Friday, October 24, 2014

Security Advisories: glibc and pidgin

Patrick has released two security updates on both -stable and -current branch. The first update was pidgin and it fixed 5 security vulnerabilities. This update was applied to all -stable releases back to Slackware 13.0. They are now upgraded to Pidgin 2.10.10.

The second update was glibc. This update was only applied to Slackware 14.1 and -current and both have different version number. On 14.1, the glibc was rebuilt to include the patch that fixed several security issues (there are 9 CVEs related to this package), while in -current, Pat (finally) upgraded glibc to 2.20, a big jumping from 2.17 found in Slackware 14.1.

With these update in -current, all the core toolchain (gcc, glibc, and kernel) are set and the fun phase of -current may start in real this time. Normally, glibc was set once for a release and there won't be any changes except for minor upgrade or security fixes only because all applications will be compiled against those combination (mostly glibc and gcc).

Update: glibc were rebuilt with an updated gcc that was patched to fix bug pr61801 since it's causing some applications not working. I tested Google Chrome, but i believe many others will not run either. Google Chrome reported
setresgid: Function not implemented
Could not drop privileges: Function not implemented
Read on socketpair: Success


After updating gcc and glibc, they are working again.