New openssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,10.2, and -current to fix a signature forgery security issue.
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2006-4339As well as here:
http://www.openssl.org/news/secadv_20060905.txt
New bind packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a Denial of Service issue.
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4095 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4096As well as here:
http://www.isc.org/sw/bind/bind-security.phpThere are no known active exploits at this time.
OSNews is reporting that Patrick Volkerding has released Slackware 11 RC4.
Slackware 11.0 RC3 has been released
New php packages are available for Slackware 10.2 and -current to fix security and other issues.
More details about these issues may be found on the PHP website:
http://www.php.net
Slackware Linux 11.0 RC1 has been released
New php packages are available for Slackware 10.2 and -current to fix security and other issues.
More details about these issues may be found on the PHP website:
http://www.php.net
New mysql packages are available for Slackware 10.2 to fix security issues (and other bugs). For complete details about the many fixes addressed by this release, you can find MySQL's news article about the MySQL 4.1.21 Community Edition release here:
http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.htmlMore details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3469
New Firefox and Thunderbird packages are available for Slackware 10.2 and -current to fix security issues. In addition, a new Seamonkey package is available for Slackware -current to fix similar issues.
More details about the issues may be found here:
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox http://www.mozilla.org/projects/security/known-vulnerabilities.html#thunderbird http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey
New mutt packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a possible security issue.
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3242
New xine-lib packages are available for Slackware 10.2 and -current to fix security issues.
More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2802Evidently there is also an issue involving AVI files which has not been issued a CVE entry.
New x11 packages are available for Slackware 10.2 and -current to fix security issues. In addition, fontconfig and freetype have been split out from the x11 packages in -current, so if you run -current you'll also need to install those new packages.
More details about the issues may be found here:
http://lists.freedesktop.org/archives/xorg-announce/2006-June/000100.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1861
New gimp packages are available for Slackware 10.2 and -current to fix a possible security issue.
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3404
New Samba packages are available for Slackware 10.0, 10.1, 10.2, and -current.
In Slackware 10.0, 10.1, and 10.2, Samba was evidently picking up the libdm.so.0 library causing a Samba package issued primarily as a security patch to suddenly require a library that would only be present on the machine if the xfsprogs package (from the A series but marked "optional") was installed. Sorry -- this was not intentional, though I do know that I'm taking the chance of this kind of issue when trying to get security related problems fixed quickly (hopefully balanced with reasonable testing), and when the fix is achieved by upgrading to a new version rather than with the smallest patch possible to fix the known issue. However, I tend to trust that by following upstream sources as much as possible I'm also fixing some problems that aren't yet public.
So, all of the the 10.0, 10.1, and 10.2 packages have been rebuilt on systems without the dm library, and should be able to directly upgrade older samba packages without additional requirements. Well, unless they are also under /patches. ;-)
New Samba packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix a security related (but in my own and also the Samba's team member who made their WHATSNEW.txt entry, "minor") denial of service issue.
New sendmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
10.1, 10.2, and -current to fix a possible denial-of-service issue.
Sendmail's complete advisory may be found here:
http://www.sendmail.com/security/advisories/SA-200605-01.txt.ascSendmail has also provided an FAQ about this issue:
http://www.sendmail.com/security/advisories/SA-200605-01/faq.shtmlThe CVE entry for this issue may be found here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173
New Firefox and Thunderbird packages are available for Slackware 10.2 and -current to fix security issues. In addition, a new Seamonkey package is available for Slackware -current to fix similar issues.
New mysql packages are available for Slackware 9.1, 10.0, 10.1, 10.2 and -current to fix security issues.
The MySQL packages shipped with Slackware 9.1, 10.0, and 10.1 may possibly leak sensitive information found in uninitialized memory to authenticated users. This is fixed in the new packages, and was already patched in Slackware 10.2 and -current. Since the vulnerabilities require a valid login and/or access to the database server, the risk is moderate. Slackware does not provide network access to a MySQL database by default.
New Firefox packages are available for Slackware 10.2 and -current to fix a security issue.
More details about the issues may be found here:
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox1.5.0.3
