[Slackware security] vulnerabilities outstanding 20140101

mancha · 03-19-2014, 03:37 PM

Update 20140319

Quote:

Originally Posted by Phorize

Firefox ESR 24.4.0 fixes some critical vulnerabilities. I'm trying to debug a failed build as I write.

Mozilla Various

Thank you for alerting us about this. Earlier today I sent Pat an email but let me copy the information here as well.
Mozilla has released the following products:

Firefox 28 (current)
Firefox ESR 24.4
Thunderbird 24.4
Seamonkey 2.25

To address the following:

Code:

MFSA 2014-15   MFSA 2014-24
MFSA 2014-16   MFSA 2014-25
MFSA 2014-17   MFSA 2014-26
MFSA 2014-18   MFSA 2014-27
MFSA 2014-19   MFSA 2014-28
MFSA 2014-20   MFSA 2014-29
MFSA 2014-21   MFSA 2014-30
MFSA 2014-22   MFSA 2014-31
MFSA 2014-23   MFSA 2014-32

--mancha

PS If you find something interesting re: your failed build, please post it here for our benefit

Didier Spaier · 03-19-2014, 03:51 PM

I'll just quote the security part of the announce:

Code:

CVE-2014-0098 (cve.mitre.org)
  Segfaults with truncated cookie logging.
  mod_log_config: Prevent segfaults when logging truncated
  cookies. Clean up the cookie logging parser to recognize
  only the cookie=value pairs, not valueless cookies.

CVE-2013-6438 (cve.mitre.org)
  mod_dav: Keep track of length of cdata properly when removing
  leading spaces. Eliminates a potential denial of service from
  specifically crafted DAV WRITE requests

Sorry for the noise if that's already in the pipe. Anyhow all users of the 2.4 branch are encouraged to upgrade.

PS Compilation went fine on my Slackware 14.0 using the SlackBuild in patches/source/httpd. I just got a warning about Lua 5.1 library not found and mod_lua was not enabled.

Caveat emptor: my Slackware 14.0 is not a clean new system and I didn't look at new options with ./configure --help

ponce · 03-19-2014, 05:14 PM

Quote:

Originally Posted by mancha

Firefox 28 (current)

...
PS If you find something interesting re: your failed build, please post it here for our benefit

I'll leave this here hoping it will be useful: in case you want to rebuild firefox >= 28.0b1 or thunderbird >= 28.0b1 you will need to explicitly add "--disable-pulseaudio" to the configure options in the -current SlackBuild or it won't build.

Quote:

Originally Posted by Didier Spaier

I just got a warning about Lua 5.1 library not found and mod_lua was not enabled.

that is optional (also the previous version does like that), so it should be ok

moisespedro · 03-19-2014, 07:52 PM

If you don't want to rebuild it you can just grab ruario's script http://www.panix.com/~ruari/latest-firefox

Phorize · 03-20-2014, 07:27 AM

Quote:

Originally Posted by mancha

Update 20140319

Mozilla Various

Thank you for alerting us about this. Earlier today I sent Pat an email but let me copy the information here as well.
Mozilla has released the following products:

Firefox 28 (current)
Firefox ESR 24.4
Thunderbird 24.4
Seamonkey 2.25

To address the following:

Code:

MFSA 2014-15   MFSA 2014-24
MFSA 2014-16   MFSA 2014-25
MFSA 2014-17   MFSA 2014-26
MFSA 2014-18   MFSA 2014-27
MFSA 2014-19   MFSA 2014-28
MFSA 2014-20   MFSA 2014-29
MFSA 2014-21   MFSA 2014-30
MFSA 2014-22   MFSA 2014-31
MFSA 2014-23   MFSA 2014-32

--mancha

PS If you find something interesting re: your failed build, please post it here for our benefit

The error was mine; I ran the slackbuild with MOZLOCALIZE=en_GB instead of MOZLOCALIZE=en-GB. Apologies to all.

mats_b_tegner · 03-21-2014, 06:24 PM

Quote:

Originally Posted by mancha

Update 20140316

FreeType

Mats, thanks for bringing this up. Actually, HarfBuzz is a new and optional dependency of FreeType as of 2.5.3.
FreeType 2.5.3 will build on stock Slackware 14.1 but automatically disables HarfBuzz support when it doesn't
detect a new enough version.

However, building FreeType 2.5.3 requires a modified illadvisederror patch (see note at end), so I've amended my
recommendation for most slackers:

Solution: Rebuild Slackware 14.1 FreeType 2.5.0.1 after applying my CVE-2014-2240+CVE-2014-2241 backport fix (sig).

--mancha

Note: For those wishing to upgrade to FreeType 2.5.3:

Get my FreeType 2.5.3 illadvisederror patch (gzip it or edit the Slackbuild so it applies uncompressed)
Build FreeType 2.5.3 (1st pass with no HarfBuzz support)
Upgrade to HarfBuzz 0.9.26 [OPTIONAL STEP]
Rebuild FreeType 2.5.3 (2nd pass with HarfBuzz support) [OPTIONAL STEP]

Keep in mind lots of things depend on HarfBuzz and FreeType so upgrading these two libs is done at your own risk.

Hmm AlienBOB's LibreOffice 4.2.2 package crashes upon launch with HarfBuzz 0.9.26. Reverting to HarfBuzz 0.9.16 restores functionality. Rebuilding FreeType with the backported fixes seem to be the sane thing to do right now...

Mats

mancha · 03-22-2014, 03:21 AM

Update 20140322

Mozilla NSS

A flaw in the handling of wildcard certificates was discovered in NSS (CVE-2014-1492).

Solution: Upgrade to NSS 3.16.

mancha · 03-27-2014, 06:03 PM

Update 20140327

curl/libcurl

Curl/libcurl released 7.36.0 which includes several bug fixes and addresses four security issues, two of which affect Slackware:

CVE-2014-0138 (see: http://curl.haxx.se/docs/adv_20140326A.html)
CVE-2014-0139 (see: http://curl.haxx.se/docs/adv_20140326B.html)

Solution: Upgrade to curl 7.36.0 (sig)

--mancha

mats_b_tegner · 03-29-2014, 01:14 AM

curl, Firefox, httpd, nss, openssh, Seamonkey and Thunderbird have been updated according to the latest ChangeLog.

Mats

bonixavier · 03-30-2014, 09:36 PM

Quote:

Originally Posted by mats_b_tegner

curl, Firefox, httpd, nss, openssh, Seamonkey and Thunderbird have been updated according to the latest ChangeLog.

Mats

Yeah, but not for Slackware 14.0. Has support dropped so soon? Won't it compile? What happened? I thought I'd get by with it a couple more months, perhaps until the next release.

mats_b_tegner · 03-31-2014, 03:08 AM

Quote:

Originally Posted by bonixavier

Yeah, but not for Slackware 14.0. Has support dropped so soon? Won't it compile? What happened? I thought I'd get by with it a couple more months, perhaps until the next release.

Are you sure? I can see ChangLog updates from 13.0 to -current here:
http://slackware.osuosl.org/
curl and openssh are updated for 13.0 to -current only Firefox and Thunderbird are missing in 13.0 and 14.0.

Mats

bonixavier · 03-31-2014, 06:04 AM

Quote:

Originally Posted by mats_b_tegner

Are you sure? I can see ChangLog updates from 13.0 to -current here:
http://slackware.osuosl.org/
curl and openssh are updated for 13.0 to -current only Firefox and Thunderbird are missing in 13.0 and 14.0.

Mats

You're right, of course. I was referring to Firefox and Thunderbird, but was too tired to make myself clear. I just didn't get why those two weren't in the batch. Not trying to be a nagger or anything, just want to understand.

mats_b_tegner · 03-31-2014, 06:59 AM

Quote:

Originally Posted by bonixavier

You're right, of course. I was referring to Firefox and Thunderbird, but was too tired to make myself clear. I just didn't get why those two weren't in the batch. Not trying to be a nagger or anything, just want to understand.

I don't know why Firefox 24 ESR and Thunderbird 24 won't compile on 14.0 since I haven't tested myself. Maybe it's a dependency? Can you use Seamonkey 2.25 as a workaround?

Edit:
...Apparently you'll need glibc 2.17 to compile Firefox and Thunderbird 24 or later

metaschima · 03-31-2014, 11:36 AM

There's also this kernel issue for all kernels through 3.13.6:
http://web.nvd.nist.gov/view/vuln/de...=CVE-2014-2523
https://github.com/torvalds/linux/co...254fc10cbc2b92
It is listed as critical:
https://www.us-cert.gov/ncas/bulletins/SB14-090

mancha · 04-07-2014, 11:50 AM

Update 20140407

OpenSSH

A vulnerability (CVE-2014-2653) was discovered in the way OpenSSH verifies SSHFP DNS resource records. Under certain
circumstances, specifically when the server provides a host certificate not recognized by the client, the client skips
SSHFP verification regardless of VerifyHostKeyDNS.

Solution: Re-build either OpenSSH 5.9 or OpenSSH 6.6 (the two versions supported by Slackware) after applying my back
ported fixes:

openssh-5.9p1_CVE-2014-2653.diff
openssh-6.6p1_CVE-2014-2653.diff

Note: If the terms SSHFP, host certificate, or resource records are new to you, you can likely ignore this alert.

--mancha