Slackware ChangeLogs
Slackware Logo

News

Security Advisories

FAQ

Book

General Info

Get Slack

Install Help

Configuration

Packages

ChangeLogs

Propaganda

Ports

Other Sites

Support

Contact

Mailing Lists

About

 
Current (pre-release) ChangeLog for x86 (32-bit)
Wed Aug 24 19:37:40 UTC 2016
xap/mozilla-firefox-48.0.2-i586-1.txz: Upgraded.
+--------------------------+
Tue Aug 23 19:45:33 UTC 2016
a/glibc-solibs-2.24-i586-2.txz: Rebuilt.
a/kernel-firmware-20160823git-noarch-1.txz: Upgraded.
a/kernel-generic-4.4.19-i586-1.txz: Upgraded.
       A flaw was found in the implementation of the Linux kernels handling of
       networking challenge ack where an attacker is able to determine the shared
       counter. This may allow an attacker located on different subnet to inject
       or take over a TCP connection between a server and client without having to
       be a traditional Man In the Middle (MITM) style attack.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389
       (* Security fix *)
a/kernel-generic-smp-4.4.19_smp-i686-1.txz: Upgraded.
       A flaw was found in the implementation of the Linux kernels handling of
       networking challenge ack where an attacker is able to determine the shared
       counter. This may allow an attacker located on different subnet to inject
       or take over a TCP connection between a server and client without having to
       be a traditional Man In the Middle (MITM) style attack.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389
       (* Security fix *)
a/kernel-huge-4.4.19-i586-1.txz: Upgraded.
       A flaw was found in the implementation of the Linux kernels handling of
       networking challenge ack where an attacker is able to determine the shared
       counter. This may allow an attacker located on different subnet to inject
       or take over a TCP connection between a server and client without having to
       be a traditional Man In the Middle (MITM) style attack.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389
       (* Security fix *)
a/kernel-huge-smp-4.4.19_smp-i686-1.txz: Upgraded.
       A flaw was found in the implementation of the Linux kernels handling of
       networking challenge ack where an attacker is able to determine the shared
       counter. This may allow an attacker located on different subnet to inject
       or take over a TCP connection between a server and client without having to
       be a traditional Man In the Middle (MITM) style attack.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389
       (* Security fix *)
a/kernel-modules-4.4.19-i586-1.txz: Upgraded.
a/kernel-modules-smp-4.4.19_smp-i686-1.txz: Upgraded.
ap/diffutils-3.5-i586-1.txz: Upgraded.
ap/linuxdoc-tools-0.9.72-i586-1.txz: Upgraded.
       Thanks to Stuart Winter.
ap/screen-4.4.0-i586-2.txz: Rebuilt.
       Reverted a change to /etc/screenrc.new that prevented the console from being
       cleared when a screen session was detached. Thanks to Stuart Winter.
d/binutils-2.27-i586-2.txz: Rebuilt.
       Recompiled with --disable-compressed-debug-sections, since other tools are
       not yet capable of parsing that.
       Thanks to Vincent Batts, Heinz Wiesinger, and Stuart Winter.
d/kernel-headers-4.4.19_smp-x86-1.txz: Upgraded.
k/kernel-source-4.4.19_smp-noarch-1.txz: Upgraded.
       A flaw was found in the implementation of the Linux kernels handling of
       networking challenge ack where an attacker is able to determine the shared
       counter. This may allow an attacker located on different subnet to inject
       or take over a TCP connection between a server and client without having to
       be a traditional Man In the Middle (MITM) style attack.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5389
       (* Security fix *)
l/glib2-2.46.2-i586-3.txz: Rebuilt.
       Applied upstream patch to fix a use-before-allocate bug in libgio. Without
       this fix, Thunar will crash if $HOME is on an NFS volume.
       Thanks to Jonathan Woithe.
l/glibc-2.24-i586-2.txz: Rebuilt.
       If libm.so is a linker script, don't clobber it with a symlink.
       Thanks to guanx.
l/glibc-i18n-2.24-i586-2.txz: Rebuilt.
l/glibc-profile-2.24-i586-2.txz: Rebuilt.
n/gnupg-1.4.21-i586-1.txz: Upgraded.
       Fix critical security bug in the RNG [CVE-2016-6313]. An attacker who
       obtains 580 bytes from the standard RNG can trivially predict the next
       20 bytes of output. (This is according to the NEWS file included in the
       source. According to the annoucement linked below, an attacker who obtains
       4640 bits from the RNG can trivially predict the next 160 bits of output.)
       Problem detected by Felix Doerre and Vladimir Klebanov, KIT.
       For more information, see:
       https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313
       (* Security fix *)
n/libgcrypt-1.7.3-i586-1.txz: Upgraded.
       Fix critical security bug in the RNG [CVE-2016-6313]. An attacker who
       obtains 580 bytes from the standard RNG can trivially predict the next
       20 bytes of output. (This is according to the NEWS file included in the
       source. According to the annoucement linked below, an attacker who obtains
       4640 bits from the RNG can trivially predict the next 160 bits of output.)
       Problem detected by Felix Doerre and Vladimir Klebanov, KIT.
       For more information, see:
       https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313
       (* Security fix *)
n/network-scripts-14.2-noarch-3.txz: Rebuilt.
       In rc.inet1, skip interfaces that are not configured in rc.inet1.conf
       to speed up the boot time slightly.
       Thanks to Amritpal Bath.
n/stunnel-5.35-i586-2.txz: Rebuilt.
       Fixed incorrect config file name in generate-stunnel-key.sh.
       Thanks to Ebben Aries.
xap/mozilla-firefox-48.0.1-i586-1.txz: Upgraded.
extra/linux-4.4.19-nosmp-sdk/*: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
+--------------------------+
Thu Aug 11 18:24:29 UTC 2016
a/glibc-solibs-2.24-i586-1.txz: Upgraded.
a/glibc-zoneinfo-2016f-noarch-1.txz: Upgraded.
a/kernel-generic-4.4.17-i586-1.txz: Upgraded.
a/kernel-generic-smp-4.4.17_smp-i686-1.txz: Upgraded.
a/kernel-huge-4.4.17-i586-1.txz: Upgraded.
a/kernel-huge-smp-4.4.17_smp-i686-1.txz: Upgraded.
a/kernel-modules-4.4.17-i586-1.txz: Upgraded.
a/kernel-modules-smp-4.4.17_smp-i686-1.txz: Upgraded.
ap/diffutils-3.4-i586-1.txz: Upgraded.
ap/vim-7.4.2196-i586-1.txz: Upgraded.
d/binutils-2.27-i586-1.txz: Upgraded.
d/gcc-5.4.0-i586-1.txz: Upgraded.
d/gcc-g++-5.4.0-i586-1.txz: Upgraded.
d/gcc-gfortran-5.4.0-i586-1.txz: Upgraded.
d/gcc-gnat-5.4.0-i586-1.txz: Upgraded.
d/gcc-go-5.4.0-i586-1.txz: Upgraded.
d/gcc-java-5.4.0-i586-1.txz: Upgraded.
d/gcc-objc-5.4.0-i586-1.txz: Upgraded.
d/kernel-headers-4.4.17_smp-x86-1.txz: Upgraded.
d/llvm-3.8.1-i586-1.txz: Upgraded.
d/oprofile-1.1.0-i586-2.txz: Rebuilt.
k/kernel-source-4.4.17_smp-noarch-1.txz: Upgraded.
l/glibc-2.24-i586-1.txz: Upgraded.
l/glibc-i18n-2.24-i586-1.txz: Upgraded.
l/glibc-profile-2.24-i586-1.txz: Upgraded.
xap/mozilla-firefox-48.0-i586-1.txz: Upgraded.
       This release contains security fixes and improvements.
       For more information, see:
       http://www.mozilla.org/security/known-vulnerabilities/firefox.html
       (* Security fix *)
xap/vim-gvim-7.4.2196-i586-1.txz: Upgraded.
extra/linux-4.4.17-nosmp-sdk/*: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
+--------------------------+
Sat Aug 6 19:29:16 UTC 2016
n/curl-7.50.1-i586-1.txz: Upgraded.
       This release fixes security issues:
       TLS: switch off SSL session id when client cert is used
       TLS: only reuse connections with the same client cert
       curl_multi_cleanup: clear connection pointer for easy handles
       For more information, see:
       https://curl.haxx.se/docs/adv_20160803A.html
       https://curl.haxx.se/docs/adv_20160803B.html
       https://curl.haxx.se/docs/adv_20160803C.html
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5419
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5420
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5421
       (* Security fix *)
n/mutt-1.6.2-i586-1.txz: Upgraded.
n/openssh-7.3p1-i586-1.txz: Upgraded.
       This is primarily a bugfix release, and also addresses security issues.
       sshd(8): Mitigate a potential denial-of-service attack against the system's
       crypt(3) function via sshd(8).
       sshd(8): Mitigate timing differences in password authentication that could
       be used to discern valid from invalid account names when long passwords were
       sent and particular password hashing algorithms are in use on the server.
       ssh(1), sshd(8): Fix observable timing weakness in the CBC padding oracle
       countermeasures.
       ssh(1), sshd(8): Improve operation ordering of MAC verification for
       Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC
       before decrypting any ciphertext.
       sshd(8): (portable only) Ignore PAM environment vars when UseLogin=yes.
       For more information, see:
       http://www.openssh.com/txt/release-7.3
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6210
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325
       (* Security fix *)
n/stunnel-5.35-i586-1.txz: Upgraded.
       Fixes security issues:
       Fixed malfunctioning "verify = 4".
       Fixed incorrectly enforced client certificate requests.
       (* Security fix *)
+--------------------------+
Thu Jul 28 19:44:25 UTC 2016
a/kernel-generic-4.4.16-i586-1.txz: Upgraded.
a/kernel-generic-smp-4.4.16_smp-i686-1.txz: Upgraded.
a/kernel-huge-4.4.16-i586-1.txz: Upgraded.
a/kernel-huge-smp-4.4.16_smp-i686-1.txz: Upgraded.
a/kernel-modules-4.4.16-i586-1.txz: Upgraded.
a/kernel-modules-smp-4.4.16_smp-i686-1.txz: Upgraded.
d/kernel-headers-4.4.16_smp-x86-1.txz: Upgraded.
k/kernel-source-4.4.16_smp-noarch-1.txz: Upgraded.
l/libidn-1.33-i586-1.txz: Upgraded.
       Fixed out-of-bounds read bugs. Fixed crashes on invalid UTF-8.
       Thanks to Hanno Böck.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8948
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6261
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6262
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6263
       (* Security fix *)
l/libtasn1-4.9-i586-1.txz: Upgraded.
n/bluez-5.41-i586-1.txz: Upgraded.
extra/linux-4.4.16-nosmp-sdk/*: Upgraded.
extra/tigervnc/tigervnc-1.6.0-i586-4.txz: Rebuilt.
       Recompiled for xorg-server-1.18.4.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
+--------------------------+
Mon Jul 25 19:59:06 UTC 2016
a/pkgtools-14.2-noarch-11.txz: Rebuilt.
       Changes to pkgtool:
       Remove option to install from floppy disks.
       Don't use the --file option, which appears to be broken in the latest version
       of dialog. The only reason --file was ever used in the first place was to
       work around the Linux ARG_MAX limit of 131072 bytes, and since Linux 2.6.23 a
       much larger limit is in place making it unlikely to become an issue again.
       So we'll go back to passing the package list on the command line.
       Thanks to David Miller for the bug report.
+--------------------------+
Fri Jul 22 20:51:23 UTC 2016
a/dialog-1.3_20160424-i586-1.txz: Upgraded.
a/kmod-23-i586-1.txz: Upgraded.
a/lvm2-2.02.161-i586-1.txz: Upgraded.
d/git-2.9.2-i586-1.txz: Upgraded.
l/desktop-file-utils-0.23-i586-1.txz: Upgraded.
l/freetype-2.6.5-i586-1.txz: Upgraded.
l/harfbuzz-1.3.0-i586-1.txz: Upgraded.
n/bind-9.10.4_P2-i586-1.txz: Upgraded.
       Fixed a security issue:
       getrrsetbyname with a non absolute name could trigger an infinite
       recursion bug in lwresd and named with lwres configured if when
       combined with a search list entry the resulting name is too long.
       (CVE-2016-2775) [RT #42694]
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2775
       (* Security fix *)
n/httpd-2.4.23-i586-1.txz: Upgraded.
n/lftp-4.7.3-i586-1.txz: Upgraded.
n/links-2.13-i586-1.txz: Upgraded.
x/xf86-video-openchrome-0.5.0-i586-1.txz: Upgraded.
x/xkeyboard-config-2.18-noarch-1.txz: Upgraded.
x/xorg-server-1.18.4-i586-1.txz: Upgraded.
x/xorg-server-xephyr-1.18.4-i586-1.txz: Upgraded.
x/xorg-server-xnest-1.18.4-i586-1.txz: Upgraded.
x/xorg-server-xvfb-1.18.4-i586-1.txz: Upgraded.
+--------------------------+
Thu Jul 21 23:25:54 UTC 2016
ap/tmux-2.2-i586-2.txz: Upgraded.
       Moved from /testing.
d/guile-2.0.12-i586-1.txz: Upgraded.
l/freetype-2.6.4-i586-1.txz: Upgraded.
n/libgcrypt-1.7.2-i586-1.txz: Upgraded.
n/network-scripts-14.2-noarch-2.txz: Rebuilt.
       In rc.inet1.new, use -L option to dhcpcd to disable Zeroconf. This is
       (almost) never going to be wanted, and ends up used accidentally on slower
       systems (such as some ARM platforms), preventing a proper DHCP lease.
       Thanks to Stuart Winter.
n/php-5.6.24-i586-1.txz: Upgraded.
       This release fixes bugs and security issues.
       For more information, see:
       http://php.net/ChangeLog-5.php#5.6.24
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5385
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6207
       (* Security fix *)
xap/gimp-2.8.18-i586-1.txz: Upgraded.
       This release fixes a security issue:
       Use-after-free vulnerability in the xcf_load_image function in
       app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of
       service (program crash) or possibly execute arbitrary code via a crafted
       XCF file.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4994
       (* Security fix *)
+--------------------------+
Tue Jul 12 03:48:34 UTC 2016
a/etc-14.2-i586-8.txz: Rebuilt.
       In /etc/profile.d/lang.{csh,sh}.new, make en_US.UTF-8 the default locale.
a/kernel-generic-4.4.15-i586-1.txz: Upgraded.
a/kernel-generic-smp-4.4.15_smp-i686-1.txz: Upgraded.
a/kernel-huge-4.4.15-i586-1.txz: Upgraded.
a/kernel-huge-smp-4.4.15_smp-i686-1.txz: Upgraded.
a/kernel-modules-4.4.15-i586-1.txz: Upgraded.
a/kernel-modules-smp-4.4.15_smp-i686-1.txz: Upgraded.
a/lilo-24.2-i586-3.txz: Rebuilt.
       In liloconfig: Skip the menu asking if the user wants a UTF-8 virtual
       console, and use the kernel default (currently this is UTF-8 active).
d/kernel-headers-4.4.15_smp-x86-1.txz: Upgraded.
k/kernel-source-4.4.15_smp-noarch-1.txz: Upgraded.
extra/linux-4.4.15-nosmp-sdk/*: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
+--------------------------+
Sat Jul 9 18:35:56 UTC 2016
x/mesa-12.0.1-i586-1.txz: Upgraded.
+--------------------------+
Fri Jul 8 23:17:22 UTC 2016
x/mesa-12.0.0-i586-1.txz: Upgraded.
+--------------------------+
Thu Jul 7 19:52:36 UTC 2016
n/samba-4.4.5-i586-1.txz: Upgraded.
       This release fixes a security issue:
       Client side SMB2/3 required signing can be downgraded.
       It's possible for an attacker to downgrade the required signing for an
       SMB2/3 client connection, by injecting the SMB2_SESSION_FLAG_IS_GUEST or
       SMB2_SESSION_FLAG_IS_NULL flags. This means that the attacker can
       impersonate a server being connected to by Samba, and return malicious
       results.
       For more information, see:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2119
       (* Security fix *)
+--------------------------+
Tue Jul 5 04:52:45 UTC 2016
xap/mozilla-thunderbird-45.2.0-i586-1.txz: Upgraded.
       This release contains security fixes and improvements.
       For more information, see:
       http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html
       (* Security fix *)
+--------------------------+
Sun Jul 3 19:29:33 UTC 2016
a/file-5.28-i586-1.txz: Upgraded.
a/util-linux-2.28-i586-1.txz: Upgraded.
xap/mozilla-firefox-47.0.1-i586-1.txz: Upgraded.
+--------------------------+
Thu Jun 30 20:26:57 UTC 2016
Slackware 14.2 x86 stable is released!

The long development cycle (the Linux community has lately been living in
"interesting times", as they say) is finally behind us, and we're proud to
announce the release of Slackware 14.2. The new release brings many updates
and modern tools, has switched from udev to eudev (no systemd), and adds
well over a hundred new packages to the system. Thanks to the team, the
upstream developers, the dedicated Slackware community, and everyone else
who pitched in to help make this release a reality.

The ISOs are off to be replicated, a 6 CD-ROM 32-bit set and a dual-sided
32-bit/64-bit x86/x86_64 DVD. Please consider supporting the Slackware
project by picking up a copy from store.slackware.com. We're taking
pre-orders now, and offer a discount if you sign up for a subscription.

Have fun! :-)
Slackware® is a registered trademark of Slackware Linux, Inc. All logos and graphics are copyrighted.