Show pageOld revisionsBacklinksBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Slackware64-13.37 ChangeLog (2016-12-24) ====== ====== Sat Dec 24 18:14:51 UTC 2016 ====== ===== Packages ===== ==== Upgraded ==== * [[slackware64.13.37>patches/packages/expat-2.2.0-x86_64-1_slack13.37.txz]] \\ This update fixes bugs and security issues: \\ Multiple integer overflows in XML_GetBuffer. \\ Fix crash on malformed input. \\ Improve insufficient fix to CVE-2015-1283 / CVE-2015-2716. \\ Use more entropy for hash initialization. \\ Resolve troublesome internal call to srand. \\ For more information, see: \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1283 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6702 \\ (* Security fix *) ====== Sat Dec 24 02:36:05 UTC 2016 ====== ===== Packages ===== ==== Upgraded ==== * [[slackware64.13.37>patches/packages/openssh-7.4p1-x86_64-1_slack13.37.txz]] \\ This is primarily a bugfix release, and also addresses security issues. \\ ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside \\ a trusted whitelist. \\ sshd(8): When privilege separation is disabled, forwarded Unix-domain \\ sockets would be created by sshd(8) with the privileges of 'root'. \\ sshd(8): Avoid theoretical leak of host private key material to \\ privilege-separated child processes via realloc(). \\ sshd(8): The shared memory manager used by pre-authentication compression \\ support had a bounds checks that could be elided by some optimising \\ compilers to potentially allow attacks against the privileged monitor. \\ process from the sandboxed privilege-separation process. \\ sshd(8): Validate address ranges for AllowUser and DenyUsers directives at \\ configuration load time and refuse to accept invalid ones. It was \\ previously possible to specify invalid CIDR address ranges \\ (e.g. user@127.1.2.3/55) and these would always match, possibly resulting \\ in granting access where it was not intended. \\ For more information, see: \\ https://www.openssh.com/txt/release-7.4 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10009 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10010 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10011 \\ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10012 \\ (* Security fix *) {{tag>slackware changelog slackware64-13.37 2016-12}} news/2016/12/24/slackware64-13.37-changelog.txt Last modified: 12 months agoby Giuseppe Di Terlizzi Log In