-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  glibc (SSA:2025-140-01)

New glibc packages are available for Slackware 15.0 to fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/aaa_glibc-solibs-2.33-i586-8_slack15.0.txz:  Rebuilt.
patches/packages/glibc-2.33-i586-8_slack15.0.txz:  Rebuilt.
  This update fixes a security issue:
  elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH.
  A statically linked setuid binary that calls dlopen (including internal
  dlopen calls after setlocale or calls to NSS functions such as getaddrinfo)
  may incorrectly search LD_LIBRARY_PATH to determine which library to load,
  leading to the execution of library code that is attacker controlled.
  The only viable vector for exploitation of this bug is local, if a static
  setuid program exists, and that program calls dlopen, then it may search
  LD_LIBRARY_PATH to locate the SONAME to load. No such program has been
  discovered at the time of publishing this advisory, but the presence of
  custom setuid programs, although strongly discouraged as a security
  practice, cannot be discounted.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2025-4802
  (* Security fix *)
patches/packages/glibc-i18n-2.33-i586-8_slack15.0.txz:  Rebuilt.
patches/packages/glibc-profile-2.33-i586-8_slack15.0.txz:  Rebuilt.
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/aaa_glibc-solibs-2.33-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/glibc-2.33-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/glibc-i18n-2.33-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/glibc-profile-2.33-i586-8_slack15.0.txz

Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/aaa_glibc-solibs-2.33-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/glibc-2.33-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/glibc-i18n-2.33-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/glibc-profile-2.33-x86_64-8_slack15.0.txz


MD5 signatures:
+-------------+

Slackware 15.0 packages:
0d6fe8fe463ebaf50ad2f335635d801d  aaa_glibc-solibs-2.33-i586-8_slack15.0.txz
4f5f063a67b275a8eab96ace5cadbc7d  glibc-2.33-i586-8_slack15.0.txz
59316f8f6f5ecb043da509b615af8061  glibc-i18n-2.33-i586-8_slack15.0.txz
1afddcd24eee4f113e7562c530b73ec1  glibc-profile-2.33-i586-8_slack15.0.txz

Slackware x86_64 15.0 packages:
f0c598d8e66dd091365799e0ed018297  aaa_glibc-solibs-2.33-x86_64-8_slack15.0.txz
2e1bf009814661164c9553c15a9ea5f2  glibc-2.33-x86_64-8_slack15.0.txz
c71a388da759ac908b619c9ef773c8bf  glibc-i18n-2.33-x86_64-8_slack15.0.txz
2b356a71d4e6766e9d4bee16c9ed7ac4  glibc-profile-2.33-x86_64-8_slack15.0.txz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg *glibc-*.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCaC0JKwAKCRBqRGPAQBAi
M6YpAKCSYlBEAvSoU8HH9mtxXg1Qq7RZxwCglZ+pyp4zBBegannSKKITwuTQpe4=
=uxnl
-----END PGP SIGNATURE-----