The Slackware Linux Security Team released updated packages for Slackware 15.0 and -current to patch known vulnerabilities in the expat XML parser and OpenSSH. The expat refresh resolves CVE-2026-72522 by correcting an out-of-bounds read that causes an infinite loop when the parser processes low Unicode surrogates. The OpenSSH upgrade pushes the software to version 10.5p1, which ships with several security hardening patches and routine bug fixes. Users can download the new builds from the official Slackware FTP mirrors and apply them with the upgradepkg command before restarting the sshd daemon.

expat (SSA:2026-223-01)
openssh (SSA:2026-223-02)

expat (SSA:2026-223-01)

expat (SSA:2026-223-01)

New expat packages are available for Slackware 15.0 and -current to
fix a security issue.

Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/expat-2.7.5-i586-3_slack15.0.txz: Rebuilt.
This update fixes a security issue:
Fix an out-of-bounds read and the resulting infinite loop caused by treating
low surrogates (Unicode) the same as high surrogates in functions *_toUtf16.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-72522
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/expat-2.7.5-i586-3_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/expat-2.7.5-x86_64-3_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/expat-2.8.3-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/expat-2.8.3-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 15.0 package:
edf6a2700756d833c8d06609f2973beb expat-2.7.5-i586-3_slack15.0.txz

Slackware x86_64 15.0 package:
438b5138f3b4eda1e4d5456ed2bd15a1 expat-2.7.5-x86_64-3_slack15.0.txz

Slackware -current package:
cc34db411706bb541c5b8421b6bdbcb6 l/expat-2.8.3-i686-1.txz

Slackware x86_64 -current package:
c6b3451a3a912b051ed81ce8a541c22e l/expat-2.8.3-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg expat-2.7.5-i586-3_slack15.0.txz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key

openssh (SSA:2026-223-02)

openssh (SSA:2026-223-02)

New openssh packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/openssh-10.5p1-i586-1_slack15.0.txz: Upgraded.
This release contains a number of security fixes and small bugfixes.
For more information, see:
https://www.openssh.org/releasenotes.html#10.5
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/openssh-10.5p1-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/openssh-10.5p1-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssh-10.5p1-i686-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssh-10.5p1-x86_64-1.txz

MD5 signatures:
+-------------+

Slackware 15.0 package:
4bc3f7ffd8a8bf72d13cf8efa0f755a2 openssh-10.5p1-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
29fdfb2f283dd33132a146559c8a9e73 openssh-10.5p1-x86_64-1_slack15.0.txz

Slackware -current package:
c6b8d0cc498d92aeb771067e2821b360 n/openssh-10.5p1-i686-1.txz

Slackware x86_64 -current package:
6d90d2070ae1679f439835dce8c9de93 n/openssh-10.5p1-x86_64-1.txz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg openssh-10.5p1-i586-1_slack15.0.txz

Next, restart the sshd daemon:
# sh /etc/rc.d/rc.sshd restart

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key