Showing posts from October, 2014

Security Advisory: wget

wget package has been updated and rebuilt in all supported Slackware releases, back to Slackware 13.0 to fix a security vulnerability that could allow an attacker to write outside of the expected directory.

in -current branch, moc is now upgraded to 2.5.0, following a request from LQ

Security Advisories: glibc and pidgin

Patrick has released two security updates on both -stable and -current branch. The first update was pidgin and it fixed 5 security vulnerabilities. This update was applied to all -stable releases back to Slackware 13.0. They are now upgraded to Pidgin 2.10.10.

The second update was glibc. This update was only applied to Slackware 14.1 and -current and both have different version number. On 14.1, the glibc was rebuilt to include the patch that fixed several security issues (there are 9 CVEs related to this package), while in -current, Pat (finally) upgraded glibc to 2.20, a big jumping from 2.17 found in Slackware 14.1.

With these update in -current, all the core toolchain (gcc, glibc, and kernel) are set and the fun phase of -current may start in real this time. Normally, glibc was set once for a release and there won't be any changes except for minor upgrade or security fixes only because all applications will be compiled against those combination (mostly glibc and gcc).

Update: g…

MATE Roadmap Updated

Few days ago i saw a discussion on IRC saying that MATE 1.10 will be released soon. I was kinda puzzled as there were lots of item in the TODO list in MATE Roadmap for 1.10. When i checked the Roadmap again, apparently MATE developers pushed GTK+3 support again to future releases (now targetting MATE 1.12) along with other features that didn't make it into MATE 1.10 schedule.

Most of the TODO list for MATE 1.10 have been completed with only 2 left:
caja: Plugin system (GSOC 2014)Move all documentation into mate-user-guide One of the reason why GTK+3 support is delayed is because they (GTK developers) introduced incompatible changes on every major releases (3.8, 3.10, 3.12, and 3.14), so it's quite hard for MATE developers to support every releases within one version number. So they came up with a decision to release separate package for mate-themes which targets different GTK+3 version, depending on which Linux distribution that are going to use MATE Desktop. You can see the br…

Poodlebleed Fixes

Slackware has released advisories to several products and i didn't write the previous one so consider this as a cumulative updates :)

The previous update was about Firefox and Thunderbird and it's only released in -current architecture. There are no ESR updates for stable releases anymore.

The second and latest advisories is about openssl which is vulnerable to multiple vulnerabilities, including the latest poodlebleed. If you are running public servers, it's highly recommended to upgrade the openssl packages as soon as possible. Use the above link to test whether your server is still vulnerable or not.

Upgrading openssl packages is not enough as your web server application (apache or nginx or any other products you use) can still fallback SSLv3, so you need to disable it manually. Here's how to do it:
nano /etc/httpd/extra/httpd-ssl.confChange
SSLProtocol all -SSLv2
SSLProtocol all -SSLv2 -SSLv3Restart apache You can also force your browser to disable SSL 3.0. If …

Firefox Rebuilt on x86 only

Pat has rebuilt mozilla-firefox on current 32 bit architecture only to fix sluggishness problem reported on LQ. This problem was not found on 64 bit, so those two arch will have different build number, but it will be synced again on the next Firefox update which is very close now (it reached Beta 9 at the time this post is written).

elilo is also upgraded to the latest version in -current.