2019-04-26 ====

**bind-9.11.6_P1**:  Upgraded.
This update fixes a security issue:
The TCP client quota set using the tcp-clients option could be exceeded
in some cases. This could lead to exhaustion of file descriptors.
For more information, see:
  * https://kb.isc.org/docs/cve-2018-5743
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5743
(**Security fix**)

**curl-7.64.1**:  Upgraded.
This update fixes a regression in curl-7.64.0 which could lead to
100% CPU usage. Thanks to arcctgx.


==== 2019-04-17 ====

**libpng-1.6.37**:  Upgraded.
This update fixes security issues:
  * Fixed a use-after-free vulnerability (CVE-2019-7317) in png_image_free.
  * Fixed a memory leak in the ARM NEON implementation of png_do_expand_palette.
  * Fixed a memory leak in pngtest.c.
  * Fixed two vulnerabilities (CVE-2018-14048, CVE-2018-14550) in contrib/pngminus; refactor.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14048
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14550
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7317
(**Security fix**)

**libssh2-1.8.2**:  Upgraded.
This update fixes a misapplied userauth patch that broke 1.8.1.
Thanks to Ook.

**glibc-zoneinfo-2019a**:  Upgraded.
This package provides the latest timezone updates.

==== 2019-04-06 ====

**httpd-2.4.39**:  Upgraded.
This release contains security fixes and improvements.
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker
or prefork, code executing in less-privileged child processes or threads
(including scripts executed by an in-process scripting interpreter) could
execute arbitrary code with the privileges of the parent process by
manipulating the scoreboard.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0211
(**Security fix**)

==== 2019-04-06 ====

**openjpeg-2.3.1**:  Upgraded.
Includes many bug fixes (including security fixes).
(**Security fix**)

**wget-1.20.3**:  Upgraded.
Fixed a buffer overflow vulnerability:
src/iri.c(do_conversion): Reallocate the output buffer to a larger
size if it is already full.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5953
(**Security fix**)

==== 2019-04-02 ====

**ghostscript-9.26**:  Upgraded.                                                                                                                                      
Fixes security issues:                                                                                                                                                
A specially crafted PostScript file could have access to the file system                                                                                              
outside of the constrains imposed by -dSAFER.                                                                                                                         
Transient procedures can allow access to system operators, leading to                                                                                                 
remote code execution.                                                                                                                                                
For more information, see:                                                                                                                                            
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835                                                                                                      
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838                                                                                                      
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6116                                                                                                      
(**Security fix**)                                                                                                                                                    
                                                                                                                                                                      
**wget-1.20.2**:  Upgraded.                                                                                                                                           
Fixed an unspecified buffer overflow vulnerability.                                                                                                                   
(**Security fix**)

==== 2019-03-27 ====

**gnutls-3.6.7**:  Upgraded.
Fixes security issues:
  * libgnutls, gnutls tools: Every gnutls_free() will automatically set the free'd pointer to NULL. This prevents possible use-after-free and double free issues. Use-after-free will be turned into NULL dereference. The counter-measure does not extend to applications using gnutls_free().
  * libgnutls: Fixed a memory corruption (double free) vulnerability in the certificate verification API. Reported by Tavis Ormandy; addressed with the change above. [GNUTLS-SA-2019-03-27, #694]
  * libgnutls: Fixed an invalid pointer access via malformed TLS1.3 async messages; Found using tlsfuzzer. [GNUTLS-SA-2019-03-27, #704]
  * libgnutls: enforce key usage limitations on certificates more actively. Previously we would enforce it for TLS1.2 protocol, now we enforce it even when TLS1.3 is negotiated, or on client certificates as well. When an inappropriate for TLS1.3 certificate is seen on the credentials structure GnuTLS will disable TLS1.3 support for that session (#690).
  * libgnutls: enforce the equality of the two signature parameters fields in a certificate. We were already enforcing the signature algorithm, but there was a bug in parameter checking code.

(**Security fix**)

==== 2019-03-19 ====

**libssh2-1.8.1**:  Upgraded.
Fixed several security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3855
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3856
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3857
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3858
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3859
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3860
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3861
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3862
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3863
(**Security fix**)

**mariadb-10.0.38**:  Rebuilt.
Fixed paths in /usr/bin/mysql_install_db.
Thanks to Stuart Winter.

==== 2019-03-08 ====

**ca-certificates-20190308**  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**ntp-4.2.8p13**:  Upgraded.
This release fixes a bug that allows an attacker with access to an explicitly
trusted source to send a crafted malicious mode 6 (ntpq) packet that can
trigger a NULL pointer dereference, crashing ntpd.
It also provides 17 other bugfixes and 1 other improvement.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8936
(**Security fix**)

==== 2019-03-03 ====

**python-2.7.16**:  Upgraded.
Updated to the latest 2.7.x release, which fixes a few security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010
(**Security fix**)

==== 2019-03-01 ====

**infozip-6.0**:  Rebuilt.
Added some patches that should fix extracting archives with non-latin
characters in the filenames. Thanks to saahriktu.
This update also fixes various security issues in zip and unzip.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8139
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8140
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8141
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9844
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18384
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000035
(**Security fix**)

**curl-7.64.0**:  Rebuilt.
Applied upstream patch to fix log spam:
[PATCH] multi: remove verbose "Expire in" ... messages
Thanks to compassnet.

==== 2019-02-27 ====

**ca-certificates-20181210**:  Upgraded.
This update provides the latest CA certificates to check for the
authenticity of SSL connections.

**openssl-1.0.2r**:  Upgraded.
Go into the error state if a fatal alert is sent or received. If an
application calls SSL_shutdown after a fatal alert has occured and
then behaves different based on error codes from that function then
the application may be vulnerable to a padding oracle.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559
(**Security fix**)

**openssl-solibs-1.0.2r**:  Upgraded.

==== 2019-02-23 ====

**file-5.36**:  Upgraded.
Fix out-of-bounds read and denial-of-service security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8906
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8907
(**Security fix**)

==== 2019-02-12 ====

**lxc-2.0.9_d3a03247**:  Upgraded.
This update fixes a security issue where a malicious privileged container
could overwrite the host binary and thus gain root-level code execution on
the host. As the LXC project considers privileged containers to be unsafe
no CVE has been assigned for this issue for LXC. To prevent this attack,
LXC has been patched to create a temporary copy of the calling binary
itself when it starts or attaches to containers. To do this LXC creates an
anonymous, in-memory file using the memfd_create() system call and copies
itself into the temporary in-memory file, which is then sealed to prevent
further modifications. LXC then executes this sealed, in-memory file
instead of the original on-disk binary.
For more information, see:
  * https://seclists.org/oss-sec/2019/q1/119
(**Security fix**)

==== 2019-02-12 ====

**xonotic-0.8.2**: added (FXP). A fast-paced first-person shooter geared towards providing
addictive arena gameplay. Xonotic is a direct successor of the Nexuiz, which was a fork of DarkPlaces, which was a fork of Quake engine.

==== 2019-02-07 ====

**php-5.6.40**:  Upgraded.
Several security bugs have been fixed in this release:

GD:
  * Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to use-after-free).
  * Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap).
Mbstring:
  * Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token).
  * Fixed bug #77371 (heap buffer overflow in mb regex functions - compile_string_node).
  * Fixed bug #77381 (heap buffer overflow in multibyte match_at).
  * Fixed bug #77382 (heap buffer overflow due to incorrect length in expand_case_fold_string).
  * Fixed bug #77385 (buffer overflow in fetch_token).
  * Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode).
  * Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code).
Phar:
  * Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext).
Xmlrpc:
  * Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()).
  * Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code).
For more information, see:
  * https://php.net/ChangeLog-5.php#5.6.40
(**Security fix**)

==== 2019-02-07 ====

**curl-7.64.0**:  Upgraded.
This release fixes the following security issues:
  * NTLM type-2 out-of-bounds buffer read.
  * NTLMv2 type-3 header stack buffer overflow.
  * SMTP end-of-response out-of-bounds read.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3822
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3823
(**Security fix**)

==== 2019-02-02 ====

**freealut-1.1.0**: added (FXP). freealut is a free implementation of OpenAL's ALUT standard.

**plib-1.8.5**: added (FXP). plib (Steve's Portable Game Library).

PLIB includes sound effects, music, a complete 3D engine, font rendering, a simple Windowing library, a game scripting language, a GUI, networking, 3D math library and a collection of handy utility functions.

**torcs-1.3.7**: added (FXP). TORCS, The Open Racing Car Simulator is a highly portable multi platform car racing simulation. It is used as ordinary car racing game, as AI racing game and as research platform. It runs on Linux (x86, AMD64 and PPC), FreeBSD, MacOSX and Windows. TORCS features more than 50 different cars, more than 20 tracks, and 50 opponents to race against.

**mariadb-10.0.38**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2537
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2529
(**Security fix**)

==== 2019-02-01 ====

**linux-libre-*-4.4.172**:  Upgraded.                                                                                                                                                                                   
These updates fix various bugs and many (mostly minor) security issues.                                                                                                                                         
Be sure to upgrade your initrd after upgrading the kernel packages.                                                                                                                                             
If you use lilo to boot your machine, be sure lilo.conf points to the correct                                                                                                                                   
kernel and initrd and run lilo as root to update the bootloader.                                                                                                                                                
If you use elilo to boot your machine, you should run eliloconfig to copy the                                                                                                                                   
kernel and initrd to the EFI System Partition.                                                                                                                                                                  
For more information, see:                                                                                                                                                                                      

Fixed in 4.4.159:                                                                                                                                                                                             
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20511                                                                                                                                               
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14633
Fixed in 4.4.160:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7755
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18021
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10880
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13053
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17972
Fixed in 4.4.163:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18281
Fixed in 4.4.164:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18710
Fixed in 4.4.167:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19824
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16862
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20169
Fixed in 4.4.168:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1120
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5848
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12896
Fixed in 4.4.169:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18241
Fixed in 4.4.170:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19985
Fixed in 4.4.171:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16884
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14611
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14610
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14613
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14612
Fixed in 4.4.172:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14616
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13096
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13097
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14614
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13099
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13100
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3701
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18690
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18249
(**Security fix**)

==== 2019-01-23 ====

**httpd-2.4.38**:  Upgraded.
This release contains security fixes and improvements.
  * mod_session: mod_session_cookie does not respect expiry time allowing sessions to be reused.  [Hank Ibell]
  * mod_http2: fixes a DoS attack vector. By sending slow request bodies to resources not consuming them, httpd cleanup code occupies a server thread unnecessarily. This was changed to an immediate stream reset which discards all stream state and incoming data.  [Stefan Eissing]
  * mod_ssl: Fix infinite loop triggered by a client-initiated renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and later.  PR 63052.  [Joe Orton]
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17199
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17189
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0190
(**Security fix**)

==== 2019-01-14 ====

**zsh-5.6.2**:  Upgraded.
This release fixes security issues, including ones that could allow a local
attacker to execute arbitrary code.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18205
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18206
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1071
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1083
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1100
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7548
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7549
(**Security fix**)

==== 2019-01-11 ====

**glibc-zoneinfo-2018i**:  Upgraded.
This package provides the latest timezone updates.

**irssi-1.1.2**:  Upgraded.
This update addresses bugs including security and stability issues:
  * A NULL pointer dereference occurs for an "empty" nick.
  * Certain nick names could result in out-of-bounds access when printing theme strings.
  * Crash due to a NULL pointer dereference w hen the number of windows exceeds the available space.
  * Use-after-free when SASL messages are received in an unexpected order.
  * Use-after-free when a server is disconnected during netsplits.
  * Use-after-free when hidden lines were expired from the scroll buffer.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7050
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7051
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7052
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7053
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7054
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5882
(**Security fix**)

**xscreensaver-5.42**:  Upgraded.
Here's an upgrade to the latest xscreensaver.

==== 2018-12-22 ====

**netatalk-3.1.12**:  Upgraded.
Netatalk before 3.1.12 is vulnerable to an out of bounds write in
dsi_opensess.c. This is due to lack of bounds checking on attacker
controlled data. A remote unauthenticated attacker can leverage
this vulnerability to achieve arbitrary code execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1160
(**Security fix**)

==== 2018-12-08 ====

**php-5.6.39**:  Upgraded.
Several security bugs have been fixed in this release: 
  * Segfault when using convert.quoted-printable-encode filter.
  * Null pointer dereference in imap_mail.
  * imap_open allows to run arbitrary shell commands via mailbox parameter.
  * PharData always creates new files with mode 0666.
  * Heap Buffer Overflow (READ: 4) in phar_parse_pharfile.
For more information, see:
  * https://php.net/ChangeLog-5.php#5.6.39
(**Security fix**)

==== 2018-12-05 ====

**gnutls-3.6.5**:  Upgraded.
This update fixes a security issue:
Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and
padding oracle verification.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16868
(**Security fix**)

**nettle-3.4.1**:  Upgraded.
This update fixes a security issue:
A Bleichenbacher type side-channel based padding oracle attack was found
in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5
data. An attacker who is able to run a process on the same physical core
as the victim process, could use this flaw to extract plaintext or in some
cases downgrade any TLS connections to a vulnerable server.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16869
(**Security fix**)

==== 2018-12-03 ====

**mozilla-nss-3.40.1**:  Upgraded.
Upgraded to nss-3.40.1 and nspr-4.20.
Mitigate cache side-channel variant of the Bleichenbacher attack.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404
(**Security fix**)

==== 2018-11-29 ====

**samba-4.6.16**:  Rebuilt.
This update patches some security issues:
  * CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server
  * CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT
  * CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server
  * CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers
  * CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported)
  * CVE-2018-16857: Bad password count in AD DC not always effective
For more information, see:
  * https://www.samba.org/samba/security/CVE-2018-14629.html
  * https://www.samba.org/samba/security/CVE-2018-16841.html
  * https://www.samba.org/samba/security/CVE-2018-16851.html
  * https://www.samba.org/samba/security/CVE-2018-16852.html
  * https://www.samba.org/samba/security/CVE-2018-16853.html
  * https://www.samba.org/samba/security/CVE-2018-16857.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14629
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16841
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16851
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16852
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16853
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16857
(**Security fix**)

==== 2018-11-22 ====
**openssl-1.0.2q**:  Upgraded.
This update fixes a timing side-channel flaw on processors which implement
SMT/Hyper-Threading architectures, and a side channel attack on DSA
signature generation that could allow an attacker to recover the private key.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5407
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734
(**Security fix**)

**openssl-solibs-1.0.2q**:  Upgraded.

==== 2018-11-15 ====

**icecat-60.3.0**: Upgraded (FXP). This update includes upstream features and patches.
  * https://www.mozilla.org/en-US/firefox/60.3.0/releasenotes/

(**Security fix**)

==== 2018-11-12 ====

**libtiff-4.0.10**:  Upgraded.
This update fixes some denial of service security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7456
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8905
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10779
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10963
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18661
(**Security fix**)

==== 2018-11-05 ====

**mariadb-10.0.37**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3282
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9843
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3174
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3143
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3156
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3251
(**Security fix**)

==== 2018-10-31 ====

**curl-7.62.0**:  Upgraded.
This release fixes the following security issues:
SASL password overflow via integer overflow.
Use-after-free in handle close.
Warning message out-of-buffer read.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16839
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16842
(**Security fix**)

**glibc-zoneinfo-2018g**:  Upgraded.
This package provides the latest timezone updates.

**httpd-2.4.37**:  Upgraded.
This is the latest release from the Apache HTTP Server 2.4.x stable branch.

==== 2018-10-27 ====

**libssh-0.7.6**:  Upgraded.
Fixed authentication bypass vulnerability.
For more information, see:
  * https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10933
(**Security fix**)

==== 2018-10-10 ====

**git-2.14.5**:  Upgraded.
This update fixes a security issue:
Submodules' "URL"s come from the untrusted .gitmodules file, but we
blindly gave it to "git clone" to clone submodules when "git clone --recurse-submodules" was used to clone a project that has such a
submodule. The code has been hardened to reject such malformed URLs
(e.g. one that begins with a dash). Credit for finding and fixing this
vulnerability goes to joernchen and Jeff King, respectively.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17456
(**Security fix**)

**httpd-2.4.35**:  Upgraded.
This release fixes bugs and regressions in httpd-2.4.34, adds an
apache2ctl -> apachectl symlink, and no longer automatically
overwrites rc.httpd when upgraded.

**extra/llvm/llvm-6.0.1**:  Upgraded.
Moved this package from /patches, since it is not really a required patch.
Unless you're planning to rebuild Firefox or Thunderbird (or have some
other use-case for a more recent LLVM than was shipped with Slackware 14.2)
you probably don't need to upgrade to this package, and it was reported
that doing so impacted at least one package provided by slackbuilds.org.
So, /extra seems like a better place for this package.

==== 2018-09-22 ====

**linux-libre-*-4.4.157**:  Upgraded.
This kernel removes the unnecessary vmacache_flush_all code which could have
led to a use-after-free situation and potentially local privilege escalation.
In addition, it fixes some regressions which may have led to diminished X
performance.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17182
(**Security fix**)

==== 2018-09-15 ====

**php-5.6.38**:  Upgraded.
One security bug has been fixed in this release: 
Apache2: XSS due to the header Transfer-Encoding: chunked
For more information, see:
  * https://php.net/ChangeLog-5.php#5.6.38
(**Security fix**)

==== 2018-09-13 ====

**ghostscript-9.25**:  Upgraded.
This release fixes problems with argument handling, some unintended
results of the security fixes to the SAFER file access restrictions
(specifically accessing ICC profile files), and some additional
security issues over the recent 9.24 release.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16509
(**Security fix**)

**lxc-2.0.1**:  Rebuilt.
Added libunistring to the list of initial packages in the Slackware
template since it is now required by wget, and without it slackpkg will
not function properly. Thanks to mralk3.

==== 2018-09-06 ====

**FXP:** Mozilla products were purged from FXP, but we still pass on the free+libre dependencies supplied by the upstream, along with their message.

**PV:** Hey folks, in light of Firefox 52.x ESR reaching EOL a few hours ago, I'm                                                                                                                
providing some updates. This required adding Rust and a newer version of                                                                                                                 
LLVM as optional updates for Slackware 14.2. And in case it doesn't work
for you (perhaps there's an extension you need that's not supported by 60.x
ESR), the last Firefox and Thunderbird 52.x EST have been moved to /pasture
as a fallback. If there are any more updates to those (but I don't think
there will be), I'll make those updates in /pasture as well.

**llvm-6.0.1**:  Upgraded.
This upgrade to LLVM is provided because Firefox and Thunderbird require
a newer version than what was shipped with Slackware 14.2. The libLLVM
shared library from llvm-3.8.0 is also included in this package, so it
should be safe to upgrade on Slackware 14.2 systems without breaking
anything, but unless you are planning to recompile Firefox or Thunderbird,
or you need a newer version of LLVM for some reason, it is optional.

**rust-1.28.0**:  Added.
Since Rust is now a requirement to compile Firefox and Thunderbird we
are adding it here. Unless you will need to recompile those (or need to
compile other code written in Rust), it is an optional addition.

**curl-7.61.1**:  Upgraded.
This update fixes an NTLM password overflow via integer overflow.
For more information, see:
  * https://curl.haxx.se/docs/CVE-2018-14618.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14618
(**Security fix**)

**ghostscript-9.24**:  Upgraded.
Patched multiple -dSAFER sandbox bypass vulnerabilities.
Thanks to Tavis Ormandy.
For more information, see:
  * https://www.ghostscript.com/doc/9.24/News.htm
  * https://www.kb.cert.org/vuls/id/332928
(**Security fix**)

==== 2018-08-29 ====

**linux-libre-*-4.4.153**:  Upgraded.
This kernel update enables mitigations for L1 Terminal Fault aka
Foreshadow and Foreshadow-NG vulnerabilities.
Thanks to Bernhard Kaindl for bisecting the boot issue that was preventing
us from upgrading to earlier 4.4.x kernels that contained this fix.
To see the status of CPU vulnerability mitigations on your system, look at
the files in: /sys/devices/system/cpu/vulnerabilities
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3615
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3620
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3546
(**Security fix**)

==== 2018-08-21 ====

**libX11-1.6.6**:  Upgraded.
This update fixes some security issues:
  * Fixed crash on invalid reply (CVE-2018-14598).
  * Fixed off-by-one writes (CVE-2018-14599).
  * Fixed out of boundary write (CVE-2018-14600).
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14598
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14599
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14600
(**Security fix**)

==== 2018-08-17 ====

**ntp-4.2.8p12**:  Upgraded.
This release improves on one security fix in ntpd:
  * LOW/MEDIUM: Sec 3012: Sybil vulnerability: ephemeral association attack
While fixed in ntp-4.2.8p7 and with significant additional protections for
this issue in 4.2.8p11, ntp-4.2.8p12 includes a fix for an edge case in the new noepeer support. Originally reported by Matt Van Gundy of Cisco. Edge-case hole reported by Martin Burnicki of Meinberg.
And fixes another security issue in ntpq and ntpdc:
  * LOW: Sec 3505:
The openhost() function used during command-line hostname processing by ntpq and ntpdc can write beyond its buffer limit, which could allow  an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source. Reported by Fakhri Zulkifli.
For more information, see:
  * http://support.ntp.org/bin/view/Main/SecurityNotice#August_2018_ntp_4_2_8p12_NTP_Rel
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12327
(**Security fix**)

**samba-4.6.16**:  Upgraded.
This is a security release in order to address the following defects:
  * Insufficient input validation on client directory listing in libsmbclient.
  * A malicious server could return a directory entry that could corrupt libsmbclient memory.
  * Confidential attribute disclosure from the AD LDAP server.
  * Missing access control checks allow discovery of confidential attribute values via authenticated LDAP search expressions.
For more information, see:
  * https://www.samba.org/samba/security/CVE-2018-10858.html
  * https://www.samba.org/samba/security/CVE-2018-10919.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10858
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10919
(**Security fix**)

==== 2018-08-14 ====

**blueman-2.0.6**:  Rebuilt.
  * Fixed install script to rename config file from .new.
  * Allow users in the netdev group to make changes. Thanks to voleg, kgha, and zakame.

**openssl-1.0.2p**:  Upgraded.
This update fixes two low severity security issues:
  * Client DoS due to large DH parameter.
  * Cache timing vulnerability in RSA Key Generation.
For more information, see:
  * https://www.openssl.org/news/secadv/20180612.txt
  * https://www.openssl.org/news/secadv/20180416.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0732
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0737
(**Security fix**)

**openssl-solibs-1.0.2p**:  Upgraded.

**xscreensaver-5.40**:  Upgraded.
Here's an upgrade to the latest xscreensaver.

==== 2018-08-10 ====

**bind-9.10.8_P1**:  Upgraded.
Fixed a security issue where named could crash during recursive processing
of DNAME records when "deny-answer-aliases" was in use resulting in a
denial of service. Note that "deny-answer-aliases" is rarely used.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5740
(**Security fix**)

==== 2018-08-02 ====

**lftp-4.8.4**:  Upgraded.
It has been discovered that lftp up to and including version 4.8.3 does
not properly sanitize remote file names, leading to a loss of integrity
on the local system when reverse mirroring is used. A remote attacker
may trick a user to use reverse mirroring on an attacker controlled FTP
server, resulting in the removal of all files in the current working
directory of the victim's system.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10916
(**Security fix**)

**blueman-2.0.6**:  Upgraded.
This update fixes an issue where blueman-mechanism did not enforce the
polkit action 'org.blueman.network.setup' for which a polkit policy is
shipped. This meant that any user with access to the D-Bus system bus was
able to access the related API without authentication. The result was an
unspecified impact on the networking stack.
Thanks to Matthias Gerstner for discovering this issue.

(**Security fix**)

==== 2018-07-31 ====

**file-5.34**:  Upgraded.
Fixed a denial of service crash when processing a crafted ELF file.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10360
(**Security fix**)


==== 2018-07-28 ====

**linux-libre-*-4.4.144**:  Upgraded.
This kernel update enables additional mitigations for spectre_v2 (IBPB and
IBRS_FW). It also enables reporting on the Speculative Store Bypass
vulnerability (aka GPZ Variant 4) which affects Intel processors and must
be patched with a microcode update.
To see the status of CPU vulnerability mitigations on your system, look at
the files in: /sys/devices/system/cpu/vulnerabilities
In addition, these kernels enable SMB2. Here's the complete list of kernel
config changes from the previous 4.4.132:
  * -X86_DEBUG_STATIC_CPU_HAS n
  *  CIFS_SMB2 n -> y
  * +CC_OPTIMIZE_FOR_PERFORMANCE y
  * +CIFS_SMB311 n
  * +X86_FAST_FEATURE_TESTS y
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3639
(**Security fix**)

==== 2018-07-21 ====

**php-5.6.37**:  Upgraded.
Several security bugs have been fixed in this release, including:
  * Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c
  * heap-buffer-overflow (READ of size 48) while reading exif data
(**Security fix**)

==== 2018-07-18 ====

**httpd-2.4.34**:  Upgraded.
This update fixes two denial of service issues:
  * mod_md: DoS via Coredumps on specially crafted requests
  * mod_http2: DoS for HTTP/2 connections by specially crafted requests
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8011
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1333
(**Security fix**)

**R-3.5.1**: Upgraded (FXP)

==== 2018-07-17 ====

**mutt-1.10.1**:  Upgraded.
This update fixes bugs and security issues. Upstream strongly recommends
that all IMAP and POP users upgrade as soon as possible.

(**Security fix**)

==== 2018-07-12 ====

**bind-9.10.8**:  Upgraded.
This update fixes security issues:
Fixed a bug where extraordinarily large zone transfers caused several
problems, with possible outcomes including corrupted journal files or
server exit due to assertion failure.
Don't permit recursive query service to unauthorized clients.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5738
(**Security fix**)

**curl-7.61.0**:  Upgraded.
This update fixes a buffer overflow in SMTP send.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0500
(**Security fix**)

**zlib-1.2.11**:  Upgraded.
This is a bugfix package update to fix decompression errors when zlib is
used with recent versions of Node.js. Thanks to Ken Zalewski for the report.

==== 2018-06-19 ====

**gnupg-1.4.23**:  Upgraded.
Sanitize the diagnostic output of the original file name in verbose mode.
By using a made up file name in the message it was possible to fake status
messages. Using this technique it was for example possible to fake the
verification status of a signed mail.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020
(**Security fix**)

**libcgroup-0.41**:  Rebuilt.
This is a bugfix package update.
  * Make cgexec setgid root (setuid root is an unnecessarily large hammer).
  * Added /etc/cgconfig.d/ directory.
  * Added "LANG=C" in build script to avoid a bug where rc.cgred reports syntax errors at start.
These changes are tested here, and work with unprivileged containers.
Thanks to chris.willing.

**libcgroup-0.41**:  Rebuilt.
This is a bugfix package update.
Make cgexec setuid root, since the cgred group doesn't exist on 14.2.
This is how the -2 build was, but the change was inadvertently dropped
in the previous update.

**libgcrypt-1.7.10**:  Upgraded.
Use blinding for ECDSA signing to mitigate a novel side-channel attack.
For more information, see:
  * https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495
(**Security fix**)

**libcgroup-0.41**:  Rebuilt.
This is a bugfix package update.
Apply all post 0.41 patches from git, including one for an infinite loop
bug that causes 100% CPU usage on one core. Thanks to chris.willing.

==== 2018-06-08 ====

**gnupg2-2.0.31**:  Upgraded.
Sanitize the diagnostic output of the original file name in verbose mode.
By using a made up file name in the message it was possible to fake status
messages. Using this technique it was for example possible to fake the
verification status of a signed mail.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020
(**Security fix**)

**elilo-3.16**:  Rebuilt.
Patched and rebuilt to fix issues with larger kernels.

==== 2018-06-01 ====

**git-2.14.4**:  Upgraded.
This update fixes security issues:
Submodule "names" come from the untrusted .gitmodules file, but we
blindly append them to $GIT_DIR/modules to create our on-disk repo
paths. This means you can do bad things by putting "../" into the
name. We now enforce some rules for submodule names which will cause
Git to ignore these malicious names (CVE-2018-11235).
Credit for finding this vulnerability and the proof of concept from
which the test script was adapted goes to Etienne Stalmans.
It was possible to trick the code that sanity-checks paths on NTFS
into reading random piece of memory (CVE-2018-11233).
Credit for fixing for these bugs goes to Jeff King, Johannes
Schindelin and others.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233
(**Security fix**)

**glibc-zoneinfo-2018e**:  Rebuilt.
Handle removal of US/Pacific-New timezone. If we see that the machine is
using this, it will be automatically switched to US/Pacific.

==== 2018-05-23 ====

**linux-libre-4.4.132**:  Upgraded.
This kernel upgrade is being provided primarily to fix a regression in the
getsockopt() function, but it also contains fixes for two denial-of-service
security issues.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000004
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1092
(**Security fix**)

**procps-ng-3.3.15**:  Upgraded.
Shared library .so-version bump.
This update fixes bugs and security issues:
  * library: Fix integer overflow and LPE in file2strvec
  * library: Use size_t for alloc functions
  * pgrep: Fix stack-based buffer overflow
  * ps: Fix buffer overflow in output buffer, causing DOS
  * top: Don't use cwd for location of config
For more information, see:
  * https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1124
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1126
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1125
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1123
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1122
(**Security fix**)

==== 2018-05-17 ====

**curl-7.60.0**:  Upgraded.
This release contains security fixes:
  * FTP: shutdown response buffer overflow
  * RTSP: bad headers buffer over-read
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000300
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000301
(**Security fix**)

**php-5.6.36**:  Upgraded.
This fixes many bugs, including some security issues:
  * Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
  * stream filter convert.iconv leads to infinite loop on invalid sequence
  * Malicious LDAP-Server Response causes crash
  * fix for CVE-2018-5712 may not be complete
For more information, see:
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10549
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10546
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10548
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10547
(**Security fix**)

==== 2018-05-11 ====

**mariadb-10.0.35**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2782
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2784
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2787
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2766
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2755
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2819
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2817
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2761
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2781
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2771
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2813
(**Security fix**)

==== 2018-05-09 ====

**glibc-zoneinfo-2018e**:  Upgraded.
This package provides the latest timezone updates.

**wget-1.19.5**:  Upgraded.
Fixed a security issue where a malicious web server could inject arbitrary
cookies into the cookie jar file.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0494
(**Security fix**)

==== 2018-05-04 ====

**python-2.7.15**:  Upgraded.
Updated to the latest 2.7.x release.
This fixes some security issues in difflib and poplib (regexes vulnerable
to denial of service attacks), as well as security issues with the bundled
expat library.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0876
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061
(**Security fix**)

==== 2018-05-01 ====

**libwmf-0.2.8.4**:  Rebuilt.
Renamed package to fix wrong package tag (was slack14.1, should be
slack14.2). Thanks to rworkman for the heads-up.

**libwmf-0.2.8.4**:  Rebuilt.
Patched denial of service and possible execution of arbitrary code
security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10167
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10168
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9011
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9317
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6362
(**Security fix**)

==== 2018-04-30 ====

**openvpn-2.4.6**:  Upgraded.
This is a security update fixing a potential double-free() in Interactive
Service. This usually only leads to a process crash (DoS by an unprivileged
local account) but since it could possibly lead to memory corruption if
happening while multiple other threads are active at the same time,
CVE-2018-9336 has been assigned to acknowledge this risk.
For more information, see:
  * https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9336
(**Security fix**)


==== 2018-04-28 ====

**R-3.5.0**: Upgraded (FXP)

==== 2018-04-18 ====

**gd-2.2.5**:  Upgraded.
This update fixes two security issues:
Double-free in gdImagePngPtr() (denial of service).
Buffer over-read into uninitialized memory (information leak).
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6362
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7890
(**Security fix**)

==== 2018-04-06 ====

**patch-2.7.6**:  Upgraded.
Fix arbitrary shell execution possible with obsolete ed format patches.
For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000156

(**Security fix**)

**libidn-1.34**:  Upgraded.
This update fixes security issues:
  * Fix integer overflow in combine_hangul()
  * Fix integer overflow in punycode decoder
  * Fix NULL pointer dereference in g_utf8_normalize()
  * Fix NULL pointer dereference in stringprep_ucs4_nfkc_normalize()
(**Security fix**)

==== 2018-04-03 ====

**puddletag-1.2.0**: Upgraded (FXP)

==== 2018-04-01 ====

**php-5.6.35**:  Upgraded.
This update fixes a security issue where sensitive data belonging to other
accounts might be accessed by a local user.
For more information, see: http://bugs.php.net/75605

(**Security fix**)

==== 2018-03-29 ====

**ruby-2.2.10**:  Upgraded.
This release includes some bug fixes and some security fixes:
  * HTTP response splitting in WEBrick.
  * Unintentional file and directory creation with directory traversal in tempfile and tmpdir.
  * DoS by large request in WEBrick.
  * Buffer under-read in String#unpack.
  * Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket.
  * Unintentional directory traversal by poisoned NUL byte in Dir.
  * Multiple vulnerabilities in RubyGems.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17742
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6914
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8777
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8779
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8780
(**Security fix**)

**openssl-1.0.2o**:  Upgraded.
This update fixes a security issue:
Constructed ASN.1 types with a recursive definition could exceed the stack.
For more information, see:
  * https://www.openssl.org/news/secadv/20180327.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0739
(**Security fix**)

**openssl-solibs-1.0.2o**:  Upgraded.

**glibc-zoneinfo-2018d**:  Upgraded.
This package provides the latest timezone updates.

==== 2018-03-20 ====

New FXP packages: **ftgl-2.1.3_rc5**, **projectM-2.1.0**

==== 2018-03-18 ====

**libvorbis-1.3.6**:  Upgraded.
This release fixes security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14632
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14633
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146
(**Security fix**)

==== 2018-03-16 ====

**curl-7.59.0**:  Upgraded.
This update fixes security issues:
FTP path trickery leads to NIL byte out of bounds write
LDAP NULL pointer dereference
RTSP RTP buffer over-read
For more information, see:
  * https://curl.haxx.se/docs/adv_2018-9cd6.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000120
  * https://curl.haxx.se/docs/adv_2018-97a2.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000121
  * https://curl.haxx.se/docs/adv_2018-b047.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000122
(**Security fix**)

**R-3.4.4**: Upgraded (FXP)

==== 2018-03-13 ====

**samba-4.4.16**:  Rebuilt.
This is a security update in order to patch the following defect:
On a Samba 4 AD DC the LDAP server in all versions of Samba from
4.0.0 onwards incorrectly validates permissions to modify passwords
over LDAP allowing authenticated users to change any other users`
passwords, including administrative users.
For more information, see:
  * https://www.samba.org/samba/security/CVE-2018-1057.html
  * https://wiki.samba.org/index.php/CVE-2018-1057
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1057
(**Security fix**)

**libtool-2.4.6**:  Rebuilt.
Rebuilt to fix the embedded GCC version number. Thanks to David Spencer.

**openssh-7.4p1**:  Rebuilt.
sftp-server: in read-only mode, sftp-server was incorrectly permitting
creation of zero-length files. Reported by Michal Zalewski.
Thanks to arny (of Bluewhite64 fame) for the heads-up.
For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15906

(**Security fix**)

**php-5.6.34**:  Upgraded.
This update fixes a stack buffer overflow vulnerability.
For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7584

(**Security fix**)

==== 2018-03-04 ====

**icecat-52.6.0**: Upgraded (FXP). This update includes upstream features and patches.
https://www.mozilla.org/en-US/firefox/52.6.0/releasenotes/

(**Security fix**)

**linux-libre-*-4.4.118**:  Upgraded.
This kernel includes __user pointer sanitization mitigation for the Spectre
(variant 1) speculative side channel attack.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753

(**Security fix**)

You may have to force slackpkg to load the files, even though ChangeLog hasn't changed. 

==== 2018-03-01 ====

**dhcp-4.4.1**:  Upgraded.
This update fixes two security issues:
  * Corrected an issue where large sized 'X/x' format options were causing option handling logic to overwrite memory when expanding them to human readable form. Reported by Felix Wilhelm, Google Security Team.
  * Option reference count was not correctly decremented in error path when parsing buffer for options. Reported by Felix Wilhelm, Google Security Team. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5732
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5733
(**Security fix**)

**ntp-4.2.8p11**:  Upgraded.
This release addresses five security issues in ntpd:
  * LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are  significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of Cisco.
  * INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer  read overrun leads to undefined behavior and information leak.  Reported by Yihan Lian of Qihoo 360.
  * LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated  ephemeral associations. Reported on the questions@ list.
  * LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode  cannot recover from bad state. Reported by Miroslav Lichvar of Red Hat.
  * LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet  can reset authenticated interleaved association.  Reported by Miroslav Lichvar of Red Hat.For more information, see:
  * http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7182
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7170
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7184
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7185
(**Security fix**)

**wget-1.19.4**:  Rebuilt.
Applied upstream patch to fix logging in background mode.
Thanks to Willy Sudiarto Raharjo.

==== 2018-02-23 ====

**compton-316eac0613bf342ff91cc645a6c3c80e6b9083fb**: Upgraded.

New FXP package: **gtklife-5.2**

==== 2018-02-15 ====

**irssi-1.0.7**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://irssi.org/security/html/irssi_sa_2018_02
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7054
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7053
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7050
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7052
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7051
(**Security fix**)

==== 2018-02-11 ====

New FXP package: **unrar-5.5.8**

==== 2018-02-09 ====

**linux-libre-*-4.4.115**:  Upgraded.
This kernel includes full retpoline mitigation for the Spectre (variant 2)
speculative side channel attack.
Please note that this kernel was compiled with gcc-5.5.0, also provided as
an update for <del>Slackware</del> FreeSlack 14.2. You'll need to install the updated gcc in order
to compile kernel modules that will load into this updated kernel.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
(**Security fix**)

You may have to force slackpkg to load the files, even though ChangeLog hasn't changed. 

==== 2018-02-08 ====

New FXP package: **ghc-7.10.3**

==== 2018-02-07 ====

**gcc-5.5.0**:  Upgraded.
Upgraded to the latest gcc-5 release, with patches to support
-mindirect-branch=thunk-extern, allowing full mitigation of Spectre v2
in the kernel (when CONFIG_RETPOLINE is used).

  * **gcc-g++-5.5.0**:  Upgraded.
  * **gcc-gfortran-5.5.0**:  Upgraded.
  * **gcc-gnat-5.5.0**:  Upgraded.
  * **gcc-go-5.5.0**:  Upgraded.
  * **gcc-java-5.5.0**:  Upgraded.
  * **gcc-objc-5.5.0**:  Upgraded.

==== 2018-02-04 ====

**php-5.6.33**:  Upgraded.
This update fixes bugs and security issues, including:
Potential infinite loop in gdImageCreateFromGifCtx.
Reflected XSS in .phar 404 page.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5711
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5712
(**Security fix**)

**mariadb-10.0.34**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2562
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2622
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2640
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2665
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2668
(**Security fix**)

**rsync-3.1.3**:  Upgraded.
This update fixes two security issues:
Fixed a buffer overrun in the protocol's handling of xattr names and
ensure that the received name is null terminated.
Fix an issue with --protect-args where the user could specify the arg in
the protected-arg list and short-circuit some of the arg-sanitizing code.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5764
(**Security fix**)

**curl-7.58.0**:  Rebuilt.
Recompiled using --with-libssh2, which is evidently no longer a default
option. Thanks to Markus Wiesner.

==== 2018-01-24 ====

**curl-7.58.0**:  Upgraded.
This update fixes security issues:
HTTP authentication leak in redirects
HTTP/2 trailer out-of-bounds read
For more information, see:
  * https://curl.haxx.se/docs/adv_2018-b3bf.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000007
  * https://curl.haxx.se/docs/adv_2018-824a.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000005
(**Security fix**)

**glibc-zoneinfo**:  Upgraded.
This package provides the latest timezone updates.

**wget-1.19.4**:  Upgraded.
More bug fixes:
A major bug that caused GZip'ed pages to never be decompressed has been fixed
Support for Content-Encoding and Transfer-Encoding have been marked as
experimental and disabled by default

==== 2018-01-18 ====

**bind-9.10.6_P1**:  Upgraded.
This update fixes a high severity security issue:
Improper sequencing during cleanup can lead to a use-after-free error,
triggering an assertion failure and crash in named.
For more information, see:
  * https://kb.isc.org/article/AA-01542
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3145
(**Security fix**)

==== 2018-01-17 ====

**linux-libre-*-4.4.111**:  Upgraded.
This kernel includes mitigations for the Spectre (variant 2) and Meltdown
speculative side channel attacks.
Be sure to upgrade your initrd after upgrading the kernel packages.
If you use lilo to boot your machine, be sure lilo.conf points to the correct
kernel and initrd and run lilo as root to update the bootloader.
If you use elilo to boot your machine, you should run eliloconfig to copy the
kernel and initrd to the EFI System Partition.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754
(**Security fix**)

==== 2018-01-09 ====

**irssi-1.0.6**:  Upgraded.
This update fixes multiple security vulnerabilities.
For more information, see:
  * https://irssi.org/security/irssi_sa_2018_01.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5205
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5206
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5207
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5208
(**Security fix**)

**xscreensaver-5.38**:  Upgraded. Here's an upgrade to the latest xscreensaver.

==== 2018-01-05 ====

**R-3.4.3**: Upgraded (FXP)

==== 2017-12-20 ====

**ruby-2.2.9**:  Upgraded.
This update fixes a security issue:
Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile
use Kernel#open to open a local file. If the localfile argument starts with
the pipe character "|", the command following the pipe character is executed.
The default value of localfile is File.basename(remotefile), so malicious FTP
servers could cause arbitrary command execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17405
(**Security fix**)

==== 2017-12-08 ====

**openssl-1.0.2n**:  Upgraded.
This update fixes security issues:
Read/write after SSL object in error state
rsaz_1024_mul_avx2 overflow bug on x86_64
For more information, see:
  * https://www.openssl.org/news/secadv/20171207.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3737
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3738
(**Security fix**)

**openssl-solibs-1.0.2n**:  Upgraded.

**curl-7.57.0**:  Upgraded.
This update fixes security issues:
SSL out of buffer access
FTP wildcard out of bounds read
NTLM buffer overflow via integer overflow
For more information, see:
  * https://curl.haxx.se/docs/adv_2017-af0a.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8818
  * https://curl.haxx.se/docs/adv_2017-ae72.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817
  * https://curl.haxx.se/docs/adv_2017-12e7.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8816
(**Security fix**)

**libXcursor-1.1.15**:  Upgraded.
Fix heap overflows when parsing malicious files. (CVE-2017-16612)
It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes
4 bytes. Properly chosen values allow an overflow which in turn will
lead to less allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.
For more information, see:
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16612
(**Security fix**)

**libXfont-1.5.1**:  Rebuilt.
Open files with O_NOFOLLOW. (CVE-2017-16611)
A non-privileged X client can instruct X server running under root
to open any file by creating own directory with "fonts.dir",
"fonts.alias" or any font file being a symbolic link to any other
file in the system. X server will then open it. This can be issue
with special files such as /dev/watchdog (which could then reboot
the system).
For more information, see:
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16611
(**Security fix**)


==== 2017-11-28 ====

**samba-4.4.16**:  Rebuilt.
This is a security update in order to patch the following defects:
  * CVE-2017-14746 (Use-after-free vulnerability.)
All versions of Samba from 4.0.0 onwards are vulnerable to a use after
free vulnerability, where a malicious SMB1 request can be used to
control the contents of heap memory via a deallocated heap pointer. It
is possible this may be used to compromise the SMB server.
  * CVE-2017-15275 (Server heap memory information leak.)
All versions of Samba from 3.6.0 onwards are vulnerable to a heap
memory information leak, where server allocated heap memory may be
returned to the client without being cleared.

For more information, see:
  * https://www.samba.org/samba/security/CVE-2017-14746.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14746
  * https://www.samba.org/samba/security/CVE-2017-15275.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15275
(**Security fix**)

==== 2017-11-21 ====

**libtiff-4.0.9**:  Upgraded.
This release contains security fixes and improvements.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8128
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5318
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10095
(**Security fix**)

==== 2017-11-16 ====

**libplist-2.0.0**:  Upgraded.
This update fixes several security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6440
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6439
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6438
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6437
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6436
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6435
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5836
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5835
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5834
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5545
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5209
(**Security fix**)

==== 2017-11-04 ====

New FXP packages:
  * **gnucash-2.6.13** and its pre-requisites
  * **goffice0.8-0.8.17**
  * **libgnomecanvas**
  * **libofx-0.9.11**
  * **libwebp-0.6.0**
  * **webkitgtk-2.4.11**

==== 2017-11-03 ====

**mariadb-10.0.33**:  Upgraded.
This update fixes bugs and security issues.
For more information, see:
  * https://jira.mariadb.org/browse/MDEV-13819
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10268
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10378
(**Security fix**)

**openssl-1.0.2m**:  Upgraded.
This update fixes a security issue:
There is a carry propagating bug in the x64 Montgomery squaring procedure.
No EC algorithms are affected. Analysis suggests that attacks against RSA
and DSA as a result of this defect would be very difficult to perform and
are not believed likely. Attacks against DH are considered just feasible
(although very difficult) because most of the work necessary to deduce
information about a private key may be performed offline. The amount of
resources required for such an attack would be very significant and likely
only accessible to a limited number of attackers. An attacker would
additionally need online access to an unpatched system using the target
private key in a scenario with persistent DH parameters and a private
key that is shared between multiple clients.
This only affects processors that support the BMI1, BMI2 and ADX extensions
like Intel Broadwell (5th generation) and later or AMD Ryzen.
For more information, see:
  * https://www.openssl.org/news/secadv/20171102.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3736
(**Security fix**)

**openssl-solibs-1.0.2m**:  Upgraded.

==== 2017-10-27 ====

**NetworkManager-1.8.4**:  Upgraded.
This update is provided to address issues with wifi scanning when using the
new wpa_supplicant with certain hardware drivers.  If you're not having
problems, you don't need this update (but it probably won't hurt).

**network-manager-applet-1.8.4**:  Upgraded.
This package goes along with the optional NetworkManager update.

**php-5.6.32**:  Upgraded.
Several security bugs were fixed in this release:
Out of bounds read in timelib_meridian().
The arcfour encryption stream filter crashes PHP.
Applied upstream patch for PCRE (CVE-2016-1283).
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283
(**Security fix**)

**wget-1.19.2**:  Upgraded.
This update fixes stack and heap overflows in in HTTP protocol handling.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13089
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13090
(**Security fix**)

==== 2017-10-26 ====

**glibc-zoneinfo-2017c**:  Upgraded.
This package provides the latest timezone updates.

**httpd-2.4.29**:  Upgraded.
This is a bugfix release.

**irssi-1.0.5**:  Upgraded.
This update fixes some remote denial of service issues.
For more information, see:
  * https://irssi.org/security/irssi_sa_2017_10.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15228
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15227
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15721
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15723
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15722
(**Security fix**)

**xfce4-weather-plugin-0.8.10**:  Upgraded.
This has a bugfix related to setting the location:
https://bugzilla.xfce.org/show_bug.cgi?id=13877

==== 2017-10-24 ====

**curl-7.56.1**:  Upgraded.
This update fixes a security issue:
IMAP FETCH response out of bounds read may cause a crash or information leak.
For more information, see:
  * https://curl.haxx.se/docs/adv_20171023.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257
(**Security fix**)

==== 2017-10-06 ====

**libXres-1.2.0**:  Upgraded.
Integer overflows may allow X servers to trigger allocation of insufficient
memory and a buffer overflow via vectors related to the (1)
XResQueryClients and (2) XResQueryClientResources functions.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1988
(**Security fix**)

**wpa_supplicant-2.6**:  Upgraded.
This update includes patches to mitigate the WPA2 protocol issues known
as "KRACK" (Key Reinstallation AttaCK), which may be used to decrypt data,
hijack TCP connections, and to forge and inject packets. This is the
list of vulnerabilities that are addressed here:
  * CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
  * CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
  * CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
  * CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
  * CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
  * CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
  * CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
  * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
  * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
  * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. For more information, see:
  * https://www.krackattacks.com/
  * https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13077
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13078
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13079
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13081
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13082
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13084
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13086
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13087
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13088
(**Security fix**)

**xorg-server-1.18.3**:  Rebuilt.
This update fixes integer overflows and other possible security issues.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12176
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12177
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12178
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12179
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12180
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12181
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12182
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12183
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12184
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12185
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12186
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12187
(**Security fix**)

**xorg-server-xephyr-1.18.3**:  Rebuilt.

**xorg-server-xnest-1.18.3**:  Rebuilt.

**xorg-server-xvfb-1.18.3**:  Rebuilt.

==== 2017-10-06 ====

**curl-7.56.0**:  Upgraded.  This update fixes a security issue:
libcurl may read outside of a heap allocated buffer when doing FTP.
For more information, see:
  * https://curl.haxx.se/docs/adv_20171004.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
(**Security fix**)

**openjpeg-2.3.0**:  Upgraded.
This update fixes security issues which may lead to a denial of service
or possibly remote code execution.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9572
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9573
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9580
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9581
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12982
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14039
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14040
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14041
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14151
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14152
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14164
(**Security fix**)

**xorg-server-1.18.3**:  Rebuilt.
This update fixes two security issues:
Xext/shm: Validate shmseg resource id, otherwise it can belong to a
non-existing client and abort X server with FatalError "client not
in use", or overwrite existing segment of another existing client.
Generating strings for XKB data used a single shared static buffer,
which offered several opportunities for errors. Use a ring of
resizable buffers instead, to avoid problems when strings end up
longer than anticipated.
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13721
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13723
(**Security fix**)

**xorg-server-xephyr-1.18.3**:  Rebuilt.

**xorg-server-xnest-1.18.3**:  Rebuilt.

**xorg-server-xvfb-1.18.3**:  Rebuilt.

==== 2017-10-02 ====

**dnsmasq-2.78**:  Upgraded. This update fixes bugs and remotely exploitable security issues that may
have impacts including denial of service, information leak, and execution
of arbitrary code. Thanks to Felix Wilhelm, Fermin J. Serna, Gabriel Campana,
Kevin Hamacher, Ron Bowes, and Gynvael Coldwind of the Google Security Team.
For more information, see:
  * https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13704
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14491
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14492
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14493
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14494
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14495
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14496
(**Security fix**)


==== 2017-10-01 ====

**openexr-2.2.0**:  Rebuilt. Patched bugs that may lead to program crashes or possibly execution of arbitrary code. Thanks to Thomas Choi for the patch.  For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9110
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9111
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9112
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9113
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9114
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9115
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9116
(**Security fix**)


==== 2017-09-28 ====

**gegl-0.2.0**:  Rebuilt. Patched integer overflows in operations/external/ppm-load.c that could allow a denial of service (application crash) or possibly the execution of arbitrary code via a large width or height value in a ppm image. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4433
(**Security fix**)

==== 2017-09-23 ====

**libxml2-2.9.5**:  Upgraded. This release fixes some security issues: Detect infinite recursion in parameter entities (Nick Wellnhofer),  Fix handling of parameter-entity references (Nick Wellnhofer),  Disallow namespace nodes in XPointer ranges (Nick Wellnhofer),  Fix XPointer paths beginning with range-to (Nick Wellnhofer). (**Security fix**)

**python-2.7.14**:  Upgraded.  Updated to the latest 2.7.x release.  This fixes some security issues related to the bundled expat library.  For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233
(**Security fix**)

==== 2017-09-21 ====

**samba-4.4.16**:  Upgraded.  This is a security release in order to address the following defects: SMB1/2/3 connections may not require signing where they should. A man in the  middle attack may hijack client connections.  SMB3 connections don't keep encryption across DFS redirects. A man in the  middle attack can read and may alter confidential documents transferred via  a client connection, which are reached via DFS redirect when the original  connection used SMB3.  Server memory information leak over SMB1. Client with write access to a share  can cause server memory contents to be written into a file or printer.  For more information, see:
  * https://www.samba.org/samba/security/CVE-2017-12150.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12150
  * https://www.samba.org/samba/security/CVE-2017-12151.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12151
  * https://www.samba.org/samba/security/CVE-2017-12163.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12163
(**Security fix**)


==== 2017-09-18 ====

**httpd-2.4.27**:  Rebuilt. This update patches a security issue ("Optionsbleed") with the OPTIONS http  method which may leak arbitrary pieces of memory to a potential attacker.  Thanks to Hanno Bo:ck.  For more information, see:
  * http://seclists.org/oss-sec/2017/q3/477
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798
(**Security fix**)

**libgcrypt-1.7.9**:  Upgraded. Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth be With You". For more information, see:
  * https://eprint.iacr.org/2017/806
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379
(**Security fix**)

**ruby-2.2.8**:  Upgraded. This release includes several security fixes. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0899
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0900
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0901
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0902
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10784
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14064
(**Security fix**)

==== 2017-09-16 ====

**bluez-5.47**:  Upgraded. Fixed an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000250
(**Security fix**)

**linux-libre-*-4.4.88**:  Upgraded. This update fixes the security vulnerability known as "BlueBorne". The native Bluetooth stack in the Linux Kernel (BlueZ), starting at Linux kernel version 3.3-rc1 is vulnerable to a stack overflow in the processing of L2CAP configuration responses resulting in remote code execution in kernel space. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000251
  * https://www.armis.com/blueborne
(**Security fix**)

==== 2017-09-12 ====

**emacs-25.3**:  Upgraded. This update fixes a security vulnerability in Emacs. Gnus no longer supports "richtext" and "enriched" inline MIME objects. This support was disabled to avoid evaluation of arbitrary Lisp code contained in email messages and news articles. For more information, see:
  * http://seclists.org/oss-sec/2017/q3/422
  * https://bugs.gnu.org/28350
(**Security fix**)

**libzip-1.0.1**:  Rebuilt. Fix a denial of service security issue. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14107
(**Security fix**)

==== 2017-09-08 ====

**bash-4.3.048**:  Upgraded. This update fixes two security issues found in bash before 4.4: The expansion of '\h' in the prompt string allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. The theoretical attack vector is a hostile DHCP server providing a crafted hostname, but this is unlikely to occur in a normal Slackware configuration as we ignore the hostname provided by DHCP. Specially crafted SHELLOPTS+PS4 environment variables used against bogus setuid binaries using system()/popen() allowed local attackers to execute arbitrary code as root. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0634
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7543
(**Security fix**)

**mariadb-10.0.32**:  Upgraded. This update fixes bugs and security issues. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3636
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3641
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3653
(**Security fix**)

**mozilla-nss-3.31.1**:  Upgraded. Upgraded to nss-3.31.1 and nspr-4.16. This is a bugfix release.

**tcpdump-4.9.2**:  Upgraded. This update fixes bugs and many security issues (see the included CHANGES file). For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11541
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11542
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11543
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12893
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12894
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12895
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12896
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12897
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12898
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12899
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12900
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12901
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12902
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12985
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12986
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12987
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12988
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12989
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12990
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12991
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12992
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12993
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12994
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12995
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12996
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12997
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12998
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12999
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13000
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13001
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13002
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13003
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13004
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13005
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13006
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13007
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13008
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13009
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13010
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13011
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13012
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13013
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13014
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13015
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13016
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13017
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13018
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13019
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13020
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13021
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13022
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13023
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13024
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13025
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13026
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13027
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13028
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13029
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13030
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13031
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13032
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13033
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13034
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13035
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13036
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13037
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13038
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13039
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13040
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13041
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13042
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13043
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13044
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13045
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13046
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13047
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13048
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13049
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13050
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13051
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13052
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13053
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13054
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13055
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13687
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13688
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13689
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13690
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13725
(**Security fix**)

==== 2017-09-03 ====

**icecat-52.3.0**: Upgraded. This update includes upstream features and patches. https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/ (**Security fix**)

==== 2017-08-12 ====

**xorg-server-1.18.3**:  Rebuilt. This update fixes two security issues: a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events. Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server allowed authenticated malicious users to access potentially privileged data from the X server. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10971
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10972
(**Security fix**)

**xorg-server-xephyr-1.18.3**:  Rebuilt.

**xorg-server-xnest-1.18.3**:  Rebuilt.

**xorg-server-xvfb-1.18.3**:  Rebuilt.

==== 2017-08-12 ====

**git-2.14.1**:  Upgraded.  Fixes security issues: A %%"ssh://..."%% URL can result in a "ssh" command line with a hostname that begins with a dash "-", which would cause the "ssh" command to instead (mis)treat it as an option. This is now prevented by forbidding such a  hostname (which should not impact any real-world usage).  Similarly, when GIT_PROXY_COMMAND is configured, the command is run with  host and port that are parsed out from %%"ssh://..."%% URL; a poorly written  GIT_PROXY_COMMAND could be tricked into treating a string that begins with a  dash "-" as an option. This is now prevented by forbidding such a hostname  and port number (again, which should not impact any real-world usage).  For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000117
(**Security fix**)

**libsoup-2.52.2**:  Rebuilt. Fixed a chunked decoding buffer overrun that could be exploited against  either clients or servers. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2885
(**Security fix**)

**mercurial-4.3.1**:  Upgraded. Fixes security issues: Mercurial's symlink auditing was incomplete prior to 4.3, and could  be abused to write to files outside the repository.  Mercurial was not sanitizing hostnames passed to ssh, allowing  shell injection attacks on clients by specifying a hostname starting  with -oProxyCommand.  For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000115
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000116
(**Security fix**)

**subversion-1.9.7**:  Upgraded. Fixed client side arbitrary code execution vulnerability.  For more information, see:
  * https://subversion.apache.org/security/CVE-2017-9800-advisory.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9800
(**Security fix**)

==== 2017-08-11 ====

**curl-7.55.0**:  Upgraded. This update fixes three security issues:
  * URL globbing out of bounds read
  * TFTP sends more than buffer size
  * FILE buffer read out of bounds
For more information, see:
  * https://curl.haxx.se/docs/adv_20170809A.html
  * https://curl.haxx.se/docs/adv_20170809B.html
  * https://curl.haxx.se/docs/adv_20170809C.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000099
(**Security fix**)

**glibc-2.23**:  Rebuilt.  Fixed a regression with the recent glibc patch packages: Don't clobber the libm.so linker script with a symlink. Thanks to guanx.

**glibc-i18n-2.23**:  Rebuilt.

**glibc-profile-2.23**:  Rebuilt.

**glibc-solibs-2.23**:  Rebuilt.

==== 2017-08-20 ====

**gnupg-1.4.22**:  Upgraded. Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster". For more information, see:
  * https://eprint.iacr.org/2017/627
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526
(**Security fix**)

==== 2017-07-28 ====

**squashfs-tools-4.3**:  Rebuilt. Patched a couple of denial of service issues and other bugs. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4645
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4646
(**Security fix**)

**dbus-1.10.8**:  Rebuilt. Don't demand high-quality entropy from expat-2.2.2+ because 1) dbus doesn't need it and 2) it can cause the boot process to hang if dbus times out. Thanks to SeB for a link to the bug report and patch.

**bind-9.10.5_P3**:  Upgraded. Fix a regression in the previous BIND release that broke verification of TSIG signed TCP message sequences where not all the messages contain TSIG records. Compiled to use libidn rather than the deprecated (and broken) idnkit.

==== 2017-07-14 ====

**tcpdump-4.9.1**:  Upgraded. This update fixes an issue where tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11108 (**Security fix**)

**expat-2.2.2**:  Upgraded. Fixes security issues including: external entity infinite loop DoS. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233
  * https://libexpat.github.io/doc/cve-2017-9233/
(**Security fix**)

**gd-2.2.4**:  Upgraded. Fixes security issues: gdImageCreate() doesn't check for oversized images and as such is prone to
  * DoS vulnerabilities. (CVE-2016-9317)
  * double-free in gdImageWebPtr() (CVE-2016-6912)
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
  * Signed Integer Overflow gd_io.c (CVE-2016-10168)
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9317
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6912
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10166
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10167
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10168
(**Security fix**)

**libtirpc-1.0.2**:  Upgraded. This is a bugfix release.

**rpcbind-0.2.4**:  Rebuilt. Fixed a bug in a previous patch where a svc_freeargs() call ended up freeing a static pointer causing rpcbind to crash. Thanks to Jonathan Woithe, Rafael Jorge Csura Szendrodi, and Robby Workman for identifying the problem and helping to test a fix.

==== 2017-07-14 ====

**mariadb-10.0.31**:  Upgraded. This update fixes bugs and security issues. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3308
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3309
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3453
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3456
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3464
(**Security fix**)

**samba-4.4.15**  Upgraded.  This update fixes an authentication validation bypass security issue:  "Orpheus' Lyre mutual authentication validation bypass"  All versions of Samba from 4.0.0 onwards using embedded Heimdal  Kerberos are vulnerable to a man-in-the-middle attack impersonating  a trusted server, who may gain elevated access to the domain by  returning malicious replication or authorization data.  Samba binaries built against MIT Kerberos are not vulnerable.  For more information, see:
  * https://www.samba.org/samba/security/CVE-2017-11103.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103
(**Security fix**)

**httpd-2.4.27**  Upgraded. This update fixes two security issues: Read after free in mod_http2 (CVE-2017-9789) Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788) Thanks to Robert Swiecki for reporting these issues. For more information, see:
  * https://httpd.apache.org/security/vulnerabilities_24.html
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9789
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9788
(**Security fix**)

==== 2017-07-10 ====

**libtirpc-1.0.1**:  Rebuilt. Patched a bug which can cause a denial of service through memory exhaustion.  Thanks to Robby Workman.  For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8779 (**Security fix**)

**rpcbind-0.2.4**:  Upgraded. Patched a bug which can cause a denial of service through memory exhaustion.  Thanks to Robby Workman.  For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8779 (**Security fix**)

==== 2017-07-09 ====

**irssi-1.0.4**:  Upgraded. This release fixes two remote crash issues as well as a few bugs. For more information, see:
  * https://irssi.org/security/irssi_sa_2017_07.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10965
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10966
(**Security fix**)

==== 2017-07-07 ====

**ca-certificates-20161130**:  Upgraded. This update provides the latest CA certificates to check for the  authenticity of SSL connections.

**php-5.6.31**:  Upgraded. This release fixes bugs and security issues. For more information, see:
  * https://php.net/ChangeLog-5.php#5.6.31
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9224
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9226
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9227
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9228
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9229
(**Security fix**)

**glibc-2.23**:  Rebuilt. Recompiled with upstream patch from git: "[PATCH] X86: Don't assert on older Intel CPUs [BZ #20647]" This fixes an ldconfig failure on older Intel CPUs including Pentium MMX.

**glibc-i18n-2.23**: Rebuilt.

**glibc-profile-2.23**: Rebuilt.

**glibc-solibs-2.23**: Rebuilt.

**xscreensaver-5.37**:  Upgraded. Here's an upgrade to the latest xscreensaver.

==== 2017-07-02 ====

**linux-libre-*-4.4.75**:  Upgraded. This kernel fixes security issues that include possible stack exhaustion, memory corruption, and arbitrary code execution. Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7482
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000365
(**Security fix**)

==== 2017-07-01 ====

**glibc-2.23**:  Rebuilt. Applied upstream security hardening patches from git. For more information, see:
  * https://sourceware.org/git/?p=glibc.git;a=commit;h=3c7cd21290cabdadd72984fb69bc51e64ff1002d
  * https://sourceware.org/git/?p=glibc.git;a=commit;h=46703a3995aa3ca2b816814aa4ad05ed524194dd
  * https://sourceware.org/git/?p=glibc.git;a=commit;h=c69d4a0f680a24fdbe323764a50382ad324041e9
  * https://sourceware.org/git/?p=glibc.git;a=commit;h=3776f38fcd267c127ba5eb222e2c614c191744aa
  * https://sourceware.org/git/?p=glibc.git;a=commit;h=adc7e06fb412a2a1ee52f8cb788caf436335b9f3
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000366
(**Security fix**)

**glibc-i18n-2.23**:  Rebuilt.

**glibc-profile-2.23**:  Rebuilt.
(**Security fix**)

**glibc-solibs-2.23**: Rebuilt.
(**Security fix**)

==== 2017-06-29 ====

**bind-9.10.5_P2**:  Upgraded. This update fixes a high severity security issue: an error in TSIG handling could permit unauthorized zone transfers or zone updates. For more information, see:
  * https://kb.isc.org/article/AA-01503/0
  * https://kb.isc.org/article/AA-01504/0
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3142
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143
(**Security fix**)

**httpd-2.4.26**:  Upgraded. This update fixes security issues which may lead to an authentication bypass or a denial of service:
  * important: ap_get_basic_auth_pw() Authentication Bypass CVE-2017-3167
  * important: mod_ssl Null Pointer Dereference CVE-2017-3169
  * important: mod_http2 Null Pointer Dereference CVE-2017-7659
  * important: ap_find_token() Buffer Overread CVE-2017-7668
  * important: mod_mime Buffer Overread CVE-2017-7679
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3167
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3169
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7659
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7668
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7679
(**Security fix**)

**libgcrypt-1.7.8**:  Upgraded. Mitigate a local flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster". For more information, see:
  * https://eprint.iacr.org/2017/627
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526
(**Security fix**)

**mkinitrd-1.4.10**:  Upgraded. Added support for -P option and MICROCODE_ARCH in mkinitrd.conf to specify a microcode archive to be prepended to the initrd for early CPU microcode patching by the kernel. Thanks to SeB.

==== 2017-06-27 ====

**linux-libre-*-4.4.74**:  Upgraded. This kernel fixes two "Stack Clash" vulnerabilities reported by Qualys. The first issue may allow attackers to execute arbitrary code with elevated privileges. Failed attack attempts will likely result in denial-of-service conditions. The second issue can be exploited to bypass certain security restrictions and perform unauthorized actions.

Be sure to upgrade your initrd after upgrading the kernel packages. If you use lilo to boot your machine, be sure lilo.conf points to the correct kernel and initrd and run lilo as root to update the bootloader. If you use elilo to boot your machine, you should run eliloconfig to copy the kernel and initrd to the EFI System Partition. For more information, see:
  * https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000364
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000365
(**Security fix**)

**nasm-2.13.01**:  Upgraded. This update is needed for some newer projects to compile properly.

==== 2017-06-21 ====

**openvpn-2.3.17**:  Upgraded. This update fixes several denial of service issues discovered by Guido Vranken. For more information, see:
  * https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7508
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7512
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7522
(**Security fix**)

==== 2017-06-15 ====

**bind-9.10.5_P1**:  Upgraded. Fixed denial of service security issue: some RPZ configurations could go into an infinite query loop when encountering responses with TTL=0. For more information, see:
  * https://kb.isc.org/article/AA-01495
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3140
(**Security fix**)

**pkg-config-0.29.2**:  Upgraded. This is a bugfix release, and is needed for some updates on slackbuilds.org to compile properly. Thanks to Willy Sudiarto Raharjo.

==== 2017-06-08 ====

**irssi-1.0.3**: Upgraded. Fixed security issues that may result in a denial of service. For more information, see:
  * https://irssi.org/security/irssi_sa_2017_06.txt
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9468
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9469
(**Security fix**)

**sudo-1.8.20p2**: Upgraded. This is a bugfix release: Fixed a bug parsing /proc/pid/stat when the process name contains a newline. This is not exploitable due to the /dev traversal changes made in sudo 1.8.20p1.

==== 2017-05-30 ====

**lynx-2.8.8rel.2**:  Rebuilt. Fixed lynx startup without a URL by correcting STARTFILE in lynx.cfg to use the new URL for the Lynx homepage. Thanks to John David Yost.

**sudo-1.8.20p1**:  Upgraded. This update fixes a potential overwrite of arbitrary system files. This bug was discovered and analyzed by Qualys, Inc. For more information, see:
  * https://www.sudo.ws/alerts/linux_tty.html
  * http://www.openwall.com/lists/oss-security/2017/05/30/16
  *  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000367
(**Security fix**)

==== 2017-05-25 ====

**icecat-52.1.0**: Upgraded. This marks a switch to a repackaged binary build by Gnuzilla. (**Security fix**)

==== 2017-05-24 ====

**samba-4.4.14**: Upgraded. This update fixes a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. For more information, see [[https://www.samba.org/samba/security/CVE-2017-7494.html]] and [[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494]] (**Security fix**)

**gkrellm-2.3.10**: Upgraded. This is a bugfix release to fix a broken gkrellm.pc.

==== 2017-05-16 ====

**freetype-2.6.3**: Rebuilt. This update fixes an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. For more information, see [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8287]] (**Security fix**)

**kdelibs-4.14.32**: Upgraded. This update fixes a security issue with KAuth that can lead to gaining root from an unprivileged account. For more information, see:
  * [[http://www.openwall.com/lists/oss-security/2017/05/10/3]]
  * [[https://www.kde.org/info/security/advisory-20170510-1.txt]]
  * [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422]]
(**Security fix**)

==== 2017-05-01 ====

**rxvt-2.7.10**: Rebuilt. Patched an integer overflow that can crash rxvt with an escape sequence, or possibly have unspecified other impact. For more information, see: [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7483]] (**Security fix**)

**xfce4-weather-plugin-0.8.9**: Upgraded. Package upgraded to fix the API used to fetch weather data. Thanks to Robby Workman.

==== 2017-04-23 ====

**getmail-4.54.0**: Upgraded. This is a bugfix release to fix a failure to retrieve HTML formatted emails that contain a line longer than 1024 characters.  Thanks to Edward Trumbo.

**ntp-4.2.8p10**:  Upgraded. In addition to bug fixes and enhancements, this release fixes security issues of medium and low severity:
  * Denial of Service via Malformed Config (Medium)
  * Authenticated DoS via Malicious Config Option (Medium)
  * Potential Overflows in ctl_put() functions (Medium)
  * Buffer Overflow in ntpq when fetching reslist from a malicious ntpd (Medium)
  * 0rigin DoS (Medium)
  * Buffer Overflow in DPTS Clock (Low)
  * Improper use of snprintf() in mx4200_send() (Low)
  * The following issues do not apply to Linux systems:
  * Privileged execution of User Library code (WINDOWS PPSAPI ONLY) (Low)
  * Stack Buffer Overflow from Command Line (WINDOWS installer ONLY) (Low)
  * Data Structure terminated insufficiently (WINDOWS installer ONLY) (Low)
For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6464
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6463
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6458
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6460
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6462
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6451
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6455
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6452
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6459
(**Security fix**)

**proftpd-1.3.5e**:  Upgraded. This release fixes a security issue: AllowChrootSymlinks off does not check entire DefaultRoot path for symlinks. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7418 (**Security fix**)

==== 2017-04-19 ====

**minicom-2.7.1**: Upgraded. Fix an out of bounds data access that can lead to remote code execution. This issue was found by Solar Designer of Openwall during a security audit of the Virtuozzo 7 product, which contains derived downstream code in its prl-vzvncserver component. For more information, see [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7467]] (**Security fix**)

==== 2017-04-14 ====

**bind-9.10.4**: Upgraded. Fixed denial of service security issues. For more information, see:
  * https://kb.isc.org/article/AA-01465
  * https://kb.isc.org/article/AA-01466
  * https://kb.isc.org/article/AA-01471
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3136
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3137
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3138
(**Security fix**)

==== 2017-04-08 ====

**libtiff-4.0.7**: :  Upgraded. This release contains security fixes and improvements. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8127
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8665
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8683
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3622
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3623
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3658
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5321
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5323
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5652
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5875
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9273
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9448
(**Security fix**)

==== 2017-04-01 ====

**samba-4.4.13**: Upgraded. This is a bug fix release to address a regression introduced by the security fixes for CVE-2017-2619 (Symlink race allows access outside share definition). Please see [[https://bugzilla.samba.org/show_bug.cgi?id=12721]] for details.

==== 2017-03-28 ====

**mariadb-10.0.30**: Upgraded. This update fixes security issues: Crash in libmysqlclient.so. Difficult to exploit vulnerability allows low privileged attacker with logon to compromise the server.  Successful attacks of this vulnerability can result in unauthorized access to data. For more information, see:
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3302
  * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3313
(**Security fix**)

==== 2017-03-24 ====

**glibc-zoneinfo-2017b**:  Upgraded. This package provides the latest timezone updates.
  
**mcabber-1.0.5**:  Upgraded. This update fixes a security issue: An incorrect implementation of XEP-0280: Message Carbons in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display.  This allows for various kinds of social engineering attacks. For more information, see: [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5604]] (**Security fix**)

**samba-4.4.12**:  Upgraded. This update fixes a security issue:  All versions of Samba prior to 4.6.1, 4.5.7, 4.4.12 are vulnerable to  a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.  For more information, see:    [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2619]]  (**Security fix**)

==== 2017-03-15 ====

**glibc-zoneinfo-2017a**: Upgraded. This package provides the latest timezone updates.

**libcgroup-0.41**:  Rebuilt. This is a bugfix package update. Fixed rc.cgred to source the correct config file. Don't remove the entire cgroup file system with "rc.cgconfig stop". Thanks to chris.willing. NOTE:  Be sure to install any .new config files.

**pidgin-2.12.0**:  Upgraded. This update fixes a minor security issue (out of bounds memory read in  purple_markup_unescape_entity).  For more information, see:  [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2640]]  (**Security fix**)

====  2017-03-08 ====

**R-3.3.3**, **icecat-45.7.0**: Upgraded.

==== 2017-02-05 ====

**murrine**, **murrine-themes**: Added to FXP.

==== 2017-02-04 ====

**libreoffice-5.3.0**: Added to FXP.

==== 2017-01-29 ====

**nted** (NoteEdit): Added to FXP.

==== 2017-01-14 ====

**SDL2**, **SDL2_image**, **physfs**, **supertux**: Added to FXP.

==== 2017-01-09 ====

**nethack-3.6.0**, **fontforge-20150824**: Added to FXP.

==== 2016-12-17 ====

Fixed up output formatting in **freepkg**, which is now ready for testing; please let us know if you have comments, feature requests, or package requests.

==== 2016-12-15 ====

**meld3**, **gtksourceview3**, **glade**: Added to FXP.

==== 2016-12-13 ====

Kernel upgrade 4.4.29 -> 4.4.38

==== 2016-12-05 ====

**icecat-45.5.1**: Upgraded.

==== 2016-11-03 ====

Kernel upgrade 4.4.19 -> 4.4.29

==== 2016-10-26 ====

**linux-libre-image 4.4.27** fixes Dirty COW (CVE-2016-5195) 

==== 2016-08-26 ====

Kernel upgrade 4.4.14 -> 4.4.19

==== 2016-08-09 ====

Purged non-free **font-bh-ttf** and **font-bh-type1** from the main repository.

==== 2016-08-09 ====

**icecat-38.8.0**: Rebuilt to avoid unidentified crashes on some CPUs.