[SOLVED] Requests for -current (20151216)

GazL · 05-28-2017, 04:31 AM

With the default character encoding now being UTF8, maybe it's worth reevaluating whether to switch from man to man-db in order to avoid issues like this one.?

Thom1b · 05-28-2017, 12:02 PM

Quote:

Originally Posted by GazL

With the default character encoding now being UTF8, maybe it's worth reevaluating whether to switch from man to man-db in order to avoid issues like this one.?

+1 for man-db.

It could be nice to include rxvt-unicode too.

CTM · 05-31-2017, 12:44 PM

Is there a reason that new kernels haven't been issued for all stable releases of Slackware to mitigate CVE-2016-10229? It's a low-complexity network exploit that can lead to arbitrary code execution, so if Slackware is affected, it's worth patching.

kjhambrick · 05-31-2017, 03:59 PM

CTM --

Not that I will be updating the official Slackware Kernels, but ...

I can't find the commit for CVE-2016-10229 in any recent ChangeLogs.

Do you know the Kernel Versions where it was merged ?

Thanks.

-- kjh

mats_b_tegner · 05-31-2017, 04:23 PM

Quote:

Originally Posted by kjhambrick

CTM --

Not that I will be updating the official Slackware Kernels, but ...

I can't find the commit for CVE-2016-10229 in any recent ChangeLogs.

Do you know the Kernel Versions where it was merged ?

Thanks.

-- kjh

For 4.4.x it was merged in 4.4.21:
https://www.spinics.net/lists/kernel/msg2508594.html

kjhambrick · 05-31-2017, 04:26 PM

CTM --

You made me look.

The most recent Official Slackware 14.2 Kernel is 4.4.38 and commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 appears to have already been included in net/ipv4/udp.c and in net/ipv6/udp.c ...

Looks like we're 'OK'

-- kjh

bassmadrigal · 05-31-2017, 04:37 PM

Quote:

Originally Posted by CTM

Is there a reason that new kernels haven't been issued for all stable releases of Slackware to mitigate CVE-2016-10229? It's a low-complexity network exploit that can lead to arbitrary code execution, so if Slackware is affected, it's worth patching.

14.2 isn't affected. Any kernels 4.4.30 and below are affected in the 4.4 series, and 14.2 now has 4.4.38.
14.1 isn't affected. Any kernels 3.10.90 and below are affected in the 3.10 series, and 14.1 now has 3.10.104.
14.0 isn't affected. Any kernels 3.2.82 and below are affected in the 3.2 series, and 14.0 now has 3.2.83.

SOURCE:
http://www.securityfocus.com/bid/97397
https://en.wikipedia.org/wiki/Slackware

However, it does seem that the kernels in 13.0, 13.1, and 13.37 are affected, but it doesn't look like there were ever any patches pushed by kernel developers to fix this issue. All those kernels were EOLed before this CVE came to light.

kjhambrick · 05-31-2017, 05:29 PM

bassmadrigal --

Thanks for the links.

I saw them earlier but you made me actually read the list

Now I see how the list 'works'.

-- kjh

USUARIONUEVO · 05-31-2017, 07:49 PM

cmake-3.8.2
https://cmake.org/files/v3.8/cmake-3.8.2.tar.gz

kjhambrick · 06-01-2017, 11:48 AM

Maybe a tad premature, but Perl 5.26.0 has been released.

-- kjh

USUARIONUEVO · 06-01-2017, 01:30 PM

Quote:

Originally Posted by kjhambrick

Maybe a tad premature, but Perl 5.26.0 has been released.

-- kjh

Some security fixes

Code:

Security 
Removal of the current directory (".") from @INC
Escaped colons and relative paths in PATH
New -Di switch is now required for PerlIO debugging output

ttk · 06-01-2017, 04:01 PM

Quote:

Originally Posted by USUARIONUEVO

Code:

Removal of the current directory (".") from @INC

This is known to break some modules in CPAN, though most such code has been fixed. qv "inc failed" rows here: http://cpan.simcop2387.info/test.html

Of particular interest there are DBD::SQLite and DBD::mysql.

That having been said, if v5.26.x is incorporated into Slackware before these modules have been fixed, I'd be willing to contribute some SlackBuilds for some of them which apply patches to fix the errant behavior.

gmgf · 06-02-2017, 03:15 AM

Quote:

Originally Posted by gmgf

sane-1.0.27:

http://www.sane-project.org/

https://alioth.debian.org/frs/?group_id=30186

just infos for new sane-backends the SlackBuild need changes:

need --docdir, instead --with-docdir
need --with-usb, instead --enable-libusb_1_0

need to add this option:

--without-api-spec,

no build without this option on slack-current, (because need other tools who are not present in slackware) and probably api-spec is just used by developper.

CTM · 06-02-2017, 07:48 AM

Quote:

Originally Posted by bassmadrigal

14.2 isn't affected. Any kernels 4.4.30 and below are affected in the 4.4 series, and 14.2 now has 4.4.38.
14.1 isn't affected. Any kernels 3.10.90 and below are affected in the 3.10 series, and 14.1 now has 3.10.104.
14.0 isn't affected. Any kernels 3.2.82 and below are affected in the 3.2 series, and 14.0 now has 3.2.83.

SOURCE:
http://www.securityfocus.com/bid/97397
https://en.wikipedia.org/wiki/Slackware

However, it does seem that the kernels in 13.0, 13.1, and 13.37 are affected, but it doesn't look like there were ever any patches pushed by kernel developers to fix this issue. All those kernels were EOLed before this CVE came to light.

Good call, thanks (also kjhambrick).

kjhambrick · 06-02-2017, 08:28 AM

Quote:

Originally Posted by ttk

This is known to break some modules in CPAN, though most such code has been fixed. qv "inc failed" rows here: http://cpan.simcop2387.info/test.html

Of particular interest there are DBD::SQLite and DBD::mysql.

That having been said, if v5.26.x is incorporated into Slackware before these modules have been fixed, I'd be willing to contribute some SlackBuilds for some of them which apply patches to fix the errant behavior.

Nice Link ! Thanks ttk !!

Yes, broken sqlite and mysql CPAN modules might indeed break a lot of code all over the world

And thanks for the offer to fix the SlackBuilds !

As always, I too, would also submit diffs for any of the few CPAN Modules that I use to the CPAN and SBo maintainers should I run into and fix issues with Perl 5.26.0 in -current.

-- kjh